#146 AI Found What Nine Years of Security Research Missed with Charles Guillemet // CTO @ Ledger

Ledger's CTO on vulnerability discovery, security-by-design, key management and AI-native engineering.
Charles Guillemet started hacking at 12. He sold his piano to buy his first computer. Nine years ago, he built Ledger's offensive security team from scratch; today, he's CTO of a company protecting a fifth of the world's crypto, and he just watched AI find vulnerabilities his team spent almost a decade not finding.

Topics covered:

• The economics of security — and why AI is breaking them

• Ledger's three layers of security, and what The Donjon actually does

• Turning a security problem into a key management problem

• Charles's recommendation for restructuring engineering teams around AI and "harness engineering"

• Zero trust, bus factor, and protecting a company's "crown jewels"

• Using AI to build a threat model and cut noise from production signals

• Why Charles believes the CISO function should stay independent

Timestamps:
[00:00:51] Intro & guest welcome
[00:01:21] Charles's nerd origin story — hacking at 12
[00:03:33] From software hacking into hardware security
[00:04:45] Ledger's security org today: hardware vs. software
[00:08:48] The three layers of security at Ledger — and The Donjon
[00:13:28] The AI vulnerability that broke 9 years of research
[00:14:47] Security as economic asymmetry — and why AI is collapsing it
[00:18:31] Why blockchain attackers already spend big to break in
[00:20:51] Is prompting AI to "find vulnerabilities" enough?
[00:23:48] Security-by-design and turning security into key management
[00:26:00] Does AI kill the CTO/developer job — or redefine it?
[00:30:40] Rebuilding an SDLC: Charles's small-team, harness-engineering recommendation
[00:36:22] Building a threat model with AI
[00:38:58] Zero trust, bus factor, protecting the crown jewels
[00:42:36] Using AI to cut through noisy production security signals
[00:47:04] "Average is better than nothing" — the Wikipedia analogy
[00:48:00] Why Charles thinks the CISO function should stay independent
[00:49:09] The Easter egg question — advice to his 2017 self

What you'll learn:

• Why the old economics of security are breaking down — and what that means for your own threat model

• A concrete way to turn any security problem into a (much easier) key-management problem

• Charles's recommendation for restructuring engineering teams around small, AI-native pods and "harness engineering"

• What zero trust looks like in practice when developers bring their own devices

• How to use AI to build a threat model and cut through noisy production security signals

Quotes:
⭐ [00:14:22] "The cost of finding vulnerabilities is trending towards zero."
⭐ [00:26:21] "If they think they will continue writing code, yes, they will lose their job."
⭐ [00:23:39] "If you just prompt like crazy — implement this database, implement this feature — and at the end just prompt, 'please find vulnerabilities,' it's something, but it won't solve the security problem."
[00:14:47] "Security is a matter of creating an imbalance, an asymmetry between attacks and defense."
[00:41:21] "More and more attackers go through the developer door, trying to compromise the endpoint of one developer and then leverage his access to production."
[00:47:14] "Some people say AI is only producing average results, but sometimes average is better than nothing."
[00:39:19] "If a human has full access to a system he doesn't need, that also means the malware running on his computer has the same access."
(All quotes lightly cleaned of stutters/filler — verify against final audio.)

Links:

• Ledger: ledger.com

• Ledger Donjon (security research team): donjon.ledger.com

• Meet Cerberus — Ledger Donjon's AI security harness: ledger.com/blog-cerberus-donjon-ai-harness

• Charles Guillemet on LinkedIn: fr.linkedin.com/in/charles-guillemet

Want to keep talking about this with other CTOs? Join over 600 tech leaders in our Slack community — go to alphalist.com to apply.