Transcript for "Code security in the Mythos era: hunt before you're hunted": Good afternoon, everyone. Welcome to this live webinar for, the topic on code security in the Mythos era, hunt before you're hunted. My name, and I'm gonna be your your MC as well and host today, is Satinder Kasria. I'm a technical product marketing manager here at Sonar. So I wanted to welcome you all, to the webinar. We'll wait for a couple more minutes, give, folks a few more minutes before they join in, so that we then we can, start the webinar. So, just gonna give folks a couple more minutes. We're almost about time to kick it off. Just waiting for a few more seconds. Alright. So, again, good good afternoon. Good evening, everyone, for joining us on this webinar. We're gonna talk about, code security in the Mythos era, today. Before we jump into the actual content, just a few housekeeping notes, for you to take care of. In terms of duration, we'll be around forty five minute session. We'll talk through a few slides. We'll do, a demo of how Hanoi agent can help you in solving this pain point. We'll have leave some time for q and a. If you have questions, feel free to, type in those questions in the chat box that you see in the on the screen. In terms of follow-up, we will be sharing a recording for this webinar, and we'll also be sharing, these slides out to you, as well. And then, what we would really appreciate is for you guys to, you know, take our survey. You know, it really helps us improve, you know, not only the content, but also, you know, what you're looking to learn more from, from Sonar in terms of, what matters to you. Moving on, in terms of the agenda today, you know, we've got a packed agenda. We'll talk about, you know, what are the different, mythos class frontier models? What do they mean? What does this new landscape look like? You know? And then, we'll talk about, you know, why is this an issue. Right? And how this these frontier models and especially these AI outputs is, is is really outpacing traditional security and leaving it far behind. Then we'll do a quick, overview of, you know, the logic flaws that we see in the field in in in in prevalence today. And then, you know, I'm gonna introduce you to, you know, our brand new offering here, which is SonarQube hunter agent, designed to to really address, the challenges in this Mythos era code security. We'll quickly look at, you know, how it works. We'll do a quick demo. And then finally, we'll recap, and and, and how you can actually get started in really protecting yourself in this, age of, mythos. You know, let's start with, you know, what are mythos class models? You know, we've all heard, you know, it's on top of news, you know, on the news cycle, and it's been dominating that, for, you know, for the last five to six months that, these have been out. If you look, you know, in layman terms, you know, these frontier models, you know, the these are designed purposefully and built for coding and cybersecurity. So they're not the a general chatbot model, you know, that you see, that can be used in in other, use cases. These are reasoning and auto autonomous. So what that means is they can work on their own, and we'll dive deep a little bit into those, capabilities shortly as well. And it it really has, upskilled the level of, you know, of black hats, you know, in terms of capabilities. So you don't need to be an expert to use these, mythos class models. And, you know, I use here and throughout the webinar, I might I'll I'll use Mythos as an example, but that's not just the only model out there. You know? All other, you know, AI labs have similar models, out there that are available. So whether it's from DeepSeq, whether it's from, OpenAI, and so there are models other models that are available, or I should say fall in the same category or same class. Let's let's look at, you know, what is really happening in in our software development life cycle today. You know, the biggest thing what we're seeing is, you know, with the introduction of, you know, AI, you know, we're shipping code faster than the traditional security teams can, keep pace with what, what what's happening. And how how what that means is, you know, let's look at certain metrics. Right? Speed. So now, it's, the time to exploit or time to get, an exploit out for a vulnerability has shrunk. And, you know, I have a couple of slides on those as well. You know, it's much faster. So the teams have to be on their toes, have to have the right, security posture to be able to prevent against those exploitation in production. If you look at the volume, AI agents write, you know, almost 40% of committed code. And this is a a stat we had from our own developer survey last year. And some of the the recent numbers that we are seeing is as high as almost 80% of committed code is now AI generated. Then the other piece here is that, in terms of a technology stack today, there is a blind spot. You know, SAST, works great at and excels at pattern matching, looking at, you know, issues like, injection vulnerabilities, you know, cross site scripting. But, you know, it's