alphalist.CTO Podcast - For CTOs and Technical Leaders

Hosted by Tobias Schlottke - alphalist CTO Podcast

Technology Management EntrepreneurshipInterviews guests

Website RSS feed

Episodes

148

Latest episode

Oct 2026

Language

About the show

This podcast features interviews of CTOs and other technical leadership figures and topics range from technology (AI, blockchain, cyber, DevOps, Web Architecture, etc.) to management (e.g. scaling, structuring teams, mentoring, technical recruiting, product etc.). Guests from leading tech companies share their best practices and knowledge. The goal is to support other CTOs on their journey through tech and engineering, inspire and allow a sneak-peek into other successful companies to understand how they think and act. Get awesome insights into the world‘s top tech companies, personalities with this podcast brought to you by Tobias Schlottke.

Listen to episodes

60 recent

October 15, 2026Episode 1481 hr 9 min

#148 Git Is the Wrong Tool Now: Rewriting the Social Contract of Agentic Teams with Raffi Krikorian // CTO @ Mozilla

Raffi Krikorian has built teams at scale: platform engineering at Twitter, Uber's self-driving center, and the Democratic National Committee, where he was its first CTO. Today he's CTO of Mozilla, working to make AI as open as the web, and on the side he runs three rotating Claude Max subscriptions and a GPU in his closet. Tobi and Raffi look at what agentic coding has done to engineering teams. Writing code used to be a social contract: coordinating with other teams, negotiating requirements, sharing work. Now one person with agents does all of it alone. Raffi argues that Git, built to commit bytes, doesn't fit a world where nobody types the bytes anymore, and that the tooling, processes and roles for working as a team still need to be invented. The conversation then moves to Mozilla's strategy: building an open source AI ecosystem without owning it, convincing CTOs and CEOs (not just developers) that open-weight models are safe to deploy, and pushing for standards like portable memory so switching providers stays possible. CTOs will come away with a clear argument for building leverage into their AI stack before their teams get locked into a single vendor's playbook. - Why Git may be the wrong tool for agentic teams - Why we may need more engineering and product managers, not fewer - Raffi's personal setup: a local Hermes agent, rotating subscriptions and a sandboxed Claude Code - Mozilla's plan for an open source AI ecosystem and open standards - Memory as the new lock-in, and a portable memory standard - Why chatbots should be measured by usefulness, not engagement - What Raffi would tell his 2009 self about shutting down the Twitter API

October 1, 2026Episode 1471 hr 13 min

#147 "Make It Secure" Isn't a Prompt: A L0pht Hacker on Securing AI-Written Code with Chris Wysopal // Chief Security Evangelist @ Veracode

Chris Wysopal was one of the first hackers to go public. As "Weld Pond" at the L0pht hacker collective in Boston, he testified before the US Senate in 1998, where the group delivered the soundbite that they could take down the internet in 30 minutes. He also wrote the Windows version of Netcat. In 2006 he co-founded Veracode, which by his account has now analysed trillions of lines of code. Today he's the company's Chief Security Evangelist. Tobi and Chris talk about what AI changes for attackers and defenders. Attacks are getting cheaper and faster, and a custom exploit no longer tells you a nation-state is behind it. Chris argues this follows a familiar cycle: attackers adopt a new class of tool first, defenders catch up, and parity returns. That only holds if defenders actually adopt the tools, especially underfunded organisations like hospitals, schools and utilities. They also cover the new attack surface created by agents, plugins and MCPs, why prompt injection may never be fully solvable, and how Chris would handle security debt when acquiring a small SaaS company. CTOs will leave with a concrete shortlist: avoid memory-unsafe languages, put a package firewall in front of open source, run AI-assisted static analysis with real architectural context, and give coding agents explicit security intent rather than hoping "make it secure" does the job. - From the L0pht and BBS culture to the professional security industry - The BGP flaw behind "30 minutes to take down the internet" - How AI changes the cost and speed of attacks - Prompt injection, agents, MCPs and least privilege - Security debt in B2B SaaS acquisitions - Secure on first write: security intent, context and pre-merge testing - How engineering and security roles change over the next two years

