AI for Security vs Security for AI: From IBM Master Inventor to Microsoft AI Architect

WEBVTT 1 - > Dewan Ahmed: Hello, hello! Welcome to another episode of ShipTalk Podcast, where we talk about the ins and outs, ups and downs of software delivery. I'm your host, Dewan Ahmed, and today I'm delighted to welcome Fatih Bulut. 2 - > Dewan Ahmed: AI architect at Microsoft, working at the intersection of cloud, security, and AI.

3 - > Dewan Ahmed: Building systems that actually work, not just dazzling proof of concept. Welcome, Fatih. 4 - > Fatih Bulut: Hi, Delvin, glad to be here. 5 - > Dewan Ahmed: Where are you dialing from, Fatih?

6 - > Fatih Bulut: I… I'm based in Boston, Massachusetts, yeah. 7 - > Dewan Ahmed: Okay, not too far from here, I'm in New Brunswick, and it's not September yet, but it was single digit last night. When I say single digit, for my friends in the down south, I have to say, I do in Celsius, so whenever I hear Fahrenheit, my brain goes. 8 - > Dewan Ahmed: off, so I have to do some conversion.

So I guess, you can, you know. 9 - > Fatih Bulut: Yeah. 10 - > Dewan Ahmed: Fahrenheit. 11 - > Fatih Bulut: I mean, I can't say it in Fahrenheit.

It was a hot topic in our household yesterday as well. My parents are here from Turkey, and they're like, in August, this shouldn't be that cold, actually, you know? Is this, like, normal? It was cold yesterday, yeah.

12 - > Dewan Ahmed: Yeah, yeah, yeah. Well, we only get a few months of summer. 13 - > Dewan Ahmed: So, I was checking your LinkedIn, and I saw that we have a common background back in the IBM days. So, I'm gonna get started there.

So, we both spent time at IBM, different teams, but same giant playground. 14 - > Dewan Ahmed: How is your IBM experience like? 15 - > Fatih Bulut: It, you know, short, it was great. It was my, first employer after my PhD, 16 - > Fatih Bulut: I worked at the intersection of AI for security and compliance for, 8 years.

I really enjoyed my time. IBM has been a… I mean, IBM was a really big company, and right now it's still a big company. 17 - > Fatih Bulut: And, it's a foundational company to everything that even we use today. If you think about, like.

18 - > Fatih Bulut: what IBM invented, you know, is, like, the ATMs that we use in banks. 19 - > Fatih Bulut: those are invented by IBM, like DRAM, even SQL, you know, and I think Fortron. There are lots of things IBM invented and put into our life, you know, PC, right? That… 20 - > Fatih Bulut: you know, it's a foundational to everything.

It was obviously a very big company, and lots of, units. 21 - > Fatih Bulut: And I was mostly part of the research part, and IBM has a very strong research culture. 22 - > Fatih Bulut: It's probably, you know, one of the few companies left in U.S, which has a dedicated research unit.

Over time, I realized, you know, we are working 23 - > Fatih Bulut: more closely with the business units, but it was an enjoyable moment, you know, I truly enjoy my time. It was a rewarding experience working with really good people. 24 - > Fatih Bulut: I still talk with, you know, some of my friends there. It was a really good company, I would say, and it has a marks on my career.

25 - > Dewan Ahmed: On the topic of invention, IBM actually invented a cheese cutter. So, when I, was working at the Markham Software Lab, there was a giant cheese cutter, and there was, like, IBM on it. Like, I could never imagine that, IBM inventing a cheese cutter. Did you know that, Fati?

26 - > Fatih Bulut: Yeah, I mean, it… I saw some of these machines, you know, in some of the IBM locations, and … 27 - > Fatih Bulut: It was really surprising, you know? You think you're working for a tech company, and you see that, you think, like, you know, maybe not, but… 28 - > Fatih Bulut: you know, this was, like, maybe 50, 60 years ago, or 70 years ago. IBM is, like, more than a hundred years company, and, you know, they invented a lot of stuff, including, like, you know, tabulating, machine and all.

29 - > Fatih Bulut: punch cards, like, all this stuff, right? I mean, it is, … 30 - > Fatih Bulut: A company that also transformed itself over time, and many times, and probably they are… 31 - > Fatih Bulut: you know, one of the such moments right now as well. So, yeah, I mean, when you work at IBM, the transformation is something that, you know, they talk about a lot. 32 - > Fatih Bulut: Which I think keeps the company alive for such a long period.

You know, if you compare to some other companies, that we… we talk probably more these days, but they're, you know, much younger companies. 33 - > Dewan Ahmed: Yeah, and talking about IBM, Fati actually was a master inventor at IBM, so working at IBM, I know that that's a very prestigious level to reach at. Not many people can become a master inventor. If you could share with our viewers and listeners about what does a master inventor have to do to earn that title?

