Episode 68 of The Security Podcast of Silicon Valley aired on May 6, 2025, with Jon McLachlan and Sasha Sinkevich hosting. The guest was Travis McPeak, co-founder and CEO of Resourcely, a company that built self-service cloud infrastructure for developers, with the secure configuration built into the template instead of a review at the end. Jon’s introduction ran from Symantec through HP, IBM, Netflix and product security at Databricks to advising, angel investing and a podcast of Travis’s own. Travis’s reply was four words: “I like to stay busy.”
The argument he came to make fits in two sentences from the middle of the conversation.
“five years from now, great security tools are going to look like engineering tools. And a side effect of using those engineering tools will be security.”
Travis McPeak, at 4:47
Travis’s LinkedIn fills in the résumé behind that bet. At HP Helion, from August 2014, he was a security architect and lead developer of Bandit, a Python security linter. At IBM, from March 2016, he reported to the company’s cloud chief security officer and co-founded its Cloud Foundry security team. He spent four years at Netflix, first as a senior cloud security engineer securing “one of the largest AWS environments in the world,” then as an application security engineering manager, before leading product security at Databricks from February 2021 to March 2022 (LinkedIn). He co-founded Resourcely that March, co-hosted the security podcast 404: Security Not Found from November 2022, and has been an angel investor since 2021, including in Leen, the company behind episode 63.
The conversation was recorded three months before it aired. Partway through, Jon stopped to tell listeners “this is recorded February 3rd, 2025,” the week the noise around a Chinese AI lab’s new model was, in his words, “just overflowing,” and two weeks after TikTok’s 75-day reprieve began. Resourcely had twelve people. Five months after the recording, Resourcely was acquired: Travis’s LinkedIn lists the company as acquired, with his time as CEO ending in July 2025 and a security role at the acquiring developer-tools company starting the same month. In 2026 he kept making the same argument in public, that security’s job is to keep security from getting in the business’s way.
This page is the rest of it: a section for each part of the conversation with the sources beside it, thirteen figures, sixteen clips from the tape, a LinkedIn card and an X card, the full transcript, and four tools: a quiz, a scorecard for how close your cloud is to secure by default, a calculator for what the JIRA dance costs, and a timeline from the first OWASP Top Ten to Travis’s posts in 2026.
Too business-slowing
Jon read Resourcely’s tagline back to Travis, “simple self-service cloud infrastructure,” and asked what it meant. Travis started with what security gets wrong.
“we are too business-slowing, too adversarial with our developer counterparts. And doing this for, you know, a long time, we lose trust.”
Travis McPeak, at 1:09
The cost of lost trust, in his telling, is that people stop telling security what they’re doing: they’re “incentivized to just keep security over there in the corner,” because security slows them down and stops them delivering value. His company was built around the opposite proposition.
“what if you could have good security and also you made life easier and faster for developers?”
Travis McPeak, at 1:26
It’s the same line Resourcely’s own site still carries under his name, that the strongest security programs he has seen “offer a better user experience to developers and have excellent security baked in” (Resourcely). The headline above it reads “It’s easier to stay secure if you start secure.”
A ton of configuration
Jon asked what pain point pulls people in. Travis said Resourcely started with cloud configuration, because it is very complex. Most organizations run more than one cloud, each cloud has tons of services, and each service carries configuration for every kind of customer.
“So I think Amazon has 250, 300.”
Travis McPeak, at 2:03
Wikipedia puts Amazon Web Services at “over 200 products and services” as of 2025 (Wikipedia), and Travis added a similar story for Google, Azure and Oracle. Every one of those services has to serve its whole customer base, so “there’s a ton of configuration.” Then he named the result.
“we’ve all seen misconfiguration on every top 10 list forever.”
Travis McPeak, at 2:19
The best-known list proves him right, and the category keeps climbing. The OWASP Top Ten, first published in 2003, had security misconfiguration at number six in 2017. The 2021 edition moved it up to number five and reported that “90% of applications were tested for some form of misconfiguration” (OWASP). The 2025 edition, the current one, moves it up from number five to number two and reports that “100% of the applications tested were found to have some form of misconfiguration,” a rise OWASP pins on “more shifts into highly configurable software” (OWASP). Its description of the category names exactly Travis’s problem: “improperly configured permissions on cloud services.”
Why does it keep happening? Travis’s answer is a defense of the people who make the mistakes.
“It’s because the users of cloud services are generally not experts to the point where they know how to correctly configure it.”
Travis McPeak, at 2:25
Data ends up on the internet all the time, he said, and that isn’t developers trying to do the wrong thing.
“They just didn’t know how to do the right thing.”
Travis McPeak, at 2:42
Even experts get it wrong. In May 2024 a misconfiguration of a Google Cloud VMware Engine private cloud “by Google operators,” made by leaving a parameter blank, triggered a bug that deleted all of the Australian superannuation fund UniSuper’s data on the platform, most of it later recovered from backups (Wikipedia). Travis posted the news with “our periodic reminder that misconfiguration can strike anywhere and happen with very savvy operators” (X), and Resourcely’s first incident review argued the Terraform provider for that resource “executes Private Cloud deletion with a hardcoded parameter of delay_hours=0” (Resourcely).
The bummed-out look
Jon asked what started Travis on the entrepreneurial path. The answer was a feeling from the start of his career, in traditional security environments built around touch points: get engaged, threat model, find vulnerabilities, review source code.
