Episode 66 of The Security Podcast of Silicon Valley aired on April 8, 2025, with Jon McLachlan and Sasha Sinkevich hosting. The guest was Michal Pechoucek (Pěchouček in Czech), an AI researcher, professor and investor (Podbean). His first line set the tone.
“And thank you for pronouncing my name with such precision.”
Michal Pechoucek, at 0:17
Jon’s introduction covered the three hats he wore at the time.
“For all of our listeners, Michal is a venture partner at Evolution Equity Partners.”
Jon McLachlan, at 0:23
“You’re the founder director of the Artificial Intelligence Center there, as well as an AI professor in the Department of Computer Science.”
Jon McLachlan, at 0:35
His LinkedIn fills in the dates. He founded the Artificial Intelligence Center at the Faculty of Electrical Engineering of the Czech Technical University in Prague in 2000 and directed it until January 2026, he has been a professor in its computer science department since 2009, and he was a venture partner at Evolution Equity Partners from 2017, a partner from January 2025, and a venture partner again since January 2026 (LinkedIn). Evolution’s team page lists him as a partner (Evolution Equity Partners). He also co-founded prg.ai, a nonprofit initiative to make Prague a significant European AI hub, and chaired its executive board from 2019 to 2026 (prg.ai, LinkedIn).
The Czech Wikipedia adds his training and the industry years. He studied technical cybernetics at the Czech Technical University, earned a master’s in artificial intelligence at the University of Edinburgh in 1996 and a doctorate back in Prague, and spent five years as chief technology officer, at Avast from 2019 and then at Gen Digital until 2024 (Wikipedia). Gen Digital is the company Avast joined when it merged with NortonLifeLock in September 2022, now co-headquartered in Tempe, Arizona, and Prague, with Norton, Avast, LifeLock and AVG among its brands (Wikipedia, Wikipedia). And since February 1, 2026 he has been the rector of the Czech Technical University, after the academic senate nominated him in October 2025 (Wikipedia). The university is one of the oldest institutes of technology in Central Europe (Wikipedia).
The conversation was recorded in October 2024, six months before it aired. The tape fits: Michal calls California’s failed AI bill recent news, and the governor vetoed it on September 29, 2024 (Wikipedia).
This page is the rest of it: a section for each part of the conversation with the sources beside it, sixteen figures, twenty-five clips from the tape, the full transcript, and five tools: a quiz, a scorecard for whether your AI security thinks ahead, a calculator for how much of your AI budget goes to safety, a timeline from 1996 to 2027, and a to-do list.
A note before the sections. Michal speaks English as a second language and thinks out loud, so a few lines on the tape are hard to hear. Where the decodes disagree, the transcript marks its best guess in brackets, and the page doesn’t quote those lines. When he passes on something he has heard rather than knows, like how TikTok works in China, the page says so.
Thank you for pronouncing my name with such precision
Jon’s answer to the thank-you was the show’s rule for names.
“You know, it’s the least that we can do.”
Jon McLachlan, at 0:21
The rest of the introduction was a list. Jon pointed at Michal’s angel investments and advisor roles, and his LinkedIn shows how long it is: an investor in GetReal, the deepfake-protection company, since March 2025, an angel investor and advisor in several startups since 2019, and a co-founder and board member of Blindspot Solutions from 2014 to 2026 (LinkedIn). The thread through all of it is the one he named later in the episode: using AI and making it safe.
AI security is not as new topic as it may sound
Jon opened with the obvious question about a field that changes every week. What comes to mind when you think about security and AI?
“This is an exciting question because, in my opinion, and when it comes to my experience, AI security and security and AI is not as new topic as it may sound.”
Michal Pechoucek, at 1:18
“For fact, the attackers have been using AI for a long time, I will even say a decade plus.”
Michal Pechoucek, at 1:31
And defenders, he said, have a tradition of their own. His proof was his own first company.
“One of my first startups that I started with my PhD students was Cognitive Security.”
Michal Pechoucek, at 1:48
Cognitive Security came out of his research group at the university, with his doctoral student Martin Rehák, in work funded in part by the US Army, according to the Czech Wikipedia (Wikipedia). The idea, in Michal’s telling, was to borrow machine learning techniques from computer vision and point them at NetFlow, the network data. NetFlow is the feature Cisco introduced on its routers around 1996 to record IP traffic as it enters or leaves an interface, so administrators can see who talks to whom (Wikipedia). The target was the kind of intruder an advanced persistent threat describes: a stealthy attacker, often state-backed, who gets into a network and stays undetected for a long time (Wikipedia).
“It was very successful. We were able to exit in Cisco and be able to service millions of customers with this technology.”
Michal Pechoucek, at 2:11
Cisco’s list of acquisitions dates the deal to January 29, 2013, filed under cyber threat protection, Czech Republic (Wikipedia). Michal dates the start to 2008, which makes his “15 years back” about right for a conversation in 2024.
Four different things
Then he laid out the field as he sees it now.
“And I see AI security as kind of four different things.”
Michal Pechoucek, at 2:36
The first is attackers using AI.