not designed to look at the intent of the code. That's by design. So that's a blind spot, today. And then how most customers fill that blind spot or the coverage gap is typically with a a security review that's done manually or an AI pen or or a pen test, engagement that's done, perhaps twice a year, to identify those logic flaws that cannot be caught within the, SDLC as you're writing code. The biggest thing here is also that the issues are what what we see from logic flaws, are proven. You know, they're not hypothetical. They're not edge cases, and we'll we'll look at those as we go through the next slides. But going back to, you know, the middle class models. Right? You know, let's look at, you know, what is the risk that they pose to our software development life cycle today? You know, what makes them so, I don't wanna call it dangerous, but they are extremely powerful. And, you know, in the hands of the right wrong right folks, they can be really, supportive, whereas in the hands of wrong people, you know, they can really cause a lot of damage. You know, the the first one is autonomous coding. Right? So these AI agents are autonomous, means they can plan, they can write, they can build code end to end without any human intervention. Right? And they have the ability to build that reasoning over code base, without any, any assistance needed. You know, the the the really interesting part is that, because they can build that context with multiple agents, you know, they can string together, you know, really complex, tool chains and create or find ways to exploit really complex vulnerabilities by chaining, different aspects within the code base. You know, it's not just a single vulnerability in a single piece of, environment, but, you know, they they can find ways to get into the application code base. And then, you know, finally, you know, they can turn that vulnerability or research into an exploit without any, any skills, needed from, from the users who are, using these models. You know, perfect example, and this is on top of news, even recently, you know, as of yesterday was, you know, OpenAI's, AI agent, going and or going rogue agent into Australian government's website that happened a couple months ago, and it's just being, released publicly and disclosed publicly to, in the last couple days. So these are some of the instances where we're seeing that these models can be really powerful. And what has done is, you know, it has really surfaced these, the power of these middle class models up to the security teams, and it's a boardroom discussion. How do we enable enterprises to so that they are well ahead of the curve when we look at the capabilities of these models? If you look at what the landscape is on how that landscape is shifted is, you know, this is not just raising the floor. It's raising the ceiling for, you know, security teams, you know, in terms of what they need to do. The the challenges that we're seeing is the offense versus defense gap is definitely widened. You know, the attack speed, with what these models can do has really accelerated. Whereas if you look at, you know, the traditional patching time, it's still around fifty days in an in in a u in a typical enterprise. So that really speaks to, the importance of, you know, how quickly the security teams need to respond. The second, challenge here is, you know, we often saw that, you know, the low hanging fruit for the attackers was always, you know, new applications, things that weren't, you know, the weren't patched, soon enough. But now what we are seeing is that decades old, security vulnerabilities or bugs aren't just saved by App Security. So if you have a, you know, a really old code base and old application, and then, you know, it's it's not, you know, now as a security team, you need to be more conscious that, you know, with the power of these models, it could easily, you know, someone could easily weaponize and look at those old code bases and discover bugs or vulnerabilities that are fifteen, twenty years old that haven't been patched. So so, again, really opening up the surf attack surface for, for the security teams to cover. And and finally, you know, what it has done, as I mentioned earlier, is that adversaries don't need to be skilled anymore. Right? You know, traditionally, we we always, believe that, you know, the attackers or adversaries had to be well skilled to understand the code base, the applications, how they work, the context to be able to chain complex vulnerabilities. But now with these models, you know, it's become much more easier. Right? All you need to do is, you know, give some prompts, and then, you know, you're able to use the power of these models to create those, vulnerabilities. You know, this is, you know, just, you know, highlighting, the challenge that, you know, I spoke earlier that the exploit window is closing. You know, you know, and this is, content, that we've taken from 0dayclock.com as well as, excuse me, the the EdgeScan 2026 vulnerability stats report. What you see here is, you know, extreme, shift that's happened is, you know, if you