“And although it felt like we were doing a lot of work, it didn’t feel to me like we were adding a lot of value.”
Travis McPeak, at 3:06
He could see it on the other side of the table.
“And I always noticed this kind of bummed-out look on developers’ face when we were meeting.”
Travis McPeak, at 3:10
The developers were thinking about the two hours they would spend in a meeting they wished they weren’t in, and hoping security wouldn’t find anything, “because then my launch is going to get delayed.” Travis said that never made him feel good.
The lightning bolt at Netflix
Then he joined Netflix.
“the lightning bolt for me was when I got to Netflix and saw that security didn’t really do any of that kind of stuff.”
Travis McPeak, at 3:28
“They focused their time on building tools that made developers not have to worry or think about security or even understand it very much.”
Travis McPeak, at 3:34
His own Netflix work is a good example of the type. His LinkedIn describes him as “lead developer and architect for the Repokid OSS project,” which applied least privilege across Netflix’s AWS deployment (LinkedIn). Netflix’s repository describes Repokid as “AWS Least Privilege for Distributed, High-Velocity Deployment,” a tool that removes “permissions granting access to unused services from the inline policies of IAM roles” (GitHub). That is the automated, usage-based trimming of permissions that Graham Neray described for agents on episode 89, built years earlier for cloud roles, and it fits the principle of least privilege without any developer filing a request. Before Netflix, at HP, his tool was Bandit, which its maintainers describe as “a tool designed to find common security issues in Python code,” first developed in the OpenStack Security Project (GitHub).
When Resourcely launched its product in July 2024, Travis wrote that the founders’ experience “at top-performing cloud-based companies like Netflix, Robinhood, and Databricks” taught them how to solve the problem, and that the aim was to let security, ops and platform teams “give developers a paved road to production” (Resourcely).
It’s not their job
Sasha asked where the main pain point lies with developers not being engaged in product and infrastructure security. Travis started with the experts. Take a cloud security engineer, he said, and count how long it took them to get good, and even then one engineer usually knows one cloud well. The human brain only holds so much.
“And then now you take a developer, it’s not their job.”
Travis McPeak, at 4:11
Developers are meant to write software and build products for the business, and teaching them every Amazon misconfiguration takes something away.
“Like, that’s just occupying headspace for them and time that should go to other things.”
Travis McPeak, at 4:23
He made the same point on LinkedIn in March 2026, after a conversation at a security newsletter’s reception: the phrase “security is everybody’s job” never made sense to him, because no sales team would say that about selling (LinkedIn). His conclusion there was blunter than on the tape, that the phrase is security teams “copping out on taking more end-to-end ownership.”
The bet
Then Travis gave the bet he started the company with. Security in a corner by itself, with tools that “scan and advise you about risks in the environment,” would not move the needle.
“Like, we’re going to keep having breaches constantly as long as that’s the interaction point between security and engineering.”
Travis McPeak, at 4:39
The alternative was the line at the top of this page: great security tools that look like engineering tools, with security as the side effect. His example was concrete. The same tool that makes it easy for a developer to deploy a database or spin up a new account “can also be used to solve DevOps concerns and really enable self-service” for the platform team’s customers.
Resourcely’s July 2024 launch post put the bet in product terms. “Developers owning infrastructure inevitably results in rampant misconfiguration,” it begins, because “Developers who aren’t Terraform experts are asked to deploy heterogeneous services” they don’t know. The product answer was Blueprints, “configurable templates,” and Guardrails, which “govern how infrastructure can be created or changed,” with the result generated as Terraform and “deployed through your existing change management and review processes” (Resourcely). Terraform is “an infrastructure-as-code software tool created by HashiCorp,” one of the tools Wikipedia lists for managing infrastructure as code.
We went the other way
Sasha summed it up: “So you’re essentially taking care of the DevSecOps.” Travis agreed and drew a distinction. Some tools came from pure infrastructure engineering and added security later, because they realized it was a good benefit of getting things done correctly.
“We went the other way. We started with security and then realized that these are also DevOps tools.”
Travis McPeak, at 5:24
Wikipedia describes DevSecOps as a practice that “integrates DevOps within security practices,” moving tests and security work earlier in the development lifecycle, which is where the phrase shift left comes from (Wikipedia). Travis had spent the summer before this conversation arguing that the movement had failed. His three-part blog series, Death of DevSecOps, ended in June 2024 with the fix he believed in, “secure-by-default: an approach that shifts responsibility onto systems, not people,” and the line “The next generation of security is secure-by-default” (Resourcely). On X he put it in one sentence: “Systems should be making security decisions, not developers” (X).
Starting from security meant Resourcely had two buyers, and Travis said the product has to talk to each in its own terms.
“you don’t want this to feel like security geek stuff. You want it to feel like it’s built for them.”
Travis McPeak, at 5:37
On the security side, the buyer is what he called a forward-facing team, one thinking about how to partner meaningfully with engineering.
“So I would call it the head of the pack in terms of our industry.”
Travis McPeak, at 5:57
On the engineering side, the buyer is a platform team whose internal customers bombard it with requests. Resourcely takes the easy requests off its plate so it can focus on the bespoke work. Wikipedia describes the discipline as platform engineering, building “self-service toolchains, services, and processes to create an internal developer platform,” with “golden paths” for most workloads.
The JIRA dance
Jon asked how starting with security turned into an advantage. Travis said security teams like the idea right away, because it makes their lives easier, and he described what their lives look like today.
