Socket CISO: Build AI Security Tools That Solve Current Pains, Not Future Hype
Andrew Becherer discusses the hidden operational burdens of AI-built security tools and how founders can earn trust from security leaders.
Key points
- AI accelerates tool creation but introduces ongoing maintenance liabilities for security teams.
- Founders should address existing pain points rather than predicting future risks to gain trust.
- Becherer draws on experience building Datadog’s security program from a single employee.
Security leaders face a paradox where building programs is easier but securing organizations is harder. Socket CISO Andrew Becherer discussed this tension on the Early Adopters: CISO podcast. The conversation, recorded at Black Hat 2026, covers vendor evaluation and the impact of AI on security operations.
What is the operational cost of AI-built tools?
Agentic coding speeds up the creation of incident-response tooling and log analysis. However, Becherer noted that a working prototype creates ongoing responsibilities. Teams must account for reliability, shifting requirements, and long-term maintenance. The initial speed of AI development does not remove the need for sustained software upkeep.
How should founders pitch security solutions?
Becherer advised founders to focus on existing pain points and practical answers. Honest accounts of security gaps carry more weight than predictions about future problems. He shared a specific question he asks vendors to test their confidence. Answers that address current realities build trust, while speculative pitches often undermine deals.
What experience informs these views?
Becherer joined Datadog in 2015 as its only security employee. He reflected on how a 2016 breach changed the company’s approach to security. The foundational work supported the firm’s growth and provided lessons he still applies. His path highlights the challenges of starting security teams from scratch and scaling them effectively.
What comes next for security programs?
The discussion spans securing AI agents and the judgment required to turn tools into stronger programs. As AI accelerates both development and securing it, leaders must decide which vendors to trust. The focus remains on reliable, maintainable solutions rather than just rapid deployment capabilities.
Questions to ask your suppliers
Security teams should verify who maintains AI-generated code after initial deployment. Ask vendors how they handle changing requirements and reliability testing. Identify which internal stakeholders need visibility into these maintenance commitments. Ensure procurement checks for long-term support plans rather than just prototype features. This prevents unexpected operational burdens from shifting onto your staff later.
Background: AI agents
AI agents are software systems that perceive their environment, make decisions, and execute actions to achieve specific goals. They move beyond generating text to performing tasks like coding, scheduling, or data analysis. You must treat them as active participants in your network, not passive tools.
Read the full guide: AI Agents Examples: How Autonomous Software Changes Security
What to do and how to stay safe: Socket
- Review current AI-assisted tools for documented maintenance plans.
- Ask vendors who is responsible for code reliability long-term.
- Align procurement criteria with ongoing operational support needs.
- Train teams to evaluate vendor answers regarding technical debt.
Step-by-step guide: AI Usage Policies at Work: How to Prevent Data Leakage
General security guidance from the TechSec Feed newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Who discussed AI tool costs on the podcast?
Andrew Becherer, CISO at Socket, shared these insights on the Early Adopters: CISO podcast.
Where was this conversation recorded?
The episode was recorded at Black Hat 2026.
What experience does Becherer cite?
He draws on his time building security programs at Datadog, starting as the only security employee in 2015.
