The BOM Explosion & Why PQC Stopped Being 10 Years Away with David Pollak & Allan Friedman

In this episode, David Pollak, founder and CEO of Spice Labs, and Allan Friedman, Senior Technical Advisor at the Institute for Security and Technology, discuss the importance of software supply chain security, bills of materials, and the emerging field of post-quantum cryptography with Kate Holterhoff. Friedman, "the godfather of SBOMs," gives a state of play for 2026: where the tooling has matured, where it still falls short, and why the Cyber Resilience Act is about to make this everybody's problem. From there the conversation moves to CBOMs and post-quantum cryptography. Pollak argues PQC stopped being a 2035 problem in June, when the White House, the US military and French standards bodies all pulled their deadlines forward by five years. Also covered: whether developers should have to think about security at all, what the IPv6 transition taught us, and the 360,000 Maven packages carrying vulnerable code nobody disclosed. This RedMonk conversation is sponsored by Spice Labs.Show notes: https://redmonk.com/videos/david-pollak-allan-friedman/Chapters00:04 Introduction to the Guests and Topics06:29 The State of SBOMs in 202613:46 Understanding Cryptographic Bills of Materials22:12 The Intersection of Security and Development31:25 The CBOM Approach and Its Importance33:23 Post-Quantum Cryptography: A Future Concern?38:55 Navigating Regulations and Compliance43:57 Finding vs. Fixing Vulnerabilities in Open Source49:58 AI's Role in Security and Vulnerability Management53:31 Lessons from IPv6 and Cryptography Libraries

Kate Holterhoff talks with Victoria Melnikova, head of new business at Evil Martians, about what product market fit looks like for developer tools in 2026. Drawing on research by Evil Martians CEO Irina Nazarova, Melnikova argues PMF is a spectrum, not a switch. Product signals and revenue signals are separate things, and the gap between them tells you where to focus. Her advice to most early stage founders? Your product is probably fine, go do sales. Their conversation covers why dev tools resist the golden path metrics of generic SaaS (what's the golden path in Photoshop?), why agent experience (AX) matters now that LLMs increasingly pick tools for their users, and why engineers who use AI well are becoming the hires companies fight over. Also: a corrupted video shoot, agencies as pirate ships, and why AI should be like a good wig.Show notes: https://redmonk.com/videos/victoria-melnikova/Chapters00:04 Introduction to Dev Tools and Product Market Fit10:52 Understanding Product Market Fit in DevTools18:19 The Shifting Landscape of DevTools and AI25:33 Agent Experience and Its Impact on DevTools28:54 Navigating Agent Experience and AI Integration34:17 The Future of Hiring in Tech38:58 Designing with AI: Balancing Human Touch and Automation47:09 Security in Open Source and AI

Generated code is arriving faster than maintainers can read it. RedMonk's Steve O'Grady discusses this new reality with Jason Brooks and Brian Proffitt, both managers in Red Hat's Open Source and AI Program Office. Proffitt's teams are adding what he calls human speed bumps upstream: PR templates that ask whether AI wrote the patch, and if so, what the prompt was. The point is transparency, not blocking the flow. Brooks argues for the importance of human decision makers because writing code may cost close to nothing now, but getting another person to accept it still costs plenty, and someone always pays the token bill. The conversation also touches on maintainer burnout, why saying "no" is still a legitimate answer to a pull request, Fedora Hummingbird and its agentically assembled packages, and the thing Proffitt worries about most: trust.This RedMonk video is sponsored by Red Hat.Show notes: https://redmonk.com/videos/brian-proffitt-jason-brooks/Chapters00:04 Introduction to AI and Open Source Governance00:32 Guest Introductions: Jason Brooks and Brian Proffitt02:10 AI's Ubiquity and Industry Impact03:06 Guardrails for AI Code Quality in Projects04:22 Implementing Human Speed Bumps for AI Contributions05:17 Encouraging Transparency in AI Contributions06:46 Automated Review and Guardrails in Open Source07:50 Verifying AI-Generated Code in Fedora09:10 Human Oversight in AI Processes13:39 Developer Burnout and Managing Contribution Floods16:09 Trust and Transparency in AI-Driven Ecosystems18:30 Evolving Policies for AI in Fedora20:16 Future Challenges and Community Trust in AI21:11 Closing Remarks and Future Outlook