“The most important one is AI-powered attacks, and us as defenders to be able to sustain AI-powered attacks.”
Michal Pechoucek, at 2:41
He named the techniques: game theory, automated reasoning and large models, used to design malicious payloads that are hard to detect. Game theory is the mathematics of strategic interaction between players, and automated reasoning is the branch of AI that lets programs reason on their own (Wikipedia, Wikipedia). The second is attackers going after the AI itself, the third is what AI does to the way software gets built, and the fourth, the one closest to his own work, is attacks on people’s minds. The next three sections take them one at a time.
We wrote about the first one in AI cyberattacks are going autonomous, and about attackers and defenders using the same tools in AI agents are now on both sides of the breach.
A net new class of cybersecurity problems
The second problem is attackers attacking our AI systems.
“AI systems are becoming a very, very important part of the software supply chain.”
Michal Pechoucek, at 3:24
“And to be able to protect the AI systems, it is like a net new class of cybersecurity problems.”
Michal Pechoucek, at 3:37
A software supply chain is every component, library, tool and process that goes into building and publishing a piece of software (Wikipedia), and a model is now one of those components. Michal pointed to how the field’s standard reference responded. MITRE, the not-for-profit that runs federally funded research centers for the US government, released ATT&CK in 2013 as a way to classify and describe cyberattacks (Wikipedia, Wikipedia). Alongside it, MITRE built ATLAS, which it describes as a living knowledge base of adversary tactics and techniques involving AI, from attacks on AI-enabled systems to misuse of AI capabilities. As of November 2026, its site lists 16 tactics, 221 techniques, 44 mitigations and 77 case studies (MITRE ATLAS).
“So kind of big, big stuff and very important.”
Michal Pechoucek, at 3:57
Adversarial machine learning, the study of attacks on machine learning and the defenses against them, is the research field under ATLAS (Wikipedia). Prompt injection is its most famous example today: inputs crafted so a language model can’t tell a developer’s instructions from a user’s (Wikipedia). Our AI Product Red Teaming team tests AI features this way, and episode 65 with Yaron Singer of Robust Intelligence goes deep on why models break under small changes.
A massive software change
The third problem is the one every engineering team is living through.
“The third one is the fact that we are using AI in building software systems is changing the software system as such.”
Michal Pechoucek, at 4:02
“And from my perspective, this is a massive software change, similar software change as we saw when computers got connected through the internet.”
Michal Pechoucek, at 4:13
Each shift he listed brought its own class of bugs. Web applications, built on web technologies and run in a browser, emerged in the late 1990s (Wikipedia). Cloud computing put shared, elastic resources behind network access (Wikipedia). Mobile apps moved software onto phones, tablets and watches (Wikipedia). Defenders caught up with each one after the fact. Michal’s point is that AI-written software is the same kind of shift, and the vulnerabilities are coming whether or not anyone has named them yet.
“Again, AI security piece.”
Michal Pechoucek, at 4:47
We wrote about the practical side in how to stop AI agents from shipping vulnerable code, and our Secure AI SDLC & Engineering work is built for teams writing software this way.
To people’s cognition
The fourth problem was the one he cared about most, the one closest to his own work.
“the fact that cyber warfare is moving big times from computers, desktops, mobile devices, network, cloud, to people’s eyes, to people’s cognition, to what people think, what people do online, how people behave, what actions people execute.”
Michal Pechoucek, at 4:58
“The precision and the scale and the availability and the cost of the human-centered attacks is just unprecedented.”
Michal Pechoucek, at 5:24
Security already has words for the old version. Social engineering is using psychological pressure to get people to act or hand over information, and phishing is its most common form (Wikipedia). What’s new is the cost: Wikipedia’s phishing article now notes that large language models can automate personalized phishing at low cost (Wikipedia). The military word for the bigger version is information warfare, manipulating information a target trusts so the target decides against its own interest without knowing it (Wikipedia). Michal’s list runs from the eyes to the actions, which is the whole chain from what someone sees to what someone does.
Would you agree with AI regulation?
That brought him to the question people ask him most.
“Often people ask me, would you agree with AI regulation?”
Michal Pechoucek, at 5:49
He knows it’s a controversial topic in Silicon Valley, he said, and he pointed at California, where an AI bill had just failed on the governor’s desk. The bill was SB 1047, the Safe and Secure Innovation for Frontier Artificial Intelligence Models Act. It would have required developers of the largest models, those costing more than $100 million to train, to assess risks before release, and it would have protected whistleblowers. California’s governor vetoed it on September 29, 2024, saying a rule based only on a model’s computing size ignored whether a model is deployed somewhere risky (Wikipedia). Michal answered with a thought experiment from Europe.
“And I often say, imagine in 2000, when there would be a regulation that somebody would say, you know, in the future, there’s going to be this thing, a social network.”
Michal Pechoucek, at 6:06
The imagined rule would have banned political campaigning on those networks. His verdict on it was blunt.
“I think it’d be a great piece of regulation, but at the time, we didn’t know, so we didn’t regulate.”
