Navroop Mitter:

[00.00.00.03–00.00.00.29]

Hello, this is Navroop Mitter, founder of ArmorText. I’m delighted to welcome you to this episode of The Lock & Key Lounge, where we bring you the smartest minds from legal, government, tech, and critical infrastructure to talk about groundbreaking ideas that you can apply now to strengthen your cybersecurity program and collectively keep us all safer. You can find all of our podcasts on our site, armortext.com, and listen to them on your favorite streaming channels.

Navroop:

[00.00.00.29–00.00.00.32]

Be sure to give us feedback.

Matt Calligan:

[00.00.00.32–00.00.01.05]

Welcome to the show. I am your host, Matt Calligan. So, here’s something I’ve been chewing on a little bit. Almost every cybersecurity tool defenders rely on today began as a startup, and most of those startups grew up inside the traditional funding model that’s been refined in Silicon Valley. But that model was originally built for consumer apps in most cases, or small and medium-sized business technologies, which lends itself to what’s called the power law.

Matt:

[00.00.01.05–00.00.01.29]

And it’s a funding model that intentionally singles out usually the 1 in 10 portfolio holdings of a VC that has this unicorn growth trajectory and often bluntly lets the others die on the vine. And everyone in the Valley now lives by this mantra, that whole “move fast and break things.” But does it actually produce security products that deliver what defenders need?

Matt:

[00.00.01.29–00.00.01.55]

And that’s the angle we’re exploring today. What are the most sophisticated cybersecurity programs asking for in capability and resilience these days from the cyber vendors and the products they build? Is it, secure by default, something that we have to think about? Is secure by design something we need to push forward to achieve? And really, is the incentive model, the way cyber startups are incentivized and funded, is it really built to that standard or are there competing priorities?

Matt:

[00.00.01.55–00.00.02.24]

So, my topic is specific to cyber startups because incentives matter. And I wanted to talk to someone who’s been there and seen them from both sides of this table as both the practitioner and buyer and as an advisor to organizations building these tools. And so, my guest has actually spent more than two decades inside of one of the most established critical infrastructure industries: electricity.

Matt:

[00.00.02.24–00.00.02.48]

He worked for American Electric Power, which is one of the largest electric utilities in North America. And before he departed, he was the Chief Security Officer. And today he advises companies and sits on boards of these organizations looking for guidance around how organizations that large evaluate security. So welcome, Steve Swick.

Steve Swick:

[00.00.02.48–00.00.02.50]

Thanks, Matt. Thanks, man.

Matt:

[00.00.02.50–00.00.03.15]

Absolutely. So, here’s the tension I want to explore: the power law, which is most investments fail, and a handful of breakout companies, which are called the unicorns these days, pay for everything else. I guess they called it the power law because “let’s throw it at the wall and see what sticks” doesn’t fit on a book cover or get you that professor slot at Harvard.

Matt:

[00.00.03.15–00.00.03.45]

But the model has built some incredible companies, no doubt, but it rewards specific behaviors, right? The minimum viable product that gets launched quick, the build fast and ship, where you’re refining and pivoting even while your end user is already using it and has it deployed. It’s what drives that viral growth, which is typically enabled by freeware or at least really heavily subsidized cost by the venture funding.

Matt:

[00.00.03.45–00.00.04.13]

And that’s what builds that, you know, exponential adoption curve, right? So that story then justifies higher valuations next time around for the higher financing round, your B or C round. And what I’ve experienced in a startup and a startup that sells into enterprise is that cybersecurity is different. Small and medium-sized businesses aren’t usually part of that initial adoption.

Matt:

[00.00.04.13–00.00.04.38]

They’re often the last to adopt. Users aren’t allowed to use just free tools inside a SOC, whatever they can download. Sales cycles are intentionally long. Security reviews can be grueling. The trust of that organization is earned slowly, because a security product that ships before it’s been hardened and is ready to be attacked can actually create new risks instead of reducing them or eliminating them.

Matt:

[00.00.04.38–00.00.05.02]

So ultimately, the question we’re asking is, does that model fit the mission? And Steve, I’m excited to have you on here because you’ve spent your career evaluating companies from both sides of that equation. And, you know, you have both perspectives. So let’s jump right in here. So, before the first question here, I want to give a little context to it.

Matt:

[00.00.05.02–00.00.05.25]

I saw a post on LinkedIn. It was maybe a couple of months ago. Harry Stebbings, he runs 20VC. It’s a very big venture podcast, one of the biggest, and he has his own venture fund as well. And he posted something that he called the truth that founders needed to hear. And he laid out that, companies traditionally, the unicorn path.

Matt:

[00.00.05.25–00.00.05.43]

They go from 1 million to 4 million in year one and then 4 to 12 in two, 12 to 30, and then 30 to 75 by the fourth year. And his point was with these new AI companies, they’re doing that in nine months. And he wasn’t throwing shade at companies who didn’t grow like this. He was careful about that.

Matt:

[00.00.05.43–00.00.06.03]

But his point was it’s no longer what VCs find attractive. He says the game has changed. And he told founders, you need to ask yourself whether you’re going all out for this giant idea or you’re looking for a steadier path that’s right for you, implying that’s not where the VCs are going to go. I respect his honesty. He’s at least saying that part out loud.

Matt:

[00.00.06.03–00.00.06.28]

A lot of folks are dancing around it a bit, but 75 million in four years, that’s usually a great company. And most CISOs would be thrilled to see something growing like that. And that scoreboard, you know, that’s proposed says that’s not enough. So I want to focus today, Steve, on your scoreboard. Right.

Matt:

[00.00.06.28–00.00.06.53]

Not what investors want, but what the buyers want, what the defenders and practitioners look for in a new security tool. So, with that context, question one here is when you were on the buying side, startups were, I’m sure, knocking constantly. I have no doubt you were always approached by new ideas. Either internally by people seeing them or externally.

Matt:

[00.00.06.53–00.00.07.10]

Did that startup, assuming it’s a startup, or a company, however broad you want to cover it, did that company’s growth rate and adoption curve, did that ever factor into the evaluation process, or were you looking for something else entirely?

Steve:

[00.00.07.11–00.00.07.37]

Actually, we did track that, but in some cases it was a bad sign. Growing too fast sometimes made us more concerned than being a positive mark, right? So if it’s escalating, moving too fast, it may not be able to take our input. They may misstep as they’re moving that fast to evolve, because we need something reliable that we can pull into our operation and keep it there for the next decade is the ideal state, right?

Steve:

[00.00.07.37–00.00.07.42]

So, we did pay attention to that, but it wasn’t necessarily a positive mark.

Matt:

[00.00.07.42–00.00.07.51]

Right. How did you decide whether it was a good or a bad thing, usually? Like, was there a certain framework you applied?

Steve:

[00.00.07.51–00.00.08.08]

It was more so we relied on our procurement organization to give us some of that, because we need to know that they’re going to be around for several years. Right. We need to know that stability exists. We need to know that they’re going to have the backing and the right model to exist for the next several years.

Steve:

[00.00.08.08–00.00.08.34]

Right. So the procurement team kind of did a lot of that piece when we’re watching it. A lot of it was, it was also, I had my technical leaders and team that were giving me a lot of this piece. Right. They were looking at it, trying to sort out what they like, what’s good. At the same time, I’m trying to figure out, is this a viable solution for us to invest in, invest our time, which is worth more than the money in many cases?

