Ganesh Datta
HostCTO & Co-founder of Cortex
Adam Berman
Engineering Leader
August 27, 2026
In This Episode
Adam Berman spent two years as VP of Engineering at Semgrep before stepping back into an IC role this past February. He came up through product engineering and loves building alongside customers on a fast feedback loop. He'd stepped into the VP role to help Semgrep scale, then felt the itch to get back to building and tackling greenfield, open-ended problems directly.
Adam joins Cortex CTO Ganesh Datta to work through what changes for security when agents write most of the code. They discuss why static analysis is having a moment, the argument for shifting security both left into the agent and right into continuous review, and why the next wave of exploits won't be a new kind of bug.
You’ll learn
Static analysis is back. Running a frontier model in a loop is powerful but slow and expensive, and much of what it catches a CPU-based check finds faster and cheaper. Save the agent tokens for the novel exploits.
Agents have commoditized the one thing that kept most attackers out: expertise. Agents aren’t necessarily introducing new vulnerability classes, rather chaining vulnerabilities together in novel ways that used to take humans years.
Shift security left and right. Left is the agent loop and design, before code exists. Right is watching a week of diffs together, since one diff says nothing about the system's direction.
AI doesn’t replace taste. A staff engineer can drop the right pattern in a README for agents to follow. Juniors, though, need the judgment to know when to break from it.
You can hand agents the fix, not just the finding. Instead of asking engineering for time to patch a flagged issue, let an agent take the first shot and move human verification to "confirm it's fixed and nothing broke."
AI slop comes from skipping the thinking. A 15,000-line PR is a dead giveaway. Spend the time to land on a sharp problem statement, and the output is much better.
Quotes
Taste is not getting replaced.
Adam Berman
Engineering Leader
The barrier to entry for a lot of attackers used to be subject matter expertise. That expertise has just become commoditized.
Adam Berman
Engineering Leader
The only thing that's 100% secure is no code at all. As soon as we're building code, we know there are potential security issues.
Adam Berman
Engineering Leader
The agent often acts with a lot of confidence, even if it's confidently wrong.
Adam Berman
Engineering Leader
Timestamps
(01:30)
Adam's background and the move from VP of Engineering at Semgrep back to an IC role
(02:11)
What actually prompted Adam’s switch back to IC work
(07:23)
AI as both a compressor and amplifier
(09:20)
The leverage multiplier: senior ICs writing more code than ever before
(11:30)
Training junior engineers looks different in the age of AI
(14:45)
Defining a sharp problem statement to improve agent output
(16:15)
What "security for AI" actually means, starting with model poisoning as a new threat model
(18:01)
Shifting security left into the agent, now that the IDE is an agent
(21:46)
Why static analysis is back: the cost and speed argument
(25:40)
How far left can you go? The context engine and security in design review
(29:10)
Security for coding agents: not new vulnerability classes, but chaining vulnerabilities together
(31:00)
Letting agents fix their own vulnerabilities
(33:57)
The Waymo analogy for building confidence in autonomy
(38:20)
Advice for going "full dark factory" from a security standpoint
(41:46)
Where exploits move next: the cross-system seams
Other episodes
August 13, 2026Garbage in, Garbage out: Splunk's Steve Flanders on why AI Can't Fix your Bad Telemetry
Steve Flanders
Senior Director of Engineering at Splunk
July 30, 2026Your Platform is your Business, Encoded onto your Infra, with Syntasso's Abby Bangser
Abby Bangser
Principal Engineer at Syntasso
July 16, 2026Trust is for People, Confidence is for Tools: Tealium's Dr. Martin Nettling on Reviewing AI-generated Work
Martin Nettling
Senior Director of Engineering