Michal Pechoucek, at 6:24
The example he didn’t need to name is Cambridge Analytica, the British political consulting firm founded in 2013 that became known through the Facebook data scandal (Wikipedia). His conclusion was a modest one: we still don’t understand the full implications of adopting AI, so it’s only fair for people to try to regulate and protect.
Regulate ourselves from a leading edge innovation
Sasha picked up the European side, the EU AI Act.
“You guys went a little bit further and a little bit faster, making sure that AI systems are not in a position to make decisions that will influence people’s lives, whereas it’s not the case everywhere else in the world.”
Sasha Sinkevich, at 6:52
“This is correct.”
Michal Pechoucek, at 7:07
Then he named the cost, as a European. The disadvantage of the European approach, he said, is that Europe will likely regulate itself out of leading-edge innovation,
“which kind of goes against the advancement of the European AI sector and innovation as such.”
Michal Pechoucek, at 7:18
The AI Act entered into force on August 1, 2024, two months before the recording. It sorts AI into four risk levels, unacceptable, high, limited and minimal, plus a category for general-purpose AI, and bans the unacceptable ones outright, including social scoring of people by public or private actors. Its provisions phase in: six months for the bans, 12 months for general-purpose AI, 24 months for most of the rest, and 36 months for some high-risk obligations. Breaking the bans can cost up to €35 million or 7% of worldwide turnover (Wikipedia). Our AI EU Compliance Program helps companies that sell into Europe work through it.
In AI security, we need to think ahead
Michal drew the line between the two fields.
“AI security is a very special kind of discipline in cybersecurity, because in cybersecurity, we as defenders are very responsive.”
Michal Pechoucek, at 7:26
“While in AI security, we need to think ahead.”
Michal Pechoucek, at 7:43
Thinking ahead means guessing what the technology will become, how it can be misused, and what guardrails to build before anyone needs them. That’s hard, he said, because people disagree about the future itself.
“Somebody argues that the future is going to be very safe and effective.”
Michal Pechoucek, at 8:10
Somebody else presents a doom perspective, he went on, and the argument doesn’t stay technical.
“it’s also kind of getting political.”
Michal Pechoucek, at 8:19
Europe, the US and China worry about different futures, he said, and that is the key difference from cybersecurity as we know it. The field that works on this is AI safety, which covers preventing accidents, misuse and other harmful consequences of AI, and includes alignment, the work of steering AI systems toward the goals people intend (Wikipedia, Wikipedia).
AI will be asking for behavioral data
Michal gave one example of thinking ahead, and it was about data.
“I would say kind of one of the future examples is going to be kind of the data, the data piece, because AI as it’s trained today is drawing out the data.”
Michal Pechoucek, at 8:34
“And believe me, AI will be asking for behavioral data, data about how things happen, what is going on, trying to understand and predict behavior”
Michal Pechoucek, at 8:46
China is ahead, he said, because it has been collecting this kind of data for years.
“They’ve been collecting behavioral data for ages.”
Michal Pechoucek, at 9:06
The public record is more careful than the popular picture. Wikipedia describes China’s social credit system as a broad governance strategy to track businesses, individuals and government institutions, and notes widespread misconceptions about a single national score that rewards and punishes people (Wikipedia). The commercial version is closer to home. Surveillance capitalism is the term for the widespread collection and commodification of personal data by companies, which grew out of advertising (Wikipedia). Michal’s twist is who will want the data next.
“not necessarily against people, but against machines”
Michal Pechoucek, at 9:18
That’s the privacy problem he expects AI security to inherit: protecting behavior from machines that are excited to understand it. The EU AI Act already bans one use of behavioral data outright, social scoring of people by public or private actors (Wikipedia). We wrote about tracking what data reaches which model in the AI data bill of materials, and our Training Data PII & Secret Scrubbing team keeps personal data out of the models you train.
This symmetry doesn’t exist
Then Michal said where he stands, which is not where a reader of the last few sections might expect.
“I’m a techno-optimist, right?”
Michal Pechoucek, at 9:27
“I really want AI to kind of grow as quickly as we can”
Michal Pechoucek, at 9:30
Hard societal problems need it, he said. The problem is the money around it. In cybersecurity, spending on defense grew alongside the attacks.
“Hence, we’ve got this big cybersecurity sector that is well funded, but it’s protecting the world from cyber attacks.”
Michal Pechoucek, at 9:55
“This symmetry doesn’t exist in AI development”
Michal Pechoucek, at 10:02
“And then the investment in AI safety is minimalistic in comparison, right?”
Michal Pechoucek, at 10:16
His fix is simple to state: investment in AI safety and security should be proportional to AI progress. He gave no numbers on the tape, so the calculator below lets you put in your own.
One-year horizon or ten-year horizon
Sasha offered a reason for the gap.
“It’s perhaps, it’s reward driven. At the moment, there is a lot more reward attached to pushing the technology forward and not really paying attention to what potentially should be considered as equally important.”
Sasha Sinkevich, at 10:32
Michal turned it into a question of time. The horizon, he said, is very important.
Do we think in one-year horizons or ten-year ones? He argued for more focus on the long term, because the near term pays so well.
