Podcast Episode 72

Episode 072 39 min

The Security Risk No One Sees Coming with AI Agents (TraceForce.ai Special)

with Xia Hua & Glenn Mulvaney · TraceForce.ai

0:00 / 39:00

Also on Spotify, Apple Podcasts, YouTube, Podbean, Player FM

Episode 72 of The Security Podcast of Silicon Valley, published July 1, 2025. Hosts Jon McLachlan and Sasha Sinkevich, co-founders of YSecurity, talk with Xia Hua and Glenn Mulvaney, co-founders of Traceforce, about four months after they started it. Xia, who spent nine years building in-memory databases at Oracle and became director of engineering at Clumio, and Glenn, Clumio's vice president of cloud operations and security, explain why they left after Commvault bought Clumio, how they found a first product through two dozen design partners, why only two kinds of security companies were getting funded, why MCP will be the next HTTP, and why AI agents need a parallel security agent that stops them at their permission boundaries. The deep dive adds what Traceforce did next: an open-source MCP scanner, Y Combinator's Summer 2026 batch, an on-device product the company says runs on thousands of laptops, and Xia's return on episode 100.

Episode notes

AI agents can do more than access your data—they can act. TraceForce.ai founders Xia Hua and Glenn Mulvaney reveal the next big security risk: autonomous agents that operate beyond permission boundaries. From startup execution to securing the agent economy, this special episode covers it all.

Hosted by Jon McLachlan and Sasha Sinkevich — co-founders of YSecurity.

The deep dive

Trace every agentic action

Xia Hua spent nine years building in-memory databases at Oracle and five at Clumio, and Glenn Mulvaney spent twenty years in operations and security, including at the company that taught security teams to look for shadow IT. Four months into Traceforce, they told us the next security problem was AI agents acting beyond their permission boundaries, and that MCP would be the next HTTP. Here is the conversation with the public record beside it, what Traceforce built in the sixteen months after the tape, and four tools to run against the agents on your own laptops.

By Jon McLachlan, host 41 min read

Four months after she started her company, Xia Hua told us what she wanted it to be known for.

“Traceforce will be the Palo Alto Networks of agentic applications. You know, when you think of network, you associate with Palo Alto Networks. So all the agentic applications, I want people to associate with Traceforce, who can trace every agentic action down for you and automatically prevent bad things from happening.”

Xia Hua, at 32:45

Listen · Xia on episode 72, from 32:46
About 21 seconds: the company she wanted to build, in one sentence. The clip stops on its own. Read the full transcript.

Xia Hua is the co-founder and chief executive of Traceforce. Before it, she spent nine years at Oracle building in-memory databases and five at Clumio, where she went from engineer to director of engineering for the company’s flagship products, and she has a PhD in applied mathematics from MIT. Glenn Mulvaney, her co-founder, ran cloud operations and security at Clumio for more than five years, after two decades of operations and security work at PlayFirst, Skyhigh Networks and Inscape. They started Traceforce in early 2025, a few months after Commvault bought Clumio, and sat down with Sasha and me in June 2025, about four months in. We published the episode on July 1, 2025, and the show notes were 45 words. This page is the rest of it: fifteen years to get here, the security half of the founding team, the wave Xia wanted to catch, two dozen design partners, fundraising, the two kinds of security companies getting funded, MCP as the next HTTP, the shift from data to actions, a parallel agent for the agent, a VCR at 4x, the Palo Alto Networks of agentic applications, Xia’s advice to her younger self, Glenn’s wish for the security operations center, and what Traceforce did in the sixteen months after we hit stop. There are four things to try along the way: a quiz, a scorecard for whether you can see what the agents on your devices can do, a calculator for how many agent connections your laptops already have, and a timeline you can filter.

Fifteen years to get here

Sasha asked what inspired the journey, and Xia started with the oldest reason there is.

“I’ve always wanted to start my own company, actually. So prior to Clumio, I was building in-memory databases at Oracle, where a lot of my friends joined Snowflake early on. I was building in-memory databases at Oracle, and they were building in-memory databases at Snowflake.”

Xia Hua, at 1:47

Her LinkedIn has the detail. From July 2010 to August 2019 she was a consulting member of technical staff at Oracle, one of the primary contributors to the in-memory option of Oracle Database 12c, a columnar engine for analytics and mixed transaction workloads, and the leading contributor to the in-memory stores for Oracle Big Data SQL, which she writes sped up queries by up to 1000x. She also worked on the Exadata flash cache formats, Advanced Index Compression and SecureFiles (LinkedIn). The in-memory option shipped with release 12.1.0.2 in July 2014 (InfoQ). Before Oracle she finished a PhD at MIT in 2010, with a dissertation titled “Testing regression models with residuals as data,” advised by the probabilist Richard Dudley (Mathematics Genealogy Project).

What she wanted from a startup wasn’t the money. “The impact is totally different,” she said of her friends at Snowflake, and she guessed that more than 2,000 people would be a lot for the databases she had built inside Oracle. By the time we recorded, Snowflake counted 754 of the Forbes Global 2000 among its customers (Snowflake). So after her second child was born, she talked to Poojan Kumar, Clumio’s chief executive, who had also come from Oracle, and joined as an individual contributor. Clumio had been founded in 2017 by Poojan, its chief technology officer Woon Ho Jung and Kaustubh Patil to back up data in AWS, and raised $262 million along the way (Blocks and Files). Xia was the lead developer on its backup for Amazon RDS databases, a senior engineering manager a year later, and from December 2022 director of engineering, running Clumio Protect for S3 and DynamoDB and Clumio Discover (LinkedIn).

“I think it took me 15 years to get here,” she said. The leadership part came last, and she was specific about why she needed it: “Literally, if I was not in office one day, people would not know what to do. Like 40 people, right? They were all extremely talented. But it’s like in a symphony orchestra. You need somebody to string things together.”

The opening came from outside. On September 24, 2024, Commvault announced it would acquire Clumio, with the deal expected to close in early October, and said the price was not material to it (Commvault). Blocks and Files reported it at $47 million. Xia’s account of the moment she heard is the best minute on the tape.

Listen · Xia on episode 72, from 3:24
About 32 seconds: the acquisition, two seconds, a four-month handoff, and February. The clip stops on its own. Read the full transcript.

“Virtually two seconds after Woon, CTO, told me about the news, I said, Woon, I’m probably out of here.” She stayed through January as a director of engineering at Commvault and started Traceforce in February 2025, which is the order of events her LinkedIn shows too. Sasha’s summary was that she had both halves before she started: the data access problems you can’t avoid when you build databases, and a team that had shipped under her.

A timeline of eight entries for the two guests. 2004, Glenn at PlayFirst, employee number eight and vice president of IT operations at the studio best known for Diner Dash. 2010, Xia at Oracle, after a PhD in applied mathematics at MIT. 2013, Glenn at Skyhigh Networks, vice president of security and operations. 2016, Glenn at Inscape. 2019, both at Clumio. 2022, Xia becomes director of engineering. October 2024, Commvault buys Clumio. Early 2025, Traceforce, Glenn in January and Xia in February.
Two careers that met in one company and left it together.

From shadow IT to shadow AI

Glenn’s half of the founding team is the security half, and his résumé reads like a history of where companies kept their infrastructure. He was employee number eight and vice president of IT operations at PlayFirst from 2004 to 2011, the San Francisco studio best known for Diner Dash (Game Developer), then ran network operations for a Facebook game on AWS at Idle Games. From 2013 to 2016 he was vice president of security and operations at Skyhigh Networks, where he built the operations team and led the company through ISO 27001, FedRAMP and ISO 27018. After almost three years running operations at Inscape, VIZIO’s smart TV data subsidiary, he joined Clumio in March 2019 as vice president of cloud operations and security, and stayed through the Commvault handoff (LinkedIn).

Skyhigh is the part worth stopping on. In May 2013, a few months after Glenn started there, Data Center Knowledge described it as a “cloud visibility and control company” whose product “discovers, analyzes, and controls cloud services in use within an organization,” built to find shadow IT, the cloud services employees sign up for without telling anyone (Data Center Knowledge). McAfee agreed to buy Skyhigh on November 27, 2017 and closed in January 2018 (Wikipedia). In 2013 the question was which cloud apps people had signed up for. Twelve years later it’s which AI apps and MCP servers people have installed on their laptops, and what those can do. Glenn has now worked on both.

At Clumio, he said, the two of them barely overlapped.

“Yeah, that’s a great question. Actually, we had pretty limited interaction at Clumio. We were colleagues, and we were on the same staff and in the same department, but I was always focused on security and compliance, and Xia was developing products.”

Glenn Mulvaney, at 8:10

The company started with a question Xia kept asking him after they left Commvault: “what do you see as a big challenge in security because of AI?” Glenn’s answer, in June 2025, was data security, and that is how I introduced them: “Traceforce is actually an AI data security company.” The earliest code in Traceforce’s GitHub organization fits that, a Terraform provider and a Go SDK both created in June 2025 (GitHub). A year later the company had moved its whole product onto employee devices. The reasons are in the rest of this conversation.

Catch the wave

Xia’s theory of when to start a company is about timing, and she gave it with an example from the last wave.

Listen · Xia on episode 72, from 7:03
About 37 seconds: catching a wave on the way up, the last peak, and why generative AI is the one to catch. The clip stops on its own. Read the full transcript.

“So every technological wave is an opportunity to build a great company on. And when that wave is on the rise, we gotta catch it, right? When you are over that peak, it gets hard, right?”

Xia Hua, at 6:22

Her example of the last wave was cloud infrastructure: “Kubernetes was what gave birth to Wiz, basically, right? Wiz was the CNAPP thing,” the cloud-native application protection platform that became a category. That wave paid out on schedule. Google announced its deal for Wiz in March 2025, three months before this recording, and completed the $32 billion acquisition in March 2026 (Techzine).

Her date for the peak needs one small fix, and the fix makes her point better. “Like the peak would be like 2021, when Snowflake went public, right?” Snowflake listed on September 16, 2020, in what was then the largest software IPO ever (CNBC). The peak of the wave came about a year after that. In November 2021 publicly traded cloud companies were worth $2.7 trillion, and in the five months to April 2022 they lost $1.1 trillion, “just over 40 percent of their total value” (Crunchbase News). Her phrase for what followed, “most SaaS companies’ values have cut down in half,” is close to the record.

Three numbers side by side. $2.7 trillion, the value of public cloud companies in November 2021. Over 40 percent, what that value lost in the five months to April 2022, about $1.1 trillion. $32 billion, Google's price for Wiz. Below: Snowflake listed on September 16, 2020, and cloud valuations peaked about a year later, and at the start of a wave there are a lot of hard but solvable problems.
The last wave, measured. The next one is the reason this company exists.

The reason to start in 2025, in her words, was where generative AI sat on its curve: “And this Gen AI wave is like one of the biggest waves I’ve seen in my fifteen years of career. That’s where I see this is a great opportunity, because when you’re at the start of the wave, there are a lot of hard but solvable problems.” When we recorded, the Model Context Protocol that most of this page is about was seven months old.

Two dozen design partners, five different asks

Sasha asked for their proudest day, and Xia picked one from the month before we recorded.

“I really feel like that perhaps the day where, kind of, we sort of nailed our first customer, figured out that first product we want to build, right? After speaking with like two dozen design partners.”

Xia Hua, at 12:18

She gave the recipe in one line, “There are two ingredients to start a startup: connections and the technical skills,” and gave Glenn the credit for the first one: he “spent 20 years building connections with the CISOs, with executives at other companies, that really helped us.” The trouble with design partners who trust you is that they all ask for something. “And then, like, five of them were interested, but amazingly, all of them want different things, right?” They chose the first product by two tests, how much pain it was and “how much are they going to pay?” Sasha’s version was the discipline under it: “You just want one single pain point that multiple partners are looking to purchase.”