In this conversation recorded at Fastly Xcelerate, James Governor talks with Jefferson Frazer, Director of AI at Shutterstock, about how a two-decade-old media company reinvented itself for the age of foundation models. Frazer explains how Shutterstock's long history of human-reviewed, meticulously labeled content left it uniquely positioned when hyperscalers began seeking diverse, web-scale datasets for multimodal training. Frazer digs into the technical backbone too: a 100-plus petabyte footprint, cloud-agnostic architecture built on Fastly's private fiber and Wasm-based edge compute, and the discipline of tracking data provenance through standards like C2PA and SynthID. Looking ahead, he makes the case that unified embedding spaces and portable metadata—not any single model provider—will define the next chapter of AI-ready content.This RedMonk video is sponsored by Fastly.Show notes: https://redmonk.com/videos/jefferson-frazer/Chapters00:00 Introduction to Shutterstock and AI04:14 Data Scale and Infrastructure07:25 Fastly's Role in Data Management10:28 The Future of AI and Business Models13:28 Regulation and Provenance in AI16:35 Excitement for Unified Embedding Spaces

Why does ChatGPT recommend one DevTool over another, and what can founders do about it? In this RedMonk Conversation, Kate Holterhoff sits down with Adam DuVander, Principal Consultant at EveryDeveloper and author of Developer Marketing Does Not Exist, to explore how AI assistants are transforming software discovery. They discuss Adam’s LLM Rank research, which tracks how models like ChatGPT, Claude, and Gemini recommend developer tools, and why those recommendations often differ. The conversation covers the practical steps DevTool companies can take to improve AI discoverability, from documentation and developer experience to use-case positioning and contextual content. Along the way, Kate and Adam examine the expanding definition of “developer,” the rise of AI-assisted builders, and why developer marketing is evolving rather than disappearing. Whether you’re building a developer product or rethinking your go-to-market strategy, this episode offers a practical framework for succeeding in an LLM-first world.Show notes: https://redmonk.com/videos/adam-duvander/Chapters00:00 Defining the Modern Developer04:25 The Role of Every Developer09:38 Marketing to the New Breed of Developers12:37 Understanding LLM Rank and AI in Development19:57 The Evolution of Documentation and Developer Experience22:06 Understanding Developer Context and Use Cases25:31 Navigating AI Recommendations for Developer Tools28:55 The Importance of Language and Phrasing in Queries31:50 The Long Game of SEO and LLM Rankings36:44 Addressing Outdated Documentation and Bad Advice42:20 The Distinction Between Discoverability and Developer Success47:51 The Future of Developer Marketing in an AI World

Most conversations about AI agents stay on what agents can do. Less attention goes to what they leave behind: logs, traces, and tool-call chains at a volume nobody's pipeline was built for. Nikhil Mungel, Head of AI R&D at Cribl, talks with Kate Holterhoff about why that is becoming observability's cost and noise problem. They discuss why token prices keep falling while total spend climbs, how employee spend differs from the tokens a product burns serving customers, credit-based versus outcome-based billing, why users always reach for the priciest model, and how the Open Cybersecurity Schema Framework (OCSF) standardizes what agents emit. Underneath all of it sits the question the industry keeps dodging, which is whether to keep scaling the backend or get stricter about what gets collected at all.This RedMonk conversation is sponsored by Cribl.Show notes: https://redmonk.com/videos/nikhil-mungel/Chapters00:25 Leading AI research and development at Cribl01:46 Token prices fell, token bills grew03:39 The research agent that thought all night06:54 More software, more agents, more telemetry09:37 Employee spend versus cost of goods sold12:05 Credits, outcomes, and other ways to bill for agents14:46 Shadow AI and the cloud governance rerun17:00 Writing policy: cost, access, and blast radius17:49 Local models and regulated industries18:40 What Cribl collects, plus Cribl Guard21:24 Token gateways as the enforcement point24:56 Model anxiety and automatic routing27:29 What OCSF is and why it caught on30:15 Observability as an information compression problem33:48 Zero data retention versus model safety35:45 Should agents know what they cost?36:35 Where to find Nikhil and Cribl's research

James Governor sits down with Jason Willeford, Global Lead for Secure Global Support at Red Hat, to dig into digital sovereignty and why it's become such a big deal for European enterprises. Jason explains Red Hat's Confirmed Sovereign Support, launched last year, which keeps EU customer data and the engineers handling it inside the EU. They cover what sovereignty actually means, why banks and telcos now care about it as much as public sector agencies do, and how AI complicates the picture when you don't know where a model was trained or what data it consumed on the way there. The conversation also touches on IBM's Sovereign Core, Project Lightwell, and RHEL for SAP.This RedMonk conversation is sponsored by Red Hat.Show notes: https://redmonk.com/videos/jason-willeford/Chapters00:00 Introduction to Digital Sovereignty02:26 Understanding Sovereignty: Definitions and Spectrum05:31 The Complexity of Sovereignty in Europe08:21 Data Sovereignty and Support Models11:28 AI Sovereignty and Its Implications14:15 Operational Sovereignty and Customer Engagement17:20 The Role of Red Hat in Sovereignty20:40 Sovereign Core and Global Expansion23:36 Mindset Shift Towards Sovereignty26:22 Engaging Developers and Enterprises on Sovereignty29:36 The Future of Sovereignty and Open Source