“We can take a massive advantage and massive yields out of AI in the near future”
Michal Pechoucek, at 11:00
The risk, he said, is driving ourselves into huge problems in the midterm. Sasha noted the same pattern shows up over and over in things we do as humans, and Michal agreed.
“Yeah, I agree.”
Michal Pechoucek, at 11:22
Give the good guys an unfair advantage
Jon ran back through the four problems before going on: AI-powered attacks, attackers attacking AI systems, AI changing how we build, and cyber warfare moving into the human space, which he called just kind of scary. Then he said what he likes about the work.
“And I love thinking through ways to give the good guys an unfair advantage.”
Jon McLachlan, at 11:59
“And I’m sure that’s what you look for”
Jon McLachlan, at 12:05
That’s an investor’s question, and Michal answered it later, in Seen as an overhead.
Give me a deepfake and I can build you a detector
Jon’s recap set up the question Michal had been waiting for.
“If you ask me what out of those four is the problem that kind of worries me the most, where I can see that I don’t have an answer”
Michal Pechoucek, at 12:10
The first three, he said, he can imagine technologists fighting shoulder to shoulder against attackers, the way defenders have for 30 years. The fourth is different.
“in the space of deepfakes, I’m actually really scared, because I’m seeing this from a scientific perspective”
Michal Pechoucek, at 12:33
“give me a deepfake and I can build you a detector. Give me a detector that is unbeatable by next deepfake. It’s impossible.”
Michal Pechoucek, at 12:40
That’s the arms race in two sentences. A deepfake is an image, video or audio clip edited or generated with AI, a form of synthetic media, and an audio deepfake is a voice clone that says things a real person never said (Wikipedia, Wikipedia). Every detector teaches the next generator what to avoid. Michal’s answer isn’t a better detector. It’s investment, creativity, infrastructure and trust, built on the inside,
“to minimize the impact of deepfakes and manipulated reality.”
Michal Pechoucek, at 13:02
“I think this is very hard. It’s going to be very hard.”
Michal Pechoucek, at 13:08
We made the same argument in deepfake attacks keep working because we keep detecting instead of proving, and episode 92 with Jasson Casey of Beyond Identity makes the case that identity, not detection, is the boundary. For the detection side, listen to Ben Colman of Reality Defender on episode 71.
Who are you?
Jon put the problem in everyday terms.
“I guess, in some sense, we’ve had this problem for a long time.”
Jon McLachlan, at 13:11
“And we have this idea in our head that, like, oh, if we jump on a Zoom, I can see you, I can hear you, you’re talking like a human being, but now a machine can do all of those things too.”
Jon McLachlan, at 13:21
Seeing and hearing someone used to answer the question. It doesn’t anymore, which is why the practical defenses move to channels a cloned voice or face can’t reach: a call back to a number you already have, a shared secret, a second person who approves the transfer.
AI-created reality
Michal said his own view had changed.
“I thought that the biggest problem of society are the AI and recommendation systems”
Michal Pechoucek, at 13:41
A recommender system filters what each person sees, and on social media it’s what people mean when they say “the algorithm.” It analyzes behavior and preferences to build a personalized feed (Wikipedia). The worry he described is a filter bubble, the intellectual isolation that comes from algorithms choosing what each user sees (Wikipedia). Even three years earlier, he said, he would have called that the biggest problem of AI on the internet. Not anymore.
“There are things that are even more scary than AI-driven life on the internet, and this is AI-created reality.”
Michal Pechoucek, at 14:09
A recommender picks from what exists. Generative AI makes new things, text, images, video, audio and code, from patterns in its training data (Wikipedia), so a feed can be filled with content made for one viewer.
The sum of the five people
Jon pushed on it with a saying.
“You’ve heard that saying, maybe, that you’re the sum of the five people that you keep closest to you.”
Jon McLachlan, at 14:20
“But do you think we’ll move into a world where, like, one or two of them will become an AI”
Jon McLachlan, at 14:27
An AI model fine-tuned for you, he meant, one that helps you lead a better life. Michal tied it back to his point.
“but recommendation to kind of created stuff.”
Michal Pechoucek, at 14:44
“Yeah, this is quite likely.”
Michal Pechoucek, at 14:47
Then he passed on something he had heard, and said so.
“I don’t know whether it’s true or rumor”
Michal Pechoucek, at 14:51
The rumor is that TikTok works differently in China.
“That in China, TikTok recommenders are more recommending educational videos”
Michal Pechoucek, at 14:58
In Europe and the US, he said, the recommendations favor short, disruptive, erratic content. Here is what the record does say. TikTok is blocked in mainland China, where ByteDance runs Douyin instead, and the two share an interface but operate separately (Wikipedia). Wikipedia doesn’t say what either one recommends, so the educational claim stays a rumor, as Michal said it was. His real point was about the future: educational content can be constructed too, and sometimes it can be misleading, or train you in skills someone else wants you to have.
It’s just a tool
Jon took the optimistic side.
“We’re optimistic about this, right?”
