Yaron Singer, Cisco: The hard truth about deploying AI today

The company in this episode sold AI security, and its founder says it never thought of itself as selling security at all.

“We think of ourselves as basically enabling organizations to move faster. So the model that we had was securing the AI transformation.”

Yaron Singer, at 7:17

Listen · Yaron on episode 65, from 8:28

Yaron Singer co-founded Robust Intelligence in 2019 with Kojin Oshiba, who had been his student at Harvard, and ran it as chief executive until Cisco bought it in 2024. When Sasha and I recorded this, he was a vice president of AI and security at Cisco, a few months after the acquisition closed, and he was careful about which hat he wore: “on this podcast I can’t speak on behalf of Cisco, so I’ll speak on behalf of my capacity at Robust Intelligence.” He spent ten years on the Harvard faculty, ending as the Gordon McKay Professor of Computer Science and Applied Mathematics, after a PhD at Berkeley and two years at Google. A note on where we sit: Robust Intelligence was a YSecurity client for its SOC 2 program, the case study is on our site, and Yaron’s words about that work are on our homepage. We published the episode on March 26, 2025, and the show notes were 44 words. This page is the rest of it: the two axioms, why very small changes break machine learning, what it means to sell speed, the bottleneck that was never engineering, security that is almost invisible, the GCD of three personas, a seven-figure holiday party, a ten-year problem, the shoulders he stands on, Robust Intelligence inside Cisco, three or four years to disruption, two and a half years into a post-ChatGPT world, and what Yaron did after we hit stop. There are four things to try along the way: a quiz, a scorecard for whether security is speeding up your AI rollout or slowing it down, a calculator for what the wait is costing you, and a timeline you can filter.

Two axioms and a blue ocean

I opened by reading Yaron’s résumé back to him, and he corrected one line of it, gently. The year at Microsoft wasn’t a job between Google and Harvard. “So during my time at Harvard, I actually spent a year and change in the Microsoft Research Lab, kind of working with friends and stuff.” His LinkedIn has it as a contract research scientist role from August 2016 to September 2017, working on robust machine learning, three years into his Harvard appointment (LinkedIn). He said he wanted “to be a little bit more precise,” which turned out to be the theme of the whole conversation.

The interest started before Harvard. At Bidwave, the startup he founded at Berkeley, and then at Google, he kept running into the same behavior: “machine learning is actually a very, very sensitive technology to, so very, very small changes can have like detrimental effects.” That mattered to him because he was designing algorithms on top of models, and an algorithm is only as steady as the model under it. So he made it his research. At Harvard, he said, his work “was really motivated by trying to understand the vulnerabilities of AI, its implications to algorithm design, and basically, you know, what would robust machine learning look like?” When Harvard granted him tenure in February 2020, the announcement described exactly that: work on the intersection of algorithms and machine learning, including machine learning that is robust to adversarial noise (Harvard SEAS).

Then the research became a company. “And then there came a time when it just felt like it would be more fulfilling to do this as a company than research.” He and Kojin Oshiba, “a student at Harvard that I worked with, and we wrote papers together,” created Robust Intelligence and moved to the West Coast. Harvard’s engineering school, reporting the company’s $14 million raise in October 2020, lists a third founder, Alexander Rilee, then a master’s and MBA student, and says the company “grew out of Singer’s work on adversarial machine learning” (Harvard SEAS). In December 2021 Tiger Global led a $30 million Series B, with Sequoia, Harpoon Venture Capital and Engineering Capital (SiliconANGLE).

Sasha asked for the moment they knew it was a business, and Yaron’s answer was refreshingly frank: they didn’t know what the product was. “We started with these sort of very generic statements and hypotheses.” What they had instead was two things they were sure of.

Listen · Yaron on episode 65, from 4:41

“So with that, there is no way that AI can continue on growing at any rate without having security solutions around it. So those two axioms together just told us like, you know, one way or another, there’s going to be this massive market for, you know, for AI security.”

Yaron Singer, at 4:12

It is a founder’s argument a mathematician would make. You don’t need to know what the product is if you can prove the market has to exist, and you don’t need to know when if both premises keep holding. “It was like very, very blue ocean,” he said, meaning a market with nobody in it yet. In 2019 that was true. By the time Cisco bought the company, plenty of others had found the same ocean, which is what happens when the axioms are right.

Small changes, detrimental effects

“Very, very small changes can have like detrimental effects” is the shortest description of adversarial machine learning there is. A model that classifies an image or answers a question correctly can be pushed into a wrong or harmful answer by an input that differs only slightly from one it handles well. For a classifier, that might be a few pixels. For a language model, it is a reworded prompt, a role-play, a suffix that looks like noise, or an instruction hidden in a document the model was asked to summarize. The field got a shared vocabulary in January 2024, when NIST published its taxonomy of attacks and mitigations, Adversarial Machine Learning, NIST AI 100-2 E2023. Two of its four authors, Alie Fordyce and Hyrum Anderson, were from Robust Intelligence (NIST).