34 - > Fatih Bulut: So it's a… it's a title that requires a few things. One is that you have to invent. Obviously, you have to submit patents, you have to file patents, and when you have… when you submit a patent, it goes through a review process, and then it will be filed. 35 - > Fatih Bulut: drafted and filed, to the patent office.

So that's one part of it, like, you have to make sure that you continuously invent. And then, one other thing is, you have to also mentor others as well. 36 - > Fatih Bulut: So you need to make sure that the young generations and the people coming after you also, you know, start inventing as well, so that's also part of the evaluation, as far as I remember. So once you, you know, reach to some point where you have lots of patents.

37 - > Fatih Bulut: And you start mentoring people, you know, teaching them how to submit and invent as well. So that's where you become eligible for becoming a master inventor. 38 - > Fatih Bulut: So those are the two main steps, as far as I remember. One other thing I remember is that, like, you know, it's a… it's not a one-time process, so you have to, sort of, like, re-certificate every three years, as far as… if I remember correctly.

So it's, you know, it's for a period. You're a master inventor. 39 - > Dewan Ahmed: Talking about master inventor, so one topic that people fail to master is the difference between AI for security and security for AI. Even I don't quite get the exact concept.

40 - > Dewan Ahmed: So, you were the best person to explain to our listeners, where do you focus, and what are the differences between these two? 41 - > Fatih Bulut: Yeah, definitely. I mean, it's a very confusing topic, you know, because two words, like, you know, we use interchangeably in different places. So… 42 - > Fatih Bulut: My focus is mostly on, AI for security, and security itself is a, you know, really broad field, where defenders.

43 - > Fatih Bulut: try to protect enterprises, companies, environments, cloud or not. 44 - > Fatih Bulut: from bad actors, right? So, it's a broad field, and there is the idea of, like, applying AI, or bringing AI, infusing AI into the security. 45 - > Fatih Bulut: So this applies to, for example, let's take security operations center SOC into the account.

How do we make the processes more efficient? How do we automate some of this using AI? 46 - > Fatih Bulut: And these are, typical, you know, AI problems that you may also find some alignment in different areas as well. And, so this is for AI for security, bringing AI into the security.

But then, obviously. 47 - > Fatih Bulut: AI itself needs security as well, so that is the part of security for AI. So when we deploy the AI, we need to make sure that it's secure, and, you know, there are lots of attack vectors. 48 - > Fatih Bulut: That people, today, take advantage of.

You know, for example, putting some prompts into their websites, which, 49 - > Fatih Bulut: Which is basically not something you would like in a prompt. 50 - > Fatih Bulut: But when you read that website and automatically end up putting it into the context in your prompt, then it becomes your prompt. So, now that it can be a prompt injection attack, for example, to extract some information, such as system prompts and, you know, such details. 51 - > Fatih Bulut: Even some other sticks that you're putting into the prompt.

52 - > Fatih Bulut: At that point of time. So… so there is, that part of, like, securing the AI itself, so that's the, that's the second part, security for AI. So that's the, you know, the difference in short. 53 - > Dewan Ahmed: One other… since we're on the topic of similarities and differences, this is about software delivery, and the theme for Season 4 is AI meets software delivery.

How do you draw the parallel between the practices you are mentioning in security space and how we do DevOps and SRE? Do you see similarities, differences? 54 - > Dewan Ahmed: Do the fundamentals of SDLC still hold? 55 - > Fatih Bulut: I think the fundamentals still holds, in my opinion.

So let's take, for example, detection engineering. When we say detection, it's basically a piece of code, and sometimes this piece of code can be as small as a 56 - > Fatih Bulut: you know, a SQL sort of, like, query. Sometimes it can be a gigantic, like, query, 57 - > Fatih Bulut: Sometimes this is rule-based, sometimes this can be an ML-based, machine learning-based behavioral detection code as well. So it varies a little bit, but at the end, it's a little bit smaller than, like, you know, the typical software.

58 - > Fatih Bulut: product, you know. The idea of detection engineering is that you have some, idea around some of the threat vectors that you want to protect your organization. 59 - > Fatih Bulut: And these threat vectors can come from a variety of sources. Some of the sources are state-sponsored actors, like threat actors.

They would like to get into your environment, take advantage of, like, you know, some of the data and all. 60 - > Fatih Bulut: So that's one sort of, like, you know, area that you would like to monitor. The second is financially motivated threat actors. These are 61 - > Fatih Bulut: actors who would like to, you know, put some ransomware in your environment and, you know, make some money.