In this RedMonk conversation, Stephen O'Grady sits down with Boris Bialek, VP of Industries at MongoDB, and Raman Jatkar, Head of Product Management for Purple Fabric at Intellect Design, to examine where agentic AI and data platforms converge. The discussion makes the case that data, not models, determines enterprise outcomes. Raman reframes hallucination as a data architecture and sequencing problem, solved through deliberate ingestion, chunking, and retrieval strategies rather than model swaps. Boris stresses governance, lineage, guardrails, and the often-overlooked security risks of agent-to-agent interactions like open banking. Both argue that data and AI platforms should be treated as one interconnected capability, with governance built in rather than bolted on. The conversation closes on the renewed importance of operational, real-time data, what Boris calls OLTP returning to center stage, and keeping the human customer at the end of every workflow.This RedMonk conversation is sponsored by MongoDB.Show notes: https://redmonk.com/videos/boris-bialek-raman-jatkar/Chapters00:00 Introduction to the AI Agentic Era01:58 Understanding Purple Fabric and Its Tech Stacks05:52 Addressing Hallucinations in AI Models09:26 Governance and Compliance in AI Systems12:33 Challenges and Opportunities in Data and AI Integration

What does it mean to trust software? For this RedMonk Conversation, Kate Holterhoff sits down with John Ellis, President of Codethink and the contributor to the Eclipse Trustable Software Framework, to pull that question apart. Ellis leans on an old image: the bridge builders who once slept under their own bridges to prove the work was sound. Modern software rarely faces that kind of test, even when it steers a car or flies a plane. He explains where trust tends to break, especially the integration step where hidden dependencies finally show themselves, and points out that a safety certificate almost never uses the word "safe." Rather than pass-or-fail box-ticking, the framework asks teams to state their confidence and back it with evidence that others can inspect and challenge. They also dig into AI-written code, the EU Cyber Resilience Act, and why rising software recalls suggest current habits fall short.This RedMonk video is sponsored by the Eclipse Foundation.Show notes: https://redmonk.com/videos/john-ellis/Chapters00:04 Introduction to the Eclipse Trustable Software Framework02:57 Understanding Trust in Software05:59 The Integration Moment of Truth08:54 Challenges in Software Development Lifecycle11:25 The Role of the Eclipse Trustable Software Framework14:39 Managing Change in Software Development17:20 Versioning and Continuous Improvement20:01 Risk Analysis and Trustworthiness in Software24:39 Automating Testing and Confidence in Software25:23 Bridging the Gap with Regulators27:15 The Complexity of Software and Safety Standards29:18 Understanding Certification and Safety Claims31:12 The Need for a Shift in Mindset32:16 The Role of the Eclipse Trustable Software Framework34:18 Navigating the EU Cyber Resilience Act37:41 The Journey of Compliance and Awareness39:16 AI's Impact on Software Provenance43:34 Future Directions for the Eclipse Trustable Software Framework

In this MonkCast conversation, Rachel Stephens talks with Sehjung Hah, a product marketing engineer at Broadcom, about how VMware Cloud Foundation 9.1 is shifting private cloud operations from click-driven dashboards toward programmable, API-first workflows.Hah walks through the expanded VCF API surface that lets developers pull network details, vSphere diagnostics, and real-time infrastructure health in a self-service fashion. They also discuss a new fleet management capability that centralizes password rotation, certificate updates, and identity management across massive compute footprints.This RedMonk video is sponsored by VMware by Broadcom. Show notes: https://redmonk.com/videos/vcf9dot1-dashboards-to-apis-sehjung-hah/Chapters00:00 Intro00:30 Removing Developer Friction in Private Cloud02:44 Fleet Management for Platform Engineers04:23 From Dashboards to Telemetry-as-Code08:27 Killing Static Credentials and Shrinking the Blast Radius11:29 AI Workloads, Sovereignty, and Cost Visibility14:56 The 3 AM Scenario17:27 Putting It All Together