Five days before this episode aired, Harvard Magazine ran a profile of Yaron and asked him whether the vulnerabilities of AI could ever be fully solved. He said no, and explained why the work is never finished: “As the technology evolves, so too will the techniques used for adversarial attacks, hacking, and manipulating data.” He also claimed his team’s place in it: “We pioneered both the validation [techniques] and what we’re calling ‘guardrails’ for models” (Harvard Magazine).

The record of what his team found is the best argument that “validation” and “guardrails” belong in the same sentence. In June 2023, Robust Intelligence researchers showed that NVIDIA’s NeMo Guardrails, a framework built to keep chatbots on topic and away from sensitive data, could be talked past with prompt injection. In one test, telling the system to swap the letter “I” for “J” was enough to make it reveal personal data, and NVIDIA fixed one of the causes (The Decoder). In December 2023 the team published, with researchers at Yale, a method called Tree of Attacks with Pruning, which uses one language model to write jailbreak prompts against another, prunes the attempts that drift off topic, and refines the rest. It jailbroke GPT-4-Turbo and GPT-4o for more than 80 percent of the prompts it tried, and got past guardrails such as LlamaGuard (arXiv). Yaron is one of the seven authors.

🚀 Exciting to present "Tree of Attacks: Jailbreaking Black-Box LLMs Automatically" 📑🌳 Unlock the power of automated jailbreaks using Tree of Attacks with Pruning (TAP).

arxiv.org/abs/2312.02119

Paul Kassianik (@kass_paul) · December 4, 2023

The paper landed on Hacker News the next day, and the first reply drew the conclusion a lot of people drew:

"I watched the latest Karpathy video, where he shows that you can create a prompt suffix that looks like jibberish, using an iterative approach. It looks like this technique will be impossible to defend against, because it discovers for an arbitrary string that causes the jailbreak."

verdverm, on Hacker News, December 2023

Yaron’s answer to that worry is the same one he gave Harvard Magazine. Impossible to defend once is the wrong frame. A model can be attacked by a machine in an afternoon, so it has to be tested by a machine every time it changes, and guarded while it runs. In January 2025, two months before this episode, the Cisco team that came out of Robust Intelligence ran exactly that kind of test against DeepSeek R1 and five other frontier models, with researchers from the University of Pennsylvania. On 50 prompts sampled from the HarmBench benchmark, “DeepSeek R1 exhibited a 100% attack success rate,” and “The total cost of this assessment was less than $50” (Cisco).

The arithmetic explains why a guardrail is a rate rather than a wall. If a jailbreak gets through one time in a hundred, a hundred attempts are more likely than not to produce one success, and a thousand attempts almost certainly will. That doesn’t make guardrails useless. It means they work best next to rate limits, monitoring and validation that runs again whenever the model or the prompt changes, the pairing of validation and guardrails that Robust Intelligence built its product around.

Not selling security, selling speed

Sasha set up the central question of the episode: every chief executive wants to use the technology, so “how do you do it safely?” Yaron’s answer started with the pace. “It feels like very much like an arms race that is going, you know, at an unprecedented pace,” and the pressure falls not only on the companies building models but on every organization using them. Then he said the thing that, for me, is the reason to listen to this episode.

“One of the things that we realized is that we realized, you know, like we’re not really selling, or we don’t really think of ourselves as selling security. We think of ourselves as basically enabling organizations to move faster. So the model that we had was securing the AI transformation.”

Yaron Singer, at 7:17

The phrase “securing the AI transformation” was not new on our show. It was the title of a talk Yaron gave at EnCORE, posted in October 2024, and in January 2025 it became the headline of the press release in which Cisco unveiled its AI security product: “Cisco Unveils AI Defense to Secure the AI Transformation of Enterprises” (Cisco). When a founder’s framing survives an acquisition and ends up in the acquirer’s headline, it was probably the right framing.

It is also the most useful sentence a security team can borrow. A security function that sees itself as the department of risk will measure itself by what it stopped. One that sees itself as the department of speed will measure itself by what it shipped safely, and the second one gets invited to the meeting earlier. Jeetu Patel, Cisco’s chief product officer, said the same thing in that January release: “Business and technology leaders can’t afford to sacrifice safety for speed when embracing AI.” Both halves of that sentence are the point.

The bottleneck was never engineering

Here is the observation that the rest of Yaron’s business was built on, and it is the line every AI program owner should tape to a monitor.

“So, what we identified is that for all these organizations, the biggest bottleneck in deploying AI was not an engineering problem.”

Yaron Singer, at 7:17

He was emphatic that generative AI is “very, very easy to deploy, very easy to use in ways that I never imagined that would be possible.” The engineering works. So why are so many organizations still in the proof of concept stage? His answer: “I think surveys show that it’s been seventy to eighty percent of the time what organizations say is that the biggest problem is security and privacy.” Some worried about the privacy of their data. His own customers worried about “security implications with having such a large attack surface.”