September 17, 2026Episode 14654 min

#146 AI Found What Nine Years of Security Research Missed with Charles Guillemet // CTO @ Ledger

Charles Guillemet has spent nine years building Ledger's security organization from scratch — first as the founder of The Donjon, Ledger's in-house offensive security research team, then as CTO overseeing security for a company safeguarding roughly 20% of the world's crypto (per Tobi's intro framing). The conversation centers on one uncomfortable observation: with the latest generation of frontier AI models, Ledger's researchers started finding product vulnerabilities that fifteen dedicated experts hadn't found in nine years of trying. Charles explains why this matters security has always relied on an economic asymmetry between what it costs to attack a system and what an attacker stands to gain, and AI is collapsing that asymmetry by driving the cost of finding a vulnerability toward zero. From there, Tobi and Charles dig into what actually holds up: security-by-design, treating security as a key-management problem, zero trust, and for teams rebuilding their SDLC around AI — Charles's recommendation of small, AI-native pods spending most of their time on "harness engineering" rather than writing code. They also cover why he believes the CISO function should stay organizationally independent, even though it reports to him at Ledger today.

September 3, 2026Episode 1451 hr 17 min

#145 "Harness Writing Is Not Hard": Build to Learn, Not to Run with David Soria Parra // Member of Technical Staff @ Anthropic

Sponsored by Blocks: Save at least 20% on your AWS costs with AI-powered optimization and enterprise discounts. Get your free Cloud Check at https://blocks.cloud/alphalist?utm_source=alphalist&utm_medium=podcast&utm_campaign=blocks-podcast-2026 David Soria Parra co-created the Model Context Protocol (MCP), the standard that now underpins most AI agent integrations, and, before that, spent years as a core contributor to Mercurial and on Meta's internal source control team. He got into programming at 13, writing a PHP guestbook for a gaming website with friends, and hasn't really stopped building since. This conversation goes straight to the thing every CTO is quietly building right now: their own agent harness. David makes a surprisingly blunt case that harness writing itself isn't the hard part: "give it a bunch of tools, a bunch of execution steps, be a little smarter about context selection, and go," and that most companies would be better off configuring a strong existing harness than building their own from scratch. He and Tobi also dig into why the "MCP vs. CLI" debate is largely manufactured, how Meta and Anthropic both run on almost no prescribed process, and how David's own workflow has quietly shifted from local Claude Code sessions to Slack threads over the past six months. CTOs will walk away with a clear-eyed, unhyped view of harness-building from the person who literally created the interoperability standard. Everyone argues about when building your own is worth it, what to check for in a vendor contract, and where to actually put your attention instead of endlessly optimizing your setup. What's covered: - David's path from a PHP guestbook at 13 to Mercurial core contributor to Meta's source control team - Biggest lessons from Meta, and how Anthropic runs on even less internal process - His personal setup: a handful of skills, a few MCP connectors, and why he's a "vanilla" tool user - Why his day-to-day workflow moved from Claude Code sessions into Slack threads with Claude - The real MCP-vs-CLI debate — and why it was never actually a debate - Should every CTO or engineer build their own agent harness? - What's still defensible in software engineering as agents get stronger

August 13, 2026Episode 14459 min

#144 Writing Code Is No Longer the Job: Dana Lawson on Trusting AI Agents Like Self-Driving Cars // CTO @ Netlify