Jon McLachlan, at 15:39
“So I imagine, like, those tools can be used and deployed for good if there’s a conscious choice”
Jon McLachlan, at 15:44
His example was a life coach that keeps track of exercise, food and time, and nudges you toward being more productive and building closer relationships with people. If a thing does that, why not let it? The key word in his version is choice, and it’s the word Michal came back to in Transparency and choice.
LLMs are essentially black boxes
Sasha raised the catch.
“However, it’s a lot more complex tool than a hammer or something that I can understand by looking at it.”
Sasha Sinkevich, at 16:10
“LLMs are essentially black boxes, and you don’t really know what went into the composition of that black box.”
Sasha Sinkevich, at 16:19
We put a lot of trust in the output of a function we can’t see inside, Sasha said, and then came the question that matters for security.
“who controls the data input that goes into the training”
Sasha Sinkevich, at 16:38
In science and engineering, a black box is a system you can only see through its inputs and outputs, and in AI it means a model whose workings are opaque even to the people using it (Wikipedia). A large language model is a model trained on a vast amount of text to generate language, which is the part Sasha was asking about: whose text (Wikipedia).
Transparency and choice
Michal’s answer had two parts.
“One is transparency, and the second one is choice.”
Michal Pechoucek, at 16:51
“I kind of need to know what is going on”
Michal Pechoucek, at 16:58
How the software is constructed, what data it was trained on, and why it suggests what it suggests. He acknowledged that not everybody wants that, and then made the case that transparency alone isn’t enough.
“what good does explainability give me if I cannot choose, right?”
Michal Pechoucek, at 17:31
“And choices have been removed from us lately.”
Michal Pechoucek, at 17:36
Explainable AI is the research field that gives people intellectual oversight of AI decisions, the reasoning behind a prediction, against the black-box tendency in which even a model’s designers can’t say why it decided something (Wikipedia). Michal’s point is that an explanation you can’t act on doesn’t give you much.
Platforms are closed
He gave the security version. In the past, a customer could pick one security product over another because they trusted one brand more. On social platforms, that choice is gone.
“Why there is not an independent new cybersecurity firm that is focused only on scamming social media?”
Michal Pechoucek, at 18:03
“And me as a customer, I cannot choose who is protecting my life on social networks.”
Michal Pechoucek, at 18:11
“These days, it’s impossible. Platforms are closed.”
Michal Pechoucek, at 18:16
It’s very difficult, he said, to take your security expectations from one product to another.
“So I don’t have the choice.”
Michal Pechoucek, at 18:24
Part of that gap has been filled from the outside in. Episode 5 with Leigh Honeywell of Tall Poppy is about protecting employees from online harassment, the personal security a whole industry skipped. Sasha closed the thought with a line about the platforms themselves.
“But they tell us to trust them, and that sounds good enough.”
Sasha Sinkevich, at 18:37
Michal agreed.
If you’re not paying for the product
Jon added the business side of the data question.
“one of the interesting things about LLMs and data is not just, like, the transparency and giving us the choice, but the value from a company’s perspective of data has just gone through the roof”
Jon McLachlan, at 18:46
“if you’re not paying for the product, maybe you are the product.”
Jon McLachlan, at 19:11
Michal tied it back to his TikTok point and then to his day job. The answer, he said, is education: people trained to be inquisitive, to dig deep,
“and kind of questioning and asking for reasons”
Michal Pechoucek, at 19:29
Jon said he was happy that the younger people he talks to are asking those questions, and Michal said that’s the best part of his work.
“To me, kind of being a university professor is the most exciting part of the job.”
Michal Pechoucek, at 19:47
“these days we are underestimating some of the problems that this generation is not underestimating, and they will remind us in the future.”
Michal Pechoucek, at 20:01
“Yes, they will. I hear, like, I told you so coming here pretty soon.”
Jon McLachlan, at 20:10
Seen as an overhead
Sasha asked the question every security leader gets in the budget meeting.
“In general, when we talk within a business with leadership teams about security and compliance subjects, often they are seen as an overhead.”
Sasha Sinkevich, at 20:15
“However, it’s very important that we structure the dialogue such that it’s not seen as an overhead, but rather as a core component of the system and of the product that we are delivering into the market.”
Sasha Sinkevich, at 20:27
How does Michal make the case that research and development matters, but so do the consequences of doing it wrong? He answered as an investor.
“So one remark I want to make is that as an investor, we just are investing for the purpose of generating returns, right?”
Michal Pechoucek, at 20:54
“And you can generate return while solving important societal problems.”
Michal Pechoucek, at 21:11
“And I chose to kind of invest in AI, and mainly in AI, in such a way that I’m focused on problems that would reduce risks of AI explosion.”
Michal Pechoucek, at 21:16
Then he said why.
“And this is partly because I’m an AI scientist for the last 30 years.”