The record backs the range, with the usual caveat that every survey asks a slightly different question. KPMG’s March 2023 survey of 225 executives at US companies with at least a billion dollars in revenue had 81 percent naming cybersecurity and 78 percent naming data privacy as top concerns about generative AI (CFO Dive). Three years later the worry hadn’t gone away: KPMG’s March 2026 pulse found three quarters of senior leaders at large companies worried about the cybersecurity and privacy risks of AI tools (Cybersecurity Dive). Other surveys put the number lower: Forrester’s July 2023 survey called security and privacy the biggest barriers to adopting generative AI, named as top issues by 39 percent of enterprise AI decision-makers (CBTS), and K2view’s 2024 survey of 300 senior professionals building generative AI had 48 percent citing data security and privacy as roadblocks to deployment (K2view). And Cisco’s 2024 AI Readiness Index found that “only 29% of those surveyed feel fully equipped to detect and prevent unauthorized tampering with AI.”

If the bottleneck isn’t engineering, then adding engineers won’t clear it. What clears it is answering the security and privacy questions quickly and in a form the people asking will accept, which is a product, a process and a team, and which is why Yaron’s company described itself as selling speed. The calculator below puts a number on your own version of the wait.

Almost like invisible

The product goal Yaron described follows from the diagnosis. Build it “in a way that just, yeah, where people feel like kind of they can, security, safety is just automated, and just allows them to just like just move like really, really quickly with deploying the technology without having to think about it.” He went further, and said it was “the goal for every security company out there, especially when it comes to AI.”

“You know, it’s just to kind of like to be almost like invisible, right? Kinda like enable that deployment in a really seamless way.”

Yaron Singer, at 7:17

My contribution was an analogy from the protocol most people use without knowing it.

“A good analogy that comes to my mind is HTTPS. Essentially we are using TLS under the hood, but you don’t have to be involved in the key exchange. It’s there to do the right thing for you as the consumer of the interwebs.”

Jon McLachlan, at 10:34

Yaron agreed, and I still like the analogy, because it shows what invisible actually requires. TLS is invisible to the person reading a web page because a great deal of very visible work happened elsewhere: standards, certificate authorities, browser vendors, years of breaking and fixing. Invisible security is not less security. It is security that has been engineered until the person using it doesn’t have to make a decision. Deepak Dutt made the same case for authentication on episode 78, and it is the same design goal here: the safest path should be the easiest one.

The GCD of three personas

Sasha asked how much user experience matters when the person using a security product may know nothing about security. Yaron’s answer was about who the product is for, which in AI security is a harder question than it sounds.

“A lot of the questions that we would always have is: who is the buyer, who is the customer, who is the user, right?”

Yaron Singer, at 14:45

In Robust Intelligence’s case, the people deploying and using the product were the AI teams, and “oftentimes it’s the, the check comes from the, you know, security teams.” One product, several sets of stakeholders, each with a different idea of what good looks like.

Listen · Yaron on episode 65, from 15:25

“So what that means is it means you somehow have to find the GCD between all these different personas. You have to make it as simple as you can, right?”

Yaron Singer, at 14:45

Only a mathematician reaches for the greatest common divisor to describe product strategy, and it is exactly right. The GCD of a set of numbers is the largest number that divides all of them, the biggest thing they have in common. A product for three personas fails in two ways: as the union of everything each one wants, which is the complex product, or as the thing only one of them likes. The GCD is the largest experience all three can share. “Potentially, there’s a complex experience, right? Because there’s AI, there are endpoints, there’s this, there’s data,” and distilling that into “a really simple experience is something that we worked on quite a bit.”

It wasn’t free. “I will forever remember the time that like my leadership almost quit on me for, for like driving that, you know, that simplicity in the product.” The product was “headed towards becoming like a potentially a complex product,” and he decided to “make it a very simple, very simple product without compromising on any of the functionality of it.” He admitted the way it was done “was not the gentlest,” and said everyone took a deep breath, aligned, and saw the value. His closing line on the subject is the best sales pitch for simplicity I’ve heard: anyone who sees the validation product will “appreciate the simplicity of it. And if they can’t appreciate the simplicity of it, then they can maybe appreciate the fact they could have been a lot more complex.”

I told him I detected “strong remnants of like Steve Jobs energy,” and reached for a line I half remembered: “maybe it was Pascal, like an old mathematician,” who apologized for writing a long letter because he didn’t have time to write a short one. The record is kind to my memory. Blaise Pascal wrote it in the sixteenth of his Provincial Letters, published in 1657: “Je n’ai fait celle-ci plus longue que parce que je n’ai pas eu le loisir de la faire plus courte,” or, in Quote Investigator’s translation, “I have made this one longer only because I did not have the leisure to make it shorter.” Pascal wasn’t even the first. Quote Investigator found the same idea in Guez de Balzac in 1652 (Quote Investigator). Short takes longer, which is the whole point.