Steve:

[00.00.08.34–00.00.08.57]

Absolutely. And get them to push that company and figure out, is it something that we can that we want to back, that we want to be behind, you know, being part of a big organization that had a reputation for being mature. There was also value in us saying, “We got you. We’re going to use you as a product and we’ll tell all our friends.”

Steve:

[00.00.08.57–00.00.09.04]

So, we were very careful about how we leverage that and use that to partner and push our partners.

Matt:

[00.00.09.04–00.00.09.32]

Yeah. Yeah. Well, I’ve argued in the past, there’s the settled sort of Crossing the Chasm adoption curve that, at least on the founders and builders side, everyone’s familiar with. And the cybersecurity adoption curve is the almost literal inverse of that model that everybody says, you know, your typical new company growing should follow.

Matt:

[00.00.09.32–00.00.10.10]

And that’s because in most B2B markets and in consumer, whatever, you know, the proving ground is the small and medium-sized businesses who have lower risk thresholds, faster procurement. You can sell to them faster to validate the technology. But in cyber, the first real buyers are the big enterprises because they have the resources to map risks out to the edge, and then often hire that subject matter expert to own that problem and solve for a very specific problem.

Matt:

[00.00.10.10–00.00.10.41]

Whereas the small side, the SMB side, they’re looking for, “We’re just going to adopt the best practices once it’s all kind of been threshed out.” And so, especially in critical infrastructure, enterprises tend to be, from my perspective, the R&D lab for the industry, right? That’s where everything is vetted and threshed out efficiently and effectively before best practices and best of breed are established and adopted industry-wide.

Matt:

[00.00.10.41–00.00.10.45]

Does that match what you saw from your side?

Steve:

[00.00.10.45–00.00.11.11]

Yeah, we even partnered to help develop solutions with VC companies to help make sure we had a solution that we needed. The challenge is staffing, right? Nobody, including well-staffed mature organizations, well, maybe there might be some exceptions in banking or something, but nobody has enough staff that they would like to have. We were always focused on what we’re not getting to yet, even with a large, mature organization.

Steve:

[00.00.11.11–00.00.11.34]

Yeah. So, we were careful about what we allocated our resources to. So, if we heard of a solution or something we need to fill a gap, somebody brings us something that sounds very interesting. We’ve got to figure out do we want to allocate that time for that person to start digging into it, evaluate it, figure out if it’s got enough foundation to be a solution for us.

Matt:

[00.00.11.34–00.00.11.35]

To continue to invest in.

Steve:

[00.00.11.35–00.00.12.01]

Yeah, where small and mid companies, they’re lucky to have a cyber person, much less a cyber person that can focus on the cost, right? Right. Yeah. It’s even harder for them to staff up and cover all the risks that they would like to hit. So, they’re focused on, hopefully, the foundational pieces and building from that and bringing in a startup company and a new product that isn’t proven.

Steve:

[00.00.12.01–00.00.12.14]

They don’t. They shouldn’t, in my opinion. They shouldn’t be focusing on that. They should go with products that are vetted so they at least know when they’re investing their time. They’ve got a solid foundation for the tool and a person that can allocate time.

Matt:

[00.00.12.14–00.00.12.16]

Get your blocking and tackling done.

Steve:

[00.00.12.16–00.00.12.18]

Yeah. Yeah, exactly.

Matt:

[00.00.12.18–00.00.12.20]

Don’t chase the shiny new thing, right?

Steve:

[00.00.12.21–00.00.12.46]

I was able to have people chase that shiny new thing. But when it came time to investing time into it, that was a bigger discussion that we had to figure out. Is this a viable long-term technology and can it be something we can rely on to be, you know, long term available and availability is critical for critical infrastructure.

Matt:

[00.00.12.46–00.00.12.48]

Availability is the thing. Yeah.

Steve:

[00.00.12.49–00.00.12.52]

Yeah. And especially for cyber within a particular…

Matt:

[00.00.12.52–00.00.13.14]

Yeah. Yeah. Well, the tough part with cyber, from a vendor side and from a buyer side, is that with many cyber tools, you can’t tell when they’re working because nothing happens when they’re working, or you don’t use them until the thing is happening. And so, you won’t know if it works until you got to use it.

Matt:

[00.00.13.14–00.00.13.40]

And so, yeah, it’s an intersection of the two hardest, you know, ROI equations to ever satisfy. You’ve alluded to this, and it actually kind of folds right into a question. I’ve always been on the vendor side of things and, you know, the free pilot or the freeware or the freebie trials.

Matt:

[00.00.13.40–00.00.14.05]

These are things that are relied upon a lot by small companies to sort of. You know, maybe not necessarily give a false impression of growth, but, drive their adoption numbers higher than if they have to just wait for a paid client. But free has a cost, as you’ve said a few times already, from an enterprise buyer side.

Matt:

[00.00.14.05–00.00.14.19]

I don’t want to put you on the spot as far as hard numbers, but if you do have hard numbers, I’d love it. But talk to me about what that cost looks like of a free pilot from an enterprise side.

Steve:

[00.00.14.19–00.00.14.50]

I don’t know if I have dollars besides people’s salaries, right? Right. It’s that time commitment. I can’t tell you how many times, multiple times a year, we had people come to us and say, we will give you a free pilot. We will come in and set it up. But now, if I’m putting this, some of these things you cannot test unless they’re in production or we create data to send to it, or we do certain things to be able to actually because we’re not going to bring anything in unless we can have confidence it works.

Steve:

[00.00.14.50–00.00.15.08]

So, we’re not going to just sit it there and hope it’ll trigger on the bad thing. Right? We’re going to create the bad thing and send it to it to be able to prove it works. The piece with that is the time, the resources that it takes. And if we’re putting it on a production network now we’ve got tons of approvals, we’re calling in favors, all that.

Steve:

[00.00.15.08–00.00.15.30]

And it’s before it’s gone through that long procurement vetting process and leadership has checked off. Right. Usually, I was in a level where I could get it approved to be able to test it in our environment, but again, I’m calling in favors. I’m using my credibility. If I put something on the production network that causes any kind of issue, I just lost all my credibility.

Steve:

[00.00.15.30–00.00.15.57]

Right? So, there are so many pieces that fall into place that have to fall into place for us to say we will test it in production, in our environment, even for free. Right? Right. But free, usually that’s not a big piece of this. Yeah. The bigger piece is, can we show the value? Can we justify the staff time and the resources that are outside my staff.

Steve:

[00.00.15.57–00.00.16.10]

Right. A lot of those people didn’t work for me. They weren’t in security. They were in technology, networking, and whatever. I needed their help to fully test this solution. Right. So, it’s the bigger story.

Matt:

[00.00.16.10–00.00.16.34]

Yeah. And, you know, it even goes beyond calculating just man hours. It’s, to your point, your internal credibility. It’s you know, there are times when you’re going to have to put your name out there as, yes, internally, even before, like you said, it’s public, that you’re saying we’re going to, plant a flag here and we’re going to look at this tool and we think this is the one that will work.

Matt:

[00.00.16.34–00.00.16.58]

And if it goes sideways, that you’re the guy that brought this tool in that went sideways, and wasted all this effort. “Oh, but it was free. So, you know, like, who cares,” right? Interesting. This is not a question, but this is a follow-up. Do paid pilots often I mean, does a pilot not being free generally seem more legitimate to somebody from your side?