look at the the decade before 2020, you know, it took, you know, years or you know, for the adversaries to build exploits, you know, and and and get a working exploit based on a vulnerability. Since 2020, you know, we've seen this shift that, you know, that process or that timeline has shrunk, and now it's a much more accelerated process. You know, 2024, we saw, you know, once a vulnerability was disclosed, you know, it was roughly about a few months of time, before you could see a live exploit in in in real time, for those, vulnerabilities out that have been disclosed. Today, this is down to an hour. In fact, you know, one of the the latest reports from, Google Trends, m trends, which is the Mandiant trend report, is that this time, in '20 first half of twenty twenty six, that number has gone negative, and which is around seven and a half hours of negative time. So what it means is, in some cases where a vulnerability has not been publicly disclosed, there has been an instance where we've seen a live exploit before that vulnerability became public. So that's the risk the security teams are managing here, that we wanna want, the security teams, to be aware of. Let's quantify, you know, what is that risk in terms of where that risk lies within the code base. You know, what we are looking or what we are going to cover here is the logic flaws. You know, as I mentioned earlier, you know, SAST, you know, in terms of technology is designed well designed to look at, you know, structured patterns, structured approach, you know, algorithmic approach, looking at the code base, algorithmically and seeing, are there any injection flaws? Are there any is there any cross site scripting happening? Is there you know? So but what SAS cannot cover is the logic flaws, and these logic flaws are, the top categories, within the OWASP. You know, what I here have is the latest OWASP top 10, twenty twenty five that came out, you know, late last year, around December, January where it was published. If you look at the, the number one risk category for flaws across the board is broken access control, and this has been the top one category since 2021. So that speaks to the volume of the critical, nature of these, logic flaws that exist within the code base. You know, the other ones we see here on number six and number seven, insecure design, authentication failure, these are all major categories, you know, that we see for logic flaws across the base. The way we, you know, wanna, explain logic flaws are, if you look at the code, the code is written correctly, but where the flaw actually, emanates is from the intent. You know, it's supposed to work or the way it's written is designed accurately, but adversaries are able to manipulate that intent, that logic that exists within the code base, to to really, circumvent, those flaws and use them, in a different way. And we'll look at an example of how that works in in, in real real life as well. I mentioned, so the three categories of logic flaws, you know, broken access control, business logic views, and authentication and access control failures are the ones. For the sake of time for this webinar, we'll just look at broken access control. So what broken access control means is that if you have a multi tenant application or a single user application, you know, I as a user can view or modify data and actions, not only for myself, but for other folks within the, within that application. Now this is a this is a a purely intent flaw where as a user, you know, I should be able to access my own data within the application, but I should not be able to access or manipulate the input variables so that I can get access to, data for other users within that application. So that is, a real world example, for, you know, for, for this logic flaw that's, really, available or or that we see in prevalence out there. The other one, is, we talked briefly, and touched is business logic flaws. So so this is where, you know, where the users are able to, really manipulate the intent, the business logic to circumvent the process. And, you know, perfect example here is if you have if there's an ecommerce website that has, you know, discount tokens or discount, limit on on purchases, you know, as an adversary, you know, you could manipulate that logic to really stack on multiple discount codes, to really abuse that, that capability within the within the platform. And and this is, again, giving you giving an example that, there's nothing wrong with the code inherently. The code is written accurately to define a use case where you if you, as a user, have a discount code, you're able to apply the discount code within the within the process. But, that logic can be abused, by the by the an adversary to stack, and and that's, another real world example of, the logic flaw. The the last one, is, you know, authentication and session control failures. And, again, this is all related to, you know, session tokens not expiring accurately and the ability for users to impersonate, you know, a legitimate user to access, the application and and the database. You know, I I quickly