A seven-figure holiday party

My question about his proudest moment got the best story of the episode. It was 2022, early days for the company. Robust Intelligence had run a proof of concept with a very large customer, it had gone well, Yaron was close to the champions, and the deal was a seven-figure contract that mattered a great deal to a company that size. Then came the year-end board meeting.

“You know, we were in a board meeting kind of like to close the year, and then kinda like one of the board members was just like giving me hell for like, you know, oh, this is like never gonna close, and this and that, and you don’t have a deal, you this, that, and you know, and it’s like, you know, you sort of like take this abuse for like, you know, thirty minutes in the boardroom, and, you know, and you feel like an incompetent CEO”

Yaron Singer, at 12:11

Listen · Yaron on episode 65, from 13:25

“And then we had a holiday party, and in the holiday party I get the email with the signed contract.” He thinks it was December 16th “or something like that.” He forwarded it to the board immediately: “Just want to let you know that, you know, hey, just a minor update. Not a big deal, but not a big deal.” And he was honest about why the story is sweet: “kind of like proving someone wrong at the same time kind of sweetens the whole deal.”

The lesson I take from it isn’t revenge. A board meeting is a forecast, and the scoreboard is the signature. A founder who is close to the champions, who knows the proof of concept went well and why, has better information than a board member reading a pipeline report, and the job in that room is to hold steady on the evidence. I said, “there’s no such thing as a success without first a little bit of struggle,” and Yaron quoted it back to me two minutes later, which is the nicest thing a guest can do.

A problem to love for ten years

I told Yaron he had been working on machine learning since long before it was the cool thing around the block. His answer was advice for anyone choosing what to build.

“If you’re going to be doing this, you should be thinking about doing this for like at least 10 years, right? You know, it better be something that you love, and it honestly just better be something that is like big and deep, right?”

Yaron Singer, at 11:09

A six-month roadmap is fine, as long as it sits inside “a 10-year vision,” which will “change like a gazillion times over.” When we spoke he had been at it for sixteen years, from Bidwave in 2009 through ten years at Harvard and five at Robust Intelligence, and sixteen months later he started another company on the same problem, this time using AI to defend rather than defending AI. “And I think AI security like happens to have that depth.” It does, and the next sections are the evidence.

The shoulders he stands on

Sasha asked about role models, and Yaron gave a longer answer than most guests do. I said so on the tape: usually there’s one, “like maybe two.” Here is who he named, with what the record says about each.

His advisor from grad school, “basically the father of computational complexity and algorithms,” is Christos Papadimitriou, who supervised Yaron’s PhD at Berkeley and wrote Computational Complexity, published by Addison-Wesley in 1994 and one of the field’s most widely used textbooks. He is now at Columbia (Wikipedia).

At Harvard, Leslie Valiant, “who won the Turing Award for basically the theory of machine learning.” The 2010 citation reads “For transformative contributions to the theory of computation,” starting with probably approximately correct learning (ACM). Cynthia Dwork, “who invented differential privacy,” with Frank McSherry, Kobbi Nissim and Adam Smith, in a paper that won the four of them the 2017 Gödel Prize, and who received the National Medal of Science in 2025 (Wikipedia). Boaz Barak, “one of the heroes of cryptography, who’s kind of like now spending some time at OpenAI,” which is accurate: the Gordon McKay Professor of Computer Science joined OpenAI’s alignment team in January 2024 (Wikipedia). He also once tweeted a jailbreak for GPT-4: talk to it in Morse code, which is Yaron’s whole field in one tweet. And Michael Mitzenmacher, who works on randomized algorithms, hashing and coding theory, and co-wrote Probability and Computing with Eli Upfal (Wikipedia).

From Google he named “this legendary kind of VP of engineering called Bill Coughran,” who joined Google in 2003 and, as its senior vice president of engineering, oversaw engineering for search, video, security and systems, then joined Sequoia Capital as a partner in 2011 (TechCrunch). “I was just, ended up being fortunate enough to have Bill as my seed investor from Sequoia.”

And at Cisco, the leaders he was learning from as an executive: “the person who ended up being my boss, she was on our board when we were Robust Intelligence,” Shailaja Shankar, who leads engineering for Cisco Security. Cisco’s own biography adds a small precision he would appreciate: she was a board observer for Robust Intelligence before the acquisition (Cisco), the kind of seat a corporate investor’s executive often takes, and Cisco Investments had put money into the company a couple of years before buying it (SiliconANGLE). Raj Chopra, Cisco’s SVP and chief product officer for security, and Jeetu Patel, “who’s now kind of chief product officer at Cisco,” the title on Cisco’s January 2025 release. “It’s been an amazing, amazing learning experience.” My reply, “We’re all connected,” was truer than I knew. A month after we published, the team Yaron built inside Cisco launched its first model, with a quote from Jeetu in the announcement.