There are, like, all sorts of hackers as well, and you would like to, you know, understand your threat 62 - > Fatih Bulut: landscape first. Once you understand your landscape, you would like to make sure that whenever these behaviors of hacking, and this could be in variety of ways, if it happens, you would like to catch them. 63 - > Fatih Bulut: So to catch them, you rely on the telemetry and logs, which is basically bread and butter in security. 64 - > Fatih Bulut: And, and… and to be able to analyze this, telemetry and logs, you need some piece of software, such as deduction code.

65 - > Fatih Bulut: to analyze these logs and look for patterns. For example, for a password spray attack, you know, you would see logs that, you know, passwords, different passwords are, like, entered multiple times. 66 - > Fatih Bulut: So if you catch such things, you look for such things in the detection code, and if you catch it, you generate an alert. So that's sort of like a typical detection engineering, and it's basically, you need to develop a code.

67 - > Fatih Bulut: It's very similar to, if we think about it, you know, how we develop, 68 - > Fatih Bulut: you know, software features as well. So we have some features, and then that features turn into some code. 69 - > Fatih Bulut: by a developer, and then the developer needs to test this code, and then make sure that the quality is there, and then it goes through the CICD and all, and then it's, you know, shipped into the production. So similarly, when you generate deduction code, you want to make sure that the quality is there in terms of all the tests and all.

70 - > Fatih Bulut: And then it, you know, goes through the test and then went into the CICD and the production. One difference that I can tell is that, like, you know, when you're shipping a code. 71 - > Fatih Bulut: In a software, your typical metrics are probably, like, you know, if the feature is complete, if, you know, the thing that you would like to do is there or not, and maybe it's binary, not all the time. 72 - > Fatih Bulut: But in deduction engineering, your typical metrics are a little bit different, because what you're interested in here is, first of all, do you catch the behaviors that you're targeting or not?

So that's sort of like, you know, catch rate, maybe? 73 - > Fatih Bulut: The second thing is, you would like to make sure that you're not generating lots of alerts. So you may write a deduction that generates lots… that catch lots of such behaviors, but if you generate lots of alerts, then it's not very useful either, because, 74 - > Fatih Bulut: Because the Security Operations Center, where they will look into the alerts and incidents and will try to make sense of it. If there are lots of them, they will basically reduce the value of the alerts.

75 - > Fatih Bulut: So that's why you… your… one of your metrics is to make sure that you're not generating lots of alerts, your signal-to-noise ratio is high. 76 - > Fatih Bulut: So it's, you know, somewhat different, right, if you compare to the software development lifecycle. 77 - > Fatih Bulut: But at the end, you know, it's both software, so you gotta make sure that the quality is there, tests are there, and everything is there. Maybe the beginning and, you know, the end differs a little bit in terms of the research and the metrics that you are focusing on.

78 - > Dewan Ahmed: Yeah, I could… I could… when you're explaining that, I could relate to how we're designing, like, pipelines, like CICD pipelines, so when I'm trying to deploy to production, I could have some metrics, so let's say I have a CV, or Continuous Verification Module. 79 - > Dewan Ahmed: which is looking at certain metrics, like CPU usage, call per minute, and if it reaches a certain threshold, so let's say I'm not going to allow that artifact to be deployed, and it can be manual, someone can get a notification, it can be automated, it… the pipeline will just revert if there's a rollback.

80 - > Dewan Ahmed: One other thing I'm thinking is proactive versus reactive. So, so looking at certain metrics and trying to prepare in advance 81 - > Dewan Ahmed: versus something happened in production, now how can we quickly revert that? So, in the security space, have you… 82 - > Dewan Ahmed: Can you think of something similar of a proactive versus reactive? Like, can you… can you find a pattern of these bad actors beforehand, before something happens?

83 - > Fatih Bulut: Yeah, I mean, that's pretty much, like, you know, the idea in detection engineering. So, you… you really want to be prepared when that time comes, you really catch them. And usually, when an attack happens, it doesn't happen in, like, one… 84 - > Fatih Bulut: Behavior, so it happens in multiple phases. 85 - > Fatih Bulut: Some attackers, like, you know, just go into the system.

86 - > Fatih Bulut: let's say they compromise the password of a user, they get into the system, and then they move into the other machine from there and, you know, take advantage of some of the other vulnerabilities. So, it's basically… there are phases, right? It's not just one action. 87 - > Fatih Bulut: And there… from a defender's perspective, you have multiple opportunities there.

Like, let's say if you… if you… if you couldn't catch them in the first place, for multiple reasons, then there is the second opportunity. 88 - > Fatih Bulut: And sometimes it can get tricky because, some of the attackers are, really complicated and, sophisticated in a way that they can 89 - > Fatih Bulut: stay stealthy for a very long time, waiting for the moment, you know? So those are very complex use cases, but at the end, like, there are multiple opportunities, and … 90 - > Fatih Bulut: And you want to catch them, like, you know, in one of these instances.