“we have all these tools that tell us about issues after they’re already deployed in prod.”
Travis McPeak, at 6:58
“And then we have to do this JIRA dance where we go and, like, just rain JIRA tickets on all the engineers and ask them to fix it.”
Travis McPeak, at 7:02
Jira is Atlassian’s tool for “bug tracking, issue tracking and agile project management,” and it’s where many security teams send what their scanners find. “A lot of these things don’t get fixed,” Travis said. A lot of teams now won’t even file a ticket unless the finding is among the most severe, which he called silly, though he understood it: tickets are work for developers, and security is trying to be a better partner by filtering the noise. The scale those teams filter against is the Common Vulnerability Scoring System, where High runs from 7.0 to 8.9 and Critical from 9.0 to 10.0.
The fix, for Travis, is to go directly to the engineering teams with a value proposition that isn’t “security nerd stuff.” That meant learning what they care about. A top ten list of security problems will have misconfiguration on it, he said, but engineering doesn’t think in those terms.
“They think in terms of developer productivity and cost effectiveness and stability, availability, reliability.”
Travis McPeak, at 7:41
“It’s the same kind of, like, overall product strategy, but it has to be messaged totally differently.”
Travis McPeak, at 7:49
Neatsun Ziv of OX Security made a related case on episode 91, starting from the premise that shift left had failed and that most findings don’t matter. The calculator further down this page puts rough numbers on the dance: how many tickets it files in a year, the hours it costs, and the findings that never become a ticket at all.
Compliance moves so slow
Without a pause, Travis moved from messaging to compliance, and to what he finds sad about it.
“So I think compliance moves so slow that a lot of it hasn’t meaningfully kept up with the cloud at all.”
Travis McPeak, at 7:54
He went through the frameworks one at a time. FedRAMP and PCI “have some stuff in there.” Of the third, he was blunt.
“SOC 2 is very vague.”
Travis McPeak, at 8:07
There are standards that spell out what good looks like, he said, naming NIST and its Cybersecurity Framework, “but that’s not really being enforced by anybody,” so a lot of companies just don’t do it.
“They’re like, okay, we need SOC 2, but this NIST stuff seems like a nice to have.”
Travis McPeak, at 8:24
The public record matches each part of that. SOC 2 is an audit report defined by the AICPA around five trust services criteria, security, availability, confidentiality, processing integrity and privacy, and its Type 2 report covers how controls operated over a period, usually nine to twelve months, rather than a list of cloud settings. FedRAMP, set up by an OMB memo in 2011, is the federal program the US government itself calls “FISMA for the cloud.” PCI DSS dates to December 2004, and its current version, 4.0.1, became mandatory on March 31, 2025, eight weeks after this conversation. The NIST Cybersecurity Framework, first developed in 2014, reached version 2.0 in 2024 and added a sixth function, Govern, to Identify, Protect, Detect, Respond and Recover. Its guidance is broad, and Travis’s complaint was that nobody enforces it.
Three years of credit monitoring
From compliance Travis went to the people at the end of every breach. Consumers aren’t generally educated about security and privacy, he said, and they get the same letter again and again.
“how many times have you gotten an email or a letter recently where it’s like, hey, sorry, like, your data was leaked, and please have three years of credit monitoring on us?”
Travis McPeak, at 8:36
“I probably have, like, 10 of these credit monitoring things concurrently right now.”
Travis McPeak, at 8:46
The letters exist because the law requires them. Data breach notification laws now cover all 50 states, starting with California’s, which took effect on July 1, 2003. The free monitoring that comes with them is a familiar settlement term. After the 2017 Equifax breach, which exposed the records of 147.9 million Americans, the company offered affected people free credit monitoring, and its 2019 settlement included $300 million for a victim compensation fund. Wikipedia’s article on credit report monitoring is dry about the value: “Most people get little benefit from paying for regular credit reporting.”
Travis didn’t present himself as a model.
“I’m probably the worst kind of security person because, like, honestly, I’ve just given up on privacy.”
Travis McPeak, at 8:49
He cares about security, he said, but he assumes his data has been leaked and transferred so many times that he has given up on the whole thing. Ten months before this conversation he had posted a breach notice of his own on X, with a cross for details about what happened, a cross for details about what was breached and a check mark for “Another ID theft sub!” His question underneath: “Can we stop doing this token ID theft protection thing?” (X).
Flower-buying preferences
Travis’s explanation for why companies collect so much is the data broker industry.
“It’s because, like, a lot of times they’re selling it.”
Travis McPeak, at 9:11
His example was ordinary on purpose. You buy flowers for your partner, the shop collects everything about you, “including your flower-buying preferences,” and sells it to a data broker you never chose to do business with, who can sell it everywhere else.
“It’s a big web. You don’t have control in a lot of these cases.”
Travis McPeak, at 9:34
The US regulator has said the same for over a decade. Wikipedia notes that the Federal Trade Commission recommended in 2009 that Congress let consumers see what brokers hold about them, and renewed the recommendation in 2012 and in 2014, the year of its report “Data Brokers: A Call for Transparency and Accountability” (FTC). In October 2019 California’s AB 1202 required data brokers to register with the state’s attorney general (Wikipedia).
Jon said he had been about to ask whether Travis ever felt like giving up, and it sounded like he had, on privacy. Travis drew the line precisely.
“I’ve not given up on security, but I have given up on privacy.”
