Proton Shows People Are the Hard Part of AI

This week Matt Stockton posted on X that every leader of an engineering team should read Proton's internal AI manifesto. He called it short, well written and directionally correct. I read it, then I read the reporting around it, and I agree with him on both counts.

Proton's plan for AI is good. Getting people to follow it is the hard part. AI engineering is easy now. People engineering is hard, and it is the work every leader has in front of them.

Proton makes the encrypted email service Proton Mail. An internal document obtained by 404 Media says the company is not on track to hit its annual recurring revenue target "due to insufficient velocity." The same document says, "By all metrics that matter, we're an underperforming company."

Velocity is the word Proton uses. Read the reporting closely and the slowdown isn't coming from the models. It is coming from people: fear, pushback, approvals and old habits. I wrote about the same shift in the new model for employment.

Why are people the hard part of security too?

Two days before I wrote this, about $6.3 billion was moved out of Binance wallets, the largest crypto theft on record. Binance's early finding is that it "may involve a compromised DevOps engineer's laptop," which gave the attacker access to a service container to submit withdrawals, according to its announcement. It found no sign that a wallet private key leaked.

Co-CEO Richard Teng said the attacker "did not simply use one engineer's permissions" and that "our investigation has not attributed responsibility to any individual," BleepingComputer reported. Blockchain analysis firm TRM tied the attack to North Korean state hackers, and most of the money moved in about 20 minutes.

The attackers started with a person's laptop and the access that came with it. Proton is a security company, and its engineers are the people attackers will target the same way. When one of them asked for a few days to pentest new code, the CEO called it loser thinking.

What did Proton's CTO write in the AI manifesto?

Joseph Cox of 404 Media shared pages of the manifesto, written by Proton's CTO. It says AI is not the death of good engineering. Tests, documentation and well-built code still matter, and some best practices will change as their cost drops.

The manifesto splits the change into two phases. Phase 1 is using AI to speed up tasks inside the workflows a team already has. Proton says it has been almost completely stuck there.

Phase 2 is finding and removing the next bottleneck once code gets cheap. The CTO lists the candidates: the build system, design, approvals, specifications and code reviews. He writes that most human code review will end.

He also names a collective action problem. One engineer can learn to use AI alone. Retooling a whole team or company takes money and organization that Proton says it hasn't invested yet.

Why are humans the bottleneck now?

Look at the manifesto's list again. Design, approvals, specs and code review are all human steps. The build system is the only item on it that a machine runs.

When AI writes the code in minutes, the slow parts are the meeting where a spec gets approved, the reviewer who takes two days and the team that still works the way it did in 2022. The CTO's own answer is a people answer: engineers now own how the work gets done, and they are responsible for sharing what they improve.

I've run teams through big shifts before, at Superpages, RealPage and Aha! The tools were rarely what held us back. Getting people to agree on the new way of working took far longer.

Where did Proton's rollout go wrong?

According to 404 Media, an employee in Proton's security channel asked for a few days to pentest new code before it went live. CEO Andy Yen replied, "That's bullshit and loser thinking," and told the team to "stop lovingly handcrafting all our code and use AI more."

• Leadership set up an email address so staff could report anything blocking AI, so it could "ruthlessly smash everything that stands in the way of AI velocity."
• Proton installed software on workers' computers to track how much AI-written code the company produces.
• Yen said this is the last year Proton will hire engineers, and future hires will build with AI.
• Proton said it would re-interview staff about how they use AI.

404 Media spoke to eight current employees and one former employee, who described a culture of fear. A Proton spokesperson did not dispute the reporting and said, "In our determination to move fast, we have sometimes been too blunt or too slow in explaining ourselves to our people."

For a security company, scared engineers are a real risk. People who expect to be called losers for raising a concern stop raising concerns, and security problems stay hidden until a customer finds them. At Binance, the way in was an engineer's laptop.

Is there still a middle ground between AI and people?

I don't think there is one anymore. A company can go all in on AI and rebuild its workflows, roles and approvals around it. Or it can go all in on humans and compete on craft, service and relationships.

Proton is stuck between the two. Leadership is pushing AI at full speed while much of the team still works the old way and feels unsafe saying why. Each side slows the other down, and the revenue target slips.

Going all in on AI also means going all in on the people who run it. Matt put it well: the leader's job is to get people on the new ship and get them sailing together.

Why this applies to every team, not just engineers

Matt wrote his post for engineering leaders. I'd widen it. With AI, everyone is an engineer now. A marketer builds a landing page, a finance lead builds a forecasting tool and an operations manager automates a workflow in an afternoon.

That means Proton's phase 1 and phase 2 apply to sales, support, finance and HR too. It's also why I argued that your best people need unlimited tokens, and why companies are hiring forward-deployed engineers to sit with the business.

How should leaders get people on the new ship?

1. Fund the tools for the whole company. The manifesto admits individual effort only goes so far, so budget for retooling the way you'd budget for a new office.
2. Measure bottlenecks, not AI line counts. Track how long a change waits for a spec, an approval or a review, then fix the slowest step first.
3. Make security review fast instead of cutting it. Use AI to test and scan code in hours, so safety and speed stop competing. Lock down the laptops and access of everyone who ships code.
4. Make it safe to raise concerns. Thank the person who flags a risk in public, and answer the question before you push harder.
5. Show people their new career path. If engineers will design, review and own systems, say so, and train them for it before you re-interview them.

Proton's CTO wrote that it is past time to commit as an organization. I agree. The commitment that takes the longest is getting your people to believe the change is good for them.