As early as possible, it's the best way to catch it, but if it doesn't happen, there will be other opportunities as well. 91 - > Fatih Bulut: When it comes to the novel attacks, like, you know, maybe, those are the areas where I think, AI, ML sort of solutions, can really, really help, because, the… 92 - > Fatih Bulut: Sort of, like, attacks that we discussed, … 93 - > Fatih Bulut: for example, password spray and all. These are very well-known attacks, and, you know, you can write deductions to detect those.

94 - > Fatih Bulut: But then there are always, like, noble attacks that, attackers can come up with. How do you detect those? You know, if you haven't seen those before, how can we be more proactive to those? 95 - > Fatih Bulut: I think it's, it's an open question, and, I think AI, LLMs with the cognitive skills, reasoning capabilities, presenting a lot of opportunities in that space, to be more proactive.

But in general, you know, security is a, I think. 96 - > Fatih Bulut: It's a very proactive, business where, you have your deductions, and if somebody acts, you know, you… 97 - > Fatih Bulut: basically, create an alert, and mobilize the teams, Security Operations Center, whether to mitigate it, disrupt it, and all sort of, like, you know, 98 - > Fatih Bulut: mitigations. 99 - > Dewan Ahmed: Now, you have taken ideas from prototypes to general availability. 100 - > Dewan Ahmed: a giant leap that a lot of people underestimate.

What was the hardest part into turning something which is just in the research phase from something people can actually use? 101 - > Fatih Bulut: Yeah, I mean, great question, though. Like, there are a couple of things. First is that, I think, like, you know, people have a lot of ideas, and, 102 - > Fatih Bulut: The main part that makes a difference in terms of having ideas and getting that into the people's hands is the execution.

103 - > Fatih Bulut: And when you left the execution, a lot of ideas basically just stay in the paper, in PowerPoints, Word documents, or, you know, wherever it's written. 104 - > Fatih Bulut: So I see that, like, you know, lots of people have ideas, but to get to the point where it's actually useful, you really need to get this into the hands of the practitioners, whether this is a customer, or if you're developing this for, you know, for internal purposes. 105 - > Fatih Bulut: Whatever the, you know, customers in this case.

106 - > Fatih Bulut: It takes a lot of efforts to get a research idea into the practitioner's hands. First of all, you have to deal with, 107 - > Fatih Bulut: the… the problem of, like, you know, proving that, the idea itself worth investment. So, you know, there are lots of scrutiny around that. Some people may say that, you know, no, this is not a good idea.

108 - > Fatih Bulut: And, you know, there are such things. So you have to make sure that you have the alignment. The second thing I would say is that, especially working on the research side, you have to make sure that you really understand the products 109 - > Fatih Bulut: the customer sides, you can't just, like, operate in silo and solve customer problems. So you have to make sure that, like, you know, you work very closely with the product teams and engineering teams, understanding their limitations.

110 - > Fatih Bulut: Sometimes they don't support, you know, certain functionalities that you would need in your solution, for example. So, you want to make sure that, you know, you build your prototype and solution based on that. 111 - > Fatih Bulut: And also working very closely with the customers, and, you know, understanding their pain points, and revising, iterating, getting to the point, you know, things are useful, because when you build a POC, 112 - > Fatih Bulut: And you may think that it works, and it solves the problem, but, you know, when you actually put this into the customer hands, then you started to realize that 113 - > Fatih Bulut: It actually doesn't solve the problem, you know, maybe it creates more problems, and it's very important that, like, you build and establish that feedback loop with the customers, so that you can iterate, and then make the solution, you know, much better.

114 - > Fatih Bulut: I think all of this needs to come together to get, you know, an idea from early research ideas to the production, to the customer hands. All of this needs to come together, and it's a… it's a challenging thing to do, but it's a necessity. 115 - > Dewan Ahmed: Couldn't agree more. And one of the challenging things is how we do software delivery.

How we take a piece of code. 116 - > Dewan Ahmed: turn that into software and get it to customers' hands. How do you see AI affecting software delivery? Does it add complexity?

Does it make things simple? And you can draw parallels between, like, your experience on how you're using AI for security and how you see AI in software delivery. 117 - > Fatih Bulut: I think this is a, you know, this is a very hot topic right now that people discuss. 118 - > Fatih Bulut: there are, like, multiple, I think, phases in software development, right?

First, you have to develop the software, and right now, there are lots of buzz around using 119 - > Fatih Bulut: AI agents, like, you know, Cursor, Copilot, and all, to use them to generate the code. I mean, in my experience, I can see that, you know, they're really powerful, they can generate quotes that actually work. 120 - > Fatih Bulut: But in the meantime, I also see limitations too. When the codebase gets larger, for example, they start to struggle.