Travis McPeak, at 9:45
Make it really important
Jon asked about the GDPR and the European approach of putting the law on privacy’s side. Travis said he appreciates regulation and thinks the industry has to pick one of two paths.
“We should either stop saying that security is important, and just say, like, okay, fine, we’re just going to live in a world where stuff gets breached all the time.”
Travis McPeak, at 10:01
The other path was a GDPR-like regulation for security itself: a clear statement of what you have to do, an investigation after a breach into whether you did it, and fines and personal liability if you said you did and didn’t.
“Like, that would actually move the needle.”
Travis McPeak, at 10:25
The GDPR is the model he had in mind. Adopted on April 14, 2016 and enforceable from May 25, 2018, it lets regulators fine violators “up to €20 million or up to 4% of the annual worldwide turnover,” whichever is greater, and requires controllers to report breaches to national authorities “within 72 hours” (Wikipedia).
If you lie about something
Jon pushed further: should people go to jail for not taking security seriously?
“If you lie about something, then absolutely.”
Travis McPeak, at 10:30
An officer of the company, like the chief security officer, who says the company is doing something that turns out not to be true should be personally liable, he said. Then he described how a CSO should handle a promise the company isn’t keeping. Customers ask for a commitment, say that every vulnerability gets patched within 30 days.
“I don’t know if you know any companies that are actually patching everything in 30 days, but it’s not as common as you would think.”
Travis McPeak, at 10:55
The CSO who knows the company isn’t doing it should tell the CEO, refuse to tell anybody otherwise, and put a price on doing it for real.
“And then let the CEO decide whether to fund that or not.”
Travis McPeak, at 11:14
The 30-day window is a real one in the record. Equifax’s 2017 breach began on May 12, 2017, through a web framework flaw whose patch had been released on March 7, about two months earlier (Wikipedia). The promise problem is also the one in our post on questionnaire answers that say a control is enforced when it’s only enabled (Enabled isn’t enforced), and in the security exhibit your startup signed last quarter.
Risk transference
Jon named what Travis had described: “It’s just risk transference, I suppose, from CISO to CEO.”
The handoff fits the NIST framework’s newest function. Version 2.0 added Govern to the framework’s core in 2024, putting governance on the same list as protecting, detecting and responding (Wikipedia). In Travis’s version the security leader’s job is to make the decision visible and priced, and the CEO’s job is to make it.
Too absolutist
Asked how big Resourcely was, Travis said twelve people, still small. Jon pointed out that a small shop is easy to manage, and that in a 100- or 150-person startup even the right policies, alignment and procedures might not cover every case. Travis agreed and added the other way security loses trust.
“And the other problem is in security, like, we’ve also lost trust by being too absolutist.”
Travis McPeak, at 11:45
His example was the 90-day password change.
“Like, these, like, password rotation policies are dumb, and we’ve known that they’re dumb for a long time, right?”
Travis McPeak, at 11:49
“Like, pick a strong, like, pseudo-random 16-character password, store it in a password vault.”
Travis McPeak, at 11:53
You never need to rotate it, he said, but somewhere somebody wrote down that passwords get changed every 90 days, “and it’s completely pointless.” Forced every 90 days, people just bump the number at the end. “Like, actually, it encourages bad behavior.”
The standards agree with him. The current NIST SP 800-63B says: “Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically.” A change is forced only “if there is evidence that the authenticator has been compromised,” and a password used on its own has to be at least 15 characters. Wikipedia’s password policy article traces the shift to NIST’s 2017 update and notes that some policies still require a change “every 90 or 180 days.” The vault Travis recommends is what Wikipedia calls a password manager, software that stores passwords “in a collection called a password vault.” Episode 61 with Taher Elgamal, the father of SSL, went further, arguing that passwords themselves are holding us back.
Travis’s own tests of that advice at home were humbling. In December 2023 he posted that he had set up five family members with a password manager a year earlier, and only one was still using it, because it “feels like too much of a project/too intimidating.” His conclusion: “We have a ton of work to do to make good security approachable” (X).
Four levels
Sasha took the conversation back to data, GDPR and a newer European law, the EU AI Act, and to the intersection of AI and data privacy.
“In the EU, there’s four levels of impact of AI on a life of a person, and there are certain functions that AI cannot perform in the EU, because a human needs to make that decision.”
Sasha Sinkevich, at 12:35
The Artificial Intelligence Act entered into force on August 1, 2024, with four risk levels, unacceptable, high, limited and minimal, plus a separate category for general-purpose AI. Its bans on unacceptable-risk systems applied six months later, at the start of February 2025, right as this conversation was recorded, and breaking them can cost up to €35 million or 7% of worldwide annual turnover. Sasha’s point was that the data with a potential for high impact on a human life has to be protected, and the only way to protect it is to apply the right controls to it.
Travis split the controls in two. For a platform AI model from one of the big providers, “then it’s going to be their controls and not our controls.” For the customer data a company stores itself, the cloud is where the requirements land.
“then we can help make sure that you’re using the proper cloud controls to actually, like, meet your requirements there.”
Travis McPeak, at 13:25
If the AI Act applies to what you build, our AI EU compliance program can help you map which level each system falls in.
A government playbook
Jon brought up the week’s news. A Chinese AI lab’s model was everywhere, along with sound bites that using it sent all of your data to China. Jon’s reading was narrower, that the risk came from using the lab’s own app, hosted in China. Did Travis make a distinction between data leaking in the US and data going to China?
