The Start and Scale Podcast

The episode contains several genuine practitioner insights - particularly the 75% non-code finding, the deterministic-vs-probabilistic systems argument, and the misconfig-over-compromise thesis - but at least a third of the runtime is backstory, RSA small talk, YC anecdotes, and product-adjacent explanation that dilutes the density considerably.

“about 75% of the reviews that our customers run aren't code reviews. They're data privacy, vendor risk compliance, AI governance”

“I actually think that AI is not the perfect solution to every problem... sometimes you want a deterministic system and so you want something more like an FST or these rule based pieces because you know you'll get it 100% right every single time”

Two genuinely counterintuitive angles stand out: an AI company founder arguing for FST/deterministic systems over ML for some controls, and the contrarian claim that buyers don't need AI-specific security tools at all. The rest leans on common security practitioner framing without much first-principles novelty.

“like the best you can do in machine learning is 9, non in a bunch of nines. You can't guarantee 100% in a probabilistic system. It's just not possible”

“Do you really need an AI specific DLP solution or do you just need a DLP solution that thinks about AI as part of it?”

Emily is a genuine practitioner with verifiable depth: five years as AppSec lead for all of Alexa AI at Amazon and data security ownership at Moveworks, giving her direct experience with exactly the problems she's commercialising. She is a founder-operator, not a career thought leader, and her answers reflect real incident knowledge rather than conceptual framing.

“I spent my first five years at Amazon, oversaw AppSec for all of Alexa AI. So everything from the models running on device through the intelligent decisions in the cloud, our machine learning, compute platform, data platform”

“I then went to a company called Moveworks where I owned data security and privacy”

The episode is well-stocked with named vendors (FullStory, Zscaler, Gemini, Confluence, JIRA), named regulations (NYDFS Part 500, EU AI Act, Cyber Resilience Act, SOX, SEC), named certifications (PSA Level 3), and a concrete real-world incident from Moveworks. The 75% non-code figure is the headline stat, though no customer names, ARR figures, or hard outcome metrics are shared.

“about 75% of the reviews that our customers run aren't code reviews. They're data privacy, vendor risk compliance, AI governance”

“semiconductor companies have gone through their own kind of industry certification, for example, called psa. They're aligning PSA certs to Cyber Resilience act levels”

The host surfaces some genuinely useful topic areas (shadow AI, non-human identities, regulatory change) and shows self-awareness about not being a domain expert, but the follow-ups rarely press on mechanism or evidence, and affirmations like 'Wow,' 'That's insane,' and 'Brilliant' dominate the transitions with no meaningful pushback on any claim.

“Are you seeing um. Thank you by the way, that was a great explanation. And are you seeing a lot of uh, when you're doing your kind of like um, reviews through clearly, are you seeing a lot of shadow AI popping up that's just like not governed?”

“Wow. So when you're doing the other 75% reviews, what's the biggest vulnerability or the place where the most vulnerabilities, uh, show themselves?”