Glenn’s proudest moments were the conversations themselves. “There are just myriad pain points. They’re legion, right? They’re everywhere.” What made him happy was the moment a security leader in his old seat saw a way through: “So just get, just being able to help somebody who is in my role in another org, and really make their life materially better, improve things in their org and improve security for their org, that, I think that makes me really intrinsically very happy and very proud.”

The count kept going after the tape. By the company’s Launch HN a year later, the number was “50+ CISOs and CIOs,” and the conclusion was the same one: “We keep hearing that new AI features are being adopted so quickly and so broadly that visibility and control just can’t keep up” (Hacker News).

Never a wasted conversation

The hardest days were the first investor meetings. “Sometimes investors say no in very subtle way, right?” Xia said, and later in the process the no was often about a portfolio: “it was more or less because perhaps they have a competing portfolio company already.” Her summary is one of the best lines on the tape.

“Overall, it’s much harder than getting a 4.0 GPA at MIT, I can tell you that.”

Xia Hua, at 15:32

Sasha asked whether it was the number of variables, and Xia said it was the people: “Yeah, because humans are unpredictable, right?” For someone whose dissertation was on testing regression models, that is a professional observation. I added the obvious thing for a room full of engineers: “Humans, we’re something else. Like, we’re not a math equation.” Her answer to it was to sell. “No, it’s all about customers,” she said, and then told on her co-founder: “I gave Glenn a really hard time. I said, you gotta sell. He’s like, I never sold anything before.”

Glenn’s account matches. “I always think of myself still as a practitioner,” he said, and he had expected fundraising to go the way it had gone for founders he’d watched from close by. “And I was very, very wrong.” What he took from it is the most generous thing on the tape about investors: “there was never a wasted conversation. We always learned something.”

They had help. Xia named their advisors, Poojan from Clumio and Kamal among them, as “very successful entrepreneurs who have sold companies to public companies before.” Kamal comes back at the end of the episode. Glenn’s list of mentors was too long for the show: “it would be like I’d be getting played off the stage at the Oscars.”

Two kinds of companies get funded

Sasha asked about the biggest opportunity of the next five years, and Xia answered with the map they had drawn before picking a direction.

“So today, really, only two types of companies are getting funded in the security space. One is AI SOC agents, AI security, basically, because security professionals like Glenn always complain to me, like, they’re drowning, you know, signals and the noise, right?”

Xia Hua, at 21:05

The other kind was security for AI, which she compared to the waves before it: “It’s a little bit like a security for Kubernetes, security for the cloud, right? When you have a new technology, you have a new surface of attack.” She said the market had proved itself while they were building: “just last month, right, several companies came out of stealth with like 20 million seed, 30 million seed, 50 million Series A in the security for AI space.” The record has rounds that size from that spring. Aurascape came out of stealth with $50 million on April 8, 2025 (Business Wire), and Virtue AI announced $30 million across seed and Series A a week later (Axios). The other column has a name we hear again at the end of the episode. Prophet Security, which builds an AI analyst for the security operations center, came out of stealth with an $11 million seed round in April 2024 (SecurityWeek) and raised a $30 million Series A led by Accel in July 2025 (Business Wire).

Two boxes. On the left, AI for security: Prophet Security came out of stealth in April 2024 with an $11 million seed round and raised a $30 million Series A in July 2025, and Glenn's wish is for someone to solve signal to noise in the security operations center. On the right, filled, security for AI: Aurascape came out of stealth with $50 million on April 8, 2025, Virtue AI announced $30 million across seed and Series A on April 15, 2025, and Traceforce's bet is agents that stay inside their permission boundary.
Xia's two columns, with the money that landed in each that spring.

Traceforce picked the second column, and Xia said why in terms of her own background: “Coming from a developer space myself, it’s more natural for me to want to attack problems in building the new agent applications.” She called it a shift-left paradigm, security built into the product the way companies like Snyk made popular with developers, and she ended on the phrase that defines the company: “Integration, how to enable agents to perform within their permission boundary.” Sasha added the condition that makes it work: “Bottom line is, security needs to be part of the product from early stages in order for it to be effective.”

The next HTTP

Then Xia said the most quotable thing in the episode, and made a joke inside it that’s easy to miss.

“Yes, yes, yeah. It’s a, it’s a, it’s a very hot topic right now, especially with all the MCP stuff, right? The MCP is gonna, you know, be the next HTTP, right? Yeah, and [the] security. So there will be MCPS.”

Xia Hua, at 24:02

Listen · Xia and Jon on episode 72, from 24:04
About 29 seconds: the next HTTP, the S that comes after it, and whether Traceforce is an MCP firewall. The clip stops on its own. Read the full transcript.

HTTP became HTTPS when the web added encryption, so MCPS is her name for the Model Context Protocol with security built in. It isn’t a real standard, and it’s a good way to describe what’s missing. Anthropic introduced MCP on November 25, 2024, as an open protocol for connecting AI apps to data and tools.

The launch, seven months before this recording. "No more building custom integrations" is the line Xia picked up. View on X.

The adoption that followed is why her comparison didn’t sound like hype in June 2025. OpenAI added support in March 2025.

The day a competitor's standard became everyone's. View on X.

On December 9, 2025, Anthropic donated MCP to the new Agentic AI Foundation at the Linux Foundation, which counted “more than 10,000 published MCP servers” and adoption by “Claude, Cursor, Microsoft Copilot, Gemini, VS Code, ChatGPT and other popular AI platforms” (Linux Foundation). Xia’s account of what that did to other startups, a few minutes later on the tape, is the other half of the HTTP comparison: “All these startups that started building API integrations, they all now had to pivot to rewrite their stuff because of the MCP.”

I asked the obvious question, “would it be wrong to think about Traceforce as maybe like a potential, like, MCP firewall?” and Xia said “that’s definitely one of the things that, the directions we could go into, actually.” A year later she answered it more precisely, in the comments on Traceforce’s Launch HN: “We integrate with popular gateways such as Kong to bring MCP controls” (Hacker News), and “MCP gateways work mostly with remote MCPs only. For the stdio ones, we still need local agents to take care of the controls” (Hacker News). That second sentence is the reason the company ended up on the endpoint, and it gets its own section below.

The security record for the S she asked for filled in fast. On April 1, 2025, Invariant Labs described tool poisoning, malicious instructions hidden in an MCP tool’s description. The problem is who reads what: “AI models see the complete tool descriptions, including hidden instructions,” while the instructions stay hidden from the person using the tool (Invariant Labs). A commenter on Traceforce’s launch thread described the gentle, legal version of the same thing:

"I removed an MCP server a while back because its tool descriptions quietly told the agent to prefer it as the primary search tool over the built-in one. Not a vulnerability, no leaked secrets, just the vendor steering agent behavior in a way you only notice if you read the raw tool definitions."

belschak, on Hacker News, July 2026

In July 2025, JFrog disclosed CVE-2025-6514 in mcp-remote, a widely used proxy that lets apps like Claude Desktop reach remote MCP servers. It scored 9.6 out of 10, it allowed arbitrary command execution when the proxy connected to an untrusted server, and the package had been downloaded more than 437,000 times (The Hacker News). In December 2025, Bitsight counted the open doors.

About a thousand MCP servers on the open internet with no authorization. View on X.

And on May 20, 2026, the National Security Agency published security design guidance for AI automation built on MCP, which put it plainly: “Gaps in MCP design, implementation, and operational posture have created significant and evolving security concerns” (NSA). We wrote about the version of this that bites teams who did review their servers once, in Your MCP Server Passed Review, Then It Changed.

A timeline of eight entries. November 2024, Anthropic introduces the Model Context Protocol. March 2025, OpenAI adds support. April 2025, Invariant Labs shows tool poisoning. July 2025, this episode, where Xia calls MCP the next HTTP. July 2025, JFrog discloses a critical flaw in mcp-remote. December 2025, MCP goes to the Agentic AI Foundation. December 2025, Bitsight finds about 1,000 exposed MCP servers. May 2026, security design guidance from the NSA.
The next HTTP, eighteen months in. The S is still being written.

Off the data, onto the actions

Glenn framed the problem as two old disciplines under new pressure.

“Yeah, I think, I mean, for the challenges coming in the next five years, for sure, I see it as two problems, and they’ve been around for a while: monitoring, or you want to call it observability, and also prevention, right?”

Glenn Mulvaney, at 24:33

He said AI doesn’t invent new weaknesses so much as surface the ones teams already had: “Lack of good, strong identity governance, lack of a good data security posture, right?” He was encouraged by the push for secure development he saw at RSA Conference and BSides that spring, and realistic about how long it takes. And he said where Traceforce would put its weight: “Once the horse has left the barn, it’s great that we can do the forensics. It’s great that we can figure out what happened and learn how to close those gaps, but really prevention to me is the key.” I added the economics, “prevention is so much more efficient than chasing down, like, all of the bad things that could possibly happen,” and Glenn kept both: “I don’t want to stop doing threat modeling and risk analysis.”

Then I told them about a security review I’d been on.

Listen · Jon on episode 72, from 28:05
About 37 seconds: the review where the questions moved from data to actions. The clip stops on its own. Read the full transcript.

“And for the very first time in a very long time, the shift moved off of the data and onto what agents could actually do and execute.”

Jon McLachlan, at 28:05

A lot of security still assumes the breach is about data: “How do we protect the data? If there’s a breach, it must be about the data.” An agent breaks that assumption, because it can act. The industry has a name for this now. The OWASP Top 10 for Large Language Model Applications calls it excessive agency, and defines it by the power you hand the model: a system “is often granted a degree of agency by its developer,” meaning “the ability to call functions or interface with other systems via extensions,” and “The decision over which extension to invoke may also be delegated to an LLM ‘agent’.” Its three root causes are “excessive functionality,” “excessive permissions,” and “excessive autonomy,” and two of its fixes are the ones this episode keeps circling: “Limit the extensions that LLM agents are allowed to call to only the minimum necessary,” and “Utilise human-in-the-loop control to require a human to approve high-impact actions before they are taken” (OWASP).

Seventeen days after this episode came out, the industry got its example.

The founder of SaaStr, partway through building an app with Replit's agent. View on X.

Replit’s chief executive, Amjad Masad, answered two days later: “Unacceptable and should never be possible.” The first fix he listed was the boring, correct one, “we started rolling out automatic DB dev/prod separation to prevent this categorically,” and he said a planning mode that can’t touch the code was on the way (X). Graham Neray of Oso came on the show in February 2026 to talk about exactly this kind of failure, in episode 89.

Traceforce has its own version of the story, from before the company existed. In its Launch YC post a year after this episode, the founders wrote that at their last company “an AI coding agent running on a developer’s laptop scraped what looked like database credentials and pushed them straight into a public GitHub repo. It took us weeks to investigate, rotate credentials, and clean up the fallout.” They added that the credentials were for a development environment, so no customer was affected (Y Combinator). Nothing about it needed malice. An agent with a developer’s access did something nobody had decided it should do.

Two boxes joined by an arrow. On the left, the data question, who can read it and where it can go, the frame of classic data loss prevention and of most breach reviews. On the right, filled, the action question, what it can run, change or delete. Below it: an agent can run DROP TABLE, push credentials to a public repository, or wipe a production database during a code freeze, so the review asks what it can execute, with whose permissions, and who confirms before it does.
The question moved. The controls are catching up.