Steve:

[00.00.16.58–00.00.17.20]

No, not coming from that company. In fact, I’m sure there were cases where we paid for a pilot, but it was very rare where we were willing to pay for a pilot. If you want us to allocate our time and some very skilled resources to look at your technology, vet it out and do all that, especially if you’re a newer company.

Steve:

[00.00.17.20–00.00.17.39]

Yeah, that’s our. Exactly. That is our payment. Yeah. So, if my team brought me, because really a lot of these things came. I was super technical at one point, but I relied on my teams to do this. There’s a lot of times where vendors say, “I need to talk to the CSO.” Well, a smart CSO is not the one making the decisions.

Steve:

[00.00.17.39–00.00.17.55]

It’s the people that are hands-on in that job that should be making the decision, figuring out what is right and what works, and then bring it to the CSO. The CSO may find it and say, “I like this. Can you guys dig into this and see if it’s worthwhile?” And I did lots of times. And then they’d be like, “Nope, that’s junk.”

Steve:

[00.00.17.55–00.00.18.15]

Or we don’t have time to look at it or whatever. And it was a collaborative discussion. In my world, at least I was not a “direct, try this out,” unless, you know, one of the executives handed me something and said, “Check this out. Some politician or whatever told me we need to do this,” which happened.

Steve:

[00.00.18.15–00.00.18.17]

But that was the rare case, right?

Matt:

[00.00.18.17–00.00.19.01]

Right. That investment of time and sort of the evaluation process is something we’re very familiar with here. But what worries me at times is the incentive to sort of rush cybersecurity. And I’m going to say cybersecurity, not just security, because it really is dialed into that in this case. But, you know, cybersecurity products that get pushed too quickly to market to hit growth targets, they can become the attack surface because they haven’t worked out all the bugs.

Matt:

[00.00.19.01–00.00.19.23]

From the defender’s seat, we talked about sort of, you know, does the growth trajectory matter in this case. But was there a suspicion, or sort of, you know, natural hackles going up when, you know, someone came in as a technology or someone was recommending a technology because they’re just, oh, they’re trendy, they’re the next greatest thing.

Matt:

[00.00.19.23–00.00.19.35]

How did you think about the risk that a security tool can become a vulnerability, from that sort of how-did-they-check-the-boxes perspective? It’s a broad question there.

Steve:

[00.00.19.35–00.00.19.58]

So, yeah. Let me see if I can hit all the points. But our job was managing risk, right? So, we did everything possible to avoid introducing risk, especially not just security risk but also reliability, availability, all that stuff that we need, the foundation of the network and the infrastructure. We did not want to cause that issue.

Steve:

[00.00.19.58–00.00.20.23]

So, it was a huge piece looking at that to figure out if it was something. And also scalability, you know, coming from where I came from, a large corporation, I needed to know things at scale. So, there was a lot of discussion that happened before my team would even touch it, to vet out how much they tested, or do they know how much this will scale?

Steve:

[00.00.20.23–00.00.20.51]

Can you handle, you know, 10,000 gigs per second or whatever? Yeah. What can you handle as far as data bandwidth and can it scale to a large corporation? We were not the biggest, but we were big enough to test availability, scalability solutions in addition to stability, that it’s not going to introduce risk, because huge, huge concerns around that.

Steve:

[00.00.20.51–00.00.21.05]

We definitely didn’t want to be the vector for a threat. We wanted to do things to minimize and manage it. So, we did try to check all those boxes to determine if we were introducing any type of risk.

Matt:

[00.00.21.05–00.00.21.25]

Getting into a little trendy piece of this for a second, with AI and Mythos and some of these scanning capabilities that are pushing quickly to, you know, general availability, do you see that helping this process as far as finding those cracks and those vulnerabilities?

Steve:

[00.00.21.25–00.00.21.46]

So that’s a perfect example of trendy and hype solutions, right? And now, with all the Mythos drive, the benefit to some of the scanning solutions is it’s a point and shoot or it’s monitoring to scan things. If it stops working, it shouldn’t introduce risk. It just won’t be identifying new risks that you’re trying to protect against.

Steve:

[00.00.21.46–00.00.22.09]

So, I think those solutions might be something where we’re accepting a little bit of that. We don’t understand the full trajectory. We don’t understand some of that. That may be a vector in the cyberspace where people are willing to take a little, a little more of the risk, but also it is doing some type of scanning and monitoring, and you cannot disrupt the systems.

Steve:

[00.00.22.09–00.00.22.13]

Right? I mean, I’m just talking IT systems before you get to OT systems.

Matt:

[00.00.22.13–00.00.22.14]

Not even.

Steve:

[00.00.22.14–00.00.22.35]

Just the IT systems. I, started well in the ’90s, and then when I got to corporations in ’98, there were multiple times we did something that we broke a system as we’re trying to test security. You can’ that, again, destroys relationships. “Yeah, you did a scan of something. You broke my stuff. I’m not going to let you scan it anymore.”

Steve:

[00.00.22.35–00.00.22.53]

Right. So, it took us a lot once we got that trust. That was one of our biggest things we protected. Like, we’re going to prove we’re going to do our best to not disrupt anything. And scanning tools are just known for that type of risk. Right. Introducing that risk. So that would be the biggest caution I would say for anyone doing that.

Steve:

[00.00.22.53–00.00.22.56]

And that’s what I’ve seen. Yeah.

Matt:

[00.00.22.56–00.00.23.17]

Did you find yourself in many scenarios where a new technology pivoted and sort of either, you know, moved away from what they said they were doing for you as a use case into something else, or got acquired and were forced to, or, were just kind of phased out by the VC, you know, one of the nine, so to speak.

Matt:

[00.00.23.17–00.00.23.23]

Have you found that, has that happened to you? Have you had to work through that in the past?

Steve:

[00.00.23.23–00.00.23.45]

Yeah. Even large corporations that bought somebody or sold somebody or a few that changed their names. And then I was on the advisory board at that, major corporation level. And trying to advise them was like, if you change this, I have trust from the executive team that I’m using this technology, say McAfee versus Trellix.

Steve:

[00.00.23.46–00.00.24.09]

Everybody knew McAfee. I’m using McAfee to protect our systems. Right. And now, “What’s Trellix? What do you mean you’re switching?” “No, no, no, we’re not changing technology. The name just changed. That’s it. Nothing else changed.” But there were definitely cases where decisions change. That caused me challenges, whether it’s just simple as naming or their direction changed and it did not meet our needs.

Steve:

[00.00.24.09–00.00.24.36]

Right. You know, talk about cloud: people that were on-prem versus cloud, when they changed to the cloud, in critical infrastructure. That was a big discussion for us, even progressive critical infrastructure that would figure out how to leverage what was necessary. It’s still those changes in direction. Took a big discussion, a lot of consideration. The brain trust internally trying to figure out, are we okay with that?

Steve:

[00.00.24.36–00.00.24.42]

Do we change horses midstream or not? I mean, that’s a big deal too, so.

Matt:

[00.00.24.42–00.00.25.21]

This is more of a theoretical, because this is kind of a thread, I’ve been pulling on myself. But with the way funding for startups usually works, it’s, you know, even if it’s not freeware; they often can price artificially low to encourage adoption. Have you seen, or maybe if you haven’t seen it, in a theoretical scenario, where these artificially low prices actually price out better products or better incentive to develop better products slower, right?