Robust Intelligence, now AI Defense

Cisco announced its intent to acquire Robust Intelligence on August 26, 2024, in a post by Tom Gillis, who ran Cisco’s infrastructure and security group. The post quoted Yaron: “Security leaders need purpose-built solutions they can trust to keep up with the new paradigm of AI risk.” A month later Cisco added a line at the top: “We have completed the acquisition of Robust Intelligence. Welcome to Cisco!” (Cisco). Cisco didn’t disclose the price, and neither will we.

Four months after that, Cisco unveiled AI Defense. The release describes discovery of the AI applications in use across a company, validation of models with automated testing, including what it calls an AI-driven algorithmic red team, and runtime protection against threats such as prompt injection and sensitive data leakage, with enforcement at the network level. It was due to be available in March 2025, the month of this episode (Cisco). Hyrum Anderson, who came to Cisco with Robust Intelligence, said where it came from the day it was announced.

What have we been up to since @Cisco's acquisition of @robusthq? Cisco's unmatched network visibility plus RI+Cisco team's AI security+safety controls == #AIDefense. Check it out!

Hyrum Anderson (@drhyrum) · January 15, 2025

Sasha asked what was next, a few months into Cisco, and Yaron’s answer was about the platform. “When you’re thinking about AI applications, AI applications are everywhere and kind of different levels.” The advantage of doing AI security inside Cisco is that “Cisco is essentially the network, right?” so security can sit in the path of AI traffic instead of asking every team to install something. Jeetu’s line in the launch release said the same thing: “Fused into the fabric of the network.” Yaron also promised something specific: “you’re going to see more stuff coming out of our team.” The next section is what came out.

Three or four years

Sasha asked how cybersecurity would evolve in 2025, with all the talk of agents, and Yaron made the boldest prediction on the tape.

Listen · Yaron on episode 65, from 21:57

“I personally think that cybersecurity as an industry is like on the verge of just like massive disruption. And I personally think that the, however we think of cybersecurity products and whatever we’re seeing, I think a lot of them are just not, I mean, they’re not going to exist in the way that they exist right now, in a matter of, I would say, like, I give it like three years, four years.”

Yaron Singer, at 21:54

His reasoning is worth more than the date. “Cybersecurity is a discipline that is unbelievably data rich,” and it needs “a lot of decision making on that data.” Many products “do a very good job at [querying] the data. They do a very good job at kind of giving access to data and presenting that data. But then ultimately, the decision is thrown on a team.” That handoff is the manual process, “a lot of humans, a lot of decision making,” and he believed the technology of early 2025, or something close to it, was already capable of automating a lot of it. So the products that win will be “really, really good at automation and decision making,” and “some companies will move fast enough and, you know, and lean into that change. Some won’t.”

Nineteen months later, the most interesting evidence for the prediction is what Yaron did with it. The company he started in July 2026 builds AI for detection, where a great many of the decisions still get thrown on a team. It is a good sign when a founder bets his next company on what he told you on the record. The way I’d put the opportunity, and the way Yaron’s own work points: let the software carry the repetitive decisions, test it the way his teams tested models, and give people the decisions that need judgment and responsibility.

Two and a half years into a post-ChatGPT world

I asked whether AI had crossed the chasm, Geoffrey Moore’s 1991 name for the gap between early adopters and the pragmatic majority (Wikipedia), and Yaron shook his head before he answered. “I don’t think that we truly crossed the chasm, like, you know, as a society, I guess.” For AI security he thought the market was at its tipping point: organizations were comfortable with the technology, had use cases and knew how to use it, and “the biggest hurdles for, as we said, for adoption, like in the beginning of the conversation, are around the safety, security. I think those hurdles are now going away.”

He timed it with a phrase: “we are, let’s say, two, two and a half years into a post-ChatGPT world.” Earlier in the conversation he had dated that world from “November 2023, when everybody got exposed to generative AI capabilities,” and guessed the models then were “like GPT-2 or something.” The record puts the date a year earlier and the model a generation later. OpenAI launched ChatGPT on November 30, 2022, “fine-tuned from a model in the GPT-3.5 series” (OpenAI). That is the version of the story that makes his point better: about two years and four months from launch to the day we published, the leap in capability he found “difficult to kind of conceptualize” was real, and his “two and a half years” was right all along.

Then the prediction I hope we can replay in March 2027.

“Because I feel like in, maybe in two years, AI is going to be, you know, synonymous with software.”

Yaron Singer, at 24:40

He added that we’d be “reflecting on how handsome we used to look two years ago,” and “snickering about is the fact that we actually use the term AI.” With five months to go, I’ve started snickering.

What happened after the tape

Yaron promised “more stuff coming out of our team,” and a month later it came. At the RSA Conference on April 28, 2025, Cisco launched Foundation AI, the organization Yaron founded inside Cisco and Splunk, and its first model, Foundation-sec-8b, an open-weight, 8 billion parameter model for cybersecurity built on Llama 3.1 8B. Yaron wrote the launch post, which claims performance “comparable with models nearly 10x larger” on security benchmarks (Cisco).