A parallel agent for the agent

Xia’s design for the answer came right after my story, and Sasha supplied the history it replaces.

Listen · Xia and Sasha on episode 72, from 29:05
About 55 seconds: a security agent beside the product agent, data loss prevention, and the lineage of a data flow between agents. The clip stops on its own. Read the full transcript.

“Exactly. Like, we need, like, a kind of a, almost like a parallel agent, security agent, to monitor and to prevent the core product agent from doing things beyond its permission boundaries.”

Xia Hua, at 29:04

Sasha compared it to data loss prevention, where “their entire company is built around” stopping a person from taking information somewhere else. Agents make that harder, he said, because there are so many of them: “With agents, now you have this field with infinite number of functions, agents, that can pass information to each other. And how do you control and trace through the lineage of that data flow?” Xia’s answer was the company: “That’s exactly the problem that prompted us to start Traceforce.”

A year later the parallel agent had a shape. Traceforce’s Launch HN describes a lightweight binary and a browser extension on each device that within 30 minutes is “uploading live data to the company profile, displaying all the AI agents/apps running across all company devices on a dashboard.” On privacy, it says “By default, Traceforce collects only metadata and telemetry about the AI applications, MCPs, and tools running on a device,” and “All content inspection happens locally on the device.” The control most customers liked was the gentlest one: “Our ‘warn and acknowledge’ approach has been especially well received, giving developers the freedom to work while helping them avoid costly mistakes” (Hacker News).

A skeptic in the thread argued that endpoint detection tools already cover this, and that a command like DROP TABLE runs on a database server, not the laptop. Xia’s reply is the clearest statement of the idea on the record: “I agree that DROP TABLE executes remotely. The key point is that the decision to invoke the tool is made by coding agents like Claude Code. Traceforce captures those tool calls at the application layer before they’re executed” (Hacker News). The parallel agent doesn’t need to guard the database. It needs to sit where the decision gets made.

Four boxes joined by arrows: a person asks for a task, the coding agent picks the tool to call, MCP tools and skills run on the device, and data and systems. An arrow leads down from the call between the agent and its tools to a filled box, a parallel security agent on the device, which sees each tool call before it runs, then warns, asks or blocks.
Watch the decision, not just the database.

A VCR at 4x

I said what a lot of security teams were doing in 2025, which was buying time: “we can delay it by saying no to all of these new technologies and all of these new vendors.” Xia agreed that’s what large companies were doing, and said what it costs.

“That’s exactly what enterprises are doing, right? If they’re not sure, I’m not going to use the Salesforce agent, I’m not going to use the Workday agent, right? But then, people who are late to adopt these technologies, they will be behind others.”

Xia Hua, at 30:35

Sasha’s version was about planning horizons: “Yeah, but unfortunately, being late adopter in the age of AI is likely too late.” Ten years ago a team could plan a year ahead, he said, and now three to six months at most. Glenn gave it an image anyone over forty will get.

“Yeah. The analogy I would use is, like, everything is like on your old-time VCR. Everything is running at 2x speed now, or 4x speed. It’s actually hard to tell, because it’s not playing in real time anymore.”

Glenn Mulvaney, at 31:47

The breach data a month later showed what saying no actually produces, which is adoption the security team can’t see. IBM’s 2025 Cost of a Data Breach study, covering 600 organizations from March 2024 to February 2025, found that “One in five organizations reported a breach due to shadow AI,” and organizations with high levels of shadow AI saw an average of $670,000 in higher breach costs. Thirteen percent reported breaches of AI models or applications, and “Of those compromised, 97% report not having AI access controls in place” (IBM). The way through is the one Sasha described a few minutes earlier, controls built in early enough that saying yes is the safe answer. We wrote up how to do that without blocking anyone in Shadow AI, and how to govern it.

The Palo Alto Networks of agentic applications

I asked them to imagine Traceforce as a $100 billion company and say what it looked like, which is where the quote at the top of this page came from. Sasha liked the name: “The name is excellent.” It does say the job, trace and force, the record of what happened and the power to stop it.

The analogy changed after the tape, and the change is the most interesting thing the company did. In June 2025 Xia reached for Palo Alto Networks, the company most people associate with the network firewall. By the time Traceforce went through Y Combinator in the summer of 2026, its page there described it as “CrowdStrike for AI Agents,” the company most people associate with the endpoint, with a plain description underneath: “Traceforce gives a company’s security team visibility of how AI apps are being used across company’s devices, and the ability to detect and prevent security breaches and unsafe actions as early as possible” (Y Combinator).

The reason for the move is in the launch posts. “Competitors sit at the gateway or plug into enterprise APIs. That misses the self-adopted AI tools employees install themselves, and it can’t see how an agent is actually connected to your data via MCPs” (Y Combinator). The Launch HN put it in the vocabulary security teams buy in: “Traditional security tools fall short: EDRs see processes, CASBs see network traffic, but neither has visibility into the application-level activity happening inside AI apps” (Hacker News). Endpoint detection and response watches processes, and a cloud access security broker, the kind of product Skyhigh sold (SDxCentral), watches traffic on its way to the cloud. A local MCP server is launched by its app as a subprocess and talks to it over standard input and output on the same machine (MCP specification), so it never touches the network at all, which is why Xia wrote that “For the stdio ones, we still need local agents to take care of the controls.”

Three boxes. Endpoint detection sees processes. A gateway or broker sees network traffic. Filled, in the app on the device, which sees apps, MCPs and tool calls. Below: a local MCP server talks to its app over standard input and output on the same machine, so that traffic never crosses the network a gateway watches, and the cost is understanding the configuration and logs of every app, which change often.
From the firewall to the laptop, because that's where the agents run.

Work harder, and follow your heart

I asked what Xia would tell her younger self, and she answered in two words.

“Work harder. I didn’t work that hard when I was younger.”

Xia Hua, at 33:51

Sasha didn’t believe it, and neither will anyone who heard her earlier answer about her superpower: “I think of myself as a very focused person. And to me, it’s all about execution, it’s never about talking.” She said the focus came partly from school, where “I was the only girl in a class of like 10, 20, you know, like elite kids trained for math and physics Olympiad,” and from deciding not to surrender to people with more natural talent. “You know, I’m a fighter.” Sasha’s line on that: “Talent can only take you thus far.”

What she would change was how long it took to know what she wanted. She contrasted herself with “folks like Michael Jordan, who always knew he only wanted to play basketball, right?” and said she had wandered, toward academic math, “influenced by my father as well, who was a professor, right?” The lesson she passes on is the reason she gave for moving from China and Hong Kong to the US, to give her kids room to find their direction early. “Don’t just work for salaries, if possible, right? Do something more.” It’s the same instinct that made her leave Oracle for a startup when her friends went to Snowflake.

Signal to noise

Sasha asked each of them to name a problem they’d love someone else to solve, and Glenn picked the oldest one in the security operations center.

“My number one pain was just signal to noise in any security tooling and in your SOC. When you’re unifying all of these things with all of this monitoring and observability, how do you focus on what’s important?”

Glenn Mulvaney, at 35:55

He’d had correlation and deduplication tools before, and his complaint about them is precise: “the effectiveness is always limited by the scale of what you’re trying to process.” The company he named was Prophet Security, which he’d seen in an early demo while still at Clumio, and he was careful about the connection: “full disclosure, he’s one of our advisors,” meaning Kamal. Kamal Shah is Prophet’s co-founder and chief executive. Before that he ran StackRox, which Red Hat agreed to buy in January 2021 (Tom Tunguz), and before that he was senior vice president of products and marketing at Skyhigh Networks (DevOps.com), the company where Glenn ran security and operations.

Prophet’s own numbers since are company-reported but large: in its July 2025 Series A release, it said its AI analyst had “performed over 1 million investigations” in the previous six months (Business Wire). Alan Braithwaite of RunReveal took on the logging side of the same problem on episode 50.

What happened after the tape

At the end, Xia told us it was her first time on a podcast, and Sasha made a promise: “We’ll do, like, a year, a year check-in.” We kept it. Xia came back on episode 100, released July 29, 2026, with a live demo.

The one-year check-in, about 41 minutes: Traceforce's open-source scanner run live against Playwright's MCP server, Anthropic's report on an espionage campaign that used Claude and MCPs against about 30 organizations, and what buyers now ask about AI tools. Watch on YouTube.

Happy to return to the YSecurity podcast. Great chatting with Jon McLachlan and Sasha Sinkevich!

Xia Hua · July 29, 2026
Xia's post on the day episode 100 came out, sharing mine. View on LinkedIn.

My own post that day summed up the year better than I can now: “Traceforce started out securing production AI workloads. Now it scans employee devices for the MCPs already installed there and flags the ones with known vulnerabilities before they turn into a headline.” The prompt injection Xia triggered live was in Playwright’s MCP server, “a line as simple as asking it to ignore its instructions and return its system prompt.” The espionage campaign was the one Anthropic disclosed in November 2025, in which a China-linked group it calls GTG-1002 had Claude Code “execute 80-90% of tactical operations independently” against about 30 targets, using MCP for reconnaissance (The Hacker News).

In between the two episodes, here is what the public record shows, in order.

  • July 2025: a third founder. Varun Wadhwa, who had been a staff engineer at Clumio and then a senior engineer at LinkedIn, joined as co-founder and chief technology officer (LinkedIn). By the time Traceforce went through Y Combinator’s Summer 2026 batch, the founders on its page were Xia and Varun, and Glenn’s LinkedIn lists him as a co-founder since January 2025.
  • December 1, 2025: an open-source scanner. Traceforce published mcp-xray, which it describes as “a unified open-source security scanning and penetration testing solution for Model Context Protocol (MCP) servers,” written in Go under the Apache 2.0 license (GitHub). It checks configurations for exposed secrets and risky tool descriptions, and runs dynamic tests that Xia listed in the launch thread as “code execution, SSRF, path traversal, authorization bypass, input injection, DoS etc.” It had 91 stars and 22 forks when we published this page.
  • July 16, 2026: the Launch HN. “Hey HN, we’re Xia and Varun, the founders of Traceforce,” the post began, and it reported more than 1,000 devices at 10 organizations, and that “On average, we discover over 15 AI applications per device with each application connected to 5-10 MCPs.” The findings it listed are the ones this episode predicted: “We’ve helped customers identify exposed plaintext secrets in MCP configurations, prevent API keys from leaking through AI-generated code, and warn developers before executing potentially destructive commands such as ‘DROP TABLE’” (Hacker News).
The demo from the Launch HN, posted July 16, 2026, about three minutes: every AI app and MCP on a device, on one dashboard. Watch on YouTube.
  • July 28, 2026: the Launch YC. Twelve days later the company reported “6,000+ devices across 10+ enterprise customers, with 40+ active pilots worth $3M+ in ARR,” and a customer line from a database company with more than 500 employees: “To govern AI, we need full visibility into AI usage before we can place any type of controls” (Y Combinator). All of those numbers are the company’s own.
The Launch YC video, posted July 28, 2026, about a minute and a half, on agents leaking sensitive data that a security gateway never sees. Watch on YouTube.
  • August 2026: Las Vegas. Xia, Varun and Abhijeet Kumar were selected to present “X-Ray Specs for Agents” at BSides Las Vegas on August 4 and to run a DEF CON 34 demo lab called “X-Ray Your Agents: Pentesting MCPs, Skills, and the Plugin Supply Chain” on August 7 and 8. On August 16 the company published Skill X-Ray, a static scanner for agent skill packages (GitHub).

I'll be hopping between Black Hat, Security BSides Las Vegas, and DEF CON in Las Vegas.