“Well, the convenient thing is we have a government playbook for this now. See what happened in TikTok.”
Travis McPeak, at 14:16
If you’re collecting very important data on US citizens, the government wants to know exactly what happens with it, and “you have, whatever it was, 75 days now to comply.” The record behind that number: the Protecting Americans from Foreign Adversary Controlled Applications Act, signed on April 24, 2024, made TikTok subject to a ban from January 19, 2025 unless it was sold, and an executive order the next day “halted enforcement of the ban for a 75-day period,” moving the deadline to April 5. The extensions kept coming until a deal closed on January 22, 2026 (Wikipedia).
“That playbook has all the dust off of it.”
Travis McPeak, at 14:33
The hosted app would almost certainly face extreme scrutiny, Travis said, if not the exact TikTok treatment. The lab had also released an open source model, and that is a different thing.
“And if you use that, it’s not sending data back. There’s no way for it to do that.”
Travis McPeak, at 14:52
Could Resourcely spin up private instances of LLMs? “Oh, yeah,” Travis said. Jon counted ten signups.
Self-serve, not bottoms up
Jon asked whether Resourcely had a bottom-up go-to-market strategy, so founders listening could just jump on and try it. Travis drew a line between two words that usually travel together.
“It’s not bottoms up, but it is self-serve.”
Travis McPeak, at 15:13
You can get into the product, try it and never talk to sales. But the bottoms-up picture, an individual developer adopting it alone, isn’t how it works, and the reason is the same incentive he’d described at the start.
“Going back to developer incentives, like, they just want the fastest way to do something.”
Travis McPeak, at 15:28
“Like, they’re not going to care about setting up blueprints and guardrails and all the stuff we do.”
Travis McPeak, at 15:32
The setup belongs to the platform and security teams, and developers get the paved road they build. Resourcely shipped it in pieces over the year before this conversation. The product became generally available on July 17, 2024, when Travis posted “If you’re interested in solving misconfiguration, let’s chat!” (X). In September 2024 came Edit, “allowing developers to make changes to existing cloud infrastructure without having to write Terraform,” with the post adding that “Blueprints and Guardrails give platform teams the tools to help their developers ship faster” (Resourcely). In October 2024 the company open-sourced a set of Cloud Guardrails and asked for contributions, and Travis wrote “It’s OSS, so if we’re missing any of your favorite standards/guidance, please contribute them!” (X).
Table stakes on day one
Jon asked whether Resourcely had a SOC 2 Type 2 in place.
“Oh, yeah, of course. Yeah, we started on day one, like literally the first day of the company, we started working on SOC 2.”
Travis McPeak, at 15:39
“Like, that’s table stakes to sell to other companies.”
Travis McPeak, at 15:44
A Type 2 report, unlike a Type 1, tests how controls operated over a stretch of time (Wikipedia), so starting on day one is the only way to have one in hand when the first big customer asks. It’s the same lesson episode 64 took from Drata’s founding, and if you’re about to start, our SOC 2 Type 2 team can help you scope it.
The wet blanket
Sasha described the shift from the buyer’s side: “We do see a huge shift.”
“Five years ago, security procurement used to be at the tail end of your negotiations.”
Sasha Sinkevich, at 15:49
Today it happens at the beginning, while a company is still assessing whether a product is the right solution. Travis called it smart and explained why from security’s incentives, starting with an analogy. You shouldn’t eat fast food, because it will clog your arteries and cause heart disease, but that is a theoretical thing that might happen in the future.
“Like, we cost money to prevent theoretical bad thing from happening in the future.”
Travis McPeak, at 16:35
On a day-to-day basis, he said, security is a cost centre, the kind of unit that “adds to a firm’s cost” without adding profit. If it’s annoying and slows the business down, it gets defunded, and the business wants less of it, not more. Then he walked through the two ways a security review can land. At the end of procurement, after all the work with a vendor and with the business already wanting it, security comes in as “the wet blanket” and says it isn’t safe.
“But if you do it before you’ve done all this investment, and you’re like, okay, well, this thing’s actually sketchy, like, we should not use that, then you don’t have all of that sunken cost in there.”
Travis McPeak, at 16:59
“So the emotional impact of the business is much lower.”
Travis McPeak, at 17:07
Economists call what the late review fights a sunk cost, “a cost that has already been incurred and cannot be recovered,” and the urge to keep going because of it is the fallacy of “throwing good money after bad.” Buyers have moved the review forward with questionnaires and diligence packages, which we cover in what a DDQ is.
We have no actual authority
Travis’s description of the security leader’s job came next, and it’s the one he returned to on LinkedIn in 2026. Explain the problems to whatever business leader wants the new technology: the promises made to customers, the data processors list it would join, the questions customers will ask, the access it needs, the bad few months if it gets breached. Then hand over the decision.
“Yeah, I don’t think security should really be blocking anything, honestly.”
Travis McPeak, at 17:49
“Like, that’s not, we have no, like, actual authority.”
Travis McPeak, at 17:52
These are executive-level business decisions, he said, and security’s job is to explain them thoroughly to someone who isn’t a security and compliance expert, “what is the trade-off that they’re making.”
Jon agreed, with one objection to the vocabulary.
“Like, I hate the word trade-off, too, because I believe 100% that you can nail security and move fast and innovate at the same time.”
