One Attacker and a For Loop: Why Email Is Still the Softest Target in an AI Arms Race

Elad Gil introduces Ryan Noon as co-founder and chairman of Material Security, the company trying to make cloud email a safe place for sensitive data. Noon had previously started Parastructure, which Dropbox acquired, and then worked there as an engineering manager. Gil notes that Material was unusually fast to put early LLM APIs into production, but he first wants the origin story.

Noon dates the company to 2016 or 2017. He had left Dropbox, was living in Europe, and watched that year's election hacking with what he dryly calls love: ordinary Gmail accounts kept getting dumped onto the internet. He sketched a novel way to protect a personal Gmail account, coded it, and was shocked that the Gmail API actually let him do it. Friends back home saw a special case of a broader idea. Seven years later, he says, it is 'a cybersecurity unicorn thing' and the team works with some of the most interesting companies in the world.

The product thesis is that modern work and private life hang off Google and Microsoft accounts. Email was the starting point; Material then pushed deeper into everything those accounts unlock. The commercial core is mid-size and larger companies running Google Workspace and Office 365, with modules aimed at the worries that actually keep security teams up at night.

The first big module hunts years of sensitive files sitting in inboxes and archives, redacts them, and replaces them with a clean copy. If an attacker downloads the whole mailbox, they get nothing useful; if the owner needs the original, a button plus Face ID, Touch ID, or a stricter work policy unlocks it. The company later added anti-phishing and account-takeover protection for the things attackers do after they are already in, such as resetting bank credentials.

The operating concept is defense in depth: assume the bad guy got over the wall, then ask what they want, and put another wall and a machine gun behind it. Material used to brand itself as seatbelts for email. Crashing the car is bad enough; going through the windshield is worse. Gil ties the founding impulse to the Podesta emails and Hillary Clinton's campaign. Noon agrees it matters, then points at the structural problem: Google and Microsoft have a total duopoly, so whatever little thing they miss is world-altering. Every couple of months there is a headline that another cabinet secretary's email was hacked because all the eggs sat in Microsoft's basket. Duopolies are stable in the market and extremely fragile in security. Material exists to fill the doors they leave open.

Gil asks how Material started using generative models. Noon's answer is that the second you give a coder a REPL, they start iterating, and ChatGPT was a good-enough REPL. Playing with it, they found a lot of security domain knowledge already baked in. 'If you feed precisely one internet to precisely a million GPUs, it [picks] up a thing or two about cybersecurity.' The analogy he used at the time was Shang Tsung from Mortal Kombat: the model has eaten the souls of thousands of security engineers, so you might as well use it. The first production use case was operational: rarify the signal, filter the noise, then hand it to a human who knows what attackers are trying to do. LLMs turned out to be fantastic at that.

He is unimpressed by startups that fine-tune mainly to pretend they have a moat. As an engineer, he says he knows when he has headroom, and even GPT-3.5 had plenty. Things that were very hard for computers eighteen months earlier are easy for off-the-shelf models. His advice to the industry is to chew your food first. Offensive uses are what you are not supposed to talk about, but the bad guys are talking, and security has always had an arms-race quality, so the world needs security LLM companies because attackers exist.

The cliché he keeps hearing from founders is the cybersecurity skills shortage, as if America should bring back the draft and issue everyone a certificate. His zeroth-order answer is simpler: you already have 90% of a human for a penny and a half, so start there and go to Disney World after the boring work is done. The best security work, he adds, does not come from the vendor buying the CISO a steak and a Ferrari in Vegas every August. It comes from a strong engineer hacking something together. He points to Socket analyzing npm dependencies and hunting secrets dropped in codebases, messy text problems where models are already pretty good at reading code.

Asked for the biggest cyber threat from this technology, Noon says he is talking about text models, because so much of cybersecurity is just text. There are nasty reported hacks where a voice was faked convincingly on a phone call, and APIs from shops such as ElevenLabs and LMNT make that easier. Gil notes the classic CEO-text-to-a-new-employee scam. Noon’s sharper point is that humans trust other humans through computers, and that was the key mistake. The attacks random criminals already send are not even grammatical. If all you did was spell-check the bad guys with an off-the-shelf open-source model, it would still make a material difference to cyber risk.

On how bad this gets by a hypothetical GPT-6, the analogy that helped in a conversation with someone from the White House was Bronze Age versus Iron Age. If the neighboring tribe has iron and you still have bronze, you are going to have a bad time. Talk of airstriking data centers or restricting 'super high-grade carbon steel from space' misses the point if iron is already aimed at bronze armor. Models are a step function, the flying-car kind of discontinuity people used to complain never arrived. That does not mean everyone is doomed, but it does mean the cost curve has moved.

Scope is hard to feel in this industry. A Fortune 500 can leave the front door open for a year, nobody walks in, and executives conclude hackers are fake. A no-name company gets run over and concludes the barbarians are at the gate. What is new is supervision: one human can now oversee a thousand humans. You no longer need a room full of jerks trying to hack grandma. One jerk and a for loop will suffice.

Gil asks whether state actors and attacks on physical infrastructure should change how the West invests in LLMs. Noon’s moral basis for the whole field is unromantic: cybersecurity is the waste heat of every other computing innovation. Utility drives adoption; safety never does. Welcome to Earth. The industry is the cleanup crew. The world will take the new capability first and notice later that it messes up democracy.