walked through, you know, some of these logic flaws. You know, I do wanna, you know, highlight, you know, as I mentioned on on my slide earlier, that these are not hypothetical. These are not edge use cases. These are real world use cases, real world logic flaws that have been, you know, manipulated, that have resulted in significant breaches over the past few years. You know, here, you know, I've seen I've just shared a couple of those examples. And and and, again, you know, these are, you know, what we are seeing is with the volume of code that's being generated by, you know, the AI agents, it is becoming even more critical for the security teams to identify these logic flaws before they actually go into production. Because now with middle class models, it is much easier to go ahead and exploit or or or use those logic flaws in production because the the security teams are still far behind in catching up to, in the current process the way it works. You know, this is our, you know, the outcome or or the the pain point is, you know, if you look at current process, you know, a post release audit where, you know, the security team is doing, you know, a manual review, you know, twice a year or or if the security team is doing, you know, a pen test engagement twice a year or you know, that's not a viable strategy, a, with the volume of code and, b, with the pace of, acceleration of, you know, the application. So it's it's no longer, you know, a strategy that security teams and development teams can rely on to protect against the risks being posed by these frontier models. What we are, you know, happy to announce, is the general availability and, release of hunter agent, SonarQube hunter agent, which is our offering to really help us, help security teams identify, you know, these logic flaws, while the development is still happening. So it is available on SonarQube server and SonarQube cloud, enterprise. It scans across, existing, repositories on GitHub, GitLab, Azure DevOps. It does, focus on, finding those, logic vulnerabilities under those three categories that I mentioned earlier, broken access control, business logic flaw abuse, and authentication and session flaws. And I'll walk through, you know, how hunt hunter agent actually performs these and how it's unique. So think of it as an AI security agent. You know, it follows a a playbook. It's a very structured approach. It's not a probabilistic approach. It's a structured approach that is paired with LLM reasoning, within, within, hunter agent. And what it essentially does is, it reasons through your entire code base like a security researcher would. You know, once you point or or connect a project, endpoint, Hunter agent to, using the SonarQube cloud, or SonarQube server, you know, Hunter agent walks through and reasons through line by line of your code as a security researcher would. And as it goes through the code, you know, it will spawn multiple sub agents if it finds and discovers a possible, business logic abuse or, or one of those logic flaws that we talked in the previous categories. Once it finds those flaws, then it also uses another sub agent to actually go ahead and validate that this is in reality a flaw that can be exploited. It's a vulnerability that can be exploited. It can build. So within its own sandbox, or enclosed environment, it builds that exploit to validate that this essentially is a business logic vault. So what it means is that when you see those surface findings within the SonarQube issues, they have been validated. So what it, really does is it minimizes false positives. So we're not sending you, drowning, you know, your security and your development teams into, a really, you know, a false alarm on, multiple alerts. But what we are is we are focused on finding the true value the true value logic flaws that mean that you your teams really care about, and they're within the existing workflows for your team. It is language agnostic. We support across our code base that we have, today. Let's look at, you know, why is it different? Why is it unique? You know, why are we talking about, you know, HANA agent as an AI agent? You know, one of the things I I spoke earlier is we're covering a blind spot that exists today in most tech stacks. Right? You know, which is, you know, StAST is really great at discovering structured flaws. That's how it's designed to do. It's not designed to interpret logic within a code base. You know, so we're covering that blind spot. You know? And the issues that hunter agent covers is 19 different issues across broken access control, business logic, idle vulnerabilities. So, again, those are some of the key areas that, hunter agent, covers, for for security teams today. It is scalable. Right? So, you know, you can do analysis, easily and and scale past 10,000,000 lines of code. And once it does the code, you know, it does not need to rescan the entire code against. It does in incremental scans so that, it's really finding new additional logic flaws, vulnerabilities within the code base and not surfacing, the old findings, as in there. In our own, testing, in