Steve:

[00.00.25.21–00.00.25.47]

Absolutely, absolutely. And we’ve done things where we did RFPs or bake-offs to look at things, and then something comes from the side that comes in way cheaper, and we figure out it doesn’t have the scalability. We don’t trust the direction of the company or things like that. If they can’t convince us of those things, I will justify spending more money on a technology that we have confidence in.

Steve:

[00.00.25.47–00.00.26.09]

Even if that looks super cool and it’s shiny and it does a lot of the things they said they do, it’s not enough to commit into our infrastructure and commit my team to invest time in that. Even if there were times when I was at odds with my team where I’m like, no, I don’t trust their direction, we’re going to go with option two.

Steve:

[00.00.26.09–00.00.26.12]

I know you liked option one, but sorry.

Matt:

[00.00.26.12–00.00.26.13]

Go ahead.

Steve:

[00.00.26.13–00.00.26.26]

Internal discussions, right, where I would go against my own favorite people on my team. And sometimes we ended up back there five years later. But yeah, at that time it was the right decision.

Matt:

[00.00.26.26–00.00.26.35]

But it took the time. Five years later means that the flashy technology took the time to earn its stripes and prove itself. Yeah, right.

Steve:

[00.00.26.35–00.00.26.36]

Absolutely.

Matt:

[00.00.26.36–00.00.26.54]

So flipping this from the buyer side. Now, you’ve been on the consulting side for a number of years. What has surprised you most when you crossed from that buyer to the advisor side? What was something that you were not prepared to see?

Steve:

[00.00.26.54–00.00.26.57]

Oh, that’s a difficult discussion. Let me think about that.

Matt:

[00.00.26.57–00.00.27.02]

“Prepared to see” is not the right way to phrase it. But what was surprising, I guess. Yeah.

Steve:

[00.00.27.02–00.00.27.27]

The diversity of people leveraging tech, I’d say was impressed with versus surprised with, but the amount of companies that have tech that they’re not fully leveraging and every company has that, right? They bought something and they didn’t get it scaled out, didn’t get it fully deployed. But there are definitely cases where they bought that shiny thing, figured out it didn’t work.

Steve:

[00.00.27.27–00.00.27.49]

And now they’ve got shelfware sitting there. Yeah, I’ve seen more of that than I expected. And part of it is because they didn’t have the staff, the resources, the talent to be able to fully vet that technology or they didn’t dedicate the right people to dig into that technology and figure out, is it fully viable for today for your company?

Steve:

[00.00.27.49–00.00.28.08]

Right. There’s a lot of cases where they just didn’t get that invested. Then of course, I know cases where tons of people invested a lot of time and still that technology didn’t turn out right. There’s both examples. I’ve got lots of both examples, unfortunately.

Matt:

[00.00.28.08–00.00.28.27]

What has been a theme consistently, as you’re talking to these founders and builders and executives from the vendor side? What’s been something you find a consistent misunderstanding about folks on the buying side from that perspective?

Steve:

[00.00.28.27–00.00.28.50]

To be honest, the biggest one is about “I need to talk to the CSO. I need to talk to an executive. Why is that executive not calling me back? That’s who I need to talk to.” And explaining to them, and I’ve literally had this discussion dozens of times, they’re swamped. They’ve got 500 priorities that are top priorities.

Steve:

[00.00.28.50–00.00.29.03]

And in reality, most of them aren’t going to be the ones that want to make that decision anyway. If you convince somebody, one of their talented staff or their leaders, and they bring it to them, you’ve got.

Matt:

[00.00.29.03–00.00.29.04]

You’re in.

Steve:

[00.00.29.04–00.00.29.23]

Huge potential to get in. But if you just convince that security executive, who then says to their team, “Check this out. Tell me if there’s anything viable.” So, they’re just pushing to talk to that executive. They’re just going to hand it to somebody if they’re smart. Exactly, right? And they’re, in some cases, super upset. “But I know this person.

Steve:

[00.00.29.23–00.00.29.42]

They’re not calling me back.” They are swamped with protecting, large portions of the power grid for the US or something. That’s their top priority. They’re getting hammered by GridEx, sorry. They may like you, but it doesn’t mean they have bandwidth to call you back. They’re swamped with, every hour, five different meetings to choose from.

Steve:

[00.00.29.42–00.00.29.45]

And you were not the sixth one, right? Sure.

Matt:

[00.00.29.45–00.00.29.45]

Yeah.

Steve:

[00.00.29.45–00.00.29.55]

And I had to apologize to people I’ve made friends with over the years. I’m sorry I didn’t call you back some of those times, but, yeah, this is too.

Matt:

[00.00.29.55–00.00.29.56]

Make sure the beast is good.

Steve:

[00.00.29.56–00.00.30.10]

Yeah, because now I’m on this side, and now I’m getting the same thing from people I’ve been friends with for decades. And now, “Bro, come on, call me back. We were ” Yeah. So, it’s but I understand, because I was in there. It’s still, so.

Matt:

[00.00.30.11–00.00.30.33]

That’s incredible. Again, I’m digressing here a little bit, but pulling on this for a little more: how does somebody find that second tier of who you talk to? And that’s the age-old advice, start at the top, find the decision maker. They’ll push it down. Right. Which rationally makes sense.

Matt:

[00.00.30.33–00.00.30.57]

But to your point, when you’re talking to the guy that, 800 other vendors are trying to get in front of, and that CSO is relying on people below them in their teams to bring the best ideas to them. How does somebody find that second layer? Like, what are indicators of, like, these are the people I should be convincing to then recommend, right?

Steve:

[00.00.30.57–00.00.31.19]

So sometimes you do need that CSO to hand you off to somebody to get in that door. But there’s also the case where, I had my layers of leadership and then practitioners that were on LinkedIn, they were attending conferences. They were actually out there way more than I was. My name was out there, but I never attended conferences for decades.

Steve:

[00.00.31.19–00.00.31.50]

A couple decades probably. I wasn’t out in the mix with vendors, with practitioners and all that. I was at executive meetings or in DC talking to people in DC. But I had a large organization that was out there looking at stuff, talking to people. And I now know even better that on the vendor side, there’s a huge network of people, right?

Steve:

[00.00.31.50–00.00.32.11]

Somebody knows somebody that is one or two layers below that CSO that would help get you in the door, you know, and it might mean you got to buy somebody a dinner who doesn’t always get a dinner, right? But get you in that door to say, “It’s not me, but it’s Bob over here. You’ve got to talk to Bob, and I’ll kick you over there.”

Steve:

[00.00.32.11–00.00.32.25]

And if he’s interested, he will, if he’s got bandwidth, right? Because there’s always that bandwidth issue too. I was busy with political discussions and big decisions. They were busy with protecting the company.

Matt:

[00.00.32.25–00.00.32.26]

Yeah.

Steve:

[00.00.32.26–00.00.32.32]

Yeah. They were operationally hands-on and they needed to prioritize their time.

Matt:

[00.00.32.32–00.00.32.58]

So, yeah. Something that I’ve heard from other folks on the consulting side of this equation is that it’s actually one of the reasons a startup is purchased, procured, is actually to get access to the founder themselves because these technologies are built by subject matter experts.

Matt:

[00.00.32.58–00.00.33.18]

And so, it’s common, from what I’ve been told, that, early on, sometimes these startups will be purchased and deployed, not because the tool is amazing, but because the founder themselves brings something specific that this team wants to interact with. Do you see that at all on your side?

Steve:

[00.00.33.18–00.00.33.22]

From the vendor side, or did I see that in?

