Season 1 of the Candid CISO was a series of conversations I’m still thinking about. Security leaders told us things on the record that most people only say after the second drink — about the job, the pressure, the parts of the work nobody puts in a conference talk. It’s where the title of my book came from. It’s most of what I’ve learned in the last two years.
Season 2 starts differently. We’re not opening with a studio recording. We’re opening with fifty people in a room on the Stanford campus, a live microphone, and a guest who doesn’t hedge.
The guest
Jason Chan built and led information security at Netflix for over a decade, arriving in 2011 as the company went all-in on public cloud — before a cloud security industry really existed. Before that he was the first executive to lead security at VMware, and before that he was at iSEC Partners and @stake.
What came out of his years at Netflix is the idea most of us know as the paved road: instead of standing at a gate saying no, a platform team builds the supported, safe way to do the hard things, and engineers take it because it’s genuinely faster. Security comes along for the ride. It became the most admired security model in the industry.
It’s also, in Jason’s own telling, one of the most misunderstood. The essential quality isn’t that it’s friendlier than gates — it’s that it’s optional. You don’t enforce a paved road, you create one. Teams stay free to go their own way; they just inherit whatever the road would have handled for them. The moment you hear “standard” and start mandating, you’ve rebuilt the gates the road was meant to replace.
The question
Here’s why we’re asking it now.
Every assumption underneath the paved road involved a human being. An engineer with about eighteen months of tenure, a Slack channel to ask questions in, and a choice about which path to take. Jason’s answer to how much of that tenure should go to thinking about security was blunt: zero, if possible. Know how to find us, ask anything, otherwise go build the thing you were hired to build.
Now the traffic on the road isn’t human. Engineers are shipping AI agents faster than any platform team can pave. Agents get credentials, call APIs, take actions, and spin up other agents — a workforce nobody hired, onboarded, or in most cases can fully see. Identity teams are being handed responsibility for governing it, often without being the subject matter experts in any of it.
So: does the paved road survive when the drivers aren’t human?
Does “optional” even parse when the thing choosing is a machine? Who paves the road for an agentic workforce — security, platform engineering, or a function that doesn’t exist yet? And what would Jason build first if he were standing up a security program in 2026 instead of 2011?
John Donovan is hosting. It’s unscripted, it’s being recorded for the podcast, and the room gets the last word.
The evening
Thursday, October 8, 2026 Anderson Collection at Stanford — Denning Room, Stanford campus
6:00 PM — Reception: light fare, beer, wine, and good company
6:30 PM — Live recording: John Donovan in conversation with Jason Chan
7:15 PM — Candid Q&A: the audience joins the conversation
7:30 PM — Open bar and conversation until 8:00
Most Stanford parking is free after 4:00 PM. If you’re coming up the Peninsula, Palo Alto Caltrain plus the free Marguerite shuttle means you don’t have to drive at all.
Who should come
CISOs, deputy CISOs, heads of security engineering and platform, identity leaders, and the founders and investors who back them. If you listen to the show, you’re who we made this for.
A word on size. The capacity is forty. That’s a deliberate choice, not a humble-brag about demand — a conversation stops being candid somewhere north of fifty people, and the whole point is that it stays candid. It does mean spots are limited and RSVPs are approved, so if the date works, claim your seat now rather than next week.
Thank you to HYPR
None of this happens without a partner willing to back a real conversation instead of a captive audience. Our Season 2 sponsor, HYPR, is doing exactly that. Their focus is the identity and control layer that lets organizations scale an agentic workforce without losing track of who — and what — is acting on their behalf, which is squarely the territory this conversation wanders into on its own.
HYPR’s leaders will be in the room as participants, not as a panel. There’s no product pitch on the agenda. That was the deal, and I’m grateful they wanted it that way.
One more thing
There’s a new episode coming before October 8 — a conversation with HYPR CEO Bojan Simic on what it actually takes to govern an agentic workforce, and why he thinks governance without identity doesn’t hold. Consider it the setup. Jason’s event is the payoff.
Season 2 is here. Come be in the room.
— Steve
Thanks to our event sponsor:
The Candid CISO is a Tout Media production, co-hosted with John Donovan