our own work that we've done with hunter agent, we've found over 200 day vulnerabilities in popular, open source applications. So that speaks to the the wall the the efficacy of hunter agent in discovering those, logic flaws. The second one, you know, I I I mentioned earlier is is also precision, which is all about, you know, making sure that, you know, the findings that we are surfacing, that hunter agent is surfacing are real confirmed findings, real exploits that could or real vulnerabilities that could be exploited, in public. So, you know, and, you know, this is where, you know, we're really proud to say, you know, we're offer you know, we're getting, in real world environments, 90%, average precision in terms of those, surface findings findings that we are surfacing. The last, but not least is it's repeatable. Right? Even though we're using our own algorithmic reasoning paired with the probabilistic, power of LMM models underneath our hunter agent, you know, because of its structured playbook approach, you know, if you scan the same repository with hunter agent, you know, you get same results. You know? Unlike, you know, if you, ask a lot of security teams today who are using, you know, other LMM model, reasoning models or tools, to find logic flaws, those, approaches are not structured. You know, they're probabilistic. So, you know, your results could vary. You know, in one run, you might get 20, 20, vulnerabilities versus the other run. It might discover five different one or or, none at all. And, you know, so so that's the the the the main difference is using other LLM, reasoning or generic LLM reasoning, versus SonarQube Hunter agents' algorithmic reasoning paired with, LLM. How does this, you know, really help, you know, our customers, in their, you know, what we call now is agent development software life cycle. Right? What we believe is, you know, this is truly delivering a zero trust multilayer approach, covering a broad, landscape a threat landscape that is out there for customers. Right? And what we what I mean by that is, you know, each layer of technology, each layer of security capabilities, really minimize the risk of those, vulnerabilities getting out in the public before they could be exploited by the, you know, frontier models. Number the first layer absolutely is, you know, our own, SonarQube traditional layer of algorithmic, method using SAST. Right? So it's a methodical coverage. You know, it walks through code, every single line, more algorithmic, consistent detection, fast, cost efficient, you know, finding issues that are pattern based, in looking at injection vulnerabilities. And then, you know, the second layer is we were looking at, you know, other air, agentic reasoning through our vortex and guitar, product portfolio is looking at inline detection, you know, covering, the risk within the CICD loop, and you're continuous monitoring, looking at the PRs and, fixing issues before, they get into the commit. And it's all about scaling with the velocity of, the AI commit that's happening. And finally, you add on, you know, hunter agent to catch those hard to catch, you know, logic flaws that are missed by, you know, the the previous two layers, you know, for which, you know, you you traditionally rely on, you know, other technologies or later products. You know, at Sonar, we believe, you know, not one single layer can catch everything. So, you know, we are combining multiple layers to to really catch, those risks across a breadth of the landscape that we see from our customers. What does it really offer, you know, to, you know, our customers? Right? You know, the way we look at it is, you know, hunter agent really adds this complimentary layer, to Sonar's SaaS, you know. And, you know, one of the things, you know, I was talking to a CISO recently, and he mentioned that, you know, the security teams are always, behind the curve and looking at how quickly can we detect flaws or detect issues whether, you know, in production or before production. Right? And, one of the terms that stood out to me or the quotes was that, he he said is, prevention beats, both, whether it's a slow detection or fast detection. Right? What I mean by that, you know, my interpretation is, catching those flaws early on before it actually gets into production, a, it's easier to fix those issues, a, when they are the least expensive. And, b, now with if you look at the the power in those Frontier models, if you are not catching those flaws fast enough, the probability of an exploit using those, logic flaws or those vulnerabilities being exploited, it just goes up significantly. And, so that's the the risk of, you know, not catching those flaws earlier. That's the risk of not using proactive prevention versus relying on, the current model of, you know, detection. You know, hunter agent, you know, as I mentioned, is a complimentary layer. And the more powerful, the reasoning layer, the LLMs become, the more powerful the hunter agent will become as well as we, you know, pair that, LLM power with our own, logic reasoning, within our product. I do have a little screenshot