Michal Pechoucek, at 21:29
“And even though I haven’t invented anything related to LLMs, I still feel I’ve contributed to the AI progress”
Michal Pechoucek, at 21:35
“it’s my duty to kind of think about the negative consequences”
Michal Pechoucek, at 21:43
Five months after the recording he put money behind that, as an investor and technical advisory board member at GetReal (LinkedIn), a company that sells real-time protection against deepfakes and AI-powered identity attacks and counts Evolution Equity among its backers (LinkedIn). Sasha’s question has a practical answer too. Security stops looking like overhead when it closes deals, which is the work of our vCISO Services, and we wrote about the AI questions buyers now ask in the 10 AI security questions your first enterprise buyer will ask.
It all boils down to the UX
Sasha liked the answer and offered a theory of how security gets adopted.
“I love that answer. We believe that it all boils down to the UX, the user experience.”
Sasha Sinkevich, at 21:53
“But once you roll up your sleeves and come up with a solution that is elegant and solves a very specific pain point, everyone wants it.”
Sasha Sinkevich, at 22:10
Michal agreed and took it further. We’re entering a phase, he said, where the work is composition: taking great capabilities other people built and delivering them in the most seamless, safest and most natural way to the user. Better interfaces will increase the adoption of AI. Then he named the catch.
“Unfortunately, there is also a silver lining, which is some of the interfaces can be not such a great thing.”
Michal Pechoucek, at 23:03
His example was search, and asking a chatbot instead.
“it’s easy, it’s nice, it’s elegant.”
Michal Pechoucek, at 23:16
“this type of interface precisely removed some freedom”
Michal Pechoucek, at 23:22
When you did the research yourself, it was more laborious, but you got better results,
“because you were able to moderate the result”
Michal Pechoucek, at 23:35
and you could catch the hallucinations yourself. A hallucination is a response from AI that presents false or misleading information as fact (Wikipedia). A chatbot is software built to hold a conversation, and today’s are mostly built on fine-tuned large language models (Wikipedia). That’s the reason, he said, he’s excited about AI safety and security: every AI-enabled chatbot has negative consequences that come with wider adoption.
It almost became a verb
Jon agreed and reached for the last time this happened.
“almost became a verb to know how to use them effectively.”
Jon McLachlan, at 24:49
He meant Google, and the search engines that came with it. To google became a transitive verb for searching the web. The American Dialect Society chose it as the most useful word of 2002, and it was added to the Oxford English Dictionary on June 15, 2006 (Wikipedia). Jon expects the same thing to happen again.
“I think maybe we’ll see very similar new skills develop, like, around the way that we interact with this new type of LLM interface”
Jon McLachlan, at 25:01
“It seems to be reading the entire internet, like, six or seven times over.”
Jon McLachlan, at 25:22
And then, he said, we put security layers in front of it, behind it, on top of it and on the side.
What-if data
Michal came back to data, with a prediction.
“we are entering the era of new families of data.”
Michal Pechoucek, at 25:35
The first family is the one he’d already described: behavioral data, about what is happening and what people are doing, and even the causalities behind events. The second is new.
“I actually see there is another class of data it’s coming, and this is the what-if data, data about things that didn’t happen or things that may happen.”
Michal Pechoucek, at 25:54
“So I actually think that there is this new huge era of kind of AI simulation”
Michal Pechoucek, at 26:03
Synthetic data is the established term for the nearest thing: data generated by algorithms rather than real events, used to validate and train models (Wikipedia). Michal’s version goes further, into simulators that tell us what happens if things happen. And he named a third family, from software itself: AI running programs, analyzing how they behave and suggesting new ways to program, so that generated software stops being only an aggregation of human knowledge.
“the data that is coming from execution”
Michal Pechoucek, at 27:12
That, he said, is a new vector of data that will feed the next generation of models.
I didn’t win a Turing Award
Jon asked his closing question: if you could meet your younger self, what would you say? Michal’s first answer was the obvious one.
“a recommendation to do less things and focus more.”
Michal Pechoucek, at 28:09
Then he thought about it and changed his mind.
“At the same time, I didn’t win a Turing Award, right? Which I regret very much.”
Michal Pechoucek, at 28:26
The Turing Award is the Association for Computing Machinery’s annual prize for lasting contributions to computer science, often called the Nobel Prize of computing (Wikipedia). A hardcore career in one narrow discipline might have won it. He wouldn’t trade.
“I did enjoy kind of collecting a dissimilar experience that the life was there to offer me.”
Michal Pechoucek, at 28:47
What he tells others is the opposite of what he did, and he knows it.
“So I’m actually advising people to focus more and to go deeper”
Michal Pechoucek, at 29:11
“That’s an incredibly compassionate answer for yourself, for your younger self.”
Jon McLachlan, at 29:27
A billion-dollar fund
Jon’s last question was what Michal wishes someone would build.
“So if I would kind of sit on a billion-dollar fund”
Michal Pechoucek, at 30:14
“I’ll be kind of really kind of helping a scientific discovery”
Michal Pechoucek, at 30:22
Discovery for the climate, he said, even though it’s not a trendy topic these days.
“I still think that we owe it to the generation of young leaders that is coming”
Michal Pechoucek, at 30:31
His reason was timing: it’s easier to do this work now than in ten years. Present-day climate change is driven by human activities, especially burning fossil fuels, and the atmosphere now holds roughly 50% more carbon dioxide than at the end of the pre-industrial era (Wikipedia).
