Max Pollard - Why Hidden System Prompts Are Failing Security Teams

S6:E4 - Max Pollard - Why Hidden System Prompts Are Failing Security Teams

Episode Summary

In this episode of Simply Defensive, Josh Mason and Wade Wells sit down with Max Pollard. He is the founder and CEO of CoTool, an AI-native detection and response platform. Max's path ran through quantitative finance, then Okta's customer identity team, then Material Security, where he built and led the forward-deployed engineering team. He left to found CoTool earlier this year. The conversation traces where the idea came from. Security engineers were already turning to tools like ChatGPT and Claude Code for help writing detections. Those tools hit a wall the moment they needed to understand an org's actual logs and schema.

Josh and Wade push Max on the harder questions too. Why do SOAR teams still hesitate to trust automatic remediation, and what has to change before anyone hands that trust to AI? The back half turns into a real debate about control, built around a recent LinkedIn post where Max argued that hidden system prompts are quietly failing the security teams who depend on them. Detection engineers, SOC analysts evaluating AI tools, and anyone tired of agents that ignore instructions will get something out of this one.

What You'll Learn

Max's path from algorithmic trading to Okta, Material Security, and founding CoToolWhat CoTool does: better rule-based detections, catching behavior rules that can't be expressed, and full-context responseWhy grounding AI in your organization's real logs and schema matters more than a good promptHow backtesting a detection connects straight back to Max's quant finance backgroundWhy AI got noticeably better at MITRE ATT&CK mapping over the past couple of yearsWhy SOAR teams still hesitate on automatic remediation, and what AI changes about that calculusHow AI can fast-track junior analysts instead of replacing themMax's LinkedIn take on hidden system prompts, and why he thinks they hurt security teamsWhy CoTool calls itself a harness instead of an agentEpisode Highlights

From Algorithmic Trading to AI Security Max's path ran through quantitative finance, Okta's customer identity team, and Material Security before he left to found CoTool. He draws on that finance background more than you'd expect, especially around backtesting.

What CoTool Actually Does A unified detection and response layer that sits on top of your existing stack, not a SIEM replacement. It helps teams write and maintain better rule-based detections, catch at