of how it looks like, and I'm gonna go through a quick, demo as well. Let me switch my screens now and, go to a quick demo for, Hunter agent. Alright. So, hopefully, you know, everyone is able to see my screen here. So what I am, connected in, today is, our SonarQube cloud, instance. So in the cloud instance let me quickly look at go back in our screen. So as you can see, I'm logged into a SonarQube cloud instance with hunter agent, enabled on my account. So as a SonarQube customer today, you know, you should be able to see hunter agent available. You know, if you would like to test it, and, you know, we'll have some next steps and actions on how you can actually enable use it, on a in a trial basis and how to, reach out to your to your, to your team, to to really, take use of hunter agent. As I mentioned earlier and I have this, on a, on a Zoom on the page where I'm looking at, the scans for a project. Now, I've already created this application called Slackish back end application. The way this application is, it's a multitenant application, you know, where similar to a Slack. Right? And, you know, just in for the sake of time and brevity, you know, I'm just gonna walk through what we're trying to achieve here. So the application, you know, multiple, different organizations could have different groups of of, users, connect information or or use as a Slack channel, and each channel should essentially be locked to that organization. You know, think of it as your, you know, Slack within your organization where you are using Slack. And then there's another organization that's using Slack, but it's locked within those, boundaries of those organizations. But, you know, a perfect example of an idle vulnerability for a sim for a like to like application would be that if someone from organization a is just able to search based on a username or user number, you know, preferably a user number because, you know, it's, defined incorrectly as a logic, they would be able to then look at, the details of the other, organization, which in a sense you know, if I'm a user in org a, I should be able to search messages and content for a user number within my org without any issues. But the challenge comes is if I'm a user from org b, you know, I should not be able to, access data from organization a, if I use the same username or user number. So that's, you know, a critical or or typical example of an IDO vulnerability. So what I've done here is, you know, I've taken that code base. I've used it. I've pointed that, hunter agent, and hit the scan. Now typically, depending on the code base, the size, it'll take some time. So, you know, what I've done here is I already ran the scan, for our demo purposes. And what I see, what I do have here is, the list of the findings, you know, that have been issues that have been, shown by, hunter agent. You know, I'm just gonna zoom a little bit out, show where how it looks like. So as you can see, you know, we're seeing here's the the different issues that hunter agent has detected. If I go back, you know, I can look at a much higher level category of findings. And as you can see, these are all blocker, key blocker issues. And, you know, if I click on, you know, any of these issues, you know, it takes me to the exact issue. I can click into the specific issue, you know, and hunter agent gives me where the issue acts actually exists. You know, I do have the ability, to even reason and look at the context. You know, why is this an issue? Right? You know, how it this could be, used, by an attacker, how this could be used by an adversary in a different way. And and then I do finally we do offer the details, in terms of how can you fix it. Now, you know, this is where, you know, what we'll, do is, you know, in a typical workflow, environment, security teams would assign this to the developer team development team to fix it to a individual developer. But in, you know, in in our new agent agentic driven software, model, you can assign this to, SonarQube remediation agent as well. So SonarQube remediation agent can fix, you know, the issues that have been detected by a SonarQube Hunter agent. So, again, you know, this just goes to the value, that hunter agent delivers. And these issues are raised as blockers, within, within the the quality gate. So, you know, your security teams have full visibility across. And, the core value is that your development team, which actually owns fixings fixing these issues, you know, they can see these findings within their existing workflow. So there is no config required. There is no no new setup required. You know, simply, you know, go to hunter agent. I'm not the project administrator here, but, all you need to do is point hunter agent to the repository, scan now. And as it goes and reads the code base, it builds through, the the analysis. It will surface those findings within, your existing SonarQube workflow. So so that's the a a quick demo of, you know, Hunter agent. I'm just gonna switch back to my, slides here. Alright. Hopefully, everyone is able to see my slides again. There we go. You know, wrapping up