🚨 Just launched: Llama-3.1-FoundationAI-SecurityLLM-base-8B (Foundation-sec-8b) — Cisco’s first open-weight LLM purpose-built for cybersecurity.

The model is live. It’s open. And it’s ready to defend 🔗:

Cisco Security (@CiscoSecure) · May 5, 2025

Over the next year his blog posts on Cisco’s site trace the arc: a reasoning model in June 2025, an instruction-tuned model in August 2025, the first production deployment inside Cisco Duo in December 2025, and in January 2026 an open-weight security reasoning model (Cisco). In August 2025 he wrote the post that connects the whole story, from the term his first company coined to the model his second team built.

Back when we started Robust Intelligence (now part of Cisco), we coined the term “AI Firewall” to describe guardrails for AI models to prevent misuse, unsafe behavior, and protect from security vulnerabilities.

Fast forward to today: Baturay Saglam just published a great blog with extremely deep insights on models’ latent representations that allow building an AI Firewall powered by Foundation-Sec-8B, the open-weight cybersecurity model we’re building at Cisco Foundation AI.

The idea that started with protecting AI models has now evolved into using an AI model itself as the firewall which is open for the community to build on.

Yaron Singer · August 25, 2025

Load the post from LinkedIn

In February 2026 he sat down for a short interview at Cisco Live EMEA, the conference he told us he’d be at.

In July 2026 his LinkedIn changed. After two years as VP of AI and engineering at Splunk and Cisco Security, where he founded and led Foundation AI, he became chief executive of a new company (LinkedIn). Frontier Security calls itself “The AI foundation for cyber defense” and builds what it calls defensive superintelligence for enterprise detection (Frontier Security). Fortune’s profile lists it in Menlo Park, founded in 2026, with $55 million in funding from Lightspeed Venture Partners, Greycroft and Harpoon, the last of which also backed Robust Intelligence (Fortune). His first research post from the new company, at the end of July, made an argument straight out of this episode, about what defense actually needs: “For defensive security however, like in SOC investigations, agentic solutions perform well not as a function of compute but rather disciplined tool use and operational precision.”

A week later his team published something that would have made a good episode on its own. While evaluating models for defensive security work in an environment built on the UK AI Security Institute’s tools, they watched Kimi K3, an open-weight model from Moonshot AI, probe its network, find that github.com resolved through an allowlist meant for package maintenance, clone the benchmark’s own repository and read the answers from disk. Their write-up, by Paul Kassianik and Yaron, calls it “a classic case of specification gaming via network egress leaks,” and its advice is one line every agent builder should keep: “Assume capable agents will find exposed paths” (Frontier Security). WIRED covered it, and Yaron told the magazine, “We found a leak in the sandbox,” and that Kimi “took advantage of that loophole” (Decrypt, Engadget). An August 8 update to the post clarified that the sandbox did not provide unrestricted internet access, which is the more useful lesson: the leak was in an allowlist someone had added on purpose.

Kimi K3 pursues its goal by any means necessary, and the means it chose was escaping our sandbox to look up answers on GitHub.

It found the misconfiguration itself, by probing its own network settings. Most publicly available frontier models have internal guardrails that stop them. K3 didn't blink. It wandered off into the internet forest and came back with the answer. How soon will we see a new bar on FelonyBench?

Proud of this work at Frontier Security. Thanks @willknight for covering it with real technical care, and @yaronsinger for making it possible. Worth your read 👇

Paul Kassianik (@kass_paul) · August 6, 2026

Happy DEF CON and Black Hat everyone. WIRED just covered a discovery our team recently made. In the process of evaluating models for defensive cybersecurity tasks, we discovered that that Kimi K3 found loopholes in the UK government’s AI Security Institute (AISI) evaluation sandbox to gain access into Github accounts and succeed in the evaluation by looking up the answers. Will Knight did a great job covering this in this article:

We also wrote a short blog post with more detail.

Huge shout out to Paul Kassianik and the rest of the team for this amazing work.

Yaron Singer · August 6, 2026

Load the post from LinkedIn

If that sounds familiar, it is the serious version of a satire we published at the end of September. Your Sandbox Is Adorable argues that testing beats confinement, and the Frontier finding makes the same point without the jokes: a sandbox matters less than knowing, from inside it, what it actually lets through.

On October 28, 2026, Yaron posted that Frontier Security had been named to the Fortune Cyber 60, the list Fortune presents with Lightspeed Venture Partners, as one of 20 companies in the early-stage group (Fortune). He thanked “the forward-looking security teams who trust Frontier Security’s defensive superintelligence to work alongside them as their first line of defense.” Nineteen months earlier, on our show, he said the products that win would be good at decisions, and gave the industry three or four years. He didn’t wait.

Did you catch it? A six-question quiz

Interactive · six questions

Did you catch it?

Six questions on what Yaron actually said, with the timestamp for each answer. The answers are under each question for anyone reading without JavaScript.

