Paved Roads & Guardrails: AI, Identity, and the Future of Security with Jason Chan

In this episode of the TPRM Podcast — Threats, Pitfalls & Risk Myths — host Nate Lee sits down with Jason Chan, former VP of Information Security at Netflix, to explore how engineering-led security, paved roads, and guardrails—not gates—reshaped modern cloud security. Jason spent nearly a decade building one of the most influential security programs in tech. His work on paved roads, automation, least privilege, and engineering-aligned controls helped define how today’s high-velocity organizations approach risk, resilience, and scale. They discuss: • What the paved road was originally intended to be — and how it’s widely misunderstood Why guardrails outperform gates in fast-moving engineering environments The real reason vulnerability management is stuck, and how to fix it How AI will enable security teams to scale sub-linearly — and the new risks it introduces Build vs. buy in 2025 and where security teams should invest Why vendor questionnaires rarely predict actual risk Identity as the new perimeter — including non-human identities and agents What resilience really means when third-party failures are inevitable This episode delivers high-signal insight for CISOs, security leaders, founders, AppSec engineers, and anyone designing or evaluating modern security programs built for speed, trust, and scale. Listen and Subscribe Spotify → https://open.spotify.com/show/7JvPsyMJPgVLOKuJhkKfxA Apple Podcasts → https://podcasts.apple.com/us/podcast/the-tprm-podcast-threats-pitfalls-and-risk-myths/id1848217699 YouTube → @TPRMPodcast About the Host Nate Lee is a B2B Scaleup CISO and Founder of Cloudsec.ai, helping SaaS companies build business-aligned security programs that increase developer velocity and strengthen trust. About the Show The TPRM Podcast explores real-world conversations with security leaders reshaping how we think about risk — uncovering the threats, pitfalls, and myths behind today’s cybersecurity challenges. Connect with Us Nate’s LinkedIn → https://www.linkedin.com/in/natetrustmind/ TPRM Podcast LinkedIn → https://www.linkedin.com/company/tprm-podcast/ Website → tprmpodcast.com Instagram → @TPRMPodcast TikTok → @tprmpodcast Tags: Cybersecurity, CISO, CloudSecurity, EngineeringSecurity, PavedRoad, GuardrailsNotGates, NetflixSecurity, AIinSecurity, IdentitySecurity, SublinearScaling, RiskManagement, TPRMPodcast, SecurityArchitecture, VendorRisk, DevSecOps, StartupSecurity, NateLee, JasonChan