Jon McLachlan, at 18:07
The two positions fit together better than they sound. Travis’s point is about who decides, and Jon’s is about what’s possible when security is built in. That is the case our post Stop Saying No makes for AI, and in May 2026 Travis wrote his own version as a definition, that security’s job is to keep security “from negatively impacting the business” in the most leveraged way possible.
It seems like we lack a common understanding/definition of the security job. So let me propose one:
Travis McPeak · May 24, 2026
Security’s (the people) job is to prevent security (the concept) from negatively impacting the business, in the most leveraged (per their effort) way possible.
The post goes on to the corollary: when security asks somebody to do something and they don’t do it, “they have zero leverage in that activity. No risk was reduced” (LinkedIn).
It never turns off
Jon asked the show’s standing question, the hardest thing Travis had done as an entrepreneur.
“Geez, there’s a lot of it.”
Travis McPeak, at 18:19
He loves to work hard, he said, and the job is hard in a way you wouldn’t anticipate ahead of time.
“So it never turns off.”
Travis McPeak, at 18:30
As a founder and CEO there is never a minute, awake or asleep, when he isn’t processing something about the company, and that gets tiring. He keeps up by staying on top of his habits: sleep, exercise, eating. The other half of the advice was a warning.
“Like, if you don’t like stress, like if you’re stress-avoidant, you want a chill life, never do this job, for sure.”
Travis McPeak, at 18:47
He had said the same on X in November 2023, that the most surprising part of being a founder was realizing it never turns off, and that the job is “more like a child” (X). Asked later what he’d tell his younger self, one of his answers was about the same habits: start weightlifting, which he took up in 2019 and credits with transforming how he feels.
The how’s-your-dog conversation
The second hard thing, for a technical founder, was the sales mindset. Travis calls himself very type A, someone who likes to get to the bottom of things early. On customer calls, the good salespeople around him would spend five minutes on where people went to school and what the weather was like.
“I’d be like, can we, like, cut down the size of the, like, how’s-your-dog conversation?”
Travis McPeak, at 19:19
He learned he had it backward.
“Like, that’s actually what good looks like. They’re right and I’m wrong.”
Travis McPeak, at 19:26
Without that conversation, people don’t form a meaningful personal connection, and then they don’t care enough to go to the next steps. Fifteen months before the recording he estimated on X that he had given “the same pitch 1000 times” since starting Resourcely, about 15 a week for 18 months, which let him “A/B test metaphors, examples, and format” (X).
Pick sales
The bigger adjustment was what he believed about products.
“I thought I would build this wonderful product that was so good that, like, it would just fly out of my hands into the wind.”
Travis McPeak, at 19:38
He used to rank product over sales, he said, and now he thinks it’s the opposite. In his words, “great companies have a great product and great sales,” but a founder who can only be good at one of the two should “pick sales all day, every day.”
Jon asked whether he’d found a sales mentor. Travis said they were lucky.
“Andreessen is one of our investors, and they have a lot of good people internally that can teach us, you know, like, professional salespeople that’ll teach you how the sausage is made.”
Travis McPeak, at 20:10
Andreessen Horowitz, also known as a16z, is the Menlo Park venture firm Marc Andreessen and Ben Horowitz founded in 2009. Travis also read books on other founders’ recommendations, and he did something that felt weird at the time: an operator from a hands-on venture firm joined every one of his sales calls, and Travis learned by watching how he worked. When the company needed someone full time, it hired a zero-to-one salesperson, because what makes a great VP of sales at a Series D company is different from what a company needs at the beginning.
Sasha’s version of the same lesson was the checklist every business shares.
“You have to know your ICP, you have to know your top of the funnel.”
Sasha Sinkevich, at 21:07
Sasha added the rest of the list, knowing how to enrich the top of the funnel and drive traffic through the website and socials, and having the people to do it. Travis agreed that every step can be analyzed and tuned.
“As a founder, I figure my job is to learn enough about these functions to know when they’re being done well.”
Travis McPeak, at 21:37
I’m the adult
Jon asked about legacy. Travis said the last three years had aged him ten, and that he believes he will start a massive company, whether or not that turns out to be Resourcely. He has the entrepreneurial bug now, and he likes the baseline of stress and the responsibility that comes with it. He remembered the first day of the company.
“Like, I need an adult. And then I was like, oh no, I’m the adult.”
Travis McPeak, at 22:26
That shifted, and now any normal job feels low stakes to him. The legacy he wants is “something that generally changes the way an industry works,” in security or somewhere else, and a company successful enough to do it.
Machines at a college level
Jon’s last question was for the founders listening: what does Travis wish existed, badly enough to pay for it? His first answer came from his own sales education. Books won’t teach you what you need, he said, but a pack of really good go-to-market people who embed with founders and teach them everything, like a boot camp or a crash course, would be extremely helpful. He was clear it would be a consulting business, not a venture one.
His second answer was the venture-scale one. A friend’s keynotes at BSides had made the case, he said, and he agreed with it.
“so much of the issue in an organization from a security standpoint is, like, just chaos, right?”
Travis McPeak, at 25:19
Nobody knows what’s happening, developers are doing things, people are making changes, and there’s no visibility. That is changing, in his view, because there is now a fleet of machines that can check things at roughly the level of a college student.
“We’re just going to have more visibility, more filtering out, and, like, getting to the right important context, and that will enable security teams to be at the right place at the right time.”
Travis McPeak, at 25:41
“So there’s definitely, like, one or more venture-scale businesses that are going to be built in that space.”
