#146 AI Found What Nine Years of Security Research Missed with Charles Guillemet // CTO @ Ledger

alphalist.CTO Podcast - For CTOs and Technical LeadersThursday, September 17, 2026

Show Notes

Charles Guillemet has spent nine years building Ledger's security organization from scratch — first as the founder of The Donjon, Ledger's in-house offensive security research team, then as CTO overseeing security for a company safeguarding roughly 20% of the world's crypto (per Tobi's intro framing).

The conversation centers on one uncomfortable observation: with the latest generation of frontier AI models, Ledger's researchers started finding product vulnerabilities that fifteen dedicated experts hadn't found in nine years of trying. Charles explains why this matters security has always relied on an economic asymmetry between what it costs to attack a system and what an attacker stands to gain, and AI is collapsing that asymmetry by driving the cost of finding a vulnerability toward zero.

From there, Tobi and Charles dig into what actually holds up: security-by-design, treating security as a key-management problem, zero trust, and for teams rebuilding their SDLC around AI — Charles's recommendation of small, AI-native pods spending most of their time on "harness engineering" rather than writing code. They also cover why he believes the CISO function should stay organizationally independent, even though it reports to him at Ledger today.

More from alphalist.CTO Podcast - For CTOs and Technical Leaders

Oct 15, 2026

#148 Git Is the Wrong Tool Now: Rewriting the Social Contract of Agentic Teams with Raffi Krikorian // CTO @ Mozilla

Raffi Krikorian has built teams at scale: platform engineering at Twitter, Uber's self-driving center, and the Democratic National Committee, where he was its first CTO. Today he's CTO of Mozilla, working to make AI as open as the web, and on the side he runs three rotating Claude Max subscriptions and a GPU in his closet.

Oct 1, 2026

#147 "Make It Secure" Isn't a Prompt: A L0pht Hacker on Securing AI-Written Code with Chris Wysopal // Chief Security Evangelist @ Veracode

Chris Wysopal was one of the first hackers to go public. As "Weld Pond" at the L0pht hacker collective in Boston, he testified before the US Senate in 1998, where the group delivered the soundbite that they could take down the internet in 30 minutes. He also wrote the Windows version of Netcat. In 2006 he co-founded Veracode, which by his account has now analysed trillions of lines of code. Today he's the company's Chief Security Evangelist.

Sep 3, 2026

#145 "Harness Writing Is Not Hard": Build to Learn, Not to Run with David Soria Parra // Member of Technical Staff @ Anthropic

Sponsored by Blocks: Save at least 20% on your AWS costs with AI-powered optimization and enterprise discounts. Get your free Cloud Check at https://blocks.cloud/alphalist?utm_source=alphalist&utm_medium=podcast&utm_campaign=blocks-podcast-2026

Aug 13, 2026

#144 Writing Code Is No Longer the Job: Dana Lawson on Trusting AI Agents Like Self-Driving Cars // CTO @ Netlify

Jul 30, 2026

#143 The Company Brain: How Kombo Runs on a Git Repo and a Cursor Agent — with Aike Hillbrands, Co-Founder & CTO @ Kombo

See all episodes →