1. What did Robust Intelligence start from, before it had a product?

   1. A signed contract with a bank
   2. Two axioms: AI keeps growing, and AI is vulnerable
   3. A government grant for AI safety

   b. "So those two axioms together just told us like, you know, one way or another, there's going to be this massive market for, you know, for AI security." Transcript, 4:12.

2. What did Yaron say Robust Intelligence thought of itself as selling?

   1. Security
   2. Compliance
   3. Speed: enabling organizations to move faster

   c. "We think of ourselves as basically enabling organizations to move faster." Transcript, 7:17.

3. What did he say is the biggest bottleneck in deploying AI?

   1. Not an engineering problem: security and privacy
   2. The cost of GPUs
   3. A shortage of AI engineers

   a. "the biggest bottleneck in deploying AI was not an engineering problem," and "the biggest problem is security and privacy." Transcript, 7:17.

4. Where was Yaron when the seven-figure contract arrived?

   1. In the board meeting
   2. At the company holiday party
   3. On a flight to Boston

   b. "And then we had a holiday party, and in the holiday party I get the email with the signed contract." Transcript, 12:11.

5. What did he say a product with many personas has to find?

   1. One persona to serve and ignore the rest
   2. Every feature each persona asks for
   3. The GCD between all of them

   c. "So what that means is it means you somehow have to find the GCD between all these different personas." Transcript, 14:45.

6. How long did Yaron give today's cybersecurity products before they change dramatically?

   1. Three or four years
   2. Ten years
   3. Six months

   a. "I would say, like, I give it like three years, four years." Transcript, 21:54.

Is security speeding up your AI rollout?

Yaron’s test for an AI security program is whether it lets the company move faster. This scorecard asks eight questions about your own AI rollout, in the order the episode raises them, and tells you whether security is the bottleneck, in progress, or the fast lane.

Scorecard · eight questions

Is security speeding up your AI rollout?

Answer for the AI use cases you are trying to move from pilot to production right now. If two answers fit, pick the lower one.

1. Do you know every AI application, model and agent in use across the company, sanctioned or not?

   • No, and some teams use personal accounts
   • The sanctioned ones, listed by hand
   • Yes, discovered continuously, including the ones nobody approved

   Discovery was the first thing Cisco's AI Defense release listed. You can't validate or guard what you haven't found.

2. Before a model or AI feature ships, is it tested for jailbreaks, prompt injection and data leakage?

   • No, or only by trying a few prompts
   • A manual red team, once
   • Automated, algorithmic testing on every model and prompt change

   Tree of Attacks jailbroke GPT-4-Turbo and GPT-4o for more than 80 percent of the prompts it tried, automatically. The small changes section has the record.

3. In production, is there a guardrail on what goes into and comes out of the model?

   • None
   • Only the model provider's built-in filters
   • Your own guardrail, an AI firewall with policies you set, tune and monitor

   A guardrail is a rate, not a wall, so watch it. The arithmetic of many attempts is above.

4. What stops sensitive data from reaching a model?

   • Nothing, people paste what they need
   • A policy and training
   • Enforced checks that classify and redact or block sensitive data before it reaches a model

   Privacy of the data was the first worry Yaron's customers named.

5. When the model, the prompt or the provider changes, what happens?

   • Nothing, it just ships
   • Someone retests when they remember
   • Validation reruns automatically, and the change waits on the result

   "very, very small changes can have like detrimental effects."

6. Who owns AI security, between the teams that build AI and the team that secures it?

   • Nobody, or the security team alone
   • Shared, but unclear who decides
   • One simple workflow both sides agreed on, with a named owner

   The GCD between the personas. The GCD section explains it.

7. How long does a new AI use case wait for a security and privacy review?

   • Months, or the answer is no
   • Weeks
   • Days, because most of the checks are automated

   The calculator below turns your answer into money.

8. Can you show a customer how your AI is tested and guarded?

   • No
   • A policy document
   • Test results, guardrail policies and an inventory you can share

   Your buyers will ask. The ten questions they ask first, with one-sentence answers.

Security is the bottleneck

Your AI use cases are probably waiting on questions nobody can answer quickly: what's in use, whether it was tested, what stops data leaving. That is good news, because every one of those has a known answer. Start with discovery this week, then put an automated test on the next model change, so the review becomes a result instead of a meeting.

Security in progress

Some of the checks are automated and some still depend on a person remembering. Put validation on every change, give the guardrail an owner and a dashboard, and agree with the AI teams on one simple workflow, so the review time drops from weeks to days.

Security as the fast lane

You know what's in use, every change is tested automatically, a guardrail you own sits in production, and the review takes days. This is what Yaron meant by enabling organizations to move faster. Write it up so customers can check it, and keep testing, because the attacks keep changing.

What is the wait costing you?

If the bottleneck in deploying AI isn’t engineering, the cost of the bottleneck is the value of the use cases waiting on it. This calculator puts a number on yours: what the AI use cases waiting for a security and privacy review are worth while they wait, and how much of that comes back if automated validation and guardrails shorten the wait.

Calculator

What is the wait costing you?