Matt:

[00.00.33.22–00.00.33.36]

Well, from either side? Do you see that as a pattern? As a buyer, were there scenarios where you’re like, this guy really knows his stuff? You know, the technology is a little half-baked, but there’s some legs to this.

Steve:

[00.00.33.36–00.00.34.09]

Yes, I get it. There were definitely cases where I saw people that had a vision, and their vision was awesome and I was super behind their vision. And then we start talking to the people several levels down. And they were not connected to that vision and they were not going the same direction. Right. In some of those cases, you’d hope that Cisco, IBM, Microsoft, somebody would come in and swoop them up and redirect the ship and align with the right vision, because there’s also cases where they’ve run them into the ground.

Steve:

[00.00.34.09–00.00.34.29]

But there’s definitely cases where, I think, it’s to get customers and convert them over. There’s been companies I can think of in the last year or two where they bought the product just for the clients and the customers, and they were going to eliminate that product and migrate them over to.

Matt:

[00.00.34.29–00.00.34.29]

Fold them in.

Steve:

[00.00.34.29–00.00.34.35]

A better product, in reality, in the example I can think of.

Matt:

[00.00.34.35–00.00.34.48]

I’ve heard the opposite too, where they bought the entire company just to get the IP. And all the human side of that company has been actually, cut loose. They just got the IP and the customers from that IP. Yeah.

Steve:

[00.00.34.48–00.00.35.20]

Yeah, I’ve seen that. And I’ve been in discussions with the Cisco’s, the IBMs, the Microsofts on, “Okay, you’re buying this technology, this product that we are very committed to, right? I need to know you’re not going to run it into the ground, drastically change it.” Eliminate the visionary. Yeah, exactly. So, I’ve had some pretty strong discussions with executives from some of those big players who were buying companies I really liked, and not that they didn’t like them also, and obviously I did.

Steve:

[00.00.35.20–00.00.35.23]

I wouldn’t have that relationship to get that call.

Matt:

[00.00.35.23–00.00.35.24]

Yeah. To be with them.

Steve:

[00.00.35.24–00.00.35.39]

Right. Exactly. But yeah, I’ve had some hard discussions with some of them that in some cases they’d already killed two products I loved. And one example I can think of, you killed a couple of products I loved. And I need to know you’re not going to do that with this product.

Matt:

[00.00.35.39–00.00.36.02]

Yeah. I was actually on the receiving end of that discussion once. I was working for a startup that got acquired by a very large tech vendor and everybody thought, “Oh, we’re the real deal now.” And then they started implementing policies from the corporation that were, you know, antithetical to our culture, et cetera.

Matt:

[00.00.36.02–00.00.36.24]

And so, we had this town hall meeting and everyone’s complaining, and the guy stops, and he’s from the corporation. He goes, “Let me tell you guys something.” He’s like, “We just bought this company,” referring to us, and he said, “And we just bought another company at 10X, and we’re about to just let that company go just so that we could acquire that market share.

Matt:

[00.00.36.24–00.00.36.39]

Like, don’t think that you’re not, you know, in those crosshairs. Like, you are very easily forgettable. So don’t think you’ve got some kind of leverage in this situation.” I was like, oh crap.

Steve:

[00.00.36.39–00.00.36.40]

Yes.

Matt:

[00.00.36.40–00.00.36.42]

We’re in a whole other game here. Yeah.

Steve:

[00.00.36.42–00.00.37.03]

That’s a hard discussion. And I’ve talked to friends that left sales or tech companies where they liked that smaller company, that startup culture, and when they got embedded in a big old-school tech company, they were not happy, super miserable. So, I like it when they kind of leave them autonomous a little bit and then gradually integrate them.

Steve:

[00.00.37.03–00.00.37.17]

But usually they’re doing it because they want that company and that tech to be part of theirs, right? So, they’re in some cases in a hurry to integrate. And it’s hard for the people that are migrating over. I’ve seen from the outside.

Matt:

[00.00.37.18–00.00.37.19]

The cultural clash.

Steve:

[00.00.37.19–00.00.37.20]

Yeah, yeah.

Matt:

[00.00.37.20–00.00.37.26]

Yeah, it makes a difference. It’s not better or worse. It’s just different. And sometimes different is enough.

Steve:

[00.00.37.26–00.00.37.38]

Yep, yep. And being part of a big company, we bought smaller companies that we had to change their culture drastically. Yeah. On the tech side and the culture side. So, they didn’t love it.

Matt:

[00.00.37.38–00.00.37.52]

I could see that. Yeah. I’ve always thought of like technical acquisitions, but yes, even within, critical infrastructure and utility and that kind of stuff. Yeah. You’re bringing in the company. It’s got to catch up culturally to certain things.

Steve:

[00.00.37.52–00.00.38.00]

Startup renewables, startup other things that we bought, they had a very different culture than an old-school corporation, you can tell.

Matt:

[00.00.38.00–00.00.38.21]

So fascinating. At this point in the game for you, with everybody slapping agentic and AI on everything, and oftentimes not actually changing anything underneath, how do you separate real capability from just a flashy story right now with this kind of stuff?

Steve:

[00.00.38.21–00.00.38.36]

That is super hard. I’m getting ready to go to a conference here next week, and I’ll walk through the… Now, I used to not walk through vendor halls with the CSO tag, because then everybody would flock to me. Now people look at me.

Matt:

[00.00.38.36–00.00.38.36]

…guy?”

Steve:

[00.00.38.36–00.00.38.40]

“I don’t care who he is now,” because he doesn’t have, you know…

Matt:

[00.00.38.40–00.00.38.41]

Right?

Steve:

[00.00.38.41–00.00.39.06]

Yeah. So now I walk through the vendor halls and I’m looking at it, like, “No, pretty sure you embedded ChatGPT and that’s your AI spin.” So, it is definitely hard. I try to stay up on it, but we’ve got some really sharp people that are really embedded in the AI discussion and are long-term security practitioners, who can dig a little deeper under the covers and figure out what is and what isn’t.

Steve:

[00.00.39.06–00.00.39.31]

But it goes back to that. The teams, the security teams in the company need to vet that out and figure out what’s reality, what isn’t, right? Because unfortunately, marketing spin puts a little twist on things, maybe leaves out a couple of critical details that I might be interested in, and somebody’s got to vet that out a little further before committing and saying that.

Steve:

[00.00.39.31–00.00.39.54]

And even inside the companies, the executives want to hear we’re using AI, we’ve done this and we’re keeping up with technology to protect and all that. So I had to use a lot of the same buzzwords inside to let them know I’m keeping up with the threat. I’m keeping up with technology as it evolves. But I also made sure they understood.

Steve:

[00.00.39.54–00.00.40.08]

I’ve got to vet that out. And I did these three. And they weren’t what they claimed to be. But this one here is the one I’m backing. And I would like to make sure you guys are supportive or whatever. So, it’s important to figure out for sure.

Matt:

[00.00.40.09–00.00.40.43]

Yeah, for sure. Kind of shifting to what better might look like, given sort of the nature of what it is now, again, specifically with how startups cybersecurity is developed and brought to market, are there any particular areas that you see an incentive change would improve, like the way the culture of this, everything we’ve been talking about is sort of the culture of adoption and integration of cyber technologies.

Matt:

[00.00.40.43–00.00.40.59]

Now that you’ve kind of played both sides of this discussion, where do you see the most obvious areas for change as far as like if we all just kind of approach this differently this way, are there any things that have kind of jumped out to you?