Abhijeet Kumar and Varun Wadhwa have been building something truly unique. If you're curious about the behind-the-scenes work at Traceforce, come check out our demo labs and presentations.

And if you'd like to chat over coffee, my schedule is available in the first comment.

#BlackHat #DEFCON #BSidesLV #OpenSource #Cybersecurity #AISecurity #SecurityCommunity

Xia Hua · July 24, 2026
A community-first plan for the week of Black Hat: talks and demo labs. View on LinkedIn.
  • September 28, 2026: TraceGraph. The second Launch YC turned the same telemetry into a graph in which “Every user, team, app, model, MCP, and token is a connected node,” queryable in plain English, with examples like “Show Claude Code sessions that called the Supabase MCP” (Y Combinator).
  • October 2026: the road. Traceforce announced talks by Xia at CISO XC in Dallas and at a technology summit in Hermosa Beach, on what happens when AI starts acting on its own (LinkedIn).
Three numbers side by side. More than 1,000 devices at 10 organizations, at Traceforce's Launch HN on July 16, 2026. More than 15 AI applications on an average device, each connected to 5 to 10 MCPs. More than 6,000 devices across more than 10 enterprise customers, by July 28, 2026. Below: what the company says it found, plaintext secrets in MCP configuration files, API keys leaking through AI-generated code, and destructive commands like DROP TABLE that needed a warning first.
Sixteen months after four months in, by the company's own count.

Put the two episodes side by side and the idea didn’t change, only where it runs. In June 2025 Xia wanted a parallel agent that stops the product agent at its permission boundary. In July 2026 the product agent was mostly someone’s coding assistant on a laptop, and the parallel agent went there with it.

Did you catch it? A six-question quiz

Interactive · six questions

Did you catch it?

Pick an answer for each, then check. Every answer is on the tape.

  1. What did Xia say when Clumio's chief technology officer told her about the acquisition?

    1. That she'd stay for the integration
    2. That she was probably out of there
    3. That she wanted to run the combined team

    b. "Virtually two seconds after Woon, CTO, told me about the news, I said, Woon, I'm probably out of here." Transcript, 1:47.

  2. What did Xia say gave birth to Wiz?

    1. Generative AI
    2. The move to remote work
    3. Kubernetes

    c. "Kubernetes was what gave birth to Wiz, basically, right?" Transcript, 6:22.

  3. What did Xia say was harder than getting a 4.0 GPA at MIT?

    1. The first conversations with investors
    2. Hiring the first engineer
    3. Writing the first line of code

    a. "I think the initial conversations with the first set of investors were definitely the most, say, challenging," and "Overall, it's much harder than getting a 4.0 GPA at MIT, I can tell you that." Transcript, 15:32.

  4. What did Xia say MCP is going to be?

    1. A passing fad
    2. The next HTTP
    3. A replacement for APIs inside companies only

    b. "The MCP is gonna, you know, be the next HTTP, right?" Transcript, 24:02.

  5. What did Xia say we need to stop a product agent from going beyond its permission boundaries?

    1. A longer approval process
    2. A ban on agents
    3. A parallel agent, a security agent

    c. "almost like a parallel agent, security agent, to monitor and to prevent the core product agent from doing things beyond its permission boundaries." Transcript, 29:04.

  6. What analogy did Glenn use for how fast things move now?

    1. An old VCR running at 2x or 4x
    2. A rocket leaving the launch pad
    3. A treadmill that keeps speeding up

    a. "Everything is running at 2x speed now, or 4x speed." Transcript, 31:47.

Can you see what your agents can do?

The question this episode leaves you with is the one my security review asked: not only what your agents can read, but what they can do. This scorecard asks eight questions about the AI apps and coding agents on your own company’s devices and tells you where you stand.

Scorecard · eight questions

Can you see what your agents can do?

Answer for the laptops and sandboxes your people actually use. If two answers fit, pick the lower one.

  1. Do you have an inventory of the AI apps and coding agents on company devices, including the ones people installed themselves?

    • No
    • A list of the approved ones
    • Yes, discovered on every device, sanctioned or not

    Traceforce reported more than 15 AI apps on an average device. The calculator below multiplies that out.

  2. Do you know which MCP servers and skills each of those apps is connected to?

    • No
    • For a few teams, by asking
    • Yes, per device, with versions

    Five to ten MCPs per app is the average Traceforce reported. The next HTTP section has the record.

  3. Where do the API keys and tokens your MCP servers use live?

    • In plaintext in config files
    • Mostly in environment variables
    • In a secrets manager, scoped and rotated

    Plaintext secrets in MCP configurations were the first finding Traceforce listed. Our post on the .env file is the place to start.

  4. What happens when an agent tries a destructive command, like DROP TABLE, a force push or deleting files?

    • It runs
    • Some tools ask, depending on settings
    • A warn and acknowledge step on every device, with a log

    OWASP's fix for excessive agency: a human approves high-impact actions before they are taken.

  5. Can an agent on a developer's laptop reach production credentials or databases?

    • Yes, with the developer's access
    • Some of them
    • No, production is separated, and access is scoped and short-lived

    Replit's first fix after the deleted database was automatic separation of development and production.

  6. Are new MCP servers tested before people use them, and again when they change?

    • No
    • Reviewed once, by reading the code
    • Scanned and tested dynamically, and again on every update

    A server that passed review can change. Here is how to catch it.

  7. Are agent tool calls logged somewhere your security team can query?

    • No
    • Some apps keep local logs
    • Yes, collected, queryable, with alerts on risky patterns

    Monitoring and prevention, Glenn's two problems. You need the first to do the second well.

  8. Who owns an agent incident, like a leaked key or deleted data?

    • Nobody has decided
    • Whoever notices first
    • A named owner, with a runbook for rotating keys and restoring data

    The incident Traceforce's founders described took weeks to investigate and clean up.

Start with the inventory

The agents on your laptops are probably doing more than anyone has written down, which is normal in 2026 and very fixable. Start by finding them: every AI app, every MCP server, every secret in a config file. Once you can see them, the controls in the rest of this scorecard are each a week of work, not a program.

Visible, not yet controlled

You can see a good part of what's running. The next step is the one Glenn called the hardest, prevention: a confirmation in front of destructive actions, production out of reach by default, and a scan every time an MCP server changes. Then give agent incidents an owner.

Seen and stopped

You know what's installed and connected, secrets are out of config files, risky actions wait for a person, and tool calls land somewhere you can query. That's the parallel agent Xia described, whatever tool provides it. Write it up so customers can check it, and keep the inventory current, because the apps change monthly.

How many agent connections are on your laptops?

Traceforce’s averages make a quick estimate possible. This calculator multiplies your devices by the AI apps on each and the MCP servers each app is connected to, then shows how many of those connections nobody has looked at, and what looking at them by hand would take.

Calculator

How many agent connections are on your laptops?

Your devices, the AI apps on each, the MCP servers each app is connected to, and the share someone has reviewed.

–AI app installs
–app to MCP connections
–nobody has reviewed
–hours to review by hand

On 200 devices with 15 AI apps each, that's 3,000 AI app installs and 15,000 connections from an app to an MCP server. If 10 percent of them have been reviewed, 13,500 haven't, and reviewing those by hand at ten minutes each would take 2,250 hours.

The 15 apps per device and 5 MCP servers per app are the low end of the averages Traceforce reported in its Launch HN in July 2026, over 15 apps per device with 5 to 10 MCPs each, measured on its customers' devices, so yours may be higher or lower. The 200 devices, the 10 percent reviewed and the ten minutes per review are placeholders, not research. Many connections are the same server on many laptops, which is why an inventory with versions, and a scan that runs when a server changes, beats reviewing each one by hand.

From Oracle to TraceGraph

Everything on this page sits on one timeline, from Glenn’s first operations job to the product Traceforce launched in September. Filter it by thread.

Timeline · 2004 to 2026

From Oracle to TraceGraph

Filter by thread. Dates are from the public record except where marked as the guests' own account on the tape.

  1. PlayFirst

    Glenn joins as employee number eight and runs IT operations (LinkedIn).

  2. A PhD at MIT

    Testing regression models with residuals as data (Mathematics Genealogy Project).

  3. Oracle

    Nine years on in-memory databases, Exadata and SecureFiles (LinkedIn).

  4. Skyhigh Networks

    Glenn runs security and operations at a cloud visibility company (LinkedIn).

  5. Shadow IT gets a product

    Skyhigh's software discovers the cloud services in use inside a company (Data Center Knowledge).

  6. Database In-Memory ships

    With Oracle Database 12.1.0.2 (InfoQ).

  7. Clumio

    Glenn from March, Xia from August (LinkedIn).

  8. Snowflake lists

    The largest software IPO at the time (CNBC).

  9. The cloud peak

    $2.7 trillion, then just over 40 percent lost by April 2022 (Crunchbase News).

  10. Director of engineering

    Xia runs Clumio's flagship products (LinkedIn).

  11. Prophet Security

    An AI analyst for the security operations center, with an $11 million seed (SecurityWeek).

  12. Commvault buys Clumio

    Expected to close in early October (Commvault).

  13. MCP

    Anthropic introduces the Model Context Protocol (X).

  14. Traceforce

    Glenn starts in January, Xia in February (LinkedIn).

  15. OpenAI adopts MCP

    In the Agents SDK first (X).

  16. Tool poisoning

    Hidden instructions in tool descriptions (Invariant Labs).

  17. Security for AI gets funded

    Aurascape with $50 million, Virtue AI with $30 million (Business Wire).

  18. The first customer

    After about two dozen design partners.

  19. Episode 72 airs

    This conversation. "The MCP is gonna, you know, be the next HTTP, right?"

  20. Varun Wadhwa

    Joins as co-founder and chief technology officer (LinkedIn).

  21. An agent deletes a database

    During a code freeze, at Replit (X).

  22. Shadow AI in the breach data

    One in five organizations reports a breach due to shadow AI (IBM).

  23. mcp-xray

    An open-source scanner and penetration tester for MCP servers (GitHub).

  24. A home for MCP

    The Agentic AI Foundation, at the Linux Foundation (Linux Foundation).

  25. The NSA on MCP

    Security design considerations for AI-driven automation (NSA).

  26. Launch HN

    More than 1,000 devices at 10 organizations (Hacker News).

  27. Launch YC

    More than 6,000 devices, by the company's count (Y Combinator).

  28. Episode 100

    The one-year check-in, with a live MCP demo (episode 100).

  29. DEF CON 34

    A demo lab on pentesting MCPs, skills and the plugin supply chain (LinkedIn).

  30. TraceGraph

    Every AI interaction in a company, as a graph you can query (Y Combinator).

What to do this week

Five things, in the order the episode suggests.

  1. Find the agents. Inventory the AI apps and coding agents on company devices, including the ones nobody approved, and the MCP servers and skills each is connected to. You can’t put a permission boundary around something you haven’t found.
  2. Get the secrets out of the configs. Move API keys and tokens out of MCP configuration files and into a secrets manager, scope them to what each server needs, and rotate the ones that have been sitting in plaintext.
  3. Test the servers you depend on. Scan your MCP servers dynamically, with an open-source tool like mcp-xray or your own tests, and scan again whenever one updates. Read the tool descriptions too, since that’s where the steering hides.
  4. Put a pause in front of destructive actions. A warn and acknowledge step for commands like DROP TABLE, force pushes and bulk deletes, and production credentials out of reach of agents by default. Replit’s fix and OWASP’s agree on this one.
  5. Log the tool calls and name an owner. Send agent tool calls somewhere your security team can query, and decide today who rotates the keys and restores the data when an agent gets it wrong.