After the tape
Michal’s titles changed. In January 2025 he became a partner at Evolution Equity Partners, and in March 2025 he joined GetReal as an investor and technical advisory board member (LinkedIn). On October 22, 2025 the Czech Technical University’s academic senate nominated him for rector, and he took office on February 1, 2026 (Wikipedia). He is a venture partner at Evolution again and chairs the board of the Artificial Intelligence Center he founded (LinkedIn).
On the EU AI Act’s own schedule, the bans applied six months after it took effect, the general-purpose AI rules at 12 months, and most of the rest at 24 months, in August 2026, with some high-risk obligations set for 36 months (Wikipedia). And in September 2026 he wrote about AI in science, where he expects AI to speed up grand discoveries and wants scientists to keep their agency.
humans need to stay in control as much as possible
Michal Pechoucek · September 12, 2026
It’s the same argument he made on the show, aimed at a different field: grow AI as fast as you can, and keep people in a position to choose.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each. The explanation shows once you choose.
-
Which company bought Michal's first startup, Cognitive Security?
- Cisco
- Avast
- MITRE
a. "It was very successful. We were able to exit in Cisco and be able to service millions of customers with this technology." Transcript, 2:11.
-
How many kinds of AI security problems does Michal lay out?
- Two
- Three
- Four
c. "And I see AI security as kind of four different things." Transcript, 2:36.
-
Which of them worries him the most?
- Attackers going after AI systems
- Deepfakes and attacks on people's minds
- AI-written software
b. "in the space of deepfakes, I'm actually really scared, because I'm seeing this from a scientific perspective" Transcript, 12:33.
-
What two things does Michal say he needs from AI?
- Speed and scale
- Transparency and choice
- Privacy and a lower price
b. "One is transparency, and the second one is choice." Transcript, 16:51.
-
What new class of data does he expect?
- What-if data
- Dark data
- Metadata
a. "I actually see there is another class of data it's coming, and this is the what-if data, data about things that didn't happen or things that may happen." Transcript, 25:54.
-
Which award does Michal say he regrets not winning?
- The Nobel Prize
- The Fields Medal
- The Turing Award
c. "At the same time, I didn't win a Turing Award, right? Which I regret very much." Transcript, 28:26.
Is your AI security thinking ahead?
Michal’s line between the two fields is that cybersecurity responds and AI security has to think ahead. Eight questions on which side your company is on.
Scorecard · eight questions
Is your AI security thinking ahead?
Answer for how your company works today. If two answers fit, pick the lower one.
-
Do you know which AI models and AI features your company uses, and what data reaches each one?
- Not really
- For the tools we bought, not the ones people brought
- Yes, a written inventory we keep current
"who controls the data input that goes into the training" See LLMs are essentially black boxes.
-
If a familiar voice or face asks for money, credentials or access, does your team confirm it on a second channel first?
- No, we'd trust a call from the boss
- For wire transfers only
- Yes, a written callback rule for money and access
"give me a deepfake and I can build you a detector. Give me a detector that is unbeatable by next deepfake. It's impossible." See Give me a deepfake and I can build you a detector.
-
Do you threat-model your AI features against attacks on the AI itself, with a framework like MITRE ATLAS?
- No
- Informally, when something new ships
- Yes, and we test the findings
"And to be able to protect the AI systems, it is like a net new class of cybersecurity problems." See A net new class of cybersecurity problems.
-
Does code written with AI get the same review and testing as code people write?
- It ships if it runs
- Some of it gets reviewed
- Yes, the same gates for all code
"And from my perspective, this is a massive software change, similar software change as we saw when computers got connected through the internet." See A massive software change.
-
Does your security training cover AI-written phishing, cloned voices and fake video calls?
- No
- Phishing only
- Yes, with examples people have actually seen
"The precision and the scale and the availability and the cost of the human-centered attacks is just unprecedented." See To people's cognition.
-
Do you know which AI rules apply in the markets you sell into, like the EU AI Act?
- Not yet
- For our home market
- Yes, for every market we sell into
"You guys went a little bit further and a little bit faster, making sure that AI systems are not in a position to make decisions that will influence people's lives, whereas it's not the case everywhere else in the world." See Regulate ourselves from a leading edge innovation.
-
Do you collect only the behavioral data you need, and keep it away from models that don't need it?
- We collect everything, just in case
- We try to
- Yes, and we check what each model can see
"not necessarily against people, but against machines" See AI will be asking for behavioral data.
-
Does your security budget grow when your AI budget does?
- No
- Sometimes, after an incident
- Yes, we plan them together
"And then the investment in AI safety is minimalistic in comparison, right?" See This symmetry doesn't exist.
You're defending the way cybersecurity always has, after the fact. This month, write down which AI tools you use and what data reaches them, and set a callback rule for any request for money or access.
The basics are in place. Next, threat-model your AI features with ATLAS, review AI-written code like any other, and train people on cloned voices and AI-written phishing.
You're building guardrails before you need them. Keep the security budget in step with the AI budget, track the AI rules in each market, and red-team your AI features before your customers do.