121 - > Fatih Bulut: And there are also patterns that I see sometimes can be annoying, like, … 122 - > Fatih Bulut: you know, it's… it's… I use this, like, it's a plausible, but wrong, you know? They, for example, generate quotes, 123 - > Fatih Bulut: To, to support, like, legacy features. 124 - > Fatih Bulut: Which you don't want to support sometimes, because you're iterating, and you instruct, like, you know, the agent to, not even, like, to support it, but it, you know, it tries to support it, so that's one of the annoying points I can see.

125 - > Fatih Bulut: The other thing is, that, that I usually see is it's, … 126 - > Fatih Bulut: It basically, it puts, … 127 - > Fatih Bulut: Sometimes it can't solve the problem, … 128 - > Fatih Bulut: But it puts some hard-coded, like, you know, solutions, somewhat like a, you know, workaround solution in, in… 129 - > Fatih Bulut: in the agent's minds, I guess. It can't solve the problem, but, you know, maybe if I put this, like, hard-coded, like, strings and return this, it's gonna work, right?

You think that if you don't look into that. 130 - > Fatih Bulut: you may think that it's actually working, but actually, it's just, like, not the functionality that you want, it's a hard-coded string. So those are the issues, like, I think, you know, is, is real problems in, you know, software or code generation. 131 - > Fatih Bulut: And, and we have to be very careful about this.

But in the meantime, 132 - > Fatih Bulut: Once you know that, like, how this works, some of the limitations, you become more cautious in terms of, becoming careful on these stuff, and, 133 - > Fatih Bulut: and you take this into the account, and you generate and, you know, you work better with the agent. I can see that, like, you know, it improves over time. 134 - > Fatih Bulut: So looking back to the, you know, GPT-3… 135 - > Fatih Bulut: And then now coming into the, like, GPT-4 and 5, definitely AI, you know, has improved.

136 - > Fatih Bulut: And, it generates more meaningful code and all. It's definitely useful, but we have to be careful because, at the end, if the generated codes 137 - > Fatih Bulut: somebody has to, you know, look into that, somebody has to make sure that the quality is there, and, I think we are… 138 - > Fatih Bulut: we're… we're not right there where we can just, like, use AI, and trust fully. But, you know, I think AI is there, and useful as a co-pilot. So that's, you know, where my opinion stands on this.

139 - > Dewan Ahmed: Yeah, I agree. I see it as, 140 - > Dewan Ahmed: helpful peer, sometimes a junior engineer, who'll do a lot of work for you, but at the end, it's your job as a senior engineer to ensure that the quality remains of the software you're delivering, because it's your responsibility. 141 - > Fatih Bulut: And you also ask about, like, you know, how security, for example. 142 - > Fatih Bulut: goes into that too, right?

Some of the pieces are still missing. For example, if, as a developer, I use AI to generate the code, and if that code is vulnerable to something, like, who is responsible, you know, for that code? Is the 143 - > Fatih Bulut: is the developer who committed that piece of code responsible? Obviously, there is some responsibility there.

144 - > Fatih Bulut: But then, how do we audit this? How do we, go back and do forensic on this? 145 - > Fatih Bulut: what actually went wrong, you know, what AI agent or LLMs, there are multiple options, even, like, using Copilot, you see multiple, like, LLMs and, you know, you can use. Which one actually was used?

146 - > Fatih Bulut: How did this happen? Like, did I use an MCP server, get some more context? Maybe that was the point. So lots of, like, security issues there as well, like, how do we actually audit this?

How do we make sure that, like, you know, if something goes wrong, we understand why? 147 - > Fatih Bulut: And so these are, I think, still open questions, and, lots of security aspects that needs to come into the place. 148 - > Fatih Bulut: And … but I think, you know, it's becoming more useful. 149 - > Dewan Ahmed: Yeah, agreed.

So, when we think of the whole SDLC, like, the life cycles from building software to building the artifact, delivering it, monitoring it, AI touches almost, like, every single bit. So, Fati, you talked about, like, code generation part. 150 - > Dewan Ahmed: But what I see, customers using AI, or taking benefit from AI is, let's say they have to generate a pipeline. Harness AI, for example, in the platform, it gives you an option to generate a pipeline using AI.

So you click a button, and it generates the whole pipeline for you. 151 - > Dewan Ahmed: There might be any issues if you have any specific use cases, but an experienced user, so let's say a DevOps engineer, they'll know that, okay, it did 95% of my work, now I have to do some tweaking. 152 - > Dewan Ahmed: I remember, like, 3 or 4 years ago, whenever, there is a failed pipeline, actually look at the pipeline logs. Like, just scroll through the logs, do a Command-F or some tail to find out what's the issue.