where we are, you know, what is, you know, the the value proposition for SonarQube Hunter agent? You know, the the first and foremost, you know, it's covering a blind spot that, you know, most customers have today. And it's not only covering that blind spot, but it is automating that blind spot. You know, just the security team or the development team can run hunter agent. It's an on demand agent. So you can run it on demand or you can schedule it. And then, what it does is it'll help detect those zero days, those deep logic flaws that we talked about earlier before they get into the code base. And, before they stay in the code base in public, before they're even discovered by manual reviews or pen test engagements. The second major, you know, value proposition is no new workflow, no new dashboards, no new console, no context switching. You know, your all these logic findings surface within your existing, SonarQube workflow. There's nothing new to install. There's no new config. There's no new script to run. You simply, get those, findings within your, existing workflows for your teams to work on. Third, you know, high precision. You know, we understand that security teams and development teams, the challenge of drowning in false alerts and false positives. So, you know, we at SonarQube here take pride in our approach is how can we minimize that for our team so that they can, you know, it's better adoption, it's better efficacy for what they do. So with 80 to 90% precision, we you know, as a developer, you can trust that these findings are real, for, that we've discovered. And finally is, you know, independent by design. You know, this is, again, going back to, the core fundamental is SonarQube is the independent, platform for code verification. And, you know, whether that code generation is happening within your IDE, whether it's happening within your CLI for your development team, or if it's happening with, you know, agents across your, development life cycle. And, you know, we offer that independence from, the LLM reasoning model. So, you you can have the same code write the same LLM write that code and then also use the same LLM to, verify the code for any vulnerabilities or issues. So SonarQube offers that independence, that, that, second layer of code verification that's independent across your entire code base. With that, you know, I'm, at the end of my slides. You know, hopefully, you know, you found, you know, the slides, insightful in terms of the threats that are being posed that is being posed by these Frontier models. The goal here is, you know, we warn the security teams, the development teams to hunt for these issues before they can be hunted by Frontier models or your adversaries to be exploited. You know, we'd love to, you know, share more details. As I mentioned earlier, we'll share these slides, in a follow-up email. You can go online and watch hunter cube hunter agent in action, in a more detailed demo that's available as well. If you have more questions, if you would love to do a trial for SonarQube hunter agent within your, organization, you know, please do engage your sales team, reach out to your sales team or contact sales online as well to be able to, get details on how you can use, a SonarQube Hunter agent, for a trial in your code base. With that, you know, I, would like to thank you everyone for your time, and we'll, open it up for questions. Hey. Thank you so much, Satinder. I just wanna ask a a couple questions. One is I was hoping that you could speak a little bit more to, the overlap and if there's, any, complimentary, fitting between existing security tools, SonarQube, and then the Hunter agent? That's a great question, Kellyanne. And, again, if you look at, you know, today, how these logic flaws are, you know, caught by, the security teams. So the current workflow is all either through a manual review where once the code is compiled, once the, you know, the product when the once the code is in deployment, you know, typically, you know, security teams would use, tools like a DAST to discover some vulnerabilities, some of those logic flaws, or they would use, a manual review where they will assign a a security researcher or one of their senior developers to go through the, application and then try to find those, logic flaws. And the third way where, you know, organizations discover these flaws is through, a pen test engagement where, you know, you would, bring in an external agency or have a red red team, if it's a large enough organization to go in and discover those, logic laws. So there's two ways we're seeing, to address the same issues. The first one is from the outwards where once the code is deployed, once the application is live, it's finding those ways that it could be exploited by adversaries through those DAST and pen test engagement. Where we believe Sonar believes, the value for our customer lies is through within the code base. So we wanna help our security teams and development teams discover these and identify these issues while they're still within the code base and has not gone live. Right? So it's all