Key takeaways

  1. Fifteen years of preparation, then two seconds

    Xia built in-memory databases at Oracle for nine years, then joined Clumio as an engineer and became director of engineering for its flagship products. When Commvault bought Clumio, she didn't hesitate: "Virtually two seconds after Woon, CTO, told me about the news, I said, Woon, I'm probably out of here." She gave the team four months to hand off and started Traceforce in February 2025.

  2. A security co-founder for a developer's company

    Glenn ran cloud operations and security at Clumio and, before that, security and operations at Skyhigh Networks, the cloud visibility company built to find shadow IT. The company started with one question: "what do you see as a big challenge in security because of AI?"

  3. Catch the wave on the way up

    "So every technological wave is an opportunity to build a great company on. And when that wave is on the rise, we gotta catch it, right?" Kubernetes produced Wiz, which Google bought for $32 billion. Xia called generative AI one of the biggest waves of her fifteen-year career, with "a lot of hard but solvable problems" at the start.

  4. Two dozen design partners, then one pain point

    Their first customer came after "like two dozen design partners." Five were interested and "all of them want different things," so they picked by how much pain it was and "how much are they going to pay?" Connections, Glenn's twenty years with security leaders, were half of it.

  5. Fundraising is a people problem

    "Sometimes investors say no in very subtle way," and later in the process the no was often a competing portfolio company. "Overall, it's much harder than getting a 4.0 GPA at MIT, I can tell you that." Glenn's lesson: "there was never a wasted conversation. We always learned something."

  6. Two kinds of security companies get funded

    "So today, really, only two types of companies are getting funded in the security space": AI agents for the security operations center, and security for AI, "a little bit like a security for Kubernetes, security for the cloud." Traceforce picked the second, with a goal of agents that "perform within their permission boundary."

  7. MCP is the next HTTP, and it needs its S

    "The MCP is gonna, you know, be the next HTTP, right?" Xia added that "there will be MCPS," the protocol with security built in. Since then MCP went to the Linux Foundation with more than 10,000 published servers, and researchers found tool poisoning, a critical flaw in mcp-remote and about 1,000 servers exposed with no authorization.

  8. Monitoring and prevention, with the weight on prevention

    Glenn sees two old problems under new pressure, observability and prevention, and says AI surfaces weaknesses teams already had in identity governance and data security posture. "Once the horse has left the barn, it's great that we can do the forensics," but "really prevention to me is the key."

  9. Security reviews are moving from data to actions

    Jon described a review where "the shift moved off of the data and onto what agents could actually do and execute." OWASP calls the risk excessive agency, with three causes, excessive functionality, permissions and autonomy. Seventeen days after this episode, an agent at Replit deleted a production database during a code freeze.

  10. A parallel agent for the agent

    Xia's design: "almost like a parallel agent, security agent, to monitor and to prevent the core product agent from doing things beyond its permission boundaries." A year later Traceforce described it as capturing tool calls at the application layer before they execute, inspected on the device, with a warn and acknowledge step for destructive commands.

  11. Saying no moves adoption out of sight

    Enterprises were waiting, "I'm not going to use the Salesforce agent, I'm not going to use the Workday agent," and Glenn said planning now runs like a VCR at 2x or 4x. IBM's 2025 breach study found one in five organizations reported a breach due to shadow AI.

  12. From the network to the endpoint

    In June 2025 Xia wanted Traceforce to be "the Palo Alto Networks of agentic applications." By its Y Combinator batch it called itself "CrowdStrike for AI Agents," because gateways miss the AI tools people install themselves and local MCP servers never cross the network.

  13. Signal to noise is still the hardest problem in security operations

    Glenn's wish for someone else to solve: "My number one pain was just signal to noise in any security tooling and in your SOC." He named Prophet Security, whose co-founder Kamal Shah advises Traceforce, and disclosed it on the tape.

Chapters

Tap a chapter to play from there.

Pull quotes

“I was building in-memory databases at Oracle, and they were building in-memory databases at Snowflake.”

Xia Hua ·

“Virtually two seconds after Woon, CTO, told me about the news, I said, Woon, I'm probably out of here.”

Xia Hua ·

“But it's like in a symphony orchestra. You need somebody to string things together.”

Xia Hua ·

“So every technological wave is an opportunity to build a great company on. And when that wave is on the rise, we gotta catch it, right?”

Xia Hua ·

“And Xia would pose questions to me and say, what do you see as a big challenge in security because of AI?”

Glenn Mulvaney ·

“Overall, it's much harder than getting a 4.0 GPA at MIT, I can tell you that.”

Xia Hua ·

“there was never a wasted conversation. We always learned something.”

Glenn Mulvaney ·

“So today, really, only two types of companies are getting funded in the security space.”

Xia Hua ·

“The MCP is gonna, you know, be the next HTTP, right?”

Xia Hua ·

“Once the horse has left the barn, it's great that we can do the forensics.”

Glenn Mulvaney ·

“And for the very first time in a very long time, the shift moved off of the data and onto what agents could actually do and execute.”

Jon McLachlan ·

“almost like a parallel agent, security agent, to monitor and to prevent the core product agent from doing things beyond its permission boundaries.”

Xia Hua ·

“Everything is running at 2x speed now, or 4x speed.”

Glenn Mulvaney ·

“Traceforce will be the Palo Alto Networks of agentic applications.”

Xia Hua ·

“Don't just work for salaries, if possible, right? Do something more.”

Xia Hua ·

About the guests

Xia Hua, Co-founder and Chief Executive Officer, Traceforce

Xia Hua is the co-founder and chief executive of Traceforce, a San Francisco company in Y Combinator's Summer 2026 batch that gives security teams visibility and control over the AI apps, MCP servers and agents running on company devices. She started it in February 2025, after five years at Clumio, where she rose from member of technical staff to director of engineering for its flagship data protection products, and a few months at Commvault after it acquired Clumio. Before that she spent nine years at Oracle as a consulting member of technical staff, contributing to Oracle Database In-Memory, Big Data SQL, the Exadata flash cache formats, Advanced Index Compression and SecureFiles. She has a PhD in applied mathematics from MIT, awarded in 2010.

Traceforce ↗ LinkedIn ↗ Launch HN: Traceforce (YC S26), July 2026 ↗mcp-xray, Traceforce's open-source MCP scanner ↗Traceforce on Y Combinator ↗Episode 100, Xia's one-year check-in, July 2026 ↗

Glenn Mulvaney, Co-founder, Traceforce

Glenn Mulvaney is a co-founder of Traceforce, which he joined in January 2025. He was vice president of cloud operations and security at Clumio from 2019 until Commvault acquired it in 2024, then a senior director of cloud operations and security at Commvault. Before that he was vice president of operations at Inscape, VIZIO's smart TV data subsidiary, vice president of security and operations at the cloud security company Skyhigh Networks, where he led its ISO 27001, FedRAMP and ISO 27018 work, vice president of network operations at Idle Games, and employee number eight and vice president of IT operations at PlayFirst, the studio best known for Diner Dash. He is an alumnus of the University of Pennsylvania's School of Engineering and Applied Science, and invests in and advises startups.

Traceforce ↗ LinkedIn ↗

About the host

Jon McLachlan and Sasha Sinkevich are co-founders of YSecurity, the on-demand cybersecurity team for startups, and of Cyberbase.ai. The Security Podcast of Silicon Valley is hosted by Jon McLachlan and Sasha Sinkevich. Jon McLachlan on LinkedIn ↗Sasha Sinkevich on LinkedIn ↗

Context and sources

  • Xia Hua's LinkedIn experience: co-founder and chief executive of Traceforce since February 2025, director of engineering at Commvault from October 2024 to January 2025, and at Clumio from August 2019 to October 2024 as member of technical staff, senior engineering manager and, from December 2022, director of engineering, and a consulting member of technical staff at Oracle from July 2010 to August 2019. Source ↗
  • Glenn Mulvaney's LinkedIn experience: co-founder of Traceforce since January 2025, senior director of cloud operations and security at Commvault, vice president of cloud operations and security at Clumio from March 2019, Inscape from 2016, Skyhigh Networks from 2013 to 2016, Idle Games from 2011, and PlayFirst from 2004, as employee number eight. Source ↗
  • Varun Wadhwa's LinkedIn experience: co-founder and chief technology officer of Traceforce since July 2025, after Clumio and LinkedIn. Source ↗
  • The Mathematics Genealogy Project: Xia Hua, PhD, Massachusetts Institute of Technology, 2010, dissertation Testing regression models with residuals as data, advisor Richard Dudley. Source ↗
  • Traceforce on Y Combinator, Summer 2026: CrowdStrike for AI Agents, founded in 2025, with founders Xia Hua and Varun Wadhwa. Source ↗
  • Launch HN: Traceforce (YC S26), July 16, 2026: how the product works, the privacy model, more than 1,000 devices at 10 organizations, and over 15 AI applications per device each connected to 5 to 10 MCPs. Source ↗
  • Xia Hua's replies in the Launch HN thread on DROP TABLE and where Traceforce captures tool calls. Source ↗
  • Xia Hua's replies in the Launch HN thread on MCP gateways, Kong, and local stdio MCP servers. Source ↗
  • A Hacker News commenter on an MCP server whose tool descriptions steered the agent, July 2026. Source ↗
  • Launch YC, July 28, 2026: the coding agent incident at the founders' last company, why on-device, and 6,000+ devices across 10+ enterprise customers with 40+ active pilots, as the company reports it. Source ↗
  • Launch YC, September 28, 2026: TraceGraph, a queryable graph of a company's AI usage. Source ↗
  • mcp-xray on GitHub: an open-source security scanning and penetration testing solution for MCP servers, Apache 2.0, written in Go, published December 1, 2025. Source ↗
  • Xia Hua on LinkedIn, July 24, 2026: Black Hat, BSides Las Vegas and the DEF CON 34 demo lab. Source ↗
  • Xia Hua on LinkedIn, July 29, 2026, on returning to the show for episode 100. Source ↗
  • Commvault, September 24, 2024: the agreement to acquire Clumio, expected to close in early October 2024. Source ↗
  • Blocks and Files, September 25, 2024: Commvault buys Clumio for $47 million, its founders, its 2017 founding and $262 million raised. Source ↗
  • InfoQ, July 28, 2014: Oracle Database 12.1.0.2 and the in-memory column store. Source ↗
  • Snowflake, first quarter of fiscal 2026: 754 Forbes Global 2000 customers as of April 30, 2025. Source ↗
  • CNBC, September 16, 2020: Snowflake's listing, the largest software IPO up to then. Source ↗
  • Crunchbase News, May 10, 2022: public cloud companies lost $1.1 trillion, just over 40 percent of their value, in the five months to April 2022. Source ↗
  • Techzine, March 2026: Google completes its $32 billion acquisition of Wiz. Source ↗
  • Data Center Knowledge, May 24, 2013: Skyhigh Networks, a cloud visibility and control company built to find shadow IT. Source ↗
  • Skyhigh Security on Wikipedia: Skyhigh Networks founded in 2011, acquired by McAfee in a deal announced November 27, 2017 and closed in January 2018. Source ↗
  • Game Developer, April 30, 2014: PlayFirst, best known for Diner Dash, to be acquired by Glu Mobile. Source ↗
  • Business Wire, April 8, 2025: Aurascape launches from stealth with $50 million. Source ↗
  • Axios, April 15, 2025: Virtue AI raises $30 million in seed and Series A funding. Source ↗
  • SecurityWeek, April 2024: Prophet Security emerges from stealth with an $11 million seed round. Source ↗
  • Business Wire, July 29, 2025: Prophet Security raises a $30 million Series A led by Accel. Source ↗
  • DevOps.com, September 25, 2018: Kamal Shah becomes chief executive of StackRox, formerly senior vice president of products and marketing at Skyhigh Networks. Source ↗
  • Alex Albert of Anthropic on X, November 25, 2024: introducing the Model Context Protocol. Source ↗
  • Sam Altman on X, March 26, 2025: MCP support in OpenAI's Agents SDK. Source ↗
  • The Linux Foundation, December 9, 2025: the Agentic AI Foundation, with MCP among its founding projects and more than 10,000 published MCP servers. Source ↗
  • Invariant Labs, April 1, 2025: tool poisoning attacks on MCP. Source ↗
  • The Hacker News, July 10, 2025: CVE-2025-6514 in mcp-remote, rated 9.6. Source ↗
  • The Hacker News on X, December 20, 2025: Bitsight finds about 1,000 MCP servers exposed with no authorization. Source ↗
  • NSA, May 20, 2026: security design considerations for AI-driven automation built on MCP. Source ↗
  • The MCP specification on transports: in stdio, the client launches the MCP server as a subprocess. Source ↗
  • OWASP Top 10 for LLM Applications 2025, LLM06: Excessive Agency. Source ↗
  • Jason Lemkin on X, July 18, 2025: Replit's agent deletes a production database during a code freeze. Source ↗
  • Amjad Masad on X, July 20, 2025: Replit's response and the move to automatic separation of development and production databases. Source ↗
  • IBM, July 30, 2025: the Cost of a Data Breach Report, on shadow AI and AI access controls. Source ↗
  • The Hacker News, November 14, 2025: Anthropic's report on GTG-1002, an espionage campaign that used Claude Code and MCP against about 30 targets. Source ↗