Steve:

[00.00.40.59–00.00.41.19]

So, I definitely think if you get to the operators and get them on board, that’s going to be your fast path, right? Continually calling the CSO, or even worse, calling somebody above. If you called somebody above me, then I probably wouldn’t even talk to you, even if you… So, I finally…

Matt:

[00.00.41.19–00.00.41.20]

…got on.

Steve:

[00.00.41.20–00.00.41.33]

Yeah, exactly. Even if I really liked those executives and trusted them, they’d still. They said, “Hey, so-and-so badgered me and I finally took the call, and they want me to pass this on to you. I don’t care if you do something with it, but here.”

Matt:

[00.00.41.33–00.00.41.34]

Get it done.

Steve:

[00.00.41.34–00.00.42.02]

And I’m like, I’m not talking to them. So, there’s that piece. Get to the operators. The other piece is I would come out the door talking about that. Even if you’ve only existed for six to nine months, we’ve thought about the scalability, the resiliency, the reliability, the availability of our technology. So, if you commit to this and start digging into it, we are focused on that also, not just this cool, flashy tech that is filling a gap that we think you need.

Steve:

[00.00.42.02–00.00.42.23]

We’ve also thought about all these things, and maybe we haven’t gotten a big company to test it yet, but we’ve really dug in on all this stuff as much as we can. And we’d like your help vetting out this and proving out the scalability, the reliability of this and ensuring it is as cool as we think it is.

Steve:

[00.00.42.23–00.00.42.53]

Right? There were a couple times over the years where people brought that to me and said, I’m very confident in this, but I really need somebody to really run its paces to make sure it is as good as we think it is. And we did think about all these things. I think that’s the best discussion in the door, because it also helps the operators when they bring something to me, they can say they checked all this stuff, and they’ve made me confident that they’ve mentioned all the right things.

Steve:

[00.00.42.53–00.00.43.00]

Now I need to test it. And then if I like it, then I’m going to bring it back to you and say, I want to take this to the next level and buy it.

Matt:

[00.00.43.00–00.00.43.01]

Yeah.

Steve:

[00.00.43.01–00.00.43.24]

Yeah, I think that will help people out. I think pilots for free, especially if you’re going to a big, mature company that you think has money. That doesn’t mean they’ve got money to just put towards a pilot. If you want their opinion, their name and their feedback, you need to make that free because they’ve got to do a lot of work and use a lot of credibility to actually test your technology and get it in.

Steve:

[00.00.43.24–00.00.43.35]

Too many times, they think, “Oh, you can just turn it on in your environment, and you’ll be able to see it works.” That is not easy at all. That is huge. It’d be easier.

Matt:

[00.00.43.35–00.00.43.39]

Because you clearly, as a vendor, don’t understand what you’re doing in here. Yeah.

Steve:

[00.00.43.39–00.00.43.43]

Yeah, exactly. Just put it in your OT environment that you never check, but every three months

Matt:

[00.00.43.43–00.00.43.46]

Just put it right on the PLC. Just put it right on there.

Steve:

[00.00.43.46–00.00.43.52]

Yeah, exactly. Don’t worry about it. It’s safe, I swear. Yeah. Like, get out.

Matt:

[00.00.43.52–00.00.44.26]

From an advisory standpoint, you know, in the role that you are in now, what could change from that perspective about what is passed down to builders and founders about how they’re building these products? What can change? Like, what are you doing differently that you could see the rest of folks on your side, the funding and the advisory side, do differently to better align these products with that process?

Steve:

[00.00.44.26–00.00.44.53]

Good question. I think it’s some of those things we talked about on making sure as an advisor; you’re coming into it from an optimistic but a critical thought process to make sure you’re thinking of that technology. Right. And for these companies I’m advising, unless I’m very confident that there’s some very good potential with this technology, I’m not going to recommend it.

Steve:

[00.00.44.53–00.00.45.10]

Right. So I’ve got people calling me all the time. “Well, you can call CISOs for these 30 big utilities that have money, and you could get our technology in there.” Well, one, I mean, they’re going to take my call, but it doesn’t mean they’re going to take my word. And I’m going to use my credibility for something.

Steve:

[00.00.45.10–00.00.45.24]

If I make that call, then I have to have some pretty good confidence. So to my friends out there, if I call you and tell you should look at this technology, I have a belief in it. I’m not just doing it because they pressured me into using my contacts.

Matt:

[00.00.45.24–00.00.45.25]

Yeah, yeah.

Steve:

[00.00.45.25–00.00.45.55]

So I think that’s a piece we’re very careful about when we’re doing that advisory work and pushing companies we’re talking to who think, “I just found this, it’s cool, and it says it will fill this gap.” You’ve got to allocate some resources for a month to look into that technology before you do something with it. So we’re using the experience we have because we’ve got several people that have been in industry for years and trying to make sure people are making informed decisions on this and not using their limited budget and their limited resources on tech that, may not.

Steve:

[00.00.45.55–00.00.46.27]

And I’d also say, on the sales side, trust and relationships will take you miles. But if you come in, get somebody to commit to something and buy it. And I think most salespeople I talk to, at least the ones I talk to, have figured that out. And they’re not just trying to sell something they really want to gain your trust and then figure out how to get you to look at this tech they’re working with and they’ve come to believe in it.

Steve:

[00.00.46.27–00.00.46.33]

So, it helps if you’ve got that trust with your sales partners and your advisors.

Matt:

[00.00.46.33–00.00.47.03]

Right. I did a podcast a while ago called Vendor Cooties, and it was interviewing the CEO of the Cybersecurity Marketing Society, and one of her right-hand guys named Charlie Gold. And that was the premise was because of the almost oversaturation of analysis and information about products out there. Even, now fueled with AI summaries, its own thing.

Matt:

[00.00.47.04–00.00.47.26]

Salespeople don’t have the luxury of just playing the asymmetric information game as leverage. You don’t get to just be kind of the prototypical, slimy, untrustworthy salesperson. You can’t bluff. You can’t BS because people are, especially in cyber, are coming armed to the teeth with intelligence about the industry and the capabilities and the technology.

Matt:

[00.00.47.26–00.00.48.04]

And it’s forcing most on the sales side to uplevel their game, to become quasi-consultants, to know the tech, to know the integration, know their space, to know how they’re impacting things and the good ones do. And the Vendor Cooties piece was that there’s still this cultural knee-jerk: “No, no, no, keep the vendor out of this. We’re just going to come to you once we’ve made our call and decision.” And it’s like you might be leaving some really in-depth understanding of this space out of your decision-making process, because these are now people who are spending all day in this subsector and know it inside and out, you know?

Steve:

[00.00.48.04–00.00.48.09]

Right. Yeah, absolutely. That is the right approach for sure.

Matt:

[00.00.48.09–00.00.48.35]

I mean, certainly there are still coin-operated, reps out there that just kind of do what they’re told. But you don’t last very long in cybersecurity if that’s your entire model. Right. Yeah. So, okay, again, kind of going with what better could look like: what is the defender’s role in helping this?

Matt:

[00.00.48.35–00.00.49.01]

And again, staying within cyber. But, buyers want better security products. They want more resilient products. They don’t want just flash in the pan or, flimsy rapid expansion ones that haven’t thought through it. How can practitioners play a better role in helping the right products come to market, whether it’s customers or references or design partners?

