A CDN CTO Warns: Half Your Engineers Will Fight Exploits for 18 Months
Vulnerability disclosures have accelerated from once a year to multiple times a week. A TLS root key was cracked using only the seed digit 4. Half of engineering resources will focus on security over the next 18 months.
The video won't play here. Listen to the audio instead:
The argument · tap a timestamp to hear it
Vulnerability disclosures shifted from annual disasters to weekly occurrences
Internet events on the scale of log4j used to happen about once a year, and when they did, Cloudflare would mobilize the entire company to protect paying and free customers alike. Over the past three to six months, reported vulnerabilities have grown exponentially. Events of log4j magnitude now happen weekly—most just aren't publicly reported. Dane forecasts that over the next 18 months, most engineering teams will spend the majority of their time on security.
— Dane KnechtA TLS root key was cracked with nothing but the digit 4
A WebPKI root key protecting TLS connections across the internet was discovered to have been seeded with just the digit 4—because cryptographic security relies entirely on randomness (which is why Cloudflare uses lava lamps as a randomness source), weak seeds are easily reversed. Dane noted that just a week before the interview, OpenAI had already cracked the seed of the NIST elliptic curves published in 2000, demonstrating that AI models' capabilities in cryptanalysis are rapidly approaching the frontier.
— Dane KnechtHigh school students are using AI agents to conduct nation-state attacks
Several major recent exploits were not nation-state operations but high school students wielding AI agents as a new tool. They used to compete in CTF capture-the-flag competitions; now they point agents at a target region to find vulnerabilities, incentivized by real bug bounties. Dane's assessment: agents have democratized attack capabilities that only nation-states possessed before. This is the first time in 15 years that senior technologists are seriously discussing physically isolating critical systems.
— Dane KnechtReducing attack surface requires humans; AI models make it harder
Dane says the answer lies in first principles: reduce attack surface, write less code to leave fewer places for bugs to hide. But he admits current AI models are part of the problem. AI is verbose, biased toward long and complex code—it doesn't naturally do subtraction. Cutting code by an order of magnitude and judging ‘whether this design actually holds’ still requires human judgment. You need engineer training, security review, and process discipline together—it's not something model upgrades alone can solve.
— Dane KnechtAgents browse a thousand pages a minute, but nobody's paying for it
Dane describes the current internet as ‘a chaotic middle ground’: humans and AI agents share the same web infrastructure designed for humans, agents can traverse a thousand pages per minute, yet there's no matching economic model. His proposed solution: websites already know their CPM, and agents could decide whether to pay for each read, but this requires payment infrastructure supporting millions of micropayments per second—a system he believes will take ‘two years’ to mature, though agents will accelerate it.
— Dane KnechtOne tool replaced an entire three-team workflow
In May this year Cloudflare went through a difficult restructuring—their first intentional layoff. Dane likens the company to a factory floor being redesigned: before, a product manager wanting to send a customer email had to work through BI pulling the list, marketing adjusting the tone, and marketing operations hitting send—three teams. After restructuring, one tool: the product manager describes the target audience and drafts the email, the system rewrites it in Cloudflare's voice, and approval is one click—not three teams each working faster, but one tool that replaced the entire workflow.
— Dane KnechtA 5,000-person company hired 1,000 interns to learn AI
Two years ago Cloudflare hired roughly 200 interns. Dane noticed they were a truly ‘AI-native’ generation—take away AI and some of them might not function. Managers who worked with this cohort afterward adopted AI tools noticeably faster. So this year the 5,000-person company hired 1,000 interns at once—not following some master plan to redesign workflows per department, but letting numbers and grassroots experimentation drive the organization to genuinely learn how to use AI.
— Dane KnechtSecurity capabilities must be open-sourced; attackers will get them anyway
On the question of whether open-source models enable cyberattacks, Dane is clear: long-term, security capabilities must be open, because attackers will get them anyway—the only people locked out are those who can't afford top-tier proprietary models but equally need defenses. This matches his advice at the interview's end for ordinary websites: put your infrastructure behind services like Cloudflare that offer free security, because major security patches (like last year's React vulnerability) Cloudflare shares freely with everyone, not just paying customers.
— Dane KnechtIn their own words · checked verbatim
I think there's a stat that was put up earlier today that during one of our keynotes, where it was showing that I think over 50% of engineering time is going to be spent on security.
Dane Knecht3:04
high school kids even that are going to call them agent kitties now
Dane Knecht5:13
This is the first time in 15 years I've heard serious technical people say things like, well, we should just like air gap everything important.
Dane Knecht6:23
I kind of go back to first principles of there is you want to reduce your attack surface area. The easiest thing you can do is to give less places for there to be vulnerabilities.
Dane Knecht9:40
we're in the messy middle right now where humans and agents are riding the same rails on the internet
Dane Knecht12:45
AI has become the tool that's causing this kind of security apocalypse
Dane Knecht37:32
I think over time, it all has to be open because everyone's going to get access to it anyways. you know, that's how open source tends to work.
Dane Knecht38:32
Figures
| Engineering time for security (next 18 months) | 50%+ | 3:04 |
| Greg Brockman's prediction for 2027 | Security token spending will equal engineering spending | 7:28 |
| Software patch backlog | 70 years | 8:35 |
| Cloudflare red team headcount | Currently 1; expanding to 4-5 by end of next year | 35:26 |
Glossary
- CVE
- Industry-standard identifier for software security vulnerabilities.
- WebPKI
- Public key infrastructure that provides the trust chain for internet TLS connections.
- Zero Trust
- Security model that assumes no device or network is inherently trustworthy; verification required for every access.
- AEO
- Optimization enabling AI agents rather than humans to discover and read website content.
- X402
- Payment protocol built on HTTP 402 status code for inter-agent micropayments on the internet.
- CPM
- Cost Per Thousand impressions; standard metric for ad pricing and website revenue measurement.
How to listen
Founders, engineers, and investors focused on AI security risks, internet infrastructure, or how enterprises allocate security budgets.
From 20:07: details about Cloudflare OS internals—minimal relevance for non-Cloudflare employees; safe to skip.