He does not need hyperbolic atom-bomb language. Intelligence is now a commodity you can arms-race, a Red Queen contest like nuclear power except the thing being raced is intelligence itself. Gil notes that OpenAI’s original premise was a counterweight so Google and a few others would not monopolize the capability. Noon’s follow-on is that the West is especially exposed. Open societies put everything out, let the private sector run it, adopt every digital technology early, and are happy to wave a soft underbelly on the internet. A totalitarian state can mandate a Linux distro, lock down social media, and make 'what if I get phished' a non-question because that is not how bank accounts work there. If you can lock information, you can lock the attack surface, including elections.

What still baffles him is that cyberspace is a formal U.S. military command, William Gibson would be proud, and yet an ordinary American in that space is basically on their own. The military guards physical borders; nobody guards your inbox. He thinks the Department of Defense does impressive offensive work and that deterrence often works, and he is not taking a side on Snowden. On LLMs specifically, though, everyone is still figuring out what is going on. DARPA has interesting projects, but most people see the technology through New York Times ChatGPT coverage or a free-tier session six months ago. The worries are order-zero: make sure it does not make stuff up. People have yet to realize the computer can think in a much more salient way than it ever could. Guo adds that shovel-selling is overhyped and thoughtful talk about society in ten years is underhyped.

Gil asks whether there is room for startups when security incumbents are so good at buying, bundling, and cross-selling. Noon says there is always room, then offers the cynical version. Required reading at Material, which he never actually enforces, is Ian Grigg’s paper 'The Market for Silver Bullets.' Buyers, sellers, and attackers share a market in which the buyer cannot be sure the product will save them. The truism is that every cybersecurity product is a complex insurance policy. That mushiness produced incredible distribution machines: Cisco, Palo Alto Networks, and to an extent Microsoft and Google, with sales forces, bundles, and glitzy conferences.

Their product managers, if honest, do not know what attackers will do in five years any better than anyone else. So why plant seeds when you can harvest crops that are already growing, transplant them into your yard, and water them with salespeople and market power? Cisco had just bought Splunk, and Splunk buys things; the whole market works that way. Noon once wrote an angry blog post calling it the cybersecurity industrial complex: PE firms dressed up as innovators. Creative destruction still happens, and some of the best security companies did not exist ten years ago, but many top VCs skip the category because the typical outcome is a $200 million takeout by Palo Alto. Discontinuities still breed new companies. Entire classes of product are now both necessary and obsolete. Much of the budget still goes to emitting logs, parsing twenty-year-old firewall formats, and aggregating alerts, work an LLM can eat. A lot of spend is up for grabs.

On who is actually adopting models, he sees three layers. Growth companies with nerdy founders integrated immediately. Younger public companies that still get it shipped a thinner feature later, the 'you can type in the box and typos do not matter' kind. Fortune 500s are running science projects that, he assumes, are excellent for OpenAI’s revenue. Microsoft had a top-down mandate and a year on everybody, plus a lot of marketing; he has not used the result himself. Partnerships still matter because customers hate buying a pile of point tools and also hate a big bundle that sucks. Vendors should be grown-ups and interoperate. Gil cites Material’s work with Slack around Office 365 and Google Workspace as that pattern.

Asked what has changed in seven years, Noon is almost gloomy: people still send email and still reply to texts, and a walled garden like Slack just becomes another hop in the same chain. Mobile is the tragic case. Apple locked devices down so hard that vendors can do very little, then sat on the remaining problems. Tech is better at keeping people out of its territory than at using that territory. Cloud centralization is the other unfinished story. His biggest miss as an investor was assuming AWS would bundle security away. He diligenced Snowflake’s Series B and told whoever asked him to pass, because Redshift existed and AWS was not asleep. AWS later told him they get paid either way: tenants do not own any CPUs, so the platform can be lazy. The gap is the business.

Founders in security and broader enterprise keep asking Noon what to build. His love-hate advice is to stop grinding a beachhead around a mediocre product that happens to be easy to sell because the category is mushy. Take a step back and build an incredibly useful thing that everyone should buy. Stop mapping CASB, UEBA, SIEM, and NDR onto a banker’s quadrant. Consumer people already make fun of enterprise diagrams; cybersecurity’s are extra mockable. If it talks to an API everyone uses, saves a pile of time, and is easier, just build that. You have about five years before you even start paying Gartner. Market is not the same thing as marketing.

The basics still come first. Figure out the team. Being a solo founder is totally okay, and far better than 'we had three coffees and we just got married.' Everything is built on the team; the saddest failure is a beautiful company with a crack in the foundation that has to be torn down. Align on risk appetite. He notes Silicon Valley is irrationally exuberant again. The six months of gloom after free money ended were too short; he wishes they had lasted a year, RIP Good Times memes and all. Now it is back to ZIRP if you are in AI.

Pick a good market: lots of dollars, and lots of weaker people you can take those dollars from. The difficulty of starting a company is the inverse of market size; play on easy if you possibly can. Guo says that is the advice she gives AI founders too: in an early industry, do the easy, high-velocity work, and save the hard problems for when the market is mature. Noon’s other pet peeve is founding teams without a real technologist. Leave MBAs alone and they will ship Casper mattresses, but for mattress pads, with razors. The best companies have a technologist somewhere, if not in the CEO seat. Technologists, though, cluster in recruiting, DevOps, and yet another monitoring tool. Get out of the house, at least on Zoom, and learn a market that is not your own. The world needs that creative energy, to paraphrase an old Dropbox slogan, but combinatorics will always invent another 'Datadog for AI, but mobile testing.' Ask how big the actual market is.