Transcript

Automatic transcription. There is no diarization on the tape, so speaker labels were assigned from the content with help from speaker-embedding clusters and pitch, and a few of the hosts' lines may be swapped between Jon and Sasha. Names and product names were normalized where the recognizer misheard them (Jon McLachlan, Sasha Sinkevich, Xia Hua, Glenn Mulvaney, Traceforce, Clumio, Commvault, Oracle, Snowflake, Poojan, Woon, Wiz, CNAPP, Kubernetes, Snyk, MCP, HTTP, DLP, RSA, BSides, Salesforce, Workday, VCR, Palo Alto Networks, Prophet, Kamal, SOC). Bracketed words are best guesses where a syllable was lost. There are no sponsor reads on this tape. Timestamps are the start of each turn to within a couple of seconds.

Read the full transcript 6,217 words

Jon McLachlan

Everyone, and welcome to another episode of The Security Podcast of Silicon Valley. I'm one of the hosts, Jon McLachlan. I'm joined by the other host, Sasha Sinkevich. Welcome to the show.

Sasha Sinkevich

Welcome to the show, everyone.

Jon McLachlan

This is YSecurity Production, and today we have two amazing, spectacular guests from Traceforce.ai. We have the co-founder Xia and Glenn. So Xia is the CEO and co-founder of Traceforce. Traceforce is actually an AI data security company that she started with her co-founder, Glenn, back in February 2025. Prior to Traceforce, Xia was the director of engineering at Clumio, which was yet another data protection startup. They were actually acquired by Commvault. What they do is they have industry-leading cybersecurity resilience products. Welcome to the show, guys.

Xia Hua

Yeah, thanks, Jon. Thanks, Sasha, for hosting us. We are super excited to be on your show to kind of tell you more about where we came from and what our visions are and where we hope to get. And of course, we're here to answer any questions that your audience might be interested in. We got Glenn here, who has more than a decade of, 20 years actually, of experience in cybersecurity. So he and I are happy to answer any questions you guys have for us.

Jon McLachlan

And Glenn, in a past life, you were [at] Clumio as well?

Glenn Mulvaney

That's correct. Yeah, it's great to be here, guys. Thanks.

Sasha Sinkevich

Thanks for making the time. Since you guys met at Clumio, and what inspired your entrepreneurial journey prior to Clumio? What happened at Clumio that prompted two of you to get together and start a new company?

Xia Hua

I've always wanted to start my own company, actually. So prior to Clumio, I was building in-memory databases at Oracle, where a lot of my friends joined Snowflake early on. I was building in-memory databases at Oracle, and they were building in-memory databases at Snowflake. And impact, you know, let's not talk about the money for a moment, right? The impact is totally different. More than 5,000 people. I think Snowflake probably has 10,000 customers now, right? Whereas the in-memory databases that [I] built at Oracle, I would be surprised if more than 2,000 people actually used it, right? So coming from there, I have always wanted to be part of an amazing startup, with the goal of eventually, if I see a good opportunity, to start something on my own. So, right after I had my second child, actually, I had two kids at Oracle, to kind of enjoy my time a little bit with the family. And right after my second child was born, I talked to Poojan, who was CEO of Clumio at the time. Poojan also came from Oracle, so I knew him, his network from Oracle. And I just decided to join Clumio. Then, while I was at Clumio, I started again as IC. But I very quickly became their manager and then the director of engineering, managing pretty much all the flagship products there. I think it took me 15 years to get here. But I have always wanted this. I think every step of the way, it was sort of, you know, you kind of, I kind of had this goal, right? I sort of know how to get there. I just, you know, like kind of took it one step at a time, right? To sort of get there. So, but you know, I was given so much responsibility at Clumio. I knew I, you know, I was not going to leave Clumio just to start something, right? I had it, I had to support my team. But, you know, the acquisition by Commvault was a great opportunity. Virtually two seconds after Woon, CTO, told me about the news, I said, Woon, I'm probably out of here. He's like, give me some time, give me some time. So I give him four months to hand off. And then in February, I just quit.

Sasha Sinkevich

Nice. So you always knew that you wanted to start a company, and you are very well versed in the data, data access, because building databases, you [are] unintentionally constantly involved in questions around data access, data access controls, et cetera. And having built that muscle at Oracle and then Clumio. Yes. You've seen a lot of pain points that no one has addressed, or a lot of companies have tried but failed. And you have this huge knowledge amount that you're ready to bring to the market and solve the pain point. At Clumio, you guys met with Glenn.

Xia Hua

Right, Clumio is where I met Glenn. Yeah, I think just having worked on databases and then worked on very highly scalable backup and restore pipeline at Clumio, I understand how to build a company from ground up, from technical point, for sure. And I also have kind of just slightly deeper understanding of the inner workings of databases and the distributed systems. Yeah, and at Clumio, I think one of the things that I knew I had to work on was the leadership skills. Literally, if I was not in office one day, people would not know what to do. Like 40 people, right? They were all extremely talented. But it's like in a symphony orchestra. You need somebody to string things together. You know, I knew I had to learn and acquire that skill to be the CEO of a company. So I think, in a way, I prepared myself both from the technical standpoint and from the kind of the leadership standpoint while I was at Oracle and Clumio.

Sasha Sinkevich

So you knew exactly where you want to be at some point in the near future. You've had all of these technical skills. You knew exactly what needs to be built. And you've been part of the Clumio [that] allowed you to gain that leadership skill. And it sounds like you had an amazing team at Clumio that was very productive, delivering amazing products that then later got acquired by a very successful company as well. So the, the ingredients are all well aligned, and you've met Glenn, who is also very excited about security, cybersecurity and compliance space. And both of you joined into this amazing team to deliver a solution to [the] biggest pain point on the market.

Xia Hua

Yes. And to me, yes, I think you're spot on, Sasha, right? Like how to build a company, I think I learned the muscle skills. But when [the] opportunity... That's the big question. Opportunities sometimes come [every] half a decade, five years, or a decade. Prior to this AI wave, what was the last big tech wave? Maybe Kubernetes, I think, right? Kubernetes was what gave birth to Wiz, basically, right? Wiz was the CNAPP thing, you know, the cloud workload and the Kubernetes. So every technological wave is an opportunity to build a great company on. And when that wave is on the rise, we gotta catch it, right? When you are over that peak, it gets hard, right? Like the peak would be like 2021, when Snowflake went public, right? Since then, how many SaaS, most SaaS companies' values have cut down in half, right? So I knew, right? I have to catch the wave, right? And this Gen AI wave is like one of the biggest waves I've seen in my fifteen years of career. That's where I see this is a great opportunity, because when you're at the start of the wave, there are a lot of hard but solvable problems, an interesting problem to be solved. So that's where I told Glenn, right? Let's jump right in, you know, swim in the wave a little bit. Let the tide carry us. Let the wave carry us. 'Cause we want that tailwind.

Sasha Sinkevich

Yeah. So Glenn, you connected with Xia at this company you work together with, and how did you guys identify the opportunity, that wave? The wave is coming, and we know it's coming. What did you guys partner up to execute on?

Glenn Mulvaney

Yeah, that's a great question. Actually, we had pretty limited interaction at Clumio. We were colleagues, and we were on the same staff and in the same department, but I was always focused on security and compliance, and Xia was developing products. And when we started discussing this after we had left Commvault, we looked at security, and we looked at the AI wave. And Xia would pose questions to me and say, what do you see as a big challenge in security because of AI? And that's really where we landed, because, like she has said, the wave, the AI wave, is different than others. It just touches so many parts of our industry. It has so many diverse effects across what we do in tech. So looking further and further of what the adoption was looking like for AI, and what security challenges were coming up, what were being addressed, which ones weren't being addressed, that's really where we focused in on data security and looked very deeply at what some of the struggles are for implementing AI, companies that are new and companies that are already established, and what challenges everyone was having. So that's really the way that this started. And that's the way that we began our thinking, and really the way Traceforce planted a seed.

Jon McLachlan

No, that's incredible. And thank you so much for sharing, too. And Xia, you mentioned that you came up through kind of like the IC role. It sounds like strong technical foundations, and then you developed a leadership style, and then before you know it, you are responsible for this huge team over at Clumio before Traceforce, almost like a proving ground or a testing ground, or like just a pressure cooker, maybe, is a good analogy sometimes. But it sounds like you have so many strengths that you bring to the table. And I'm super curious if you have maybe a superpower, like the very top one, like, here's, here it is, and maybe a little story about where it came from.

Xia Hua

Yeah, I think Glenn might agree with me. I think of myself as a very focused person. And to me, it's all about execution, it's never about talking. It's all about, you know, having a goal and then try to reach there. You know, when I'm able to find that goal, that purpose, I'm patient and I will get there, right? It's like, you know, when I had this goal, I want to start something one day, it took me 15 years to get there. You know, somehow I find a way. You know, I'm a fighter. So I think part of it is definitely personality. Part of it is also kind of learned through, you know, like earlier years. When I was in school, I was the only girl in a class of like 10, 20, you know, like elite kids trained for math and physics Olympiad, you know, solving really hard problems. You know, there I noticed there are like people who are more talented than me, right? I knew in terms of talent, I have less, right? But what am I going to do? Just surrender? No, right? If I'm in this, I have [to] find a way, right? So I sort of kind of learned like an Olympic athlete, right? Like, just not give up, find a way.

Sasha Sinkevich

Talent is an interesting subject in itself. Talent can only take you thus far. It's being persistent and being consistent is what makes and [breeds] success. Just talent in itself is not enough. As, as entrepreneurs, Glenn and Xia, what, what is your proudest day? I'm sure you've had a lot of excellent days that you'll remember forever, but what is the one day that you just, it's a highlight and you would like to share with us?