Right now, there's a button, like. 153 - > Dewan Ahmed: troubleshoot or find the issue for me. Again, with Harness AI, it reads your entire logs and tells you this is where maybe a package, maybe a version mismatch, and then you can… same thing with vulnerabilities. If there are vulnerabilities for your SBOM, it can find out this is the issue, and it also gives you remedies.

So this is how I see 154 - > Dewan Ahmed: AI helping people who already did these things by hand, and now just taking benefit from AI and automation versus someone completely new. 155 - > Dewan Ahmed: We hear the term vibe coding, vibe coding all the way from development to deployment. For them, again, it might do most of the work, but if there's an issue. 156 - > Dewan Ahmed: It, it won't, catch their eyes.

157 - > Fatih Bulut: Yeah, definitely. I mean, … 158 - > Fatih Bulut: I think one of the problems that we're currently facing with AI is definitely useful, but it also throws a lot of ideas as well. You know, for example, you have a code base, and you wanted to analyze this for issues. 159 - > Fatih Bulut: And if you ask AI, it may find you some novel patterns, too.

You know, in some instances, there are… 160 - > Fatih Bulut: there are some, like, you know, papers and blog posts about that. But in the meantime, it also generates noises too, you know? It brings up issues that may not be a problem, actually, from a production perspective. 161 - > Fatih Bulut: there's that problem as well.

I think if we put the human at the co-pilot sit, you know, and working along with AI, 162 - > Fatih Bulut: I think that's the… that's the way to approach this, at least for now. You know, in future, things may change, but for now, I think, you know, it's the best way to approach this. One of the problems that… I think the fundamental problem that I can see in AI today is the architecture itself. 163 - > Fatih Bulut: And I mean, this is not my opinion, but some of the, you know, prominent figures in AI also tell this as well.

164 - > Fatih Bulut: the transformer architecture, right? So that the architecture itself is the cause of some of the limitations. I can easily see that sometimes when I use LLMs, it overlooks information. Even though the context window gets larger and larger over time, now 165 - > Fatih Bulut: you know, we are talking about millions of tokens.

Still, I can see that, certain 166 - > Fatih Bulut: information and instructions are not followed, even by the most powerful models that we, you know, use today. And these are some of the, like, biggest problems in security and operations as well, because the data volume is huge. 167 - > Fatih Bulut: So, for example, when you deal with logs and telemetries, you know, whether this is for an operations incident, or this is for security, the volume is huge, and to be able to take advantage of AI and LLMs in that space, you have to really make sure that what you put into the prompt 168 - > Fatih Bulut: As a context, you know, is the one that you would expect that you try to get something out of it.

169 - > Fatih Bulut: So you, you need to really, you know. 170 - > Fatih Bulut: put all the noise out of it. So there are some such limitations, but I think, you know, we're getting there. It's gonna get much better.

171 - > Dewan Ahmed: Yeah, yeah, totally. I… it reminds me of the Stack Overflow days, that if I find a piece of code on Stack Overflow, it must be perfect to deploy to prod. So, similar to that, like, there might be… 172 - > Dewan Ahmed: an overconfidence on the models we have right now. Like, AI is this magic that you spring all over, and then it must work.

I think there has to be some sort of key way. 173 - > Dewan Ahmed: QA in how we generate code, how we deliver that code, and I'm talking in the context of AI, because we are creating codes like never, ever. Never before. And this huge amount of code, like, who's actually making sure that there is some QA?

Again, we can bring AI into some sort of, hopefully, like. 174 - > Dewan Ahmed: AIQA, or similar systems, that'll make sure that, yes, the code you're generating, it matches the mark, or the things you're deploying, it also is free of certain vulnerabilities, is good for production. But I think this is a very interesting time, where 175 - > Dewan Ahmed: Many engineering teams will make mistakes, and they'll learn from these mistakes. 176 - > Fatih Bulut: Yeah, definitely.

I mean, the… the… one of the main drivers 177 - > Fatih Bulut: of, you know, using AI, I think it's coming from the business itself, you know? Where… 178 - > Fatih Bulut: now that we have this powerful tool at our hands, everybody would like to get more features, you know, delivered, more products delivered, and I think that's fueling the use of AI a lot. 179 - > Fatih Bulut: because people, I think, now realize that this is something that they can use to expedite, you know, some of these, works and tasks.

And, always it comes with, you know. 180 - > Fatih Bulut: With the pitfalls and with all the potential, failures and potential drawbacks and security issues. 181 - > Fatih Bulut: But I think, you know, as you mentioned, we have to come up with quality assurance there, whether automated or not. Obviously, I mean, we need some automation there to make sure that, you know, the quality is there.