Sponsored by Blocks: Save at least 20% on your AWS costs with AI-powered optimization and enterprise discounts. Get your free Cloud Check at https://blocks.cloud/alphalist?utm_source=alphalist&utm_medium=podcast&utm_campaign=blocks-podcast-2026 Dana Lawson's path into tech started with backup tapes, not a keyboard-in-the-womb origin story. She joined the US Army in the late '90s, automated her way out of manual password resets, and went on to become VP of Product Engineering at GitHub before taking the CTO seat at Netlify. She joins Tobi to make the case that "writing code is no longer the job", an argument from her own New Stack article that lit up Hacker News, and one she doesn't back away from here. The conversation explores why trust in AI agents may eventually become automatic, the same way our trust in cars we can't repair ourselves already has. Dana explains why Netlify is designing for "agent experience" alongside developer experience, and why the engineer's role is shifting from writing every line of code to defining architecture, guardrails, reliability, and safe user experiences. CTOs will walk away with a sharper way to think about where human judgment still matters versus where it's already been commoditized, including the tension between speed and control, whether developers risk becoming the bottleneck, and why the real constraint may be moving from "can we build it?" to "does anyone actually want it?" What's covered: - Dana's path from the US Army to VP of Engineering at GitHub to CTO of Netlify - Why she argues "writing code is no longer the job" and the Hacker News backlash - The self-driving car analogy for trusting AI agents - What "agent experience" means and why Netlify designed for it - Craftsmanship, control, and the shift from writing code to defining guardrails - Whether developers risk becoming the bottleneck in the agentic era - Why the constraint is moving from "can we build it" to "does anyone want it"

July 30, 2026Episode 14357 min

#143 The Company Brain: How Kombo Runs on a Git Repo and a Cursor Agent — with Aike Hillbrands, Co-Founder & CTO @ Kombo

July 16, 2026Episode 1421 hr 4 min

#142 Why LLMs Need Their Own Programming Language: From Assembly to AI with Vaibhav Gupta // Co-founder @ BAML

Sponsored by Blocks: Save at least 20% on your AWS costs with AI-powered optimization and enterprise discounts. Get your free Cloud Check at blocks.cloud/alphalist → https://blocks.cloud/alphalist?utm_source=alphalist&utm_medium=podcast&utm_campaign=blocks-podcast-2026 Vaibhav Gupta built computer vision for the original Microsoft HoloLens, optimized AR at Google, and wrote high-performance assembly at D.E. Shaw, then left it all to start from scratch. After a YC pivot away from a Slack competitor he was told not to build, he landed on something foundational: BAML, a programming language for a world where humans increasingly don't read code. His thesis: every software leap came from a new compute paradigm getting its own language assembly, C, Java, JavaScript and LLMs are the next primitive. They're probabilistic and non-deterministic, which breaks our deterministic tooling. In this episode, Vaibhav explains why "shipping at agent speed" is really a problem of trust and control, why 90% of engineering is plumbing AI will delete, why "English as a programming language" can't work, and why the world has a mathematically infinite appetite for software. Topics covered: - Why LLMs are a new compute primitive and why that justifies a new language - BAML: an embedded, type-safe language for structured LLM outputs across any language - Shipping at agent speed as a problem of trust, locking, and granular control - Why traditional CI/CD breaks in an agent loop - The "data trench" one type system across code, backend, and data - Why 90% of engineering is plumbing, and what changes when AI removes it - Where SaaS pricing and product models are heading

July 2, 2026Episode 1411 hr 6 min

#141 AI Pat Works Here Now: Why Agents Must Follow Human Rules with Pat Casey // CTO @ ServiceNow

Pat Casey was the first person besides founder Fred Luddy to write code at ServiceNow back in 2005, when it was called Glide and lived above a friend's restaurant. Twenty years later, he's CTO of a company where 85% of the Fortune 500 are customers, and until recently ran all of engineering: 10,000 people, 7,000 of them writing code. Almost nobody survives the journey from first engineer to public-company CTO. Pat did. Tobi and Pat dig into how ServiceNow actually works under the hood: a metadata processing engine running 90,000 single-tenant databases and over 25 billion queries an hour, why they bought a 15-person German database company and turned it into RaptorDB, and why tearing apart a 20-year-old monolith is harder than every senior engineer thinks. Then the conversation turns to AI. Pat bought 7,000 Windsurf licenses and measured a real, but unglamorous, 15% productivity bump, with a small subset of engineers going 5–6x while most barely changed. His thesis: AI coding is like playing five chessboards at once, and it's reshuffling the deck on who the top engineers will be. On agents, ServiceNow's answer is disarmingly simple: create a user called "AI Pat," assign it cases, and make it follow the exact same rules as humans because you should not trust an LLM more than you trust a human being. Topics covered: - From Atari 400 and floppy-disk jockey at Aldus to first engineer at ServiceNow - Scaling engineering from a stuffed fish on a monitor to 10,000 people — and the productivity trough at ~100 engineers - Single-tenant architecture: 90,000 databases, 25B+ queries/hour, and the monolith-to-Kubernetes migration - Why ServiceNow bought Swarm64 and built RaptorDB on a Postgres fork - 7,000 Windsurf licenses, Claude Code, and the real numbers on AI coding productivity - "AI Pat": the anthropomorphic model for enterprise agents outcomes, not toolkits - Whether AI kills seat-based SaaS, and why incumbents may have the inside track - Pat's advice to CTOs: this is not a time for excessive caution