Steve:

[00.00.49.06–00.00.49.37]

I think if you’re vetting a technology and a vendor that you think you like, getting there, I think relationships with vendors are important, right? So, if you’ve got this niche technology but it’s parallel and it’s complementary to this other product you’re using, connecting those two product companies together, I think, is a benefit to the smaller startup.

Steve:

[00.00.49.37–00.00.50.16]

I’d be curious on your thoughts, but it helps them get a little more legs and then making sure products are working together is important for an operator, right? They need to know that these products are not going to be stepping on each other, they’re at least communicating at some level. So, you’re not going to break something by putting something else in, or eventually they may start working together a little more and pass alerts, communicate, so that, you know, that ideal state of one central screen you can look at as a SOC isn’t truly a reality, but it’s getting a lot closer with some of the AI tools.

Steve:

[00.00.50.16–00.00.50.27]

Getting that closer to that model I think is helpful. So, they want to know you’re kind of working with the broader group. Yeah, I think that’s something I think would help a lot.

Matt:

[00.00.50.27–00.00.50.57]

So, knowing, hearing this as a vendor, I would say the takeaway on that side is know the environment that you’re operating in. Don’t just sell a widget and just build a widget like a one-trick pony. Like, understand what the operators using this tool are going to be doing before, during and after. And how do you fit into that workflow and design for the workflow as opposed to just we solve X, you know.

Steve:

[00.00.50.57–00.00.51.16]

Yeah. Yes. Exactly that. That would be, I think, advantageous on both sides that the more that happens, because we have talked to people who said, “Oh, no, I’ve actually never talked to. I’m not exactly sure how they work, but here’s how we work.” Well, now we’ve got to go figure all that stuff out. And that’s not helpful either.

Steve:

[00.00.51.16–00.00.51.20]

Yeah. And it’ll help you have the answers for the next three companies you talk to. Right.

Matt:

[00.00.51.20–00.00.51.43]

Well, and maybe even, you know, the first is the vendor perspective there. But from a practitioner perspective a takeaway would be actually understand the workflow well enough. So, when you’re evaluating a product you can communicate where it fits instead of just coming to them saying, “I was told I need to solve for X. You solve for X.”

Matt:

[00.00.51.43–00.00.51.52]

“Yes? Okay, you’re on the wagon.” Then, understanding that workflow and the impacts, even if maybe the workflow doesn’t involve that evaluator.

Steve:

[00.00.51.52–00.00.52.10]

Right. Yeah. And it’s bigger picture, right? We all have to look at the big picture and then drill in. Right. So helping in some cases you’re helping that technician see a little bigger picture. And it’s advantageous to both of you to help make sure that happens. Yeah. For long-term success.

Matt:

[00.00.52.10–00.00.52.44]

Absolutely. Do you think there can be… I am not saying you’re speaking for them, but from your perspective, and as you see it as an advisor bringing in these different investment partners, I would imagine, to the table around these discussions, do you think there can be any changes Silicon Valley, you know, big air quotes, could make to also incentivize this better to build better products for the right use cases?

Steve:

[00.00.52.44–00.00.53.00]

I think the model that they’re looking for to see that success and that implementation within 60, 90 days, I don’t think it’s realistic across all industries. There may be some industries that can support that. Sure.

Matt:

[00.00.53.00–00.00.53.00]

Specific.

Steve:

[00.00.53.01–00.00.53.31]

Cyber-specific. Yeah. When you’re in cyber, whether you’re looking at, you know, critical infrastructure, banking, telecommunications, and then all the mid-level across everything, figure out how to approach each of them. It’s slightly different. Right. And thinking through that on what you need to know, what you need to say, what you need to understand. Walking into that market, I think is very important, because I definitely had people say, “Well, I sold to this big bank, and they really loved it, and here’s what they did with it.”

Steve:

[00.00.53.31–00.00.53.53]

Yeah, okay. But if you talk to somebody in critical infrastructure, our confidence, money, everything is drastically different than theirs. So, figure out how to approach each company and understand who you’re talking to in each case, right? That’s another piece that I had lots of people say, “Well, you provide power for Ohio, right?” Or a third of the country.

Matt:

[00.00.53.53–00.00.53.54]

So yes.

Steve:

[00.00.53.54–00.00.53.58]

Plus, yes, it’s a little bigger story than that.

Matt:

[00.00.53.58–00.00.54.23]

Right. Yeah. Yeah. An interesting little sort of, personal experience with your comment, on our side: we’ve always assumed we’ve been used by IT, because we’re typically deployed initially, at least inside of, that post-breach incident response kind of tech stack. And so, we’ve always assumed it was IT. That’s our space.

Matt:

[00.00.54.23–00.00.54.43]

That’s where we live. And everything was always kind of framed around IT. We find out that some critical applications are actually using us in OT. So, then we start diving into OT and learning and that’s a whole other language even within the same company. Yeah. And so, then we try to take that OT language from, say, utilities to telcos.

Matt:

[00.00.54.43–00.00.55.03]

They have OT, completely different language. And so it’s like you’ve got that. even though technically, yes, you are at the core providing the same capabilities, the implications and impact. And that context workflow awareness changes how you talk about it and who you talk to.

Steve:

[00.00.55.03–00.00.55.33]

Yeah, that is a very good point. And even cyber is not always in IT, right? In my 25 years at the big utility, I was only in IT less than half of those years. I was outside in different other organizations. I was always super close to IT and aligned to them always. But I also had to be aligned with all these OT functions, which even within a company, sometimes those OT functions have a different language and different requirements and different pieces.

Steve:

[00.00.55.33–00.00.55.56]

So then you go to other industries like you said, the languages and approaches change drastically. Yeah. So, the more you can understand that, the better. That’s sometimes hard to do because even then, even as I go talk to all these big utilities, some of them even coming from doing it for 25 years, I still walk into these other big utilities that go, you’re talking a little different, but I’m pretty sure you actually mean this stuff.

Steve:

[00.00.55.56–00.00.56.04]

It’s hard for me. I’m not going to expect everybody else to figure that out. But the more you understand that that exists, that is a part of the challenge.

Matt:

[00.00.56.04–00.00.56.32]

And it takes time. That’s the big thing: you have to invest in learning these industries and their idiosyncrasies, I mean, like the depth and the complexity of just the US electricity and, industry and, the three subsectors and the way they’re organized and the regions, the reliability regions versus the regulatory regions, like the whole thing was like it blew my mind the first two years.

Matt:

[00.00.56.32–00.00.56.54]

I was like, I didn’t realize it took all that. Just so the light turns on when I flipped the switch. Like, it’s crazy, right? And even if you’ve built the tool, the time it takes to understand how you position and where you fit in and integrate and become part of the workflow, takes time that I don’t see reflected.

Matt:

[00.00.56.54–00.00.57.33]

And this is just my personal, you know, personal perspective, but I don’t see it reflected well enough in the, like, “scale, scale, scale. You found your product-market fit, go,” you know. Like, that makes sense when you’re building, the next whatever, Facebook or Etsy or, you know, TikTok. But if you’re building a tool that has to work inside of these critical infrastructure industries, taking that advice, and sometimes even yielding to that pressure, because there is a lot of pressure put on founders in those scenarios, can be counterproductive.

Steve:

[00.00.57.33–00.00.58.01]

Yeah, yeah. We’ve been talking about this: industry regulations and requirements, and can you meet that or not. And just because you meet CIP does not mean you’re taking into account security, because it accounts for about 10% of the assets versus the 100% of assets that need to be protected. So, there’s a lot of pieces that intricacies that are difficult to understand without committing time to do some digging.