182 - > Fatih Bulut: And if quality is not there, you know, we stop there. We don't put this into the… or merge into the main to go into the production. 183 - > Dewan Ahmed: one of the places you're looking to add quality, or look at the security aspect was metaverse. So I came across your blog from 2022, you wrote about metaverse and security.

184 - > Dewan Ahmed: What led you to explore security in the metaverse? And then our follow-up would be, how do you see writing blogs, helping software professionals? 185 - > Fatih Bulut: Yeah, I mean, it was a time, I think, 2022, maybe… 186 - > Fatih Bulut: within the COVID, or right after the COVID, I was working at IBM Research. I was tasked with looking into the metaverse security.

Obviously, at that time around, the metaverse was a very, very, very hot topic. 187 - > Fatih Bulut: You know, I remember… even, I think, Facebook changed its name around that time, maybe a few years back, or such. So it was a very hot topic. Everybody would like to do something in metaverse.

188 - > Fatih Bulut: obviously, with my expertise, I was tasked with, like, you know, looking into the security aspect of metaverse. So that's, like, how I come up with that, you know, block. I did some research, tried to understand, you know, the landscape. 189 - > Fatih Bulut: And then think about, you know, what are the security aspects of Metaverse.

190 - > Fatih Bulut: Interestingly, you know, I mean, metaverse, we have avatars and all, and, you know, different, digital entities. Similarly, I think there are parallels in today's world where we have AI agents. 191 - > Fatih Bulut: In that, you know, metaverse context, we were talking about identities. 192 - > Fatih Bulut: So how do we, for example, make sure that the identity is, you know, is something that we can prove?

How do we make sure that, you know, it's secure and all? 193 - > Fatih Bulut: Same problems that today we are dealing with the AI-based agents as well. When they operate, you know, who's responsible on what? What identity did they use?

Are they using the identity of the person or the process that started it, versus 194 - > Fatih Bulut: they're using their own identity. I think there are lots of debates and, … 195 - > Fatih Bulut: you know, ideas floating around that topic, too. So, you know, I think there are lots of parallels from metaverse to AI agents, but the context is, like, you know, at that time, it was a hot topic, and we wanted to look into the security aspects. 196 - > Fatih Bulut: Of it.

From a blogging perspective, I… I can't say that I'm an avid blogger, to be honest, but I do benefit from a lot of substacks and, like, you know, what people generate. 197 - > Fatih Bulut: I started to look a little bit, like, you know, more suspicious, more suspicious to the blogs, given that now AI is very capable of, like, you know, writing very good text. 198 - > Fatih Bulut: So I think it diminished the value of blogs a little bit, but there are people that I trust, there are, like, blogs that, like, I follow, which I do, you know, get benefit.

On the other side of the story is that with AI, you know, it's more polished. 199 - > Fatih Bulut: We see, like, you know, more, the story of the… 200 - > Fatih Bulut: blog is basically more coherent and all, so I think there are also positive aspects as well. But yeah, I mean, you know, I think it's the… blogging is, for me, it's more of, like, a learning, so that's why, you know, when I 201 - > Fatih Bulut: write something, it's sort of for me to learn and also share what I learn.

But yeah, I think everyone may have different, sort of, like, objectives on that. 202 - > Dewan Ahmed: Maybe we can, … filter out, … 203 - > Dewan Ahmed: human-generated blogs just using mdash as a filter. 204 - > Fatih Bulut: Yeah, yeah, that's a good idea. I mean, some of these posts, like, you know, they, … 205 - > Fatih Bulut: it's… you can easily tell that… and I, you know, I also know people who use M-2, and they're really pissed off, because… because, like, you know, they say that I use this in my, like, you know, regular writing, so don't blame me that this is… 206 - > Fatih Bulut: you know, LLM-generated text, so there is that aspect.

207 - > Dewan Ahmed: Yeah, I know some people will intentionally now add mistakes or typos in their writing just to prove that, hey, I'm a human writing this, so… 208 - > Dewan Ahmed: It's, very, very strange times. Now. 209 - > Dewan Ahmed: Talking about strange times, everyone seems to have AI in their LinkedIn title. Like, you're an actual, like, AI ML architect.

Your work has been in the AI way before it was cool. 210 - > Dewan Ahmed: So, how do you see the hype versus reality? What's one thing that makes you shake your head when you see the hype? 211 - > Fatih Bulut: I mean, there's definitely a certain level of hype in AI, for sure, but… 212 - > Fatih Bulut: it's fueled by the reality, let me put it that way.

And the reason is that, you know, I think AI is now at a place where 213 - > Fatih Bulut: we can take advantage of it and deliver features and products that would transform the businesses. 214 - > Fatih Bulut: And we see the example of this, you know, in multiple places. So it already happens. So it's a reality, in my opinion.