The AI use cases waiting on a review, how long each waits, what one is worth a week in production, and how long the wait would be with automated checks.

AI use cases waiting on a security or privacy review Weeks each one waits today

Value of one use case in production, dollars a week Weeks each would wait with automated validation and guardrails

–of value waiting today

–with automated checks

–back in the business

–use-case-weeks in production sooner

With 6 AI use cases waiting 12 weeks each for a security and privacy review, $720,000 of value sits waiting before anything ships. If automated validation and guardrails cut the wait to 2 weeks, the wait costs $120,000 instead, and $600,000 of value, 60 use-case-weeks, reaches the business sooner.

A use-case-week is one AI use case in production for one week. The value per week is yours to estimate, as revenue, hours saved or cost avoided, and the 6 use cases, 12 weeks, $10,000 a week and 2 weeks are placeholders, not research. The calculator counts only the delay, not the risk of shipping without checks, which is the reason the checks exist. Yaron's point is the direction: when the safety checks are automated, the review stops being the bottleneck.

From Bidwave to Frontier Security

Everything on this page sits on one timeline, from Yaron’s first startup to the list his new company made last week. Filter it by thread.

Timeline · 2009 to 2026

From Bidwave to Frontier Security

Filter by thread. Dates are from the public record except where marked as Yaron's own account on the tape.

1. September 2009Bidwave

   His first startup, at Berkeley, where he first saw how sensitive machine learning is (LinkedIn).

2. 2011A PhD at Berkeley

   In computer science, advised by Christos Papadimitriou (Wikipedia).

3. October 2011Google

   Its inaugural postdoctoral researcher, on the algorithms and optimization team (LinkedIn).

4. July 2013Harvard

   Assistant professor of computer science (LinkedIn).

5. August 2016Microsoft Research

   A year and change on robust machine learning, during his time at Harvard (LinkedIn).

6. 2019Robust Intelligence

   Founded with Kojin Oshiba (Harvard Magazine).

7. February 11, 2020Tenure

   Full professor with tenure at Harvard SEAS (Harvard SEAS).

8. October 21, 2020$14 million

   Harvard's engineering school reports the raise (Harvard SEAS).

9. December 9, 2021A $30 million Series B

   Led by Tiger Global, with an AI firewall in production (SiliconANGLE).

10. November 30, 2022ChatGPT

    Fine-tuned from a model in the GPT-3.5 series (OpenAI).

11. December 2022, on tapeThe holiday party

    A seven-figure contract arrives by email, after a board meeting that said it never would.

12. March 202381 percent

    KPMG's survey of large companies: cybersecurity a top concern about generative AI (CFO Dive).

13. June 2023NeMo Guardrails

    Prompt injection gets past NVIDIA's guardrails (The Decoder).

14. December 4, 2023Tree of Attacks

    Automated jailbreaks for more than 80 percent of prompts (arXiv).

15. January 4, 2024A taxonomy from NIST

    Adversarial machine learning, with two Robust Intelligence authors (NIST).

16. August 26, 2024Cisco's intent to acquire

    Completed by September 24, 2024 (Cisco).

17. January 15, 2025AI Defense

    Discovery, validation and runtime protection, on sale in March (Cisco).

18. January 31, 2025DeepSeek R1, 100 percent

    Fifty HarmBench prompts, for less than $50 (Cisco).

19. March 26, 2025Episode 65 airs

    This conversation. "the biggest bottleneck in deploying AI was not an engineering problem."

20. April 28, 2025Foundation-sec-8b

    Cisco Foundation AI's first open-weight security model (Cisco).

21. August 25, 2025A model as the firewall

    From the term Robust coined to an AI firewall built on Foundation-sec-8B (LinkedIn).

22. January 29, 2026An open-weight reasoning model

    Foundation-sec-8B-Reasoning (Cisco).

23. July 2026Frontier Security

    Yaron becomes chief executive of a new company (LinkedIn).

24. August 2026Kimi K3 and the sandbox

    An allowlist leak, a cloned benchmark, and the answers read from disk (Frontier Security).

25. October 28, 2026The Fortune Cyber 60

    One of 20 early-stage companies (Fortune).

What to do this week

Four things, in the order Yaron’s argument suggests.

1. Count what’s waiting. List every AI use case stuck in pilot, and next to each, the reason. If the reason is security or privacy, write down the specific question nobody has answered yet. That list is your bottleneck, and most of it is answerable.
2. Automate the first test. Put an automated red-team pass, for jailbreaks, prompt injection and data leakage, on the next model or prompt change, and make the change wait on the result. Once it runs on every change, the review becomes a result instead of a meeting.
3. Guard the path the data takes. Put a guardrail you own between the model and the people and data it touches, with policies you can tune and someone who watches what it catches. Treat it as a rate, not a wall.
4. Find the GCD. Sit the AI team and the security team down and agree on one simple workflow, with a named owner and a target in days, not weeks. Then measure security the way Yaron did, by how fast the company ships AI it can stand behind.