Travis McPeak, at 25:49
Security BSides is “a series of loosely affiliated information security conferences,” started in 2009. Asked how to find him and Resourcely, Travis said to search for it and try it for free, and to connect with him on LinkedIn and mention the show.
What happened after the tape
The day after. On February 4, 2025, the day after the recording, Travis posted a thread on X with a Resourcely video, and its second post was the conversation’s argument in one sentence.
Remediating misconfigurations in existing resources can be painful: developers aren't cloud services or Terraform experts, and frequently, they are dealing with an overwhelming number of requests.
Travis McPeak (@travismcpeak) · February 4, 2025
Acquired. The episode aired on May 6, 2025. Two months later Resourcely was acquired. Travis’s LinkedIn marks the company as acquired by a developer-tools company, with his time as co-founder and CEO running from March 2022 to July 2025 and a security role at the acquirer starting that July (LinkedIn). The resourcely.io site now shows the team, with Travis as co-founder and CEO and Aladdin Almubayed as co-founder and CTO, and the line about starting secure (Resourcely). His run as a co-host of 404: Security Not Found ended the same month.
Misconfiguration at number two. The OWASP Top 10 for 2025 moved security misconfiguration up to second place, and found in every application tested (OWASP).
Still arguing. In 2026 Travis’s LinkedIn headline reads security at an AI company, and his posts kept to the episode’s themes: in March, that “security is everybody’s job” never made sense (LinkedIn), and in May, the definition of the security job in the card above.
The part of the conversation that aged best is the plainest. People misconfigure the cloud because nobody can be an expert in hundreds of services, and handing them the work as tickets after deployment loses trust on both sides. Travis bet that the fix would look like an engineering tool, a template that is right the first time, with security as a side effect. OWASP’s 2025 list says the problem is bigger than when he made the bet, which makes the bet look better, not worse.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each. The explanation shows once you choose.
-
What bet did Travis start Resourcely with?
- That developers would all become cloud security experts
- That great security tools would look like engineering tools
- That scanners would find every misconfiguration
b. "five years from now, great security tools are going to look like engineering tools." Transcript, 4:47.
-
Why does misconfiguration keep happening, in Travis's telling?
- The people configuring cloud services aren't experts in them
- Developers ignore security on purpose
- Cloud providers hide the settings
a. "It's because the users of cloud services are generally not experts to the point where they know how to correctly configure it." Transcript, 2:25.
-
What happens after today's tools find issues in production?
- The tools fix them automatically
- Nothing, the findings are archived
- A JIRA dance, with tickets rained on the engineers
c. "And then we have to do this JIRA dance where we go and, like, just rain JIRA tickets on all the engineers and ask them to fix it." Transcript, 7:02.
-
What did Travis say about changing passwords every 90 days?
- It's the most important control a company has
- It's completely pointless, and it encourages bad behavior
- It should be every thirty days instead
b. "But somewhere somebody wrote down that we should rotate passwords every 90 days, and it's completely pointless." Transcript, 11:59.
-
When did Resourcely start working on SOC 2?
- On the first day of the company
- When its first enterprise customer asked
- After its Series A
a. "we started on day one, like literally the first day of the company, we started working on SOC 2." Transcript, 15:40.
-
If a founder can only be good at one of product or sales, which should it be?
- Product, because a great product sells itself
- Neither, hire for both on day one
- Sales, all day, every day
c. "pick sales all day, every day." Transcript, 19:57.
How close is your cloud to secure by default?
Travis’s test was whether security arrives as a side effect of the tools developers already use. Eight questions on how far your cloud is from that.
Scorecard · eight questions
How close is your cloud to secure by default?
Answer for your cloud and your teams as they work today. If two answers fit, pick the lower one.
-
How does a developer get a new cloud resource, like a database or a bucket?
- Clicks through the console or writes the configuration from scratch
- Copies an old template and edits it
- Picks a maintained template with secure defaults built in
"They just didn't know how to do the right thing." See A ton of configuration.
-
When does security usually find a misconfiguration?
- After it's deployed, from a scanner
- In code review, when someone catches it
- Before it's created, in the template or the pull request check
"we have all these tools that tell us about issues after they're already deployed in prod." See The JIRA dance.
-
How do findings reach the engineers who own them?
- As a stream of tickets
- Only the most severe get filed
- Most are fixed at the source, so few tickets are needed
"A lot of these things don't get fixed." See The JIRA dance.
-
Who owns the secure defaults?
- Nobody in particular
- Security, on its own
- Security and the platform team, maintained like a product
"We started with security and then realized that these are also DevOps tools." See We went the other way.
-
How do you pitch security work to engineering?
- As risk and compliance
- As risk, with a deadline
- In engineering's terms: productivity, cost, stability, availability, reliability
"They think in terms of developer productivity and cost effectiveness and stability, availability, reliability." See The JIRA dance.
-
What does your password policy require?
- A forced change every 90 days
- No forced change, but no password manager either
- Long passwords in a password manager, changed on evidence of compromise
"Like, pick a strong, like, pseudo-random 16-character password, store it in a password vault." See Too absolutist.
-
When does security see a new vendor?
- At the end, after the business has picked it
- Somewhere in the middle
- At the start, before anyone has invested in it
"then you don't have all of that sunken cost in there." See The wet blanket.
-
Do the promises in your security questionnaires match what you do?
- Some promise things we don't do
- Mostly, and nobody has checked
- Yes, and the CEO decides what gets funded when they don't
"And then let the CEO decide whether to fund that or not." See If you lie about something.