But in the meantime. 215 - > Fatih Bulut: I don't yet see that AI is at a place where we can confidently rely on it for all of our problems. And those are the areas, like, I shake my hands, you know, maybe we should slow down a little bit. Obviously.

216 - > Fatih Bulut: you know. 217 - > Fatih Bulut: All of us, like, working in this field, targeting autonomous systems, making more things, like, autonomous and automated, … 218 - > Fatih Bulut: But, there are use cases where you can do this today. 219 - > Fatih Bulut: But then there are use cases you can't because of the reliability requirements, and maybe healthcare and security, you know, may fall into some of these areas. So you have to make sure that the quality is there, because human lives, you know.

220 - > Fatih Bulut: at the… at the, you know, risk here. Another aspect that I can see is, is a little bit problematic is, I think we are a little bit unfair to AI, 221 - > Fatih Bulut: In comparison to human. So, when we look at some of the use cases in, let's say, security, I see humans also makes a lot of mistakes, you know, in terms of 222 - > Fatih Bulut: Yeah, extraction of information, or in terms of 223 - > Fatih Bulut: writing, you know, a software code and all. But we are more, 224 - > Fatih Bulut: you know, careful to… or we are more okay that humans make mistakes, versus if AI makes a mistake, we are, you know, like, it's on the niffs, so those sort of, problems.

So I think we're a little bit unfair to the AI in that sense, but I think that's also normal, because we wanted to 225 - > Fatih Bulut: make sure that AI actually, not just, like, get to the human level in certain tests, it actually precedes those. So I think it's, it's, you know, also a perception problem, too. … 226 - > Fatih Bulut: But, but yeah, I mean, you know, I think one thing that, you know, we need to be careful is, 227 - > Fatih Bulut: When people say, we can… 228 - > Fatih Bulut: automate everything, I think that's where I shake my hands, like, you know.

229 - > Fatih Bulut: I can't do that with that indeterminism, with, you know, … 230 - > Fatih Bulut: uncertainty in outputs, and with all the costs as well, you know, I don't think we are there yet, but there are use cases where maybe this is possible. 231 - > Dewan Ahmed: And conversely, what's one thing that you're really hopeful with with AI? So, let's say in the next 5 years, what's one area that you see massively impacted with AI? And that's something, like, you're certain will happen?

232 - > Fatih Bulut: I think the, the places where, 233 - > Fatih Bulut: And this may get a little bit technical, but… … 234 - > Fatih Bulut: The places that we have verifiable outputs, For example, … 235 - > Fatih Bulut: I can write a code and I can test it, whether it runs or not, or whether what the output is or not. 236 - > Fatih Bulut: So those are the areas where I think we're gonna see, a lot of improvements. 237 - > Fatih Bulut: And this applies to math as well, because, you know, you can verify the math solution.

238 - > Fatih Bulut: You can look at the, you know, output and then see if it's correct or not. 239 - > Fatih Bulut: So, the places where you have such verifiable solutions, where these reasoning models started to excel. 240 - > Fatih Bulut: I think those are the areas where I can see that we will see some more improvements. 241 - > Fatih Bulut: You know, with more time to compute and all.

… And, … 242 - > Fatih Bulut: So those are the areas. One thing that, like, you know, I am really hoping where AI gets better is the context window and effective use of it. 243 - > Fatih Bulut: As I mentioned, you know, we discuss about, like, 2 million tokens, but, you know, today, I don't think AI is there. 244 - > Fatih Bulut: where this is utilized effectively.

So I am hoping that, you know, we get to the point, where we can rely AI. When we put information, it will take this into the account for sure. I think that will, 245 - > Fatih Bulut: Opportunities as well, especially in the areas where the volume is huge, like in security or ops and, you know, those use cases. 246 - > Dewan Ahmed: This was the conversation with Fatih Bulut.

247 - > Dewan Ahmed: AI architect at Microsoft, master inventor at his previous place, IBM Research. Fati, it was fantastic to have this discussion with you. If our viewers and listeners would love to learn more about AI, cloud, and security, what can they do? Where they can find you?

248 - > Fatih Bulut: The best place to reach out to me, I think, is my LinkedIn account. I have a website and a blog as well, but, you know, the one that's most up-to-date is my LinkedIn account. 249 - > Dewan Ahmed: We'll be sure to link your LinkedIn account in the podcast description and the YouTube video description. If you haven't subscribed yet, please subscribe to our YouTube channel.

This is Ship Talk Podcast. I'm your host, Devon Ahmed. 250 - > Dewan Ahmed: We talk about the ins and outs, ups and downs of software delivery, and this season, Season 4, we're talking about how AI meets software delivery. Thank you, Fati.

251 - > Fatih Bulut: Thank you, Dewan.