Xia Hua

I really feel like that perhaps the day where, kind of, we sort of nailed our first customer, figured out that first product we want to build, right? After speaking with like two dozen design partners. That was just like last month, right? We started in February. It took us some time, first of all, to even find these customers. There are two ingredients to start a startup: connections and the technical skills. The connection part, people often overlook. But, you know, just the technical skills, unless we're like building completely open source stuff, right? But Glenn had the, you know, spent 20 years building connections with the CISOs, with executives at other companies, that really helped us. And then, like, five of them were interested, but amazingly, all of them want different things, right? But then we have a road map, right? Like, eventually we will get there. But what's the first thing we want to build, right? It took us some time to kind of iterate and think and prioritize. Ultimately, we pick and chose based on [how] much pain it is, and how much are they going to pay?

Sasha Sinkevich

Yeah, no, I mean, removing the noise of the market, because the market is very noisy, everyone wants something. But as a company, you cannot build all of it at the same time with the limited resources. Glenn, it sounds like you have that experience in the space, people, all of these different pain points. But focus is what [is] needed, especially early on. You just want one single pain point that multiple partners are looking to purchase. And then there's also a question of how big of a pain point that is, and how much dollar amount [signs are] behind that pain point.

Xia Hua

Yes.

Sasha Sinkevich

How big is the market, basically? Right. Yeah. Glenn, what about you? What's the proudest day?

Glenn Mulvaney

Yeah, so I mean, related to what Xia had said, is being able to talk to CISOs, security leaders and other places that are, that have been in my role, having them express those pain points, understanding them, and then saying something like, wait a minute, okay, I see this. I think we can help you here. Like this, what if we did this? What if we did that? And then getting that engagement from them, and just kind of feeling that, that empathy with them, and feeling the relief that, okay, like, they see a path forward here. Like, I've got this painful pain point that's being caused by something in my org that I have to deal with. And you guys know, as security practitioners, there are just myriad pain points. They're legion, right? They're everywhere. And it's what is the hottest and most difficult thing at the moment. So just get, just being able to help somebody who is in my role in another org, and really make their life materially better, improve things in their org and improve security for their org, that, I think that makes me really intrinsically very happy and very proud.

Jon McLachlan

So how about, how about the converse of that question? What's been the most challenging day on your entrepreneurial journey so far?

Xia Hua

I think the initial conversations with the first set of investors were definitely the most, say, challenging, but, you know, most difficult, because we didn't know what to expect. Sometimes investors say no in very subtle way, right? It was definitely took us some learning to be able to, you know, handle rejection. Sometimes, actually, the initial conversations really helped us iterate on product, really helpful. These were super friendly investors, actually. And then the later stage, when our product got a lot better, it was more or less because perhaps they have a competing portfolio company already. So then we understand, right? We have to show more progress and stuff. Overall, it's much harder than getting a 4.0 GPA at MIT, I can tell you that.

Sasha Sinkevich

Is it because there are a lot more variables?

Xia Hua

Yeah, because humans are unpredictable, right? [Math] problems, you do what you need to do, always solved, right? Humans, you know.

Jon McLachlan

I'm pretty sure. Humans, we're something else. Like, we're not a math equation. Don't tell that to all of the hardcore AI folks, but...

Xia Hua

And yeah, and unfortunately, starting a company, as I was telling you, right, technical is just less than half of it. In the early days of a company, you would think that, oh, it's all about building. No, it's all about customers. Sell before you buy. So then, you know, Glenn and I had to learn like a new set of skills, right? So it was overall very challenging. We both had to get out of the comfort zone. I gave Glenn a really hard time. I said, you gotta sell. He's like, I never sold anything before. I was like, you know all these CISO friends.

Jon McLachlan

Yeah. Really? Like, I always assumed that, like, Glenn, you had so much, like, foundation in that space, like, you're a natural at it. So, connecting, connecting with people and...

Glenn Mulvaney

I'm pleased to hear that. I feel, again, you know, I always think of myself still as a practitioner. And when you're a co-founder, it's, you can't think that way, right? You gotta think differently, because so many different things are required. On that journey, as somebody who had been always adjacent to the VC community, being close with other co-founders, hearing their journeys, and I think of myself as a pretty level-headed person, and I sort of thought, oh, this is the way our fundraising journey will go. And I was very, very wrong. And it's a learning experience. And Xia talked about some of the, some of the interesting days that we had and feedback that we had. Like what I said before, with conversations with folks like yourself and other CISOs, there was never a wasted conversation. We always learned something. And everyone that we've talked to in the investor community was helpful, really. Like, and it's incredibly gratifying to have those conversations with folks like that and have them give you, sometimes the feedback's muted and sometimes it's direct, but it's never wasted.

Sasha Sinkevich

Is there [a] person or an event that was most impactful in this journey, in the journey of life, in the journey of entrepreneurship? But yeah, do you have a mentor or guide or someone that you've looked up to or have helped you guys grow?

Xia Hua

I mean, for me, I mean, in this fundraising, I think our advisors were just, in this past few months, I think our advisors have been amazing. Whether it's Poojan, whether it's Kamal and [Wei], they are all very successful entrepreneurs who have sold companies to public companies before. So we definitely learned how they view the market and what they see as, you know, can lead to a successful product in the long run. So these folks are definitely very, very helpful. Glenn, do you want to add anything?

Glenn Mulvaney

Yeah, I very strongly agree with [that]. They keep you grounded, and their expertise is, it's just invaluable, every conversation we have with them. But from a mentorship standpoint, it's hard for me to single somebody out. I've been really lucky to meet a lot of just absolutely tremendous people throughout my career in Silicon Valley. If I had to make a list, I would have to, like, we'd be here all night. I mean, it would be, it would be like I'd be getting played off the stage at the Oscars. But I really have to thank a lot of my colleagues and managers through the years. And your colleagues, your IC colleagues from 20 years ago, are in leadership now and C-level positions. And it's been just such a fantastic journey. And without the mentorship and the folks that have helped me along the way, I can never thank them enough. But whenever I do chat with them, I try.

Sasha Sinkevich

What do you think is the biggest opportunity and the biggest pain point in the security space that is about to arrive and will be very pronounced in the next five years?

Xia Hua

Yeah. So when we were start thinking the pick and direction, right, we kind of surveyed all the existing companies and seeing where kind of the opportunities are. So today, really, only two types of companies are getting funded in the security space. One is AI SOC agents, AI security, basically, because security professionals like Glenn always complain to me, like, they're drowning, you know, signals and the noise, right? Humans aren't so good at, you know, of going through all these signals and trying to figure out, right? Like, it's very repetitive, very error-prone. This is definitely a great opportunity for AI agents to really help us, right? And the other type of companies is security for AI. It's a little bit like a security for Kubernetes, security for the cloud, right? When you have a new technology, you have a new surface of attack. Now you have to cover that, right? So I think both are very, very hot areas right now. And I think this is proven by the fact that, I didn't know that when I started a company in February, but just last month, right, several companies came out of stealth with like 20 million seed, 30 million seed, 50 million Series A in the security for AI space, right? It's yet to tell if there's any real substance in this, but I definitely see that we know there are unsolved problems and a lot can be done. Coming from a developer space myself, it's more natural for me to want to attack problems in building the new agent applications. And I definitely see this as a very different opportunity, a very different shift-left paradigm. Used to be the security is, you know, like very much to the right, right? But like starting from Snyk and all that kind of company, especially the AI company, now security has to be built in the product since [day one], right? So there is a whole breed of company just focusing on that part, actually, right? Integration, how to enable agents to perform within their permission boundary.

Sasha Sinkevich

That's actually a very interesting point, because security is very complex and very difficult. When you try to add a security control to [an] existing product, it can be quite tedious, and you might miss certain things unless you're extremely well versed in that product and the security control that you're trying to add. What we're trying to see, and what people start to talk more and more about, is how do you make security seamless? How do you make security such that there is no room for human error when you do either integration or the implementation of certain controls? Bottom line is, security needs to be part of the product from early stages in order for it to be effective.

Xia Hua

Yes, yes, yeah. It's a, it's a, it's a very hot topic right now, especially with all the MCP stuff, right? The MCP is gonna, you know, be the next HTTP, right? Yeah, and [the] security. So there will be MCPS.

Jon McLachlan

Yes. Yes. So, so, so is it, would it be wrong to think about Traceforce as maybe like a potential, like, MCP firewall?

Xia Hua

Actually, yeah, yeah. We, that's definitely one of the things that, the directions we could go into, actually.

Glenn Mulvaney

Yeah, I think, I mean, for the challenges coming in the next five years, for sure, I see it as two problems, and they've been around for a while: monitoring, or you want to call it observability, and also prevention, right? And because of the aforementioned ubiquity of AI and how it's accelerating everything, you know, Sasha, you mentioned how security is complex, and this is really pushing and putting a lot of pressure on security, because it's a whole new set of challenges that are built on an already well-known set of issues, right? It's that, in many ways, AI is just bringing some of our well-known security issues [to] the forefront through a different means, right? Lack of good, strong identity governance, lack of a good data security posture, right? Maybe these were siloed before, but now AI applications, AI agents can change that. I was really encouraged to see the very strong renewed push at RSA and at BSides to really do the shift-left development and discipline, security discipline from day one in the development [process]. And I'm really encouraged by that. It just doesn't happen overnight. It takes a long time, and it's a shift for many software development organizations because of the way that our industry has worked, right? I mean, software development [hasn't] always prioritized security as part of what is being built. So at the same time, we also need better security tools. We need tools that are more sophisticated, that will give deep observability. And more importantly, the hardest part is prevention, right? Once the horse has left the barn, it's great that we can do the forensics. It's great that we can figure out what happened and learn how to close those gaps, but really prevention to me is the key. And that's really where Traceforce is focusing. We're not ignoring monitoring, observability, but we really want to deliver something for prevention.

Jon McLachlan

I think the economics are structured in a way where prevention is so much more efficient than chasing down, like, all of the bad things that could possibly happen, that are happening right now, that are going to happen in the future. So I see that there's a lot of, like, efficiency that could be had if we just take a little bit of prevention.

Glenn Mulvaney

I agree strongly with that. Yeah, I agree strongly with that. I don't want to stop doing threat modeling and risk analysis. That's the basis of how you really make effective security controls. But you're right. Boy, the prevention stuff certainly goes a long, long way.

Sasha Sinkevich

So perhaps this massive adoption of AI technology, and we will not go into details of what's behind AI technology, it's the podcast in itself, but it feels that AI adoption is [a] lesson for existing security control issues and [an] accelerator to solve them, because if we don't, then it's an exponential growth of threat attacks [that] will start occurring.

Glenn Mulvaney

Exactly. It supercharges both sides of the issue, I agree.

Jon McLachlan

You know, I was on an interesting security call. It was a security review. And I know a lot of times it's, it's very efficient to think about security as focused on data. And for the very first time in a very long time, the shift moved off of the data and onto what agents could actually do and execute. And it was just so refreshing, because, you know, a lot of security folks do focus on data, think about data. How do we protect the data? If there's a breach, it must be about the data. You know, in this world of agents, where these things can actually perform operations, there's a whole bucket of, like, ops and actions, and a new world, I think, is just like right around the corner of how to think about threat models and how do we protect systems.

Xia Hua

Exactly. Like, we need, like, a kind of a, almost like a parallel agent, security agent, to monitor and to prevent the core product agent from doing things beyond its permission boundaries.

Sasha Sinkevich

Like in the past, we had DLP solutions, the old classical DLP solutions, that would essentially build some type of guardrails to ensure that [a] person cannot extract information and pass it somewhere else, and their entire company is built around that. With agents, now you have this field with infinite number of functions, agents, that can pass information to each other. And how do you control and trace through the lineage of that data flow?

Xia Hua

Yes. It's a very interesting question. That's exactly the problem that prompted us to start Traceforce. And then we are, you know, thinking about it every day. It keeps us, keeps us awake at night. And definitely, I think you guys said it really well.

