Early Adopters: CISO

Datadog's security team dropped its security questionnaire vendor and built the one piece of functionality it needed in two to three months. Zack Allen, Senior Director, Trust and Detection Engineering at Datadog, says the call came down to expertise, data and the harness.

On this episode of Early Adopters: CISO, Zack shares how his team decides what to build and what to buy, and what founders need to show before his team buys.

We cover:

- How Datadog's security team decides what to build and buy

- Expertise, data and harness as build vs. buy tests

- Why saying no to AI is how security loses

- What founders need to show a skeptical security team

- Moving past hand-written detection rules

- Security as portfolio management and detection health

Andrew Becherer, CISO at Socket, joins Early Adopters: CISO to talk about what security teams should build, what they should buy, and what founders get wrong when selling to them.

The conversation covers Andrew's path from a sociology degree to iSEC Partners, joining Datadog in 2015 as its only security employee, and how the 2016 breach reshaped Datadog's security program.

Andrew also breaks down why a tool that is quick to build still has to be maintained for years, how he evaluates early-stage vendors, the softball question he asks founders, and why securing agents is the threat CISOs aren't talking about enough.

We cover:

• Joining Datadog as its only security employee
• How the 2016 breach reshaped Datadog's security program
• Build vs. buy in the age of agentic coding
• Why a quick build still means years of maintenance
• What founders get wrong when selling to a CISO
• Securing agentic software and the agents themselves

Jacob DePriest, CISO/CIO at 1Password, joins Early Adopters: CISO to talk about how security leaders decide what to adopt in the AI era.
The conversation covers Jacob’s path from the NSA to GitHub to 1Password, why not shipping is its own form of risk, and how 1Password uses a velocity-weighted risk model to decide when AI tools can move fast and when they need to wait.
Jacob also breaks down how his team pilots new AI tools while due diligence catches up, how AI is changing build-vs-buy decisions, why security teams cannot keep scaling linearly, and what founders need to prove if they want to become a design partner.
We cover:

• Velocity-weighted risk for AI adoption
• Why not shipping is its own form of risk
• Piloting AI tools while due diligence catches up
• How AI is changing build vs. buy
• Why security teams need to scale nonlinearly
• What founders need to prove to become a design partner