Socket CISO Becherer Shares Lessons on AI Tool Maintenance and Vendor Trust

Socket Chief Information Security Officer Andrew Becherer recently appeared on the Early Adopters: CISO podcast, recorded at Black Hat 2026. The conversation focuses on the practical challenges of building security programmes and evaluating vendor trust in an era where artificial intelligence accelerates both software development and the work required to secure it.

Root cause

Becherer draws on his experience building security programmes from scratch, including his time at Datadog where he joined as the sole security employee in 2015. He reflects on how the company’s 2016 breach fundamentally changed its approach to security. This historical context informs his current views on the foundational work necessary to support organisational growth and the lessons he continues to apply in modern security leadership roles.

Attack path

The discussion examines how agentic coding alters the decision between building or buying security tools. While AI can speed up tasks such as log analysis and incident-response tool creation, a working prototype introduces ongoing responsibilities. Teams must still consider reliability, changing requirements, and who will maintain the software years after its initial creation, rather than relying solely on the speed of initial development.

Affected versions

The podcast covers Becherer’s unconventional path into cybersecurity and the growing challenge of securing AI agents. Throughout the conversation, he returns to the judgment required to turn better tools into a stronger security programme. He offers a candid look at what makes a security buyer receptive to a pitch, emphasising that existing pain and practical answers carry more weight than predictions about problems that might become urgent years from now.

Mitigation

• Evaluate vendors based on honest accounts of security gaps.
• Consider the long-term maintenance burden of AI-built tools.
• Focus pitches on solving existing pain points for security teams.

Why it matters

Security leaders face increasing pressure to adopt new technologies while managing complex risks. Understanding the hidden costs of AI-driven development helps teams make informed decisions about tooling. Evaluating vendor trust requires looking beyond initial prototypes to long-term maintenance and reliability. Teams usually prioritise solutions that address immediate pain points over speculative future threats. This perspective ensures that security programmes remain robust and sustainable as technology evolves rapidly.

Background: Securing AI agents

Securing autonomous AI agents requires moving beyond model validation. You must constrain execution environments, verify tool outputs, and treat agent memory as persistent storage. Most failures stem from over-trusting the agent’s reasoning rather than flawed code.

Read the full guide: Securing AI Agents: Seven Common Mistakes and Fixes

What to do and how to stay safe: Socket

• Review current security tooling for long-term maintenance requirements.
• Assess vendor pitches for honesty regarding security gaps and limitations.
• Monitor the impact of agentic coding on internal security workflows.
• Ensure incident-response tooling remains reliable as requirements change.

Step-by-step guide: Stop Sensitive Data Leaks in AI Chatbots: Priority Controls

General security guidance from the Vector Bulletin newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What event was the podcast recorded at?

The conversation was recorded at Black Hat 2026.

Which company did Becherer build a security programme for?

He built a security programme at Datadog, joining as the only security employee in 2015.

What does Becherer say makes a security buyer receptive to a pitch?

Existing pain, practical answers, and an honest account of security gaps carry more weight than predictions about future problems.