Security finds problems after they ship and hands them back as tickets. Start with one template: the cloud resource your developers request most, with the secure settings already in it.
Some resources come from good defaults and some still come from scratch. Move the most common requests onto templates, and check configuration in the pull request instead of after deployment.
Developers get secure resources by using the tools they already use. Keep the templates maintained like a product, and keep promises to customers matched to what you actually do.
What does the JIRA dance cost?
Travis gave no numbers for the dance, so the defaults below are round examples. Put in your own.
Calculator
What does the JIRA dance cost?
Five estimates: the misconfiguration findings your scanners raise a month, the share that become tickets, the engineering hours to fix one, the security hours to triage and chase one, and what an hour costs.
At this rate the dance files 600 tickets a year and takes 2,400 hours of engineering and security time, about $288,000 a year, while 1,800 findings a year never become a ticket at all.
These defaults are examples, not figures from the episode. Travis's point in The JIRA dance was that both columns shrink when resources are configured right the first time, and that many filed tickets "don't get fixed." Count last quarter's tickets before you trust any total.
From Bandit to secure by default
Everything on this page sits on one timeline, from the first OWASP Top Ten to Travis’s posts in 2026. Filter it by thread.
Timeline · 2003 to 2026
From Bandit to secure by default
Filter by thread. Dates are from the public record except where marked as part of this show.
- The OWASP Top Ten
The list of critical application security risks is first published (Wikipedia, on this show).
- PCI DSS 1.0
The card brands release the first version of the payment card standard (Wikipedia, on this show).
- FedRAMP
An OMB memo sets up the federal program for cloud security authorizations (Wikipedia).
- NIST CSF
NIST develops its Cybersecurity Framework (Wikipedia).
- HP Helion and Bandit
Travis joins HP as a security architect and becomes lead developer of Bandit, a Python security linter (LinkedIn, GitHub).
- IBM
Travis becomes a senior security architect at IBM and co-founds its Cloud Foundry security team (LinkedIn).
- GDPR adopted
The European Parliament and Council adopt the GDPR, enforceable from May 25, 2018 (Wikipedia, on this show).
- Netflix
Travis joins Netflix as a senior cloud security engineer and leads the Repokid least-privilege project (LinkedIn, GitHub, on this show).
- Equifax
The Equifax breach begins, about two months after the patch for the flaw it used was released (Wikipedia, on this show).
- No more 90-day rule
NIST's password guidance stops recommending regular forced changes (Wikipedia, on this show).
- Databricks
Travis becomes head of product security at Databricks (LinkedIn).
- Resourcely
Travis co-founds Resourcely and becomes its CEO (LinkedIn).
- 404: Security Not Found
Travis starts co-hosting the security podcast, a run that lasts until July 2025 (LinkedIn).
- A thousand pitches
Travis estimates he has given the same pitch about 1,000 times since starting the company (X, on this show).
- NIST CSF 2.0
Version 2.0 adds a sixth function, Govern (Wikipedia, on this show).
- UniSuper
A misconfigured private cloud deletes an Australian superannuation fund's data on Google Cloud, most of it later recovered (Wikipedia, on this show).
- Death of DevSecOps
Travis ends his blog series with secure by default as the fix (Resourcely, on this show).
- Generally available
Resourcely's first product launch, focused on secure defaults, reaches general availability (X, Resourcely).
- The AI Act
The EU's AI regulation enters into force, with bans on unacceptable-risk systems six months later (Wikipedia, on this show).
- Edit
Developers can change existing cloud infrastructure without writing Terraform (Resourcely, on this show).
- Cloud Guardrails
Resourcely open-sources a set of cloud guardrails and asks for contributions (X).
- 75 days
An executive order halts enforcement of the TikTok ban for 75 days (Wikipedia, on this show).
- Recorded
Jon, Sasha and Travis record the conversation, by Jon's account on the tape (transcript).
- The day after
Travis posts that developers "aren't cloud services or Terraform experts" (X, on this show).
- Episode 68
The conversation airs (transcript).
- Acquired
Resourcely is acquired, and Travis moves to a security role at the acquirer (LinkedIn, on this show).
- Number two
The OWASP Top 10 for 2025 moves security misconfiguration up to second place (OWASP).
- Everybody's job
Travis writes that "security is everybody's job" never made sense (LinkedIn, on this show).
- The security job
Travis proposes a definition: keep security from negatively impacting the business (LinkedIn, on this show).
What to do this week
Five things, in the order Travis’s argument suggests.
- Pave one road. Pick the cloud resource your developers request most, a database, a bucket or a new account, and give them a template with the secure settings already in it. Measure how many requests it takes off the platform team.
- Count the ticket rain. Pull last quarter’s misconfiguration tickets and note how many were fixed, how many are still open and how many findings were never filed. The calculator above turns that into hours and dollars.
- Rewrite one ask in engineering’s terms. Take a security request that has stalled and restate it as productivity, cost, stability, availability or reliability.
- Retire the 90-day rule. Drop forced periodic password changes, require long passwords in a password manager, and force a change only on evidence of compromise, as NIST SP 800-63B now says. The scorecard above shows where else to start.
- Move security to the front, and keep every promise. Put the security review at the start of vendor selection, check that every answer in your questionnaires matches what you do, and take any gap to the CEO with a price on closing it. If you’d like a hand with any of it, our product security team and vCISO team can help, and you can book 15 minutes with us.