about proactive prevention. So here, we are complementing existing stacks, security stacks. So we're not ripping out, you know, DAST. We're not ripping out, you know, the the the the SAST. What we are looking at is we're complementing existing tool set so that we are able to identify those logic flaws early on within the life cycle versus where they're being, discovered late in the in in the game today. And, you know, the best way to look at it, Killian, I would say is start left. You know, everyone says shift left, but I think with hunter agent, what we are enabling our security and development teams is to start left by catching those logic flaws early on. Yeah. That makes a lot of sense. Thank you very much. Another question I was hoping you could speak to is, which which teams would be benefiting the most from this? You know, who should be most interested in in the Hunter agent? That's, again, a great question, Killian. And, you know, it will, you know, completely depend on the maturity of the software development life cycle within our organization. You know? And then I've seen this, you know, spread where you know, I've seen, in large organizations where there is a dedicated AppSec security team who are responsible for, you know, looking at these or catching these logic flaws, you know, this is a perfect, you know, sir a perfect toolset for for that security team so that they can identify those flaws early on. Where I'm also seeing where we're also seeing is, Killeen, is that there's this convergence happening with start left with between development and security teams. Right? And, you know, you know, it's not you know, it's actually pretty common now for us for me, what I'm seeing is development teams are being tasked that, hey. You have to help catch these flaws early on as well. Right? And using this tool as a bridge between security and development team, I think those what we're seeing is both those teams are finding value, in different ways using hunter agent. The security teams are able to identify those blocker issues early on, and the development teams are now, informed early on. Here's the logic flaw. You know? How do we fix it? And they're fixing that flaw, when it's the easiest to fix, before it gets into commit. So, you know, we're seeing that, both teams are finding, immense value with hunter agent. Yeah. Well, you've mentioned a couple times now, you know, not just shifting left, but starting left and finding a lot of these issues earlier. I was wondering if you could speak a little bit more to the business value of of finding these issues earlier and earlier. Yeah. Again, great question, Gillian. You know, and I'm gonna tie it back to, you know, what our topic today was, you know, in you know, especially code security in this mythos era. Right? You know, if you're looking at, you know, the the biggest risk, challenge that, you know, CISO security teams are facing in terms of business value is how do we minimize risk in this new, era of Frontier models that could, really put them at the risk, at the surface attack surface being expanded. So with hunter agent, you are minimizing that risk, for your for your CSO. You're saying we're we have full visibility into our logic flaws that are complex, that are hard to catch. We're catching them earlier, so we're not finding them late in the process. So you're improving your security posture immensely. And the second big is, you know, it's kind of an understated, sometimes value is the cost of finding an issue of finding an issue early on during development. And and fixing it is much lower than finding one in once it's deployed. Right? And and god forbid, if there is a a a a potential breach, you know, you're also looking at, you know, not only the cost of a breach, but the damage to the brand reputation, the risk involved, and not to speak of the regulatory, concerns, environment that we are in today. You know, that's an that's, again, it's all about minimizing risk and enabling teams to move faster and, with a higher velocity. And I would say the biggest, value, would be you don't wanna sacrifice velocity you don't wanna sacrifice security for velocity. You wanna use these AI tools to maximize output, maximize innovation without sacrificing security, and that would be, I think, the business value for our users. Yeah. Thank you so much. Very, very helpful. Great. Do we have any other questions, on the chat, that, Killeen, we wanna surface here? We've we we've answered a few, in the chat. You know, I I I think we should be good for for right now. Great. Perfect. Well, you know, I would like to thank everyone, for for your time this afternoon, this evening, and, listening. to us, on SonarQube Hunter agent. Again, you know, hopefully, you found the content insightful, helpful. And, if you have any questions, please reach out to your Sonar, SonarQube, sales team, within your region, or fill out the the online contact form. Would love to hear the feedback and then, from you in our follow-up survey, and we'll be sharing the content in a follow-up email as well. So, again, thank you so much for joining. Bye.