Jon McLachlan

No, no, I'm so grateful that there are such incredibly smart, dedicated and focused people taking the opportunity to think through these really challenging problems that everyone in the security community faces. Like, let's be, let's be honest, like, everyone faces this. No, we can, we can delay it by saying no to all of these new technologies and all of these new vendors, but eventually, like, we're...

Xia Hua

That's exactly what enterprises are doing, right? If they're not sure, I'm not going to use the Salesforce agent, I'm not going to use the Workday agent, right? But then, people who are late to adopt these technologies, they will be behind others.

Jon McLachlan

Those companies will fall behind. And eventually, those CEOs that run those companies are going to have to step in and be like, you know what? We have to figure out a way to make this work, get it into our ecosystem. We need to adopt this. Like, I can't fall behind anymore.

Xia Hua

Exactly. Yeah. That's where the, the opportunity, market opportunities are, right?

Jon McLachlan

So I guess everyone gets to decide, like, what sort of adopter they want to be. You want to be an early adopter, be a late adopter.

Sasha Sinkevich

Yeah, but unfortunately, being late adopter in the age of AI is likely too late. Things moving, things moving so fast. Like, ten years ago, we could plan a year ahead, and we could say this is what a year from now things will look like in the field. Now, maybe three to six months. At most.

Xia Hua

Yeah. All these startups that started building API integrations, they all now had to pivot to rewrite their stuff because of the MCP. So that's how quickly things change.

Glenn Mulvaney

Yeah. The analogy I would use is, like, everything is like on your old-time VCR. Everything is running at 2x speed now, or 4x speed. It's actually hard to tell, because it's not playing in real time anymore. Those decisions that you mentioned, Sasha, that, like, yeah, maybe we had a 12-month window to plan, now it's down to, like, three or less. Like, people have to make these extremely business-critical decisions right away that affect massive efficiency. So yeah, I feel like everything is just in fast forward right now.

Sasha Sinkevich

Anyway, let's fast forward into the future.

Jon McLachlan

If you guys use your super vision and your founders' creativity and imagination, and you peer into that future, and you see Traceforce as just an amazing success, $100 billion company, knocking it out of the park, what does that look like? Specifically, what does success look like for you and for Traceforce?

Xia Hua

Traceforce will be the Palo Alto Networks of agentic applications. You know, when you think of network, you associate with Palo Alto Networks. So all the agentic applications, I want people to associate with Traceforce, who can trace every agentic action down for you and automatically prevent bad things from happening.

Sasha Sinkevich

The name is excellent. It's, it's, it's really well descriptive of the function that will execute the vision that you guys have.

Xia Hua

Thank you.

Jon McLachlan

Love it. I love it. I'm excited. I'm so grateful that you guys are thinking through this problem. It's going to, it's, there's a huge wave coming. I don't think people quite understand how big a wave this really is. And it's just the beginning. We haven't even started to see adoption yet. Let's go in the other direction. If we could go back in time, you could meet your younger self, would you, any, what would you... Would you have any advice for your younger self, or would you have anything to share?

Xia Hua

Work harder. I didn't work that hard when I was younger.

Sasha Sinkevich

It doesn't sound like that. It sounds like you're an amazingly hard worker. But maybe the younger Xia is a different...

Xia Hua

There are people who are like, you know, like, let me, like, maybe like folks like Michael Jordan, who always knew he only wanted to play basketball, right? So he was very focused since the beginning of his life. But not everybody is lucky like that, right? Like, I myself had wandered about many different directions. I started, I was even thinking about going to academia, you know, math. And part of it was because I was influenced by my father as well, who was a professor, right? So I think I wish it was a little bit sooner for me to be able to figure out what I wanted to do.

Sasha Sinkevich

Thank you, thank you for sharing. Thank you for sharing.

Xia Hua

That's what I teach my kids, right? Like, that's why I moved from China and Hong Kong to the US, because it's a great country where people really get their opportunities, right? And I wanted to give my kids the opportunity to kind of follow their heart, figure out what they want to do as early as they can in their life, and really make an impact. Don't just work for salaries, if possible, right? Do something more.

Sasha Sinkevich

That's an excellent point. There's so many unresolved opportunities out there, whether it's software, hardware, or just life. And we, we need people that are passionate and ready to solve them. Just to expand on that a little bit more, in software and in the security space specifically, there are so many unresolved pain points that we necessarily may not be able to solve right away. If you could wish for someone to solve one of the pain points that you guys are not working on, what that pain point would be?

Glenn Mulvaney

My number one pain was just signal to noise in any security tooling and in your SOC. When you're unifying all of these things with all of this monitoring and observability, how do you focus on what's important? Because you just have so much telemetry coming in, and there's been so many efforts at trying to do this. Companies like Prophet that are applying AI to this, they have the correct model. I was lucky to see a very early demo of Prophet, and I was really impressed by what it could do, because I already had tools that would do correlation and do deduplication and, you know, the really, the, try to get the signal to noise down, but the effectiveness is always limited by the scale of what you're trying to process. And Prophet's the first time where I've seen something a little different. And I really, really like what they did. And I really saw the effectiveness. And there are a lot of players in that space, but they were outstanding to me.

Jon McLachlan

Well, I'll have to check that out. Sounds like a great platform. I haven't sunk my teeth into anyone in particular yet. And it sounds like you've got the inside connection.

Glenn Mulvaney

Yeah, yeah. I mean, we mentioned Kamal before, and he is, full disclosure, he's one of our advisors. But we had seen Prophet before that. I mean, actually, we were still at Clumio, and this was long before Traceforce was even a twinkle in our eyes. So, but yeah, I mean, the SOC, I think everybody's seen it, and I think if you talk to most practitioners and security leaders, that figuring out a way to make SOCs more efficient is really key. And it's been a problem that's been around for a long time. The more we have to monitor, the more sharp that problem becomes.

Jon McLachlan

Definitely. Definitely. Well, it's going to be an incredible journey. So much is changing. I'm so grateful that we have incredible founders building amazing companies to solve all of these difficult problems. I don't think any one person's gonna solve everything, but I'm so grateful that you've found something to sink your teeth into and give back to the security community, actually improve the lives of human beings behind all of this technology. So thank you so much for coming on and sharing a little piece of your journey. Xia, it sounds like you're just an incredible human being and incredible mother as well. Thank you for sharing, like, that very vulnerable piece with all of us. And Glenn, just awesome. So grounded. So much empathy. I feel the warmth. I'm excited. I'm not even part of Traceforce, and I'm excited for Traceforce.

Glenn Mulvaney

Thank you so much, guys, for having us. This was fantastic.

Xia Hua

Thank you, Jon. Thank you, Sasha. And always, thank you, Glenn. Yeah, I really enjoyed every minute of this show. First time on [a] podcast, by the way. It's my first time.

Sasha Sinkevich

And, well, welcome. We have to have you back. We'll do, like, a year, a year check-in. Thank you so much for your time.

Jon McLachlan

Thank you also to all of our listeners for tuning in to another episode of The Security Podcast of Silicon Valley. I'm your host, Jon McLachlan, one of the hosts, Jon McLachlan, and I'm joined [by] the other host, Sasha Sinkevich. And this is a YSecurity production.

Sasha Sinkevich

Take care, everyone.

FAQ

Questions this episode answers

Who is Xia Hua?
Xia Hua is the co-founder and chief executive of Traceforce, which she started in February 2025. Before that she spent five years at Clumio, rising from member of technical staff to director of engineering for its flagship data protection products, and a few months at Commvault after it acquired Clumio. From 2010 to 2019 she was a consulting member of technical staff at Oracle, working on Oracle Database In-Memory, Big Data SQL, Exadata and SecureFiles. She has a PhD in applied mathematics from MIT, awarded in 2010.
Who is Glenn Mulvaney?
Glenn Mulvaney is a co-founder of Traceforce, which he joined in January 2025. He was vice president of cloud operations and security at Clumio from 2019 to 2024 and a senior director at Commvault after the acquisition. Earlier he was vice president of operations at Inscape, vice president of security and operations at Skyhigh Networks, vice president of network operations at Idle Games, and employee number eight at PlayFirst, the studio behind Diner Dash.
What is Traceforce?
Traceforce is a San Francisco security company, founded in 2025 and part of Y Combinator's Summer 2026 batch, that gives security teams visibility and control over AI apps such as ChatGPT and Claude on company devices. It installs as a lightweight binary and a browser extension, discovers which AI apps run on each device and which MCP servers and skills they're connected to, and can warn on or block risky actions before they happen. It also publishes mcp-xray, an open-source scanner and penetration tester for MCP servers.
What did Xia mean when she called MCP the next HTTP?
That the Model Context Protocol, which Anthropic introduced in November 2024 to connect AI apps to data and tools, would become the standard way software talks to AI the way HTTP became the standard for the web. She added that "there will be MCPS," meaning MCP with security built in, the way HTTPS added encryption to HTTP. By December 2025, MCP had moved to the Agentic AI Foundation at the Linux Foundation with more than 10,000 published servers.
What is an agent's permission boundary?
The set of things an AI agent is allowed to do: which tools it can call, with what permissions, on which data, and which actions need a person to confirm first. OWASP calls going past it excessive agency, caused by excessive functionality, excessive permissions or excessive autonomy. Xia's answer is a parallel security agent that watches the product agent and stops it at that boundary.
Why did Traceforce move from the network to the endpoint?
Because the risky AI activity happens on the device. Traceforce wrote that gateways and enterprise APIs miss the AI tools employees install themselves and can't see how an agent is connected to data through MCP servers, and that endpoint detection tools see processes while cloud access security brokers see network traffic, neither of which shows activity inside AI apps. Local MCP servers talk to their apps over standard input and output, so they never cross the network a gateway watches.
What is mcp-xray?
An open-source security scanning and penetration testing tool for MCP servers, published by Traceforce on GitHub in December 2025 under the Apache 2.0 license and written in Go. It checks configurations for exposed secrets and risky tool descriptions, scans repositories for vulnerable dependencies, and runs dynamic tests for problems such as code execution, server-side request forgery, path traversal and authorization bypass.
What happened to Clumio?
Commvault announced on September 24, 2024 that it would acquire Clumio, the AWS data protection company founded in 2017 by Poojan Kumar, Woon Ho Jung and Kaustubh Patil, and the deal closed in early October 2024. Commvault said the price was not material to it, and Blocks and Files reported it at $47 million. Xia and Glenn both stayed on through a handoff and left to start Traceforce.
What two kinds of security companies did Xia say were getting funded?
AI agents for the security operations center, which help teams that are drowning in signals and noise, and security for AI, which covers the new attack surface the way earlier companies covered Kubernetes and the cloud. Traceforce chose the second.
Did Xia come back on the show?
Yes. On the tape Sasha promised a one-year check-in, and Xia returned on episode 100, published July 29, 2026, where she ran Traceforce's open-source scanner live against Playwright's MCP server and showed a prompt injection flaw triggered by a single sentence.
Keep reading on the YSecurity blog
Related episodes
If this episode hits close to home
Secure MCP Program MCP connects your AI to everything. We make every connection one you can trust. Shadow-AI Detection & Mitigation Find every AI tool your company already uses — and make each one safe to keep. AI Access Control Audits Least privilege, extended to the fastest-growing users in your company: AIs. Secure AI SDLC & Engineering Let AI write your code — and trust every merge.
New episodes every other Tuesday

Got a story like this one?

We're always looking for practitioners who've been in the room when it mattered.

Apply to be a guest
SpotifyApple PodcastsYouTubePodbeanPlayer FMRSS