How much of your AI budget goes to safety?
Michal’s fix for the asymmetry is to keep spending on AI safety and security in proportion to AI progress. He gave no numbers, so this calculator uses yours. Every default here is our example, not a benchmark.
Calculator
How much of your AI budget goes to safety?
Three numbers: what you spend on AI in a year, the share of it that goes to AI security and safety today, and the share you'd want.
At $500K a year on AI, 2% is $10.0K for AI security and safety. At 10% it would be $50.0K, a gap of $40.0K, or about $3.3K a month.
Michal gave no numbers on the tape. The $500,000, the 2% and the 10% are our examples, not benchmarks. Put in your own.
From NetFlow to the AI Act and after
Everything on this page sits on one timeline, from NetFlow in the 1990s to the last AI Act deadline in 2027. Filter it by thread.
Timeline · 1996 to 2027
From NetFlow to the AI Act and after
Filter by thread. Dates are from the public record except where marked as Michal's account or part of this show.
- NetFlow
Cisco introduces the traffic-recording feature on its routers (Wikipedia, on this show).
- Edinburgh
Michal earns a master's in artificial intelligence at the University of Edinburgh (Wikipedia, on this show).
- Web applications
Software that runs in a browser emerges, the first of the shifts Michal lists (Wikipedia, on this show).
- The Artificial Intelligence Center
Michal founds it at the Czech Technical University and directs it until 2026 (LinkedIn, on this show).
- To google
The American Dialect Society names it the most useful word of the year (Wikipedia, on this show).
- Associate professor
In the university's Department of Cybernetics (LinkedIn, on this show).
- Google, the verb
Added to the Oxford English Dictionary (Wikipedia, on this show).
- Cognitive Security
Michal and his doctoral students start the company, by his account on the tape (on this show).
- Professor
In the computer science department, where he still teaches (LinkedIn, on this show).
- Cisco buys Cognitive Security
Filed under cyber threat protection, Czech Republic (Wikipedia, on this show).
- ATT&CK
MITRE releases its way to classify and describe cyberattacks (Wikipedia, on this show).
- Cambridge Analytica
The political consulting firm behind the Facebook data scandal is founded (Wikipedia, on this show).
- Douyin
ByteDance launches the Chinese app that runs separately from TikTok (Wikipedia, on this show).
- Evolution Equity Partners
Michal becomes a venture partner (LinkedIn, on this show).
- prg.ai
He co-founds the initiative to make Prague a European AI hub and chairs its executive board (prg.ai, on this show).
- Avast
He becomes chief technology officer, later at Gen Digital until 2024 (Wikipedia, on this show).
- Gen Digital
NortonLifeLock completes its merger with Avast and takes the name Gen Digital (Wikipedia, on this show).
- The EU AI Act
Enters into force, with its provisions phasing in over six to 36 months (Wikipedia, on this show).
- SB 1047 vetoed
California's governor vetoes the frontier AI bill (Wikipedia, on this show).
- The recording
Jon and Sasha talk with Michal, soon after the veto (on this show).
- Partner
Michal becomes a partner at Evolution Equity Partners (LinkedIn, on this show).
- The bans apply
The six-month mark, when the AI Act's prohibited practices, social scoring among them, take effect (Wikipedia, on this show).
- GetReal
He joins the deepfake-protection company as an investor and technical advisory board member (LinkedIn, on this show).
- Episode 66 airs
On Podbean, Apple Podcasts and Spotify (Podbean, on this show).
- General-purpose AI
The 12-month mark, when the AI Act's rules for general-purpose AI apply (Wikipedia, on this show).
- Nominated rector
By the Czech Technical University's academic senate (Wikipedia, on this show).
- Rector
Michal takes office at the head of the university (Wikipedia, on this show).
- Most of the AI Act
The 24-month mark, when most of the remaining provisions are set to apply (Wikipedia, on this show).
- AI in science
Michal writes about keeping scientists' agency as AI speeds up discovery (LinkedIn, on this show).
- ATLAS
MITRE's AI knowledge base lists 16 tactics, 221 techniques and 77 case studies (MITRE, on this show).
- High-risk obligations
The 36-month mark, set for some of the AI Act's high-risk rules (Wikipedia, on this show).
What to do this week
Five things, in the order the episode suggests.
- Find out how far ahead you’re looking. Take the scorecard with whoever owns security and whoever owns AI, and compare answers.
- Write a callback rule. Any request for money, credentials or access that arrives by voice or video gets confirmed on a second channel you already trust. No detector is a substitute, as Michal said.
- List what data reaches which AI. One page: every AI tool and feature in use, and the data each one can see. Our guide to shadow AI governance has a starting point.
- Threat-model one AI feature, and price the gap. Walk one AI feature through MITRE ATLAS, then run the calculator on what fixing it would take.
- Get help with the parts you can’t staff. Our AI Product Red Teaming team tests AI features the way attackers would, our AI EU Compliance Program maps you to the AI Act, our Corporate Shadow-AI Detection & Mitigation team finds the AI tools already in use, and you can book 15 minutes with us.