The Hidden Cost of BlackBox AI: Bridging Cloud and Code Security

In this episode of the Cloud Security Podcast, host Ashish Rajan interviews Harry Wetherald, CEO and co-founder of Maze, a series A security startup focused on building AI agents for security. The conversation centers on the application of AI to application security (AppSec) and cloud security, addressing key concepts such as vulnerability reachability versus exploitability. Harry explains that reachability indicates whether code is active or an asset is network-accessible, while exploitability considers the full context needed for an attacker to trigger a vulnerability. They discuss the build vs. buy dilemma for AI security tools, noting that while building with LLMs offers flexibility, it requires significant investment in validation, monitoring, and cost optimization to achieve reliability. Harry highlights the historical problem of false positives in AppSec, where traditional SCA/SAST tools flag nine out of ten alerts incorrectly, and contrasts this with unoptimized AI products that may be more accurate but inconsistent. The episode also covers the convergence of AppSec and cloud security teams, facilitated by AI acting as a translator between domains. Harry advises on red flags when evaluating AI vendors, particularly the danger of ‘black box’ products that lack transparency. He emphasizes the importance of model optimization to reduce costs by up to 100x, and the need for a ‘security brain’ to orchestrate investigations across code and cloud. The episode concludes with the launch of Maze Code, a tool for deep cloud and code investigation.