June 18, 2026Episode 1401 hr 12 min

#140 From Stripe's Fifth Engineer to Serving Millions of Developers with Anurag Goel // Founder & CEO @ Render Goel

Before he founded Render, Anurag Goel was the fifth engineer at Stripe, where he watched roughly a fifth of the engineering team disappear into managing AWS, writing brittle, repetitive, error-prone infrastructure scripts that had nothing to do with the actual product. That experience became the seed for Render: a platform that automates away the undifferentiated DevOps work and lets application teams ship without standing up their own cloud team. Today, millions of developers build on it, and Render has raised over $260M from Bessemer and General Catalyst. In this episode, Tobi and Anurag get into what's actually changing as AI moves from hype to production. Anurag makes the case that agents are simply a new kind of application, long-running, stateful, tool-heavy, and a new kind of end user you have to design for. He explains why Render deliberately refuses the "AI cloud" label, what he's building with Workflows and sandboxes, and why the hardest part of shipping agents isn't building them but seeing inside them. The conversation also goes wide: how to hire executives when interviews lie, why short-lived keys and blast-radius thinking matter more than container escapes, how distribution is shifting from SEO to getting ChatGPT and Claude to recommend you, and why, despite all the "SaaS is dead" noise, specialization isn't going anywhere. Topics covered: Why ~20% of Stripe's engineers were stuck managing AWS and how that became Render "We're not the AI cloud, we're the application cloud," and why the distinction matters Agents, as a new type of application (and a new end user), you have to build for Render Workflows and sandboxes: the consolidated AI runtime Hiring executives when interviews are an imperfect signal Security as blast-radius management: short-lived keys over "admin forever" The shift from SEO to GEO, getting chatbots to recommend your product Why SaaS isn't dying, and specialization still wins

June 4, 2026Episode 1391 hr 3 min

#139 Your Future Job Is a Decision Inbox — Max Deichmann Built the Layer That Gets You There // Co-Founder @ Langfuse

Max Deichmann is the co-founder of Langfuse, the open-source LLM engineering platform that became the observability layer of choice for teams building production AI agents, before being acquired by ClickHouse. He started as a business student who taught himself to code via CS50 on a beach in Singapore, pivoted through Y Combinator, fired his own customers mid-batch, and built Langfuse out of a Sunday night conversation about what they'd actually want to build if nothing was in the way. In this episode, Tobi and Max dig into what it really means to build and operate AI agents in production, not the LinkedIn version, but the 3 am alert, copy-pasted into Codex version. They cover the full loop: from pre-production experimentation and prompt iteration, to tracing, online evaluation, and the emerging architecture of agentic incident response. Max is unusually honest about where Langfuse itself still falls short, and what the next 12 months of the engineer's job actually look like. What CTOs will take away: a clear mental model for LLM observability vs. traditional observability, a practical blueprint for agentic on-call workflows, and a grounded view of where agents are genuinely working in production today, and where the hype still outpaces reality. Topics covered: Why traditional observability tools fail for non-deterministic AI applications The Langfuse loop: pre-production testing, tracing, online evaluation, and iteration How the ClickHouse acquisition happened, and the half-page doc that decided it Open source as a go-to-market strategy: adoption without a sales team Agentic on-call: how Max's team handles 3 am incidents with Codex today The "decision inbox" model, what the engineer's job looks like when agents do the work Where agents are genuinely succeeding in production (and where LinkedIn is lying to you)