104. Why a16z’s CISO doesn’t trust the approve button (with Yash Kosaraju)

Yashvier Kosaraju, who goes by Yash, is the Chief Information Security Officer (CISO) of a16z, 4 months into the job when this was recorded, which by his own measure feels like about a year. The job covers the firm’s corporate environment, its cloud controls and its pitch decks, and the part that makes him useful to this audience is that a16z sits close enough to its portfolio companies that founders bring him their security problems directly.

So host Jon McLachlan starts there. When does a startup make its first security hire, and when does that become a head of security? Yash separates the two hard. The first hire is a staff or senior staff engineer who can work independently, someone in the code and the infrastructure rather than someone building a team, and the trigger is a risk decision about what data you hold and what happens if it walks. Headcount has nothing to do with it. Where that person sits matters as much as when you hire them, because an engineer without enough context and access can’t execute. The head of security comes much later, when the company is big enough to need a dedicated leader in the seat.

Then the sales version of the same question, which is the one founders feel first. A big client asks for a call with your security leader, or for a named contact they can reach in an emergency. Yash’s answer is that this is the wrong moment to go hire a head of security, and he lays out the 2 routes he’d take instead. Fractional CISOs come up, and he calls them a good resource for jumpstarting a program.

The middle of the episode is AI, and he does neither the optimistic version nor the doom version. The security market is saturated with vendors, he says, where every feature of what ought to be one suite is its own company, and for the first time in his career he can’t tell you how long consolidation will take. On offense, AI is good enough at working through known vulnerabilities, the published Common Vulnerabilities and Exposures (CVE) list, to overwhelm a defense, and the cost per exploit is falling for the attacker. His forecast is 12 to 18 months of painful catch-up, after which whole classes of vulnerability and whole categories of tooling stop being necessary. What he wants gone specifically is code security. Static application security testing (SAST) and software composition analysis (SCA) exist because humans write insecure code, and if agents are writing most of it, he’d like them writing it securely by default.

His real worry sits