Steve:

[00.00.58.01–00.00.58.20]

Yeah. So, then you’re speaking the language when you walk in there and your credibility, I mean, they’ll blow holes in you really quick if you don’t say the right things and then you lost credibility, even if you’ve got a phenomenal technology behind you. Yeah. Yeah. It’s a lot of pressure on the sales side to represent, walking in that door, get in the door.

Steve:

[00.00.58.20–00.00.58.23]

But then you’ve got to represent, keep walking.

Matt:

[00.00.58.23–00.00.58.24]

Not get kicked back out.

Steve:

[00.00.58.24–00.00.58.30]

Yeah, exactly. And make sure when you come back in five years they still want to talk to you.

Matt:

[00.00.58.30–00.00.58.52]

Yeah. Yeah. So, Steve, this has been really good here. This is one of those topics I could go on for hours and hours, but I respect your time. I’ll, kind of do the final wrap-up questions. But any final thoughts, any closing comments on your side as far as kind of what we covered today?

Steve:

[00.00.58.52–00.00.59.15]

I would just say making sure, from the technology, the vendor side, make sure you’re thinking about the big picture when you walk in, make sure you think about the availability, the resiliency that needs to exist, and the scalability that exists in your technology. As you walk in and understand the industry and the people you’re talking to.

Steve:

[00.00.59.15–00.00.59.28]

And you should not start with the CSO. You may get there; they’re not first. But you’re going to the other people. They’re not going to say, “I like you, you’re a good person, your technology sounds cool.” Like, that’s not the way it works.

Matt:

[00.00.59.28–00.00.59.30]

So, keep…

Steve:

[00.00.59.30–00.00.59.35]

Keep in mind what you’re walking into, and make sure you’ve got to spend a little time, unfortunately.

Matt:

[00.00.59.35–00.00.59.58]

Yeah. Yeah. So, having spent some time now on that, consulting, the builder and founder business side, vendor side, what’s new and exciting as an idea to you? What are you learning about right now that’s got you engaged?

Steve:

[00.00.59.58–00.01.00.27]

Really, I mean, we’re really focused on making a difference in critical infrastructure, investing time and being as honest and as compassionate as possible as we’re talking to companies. And I think that, once they meet us, if we don’t already know them, that they’re trusting that we bring something, we’ve really done our diligence. And we want to have a long-term relationship that’s that trust and relationship piece that I think is so important.

Steve:

[00.01.00.27–00.01.00.44]

It just I see more and more how important that piece is. And that’s really where we’re investing as we’re talking to different companies. And I think it applies across all industries. Right. That trust in relationship piece is so important.

Matt:

[00.01.00.44–00.01.01.23]

I found that in cybersecurity, trust is such a fundamental piece of how everything gets done. It’s such a baked-in sort of substrate that we actually unintentionally lose focus of it. As far as developing the skills and maintaining the EQ side of things, everything is so focused on technical prowess and capability and skill set that the trust that is that has to be there and is always sort of there in the background is often overlooked.

Matt:

[00.01.01.23–00.01.01.30]

So that’s something that I’ve been pulling on a lot lately, is making sure that that’s part of the equation, you know?

Steve:

[00.01.01.30–00.01.01.36]

Yeah. It’s so important. And establishing that long-term trust relationship. Absolutely.

Matt:

[00.01.01.37–00.01.01.43]

What is something that you’ve changed your mind on lately, that you kind of shifted positions on?

Steve:

[00.01.01.43–00.01.02.10]

I’m sure there’s been a lot of things. I can’t think of anything that comes to mind at the moment. I am continuing to dig in now that I have time and bandwidth to try to understand more on new tech that’s coming to market. Understand what the full benefits of AI-based tech are and realizing that I’m not talking about “you just slapped AI on it and you embedded DeepSeek.”

Steve:

[00.01.02.10–00.01.02.24]

But what can you really bring to the mission to help the mission and help move it along? I like having a little more time to dig into that and figure out what I like, what makes sense to communicate and what doesn’t.

Matt:

[00.01.02.24–00.01.02.47]

Yeah, yeah, yeah. No, there’s good and bad to it. And I think we’re finally getting past the “just use AI” kind of, knee-jerk reaction that’s been kind of pushed down, to where, like, okay, AI, but, where and why and how, you know?

Matt:

[00.01.02.47–00.01.02.49]

And what are those implications?

Steve:

[00.01.02.49–00.01.02.52]

Yeah. Yeah. And managing the data. Where’s that data going?

Matt:

[00.01.02.52–00.01.02.53]

Who has it

Steve:

[00.01.02.53–00.01.02.59]

Using it? Do you know what’s going in and out? All that stuff’s always going to be part of the story, right?

Matt:

[00.01.03.00–00.01.03.27]

Yeah. Yeah. So, the fun closing question we have here is true to our Lock & Key Lounge theme. You know, we always like to talk about sort of the libations side of the house. So, my question is always very similarly structured, right? If you imagine that you’re at a bar, and its a, I like to caveat this, that it is a nice one right where you don’t actually have to yell, to be heard.

Matt:

[00.01.03.27–00.01.03.46]

Right? Yeah. And at the other end of this bar, maybe it’s your favorite bar. Maybe it’s a cool bar when you’re, you know, at RSA or whatever. But at the other end of that is somebody in security that you’ve always wanted to talk to. The two questions are: what do you order and carry over? So, what does that, you know, taste like?

Matt:

[00.01.03.46–00.01.03.53]

And who’s at the other end of that bar for you? And it doesn’t have to be alcohol. Some people are getting off that wagon lately.

Steve:

[00.01.03.53–00.01.03.55]

Yeah, I’m still a little bit on that wagon, so.

Matt:

[00.01.03.55–00.01.03.56]

Me too.

Steve:

[00.01.03.56–00.01.04.00]

But yeah, probably ordering an Old Fashioned. It’s still a trend.

Matt:

[00.01.04.00–00.01.04.02]

So that is… yeah, that is a good one, man.

Steve:

[00.01.04.03–00.01.04.06]

Made with a credible bourbon of some type. Yeah.

Matt:

[00.01.04.06–00.01.04.08]

What’s a credible bourbon in your book?

Steve:

[00.01.04.08–00.01.04.35]

I like a fairly wide range, but I like Four Roses. Oh, yeah. Even Woodford, that’s become fairly mainstream; I think it’s still a strong player. Bulleit and several others that I think… Yeah. Yeah, I like a lot of them. So, it makes it easier when I order. But I think you’re not one of those. It’s an Old Fashioned made with Four Roses and then figure out how to have that next discussion.

Steve:

[00.01.04.35–00.01.04.44]

Who would I want to talk to? There’s a lot of people out there, a lot of people in tech startups that I think are doing a lot of good work. I don’t know.

Matt:

[00.01.04.44–00.01.04.50]

What would be an example of that? Like, who’s doing good work in the startup space for you?

Steve:

[00.01.04.50–00.01.04.56]

I can’t think of any names at the moment. Not because that’s a weakness of mine, thinking of names. So, yeah.

Matt:

[00.01.04.56–00.01.04.57]

No worries.

Steve:

[00.01.04.57–00.01.05.10]

Yeah. But I think there’s a lot of people. Yeah. And I’m probably not the person that’s going to walk up and break the ice either. So, super introverted. But yeah, I think that’s…

Matt:

[00.01.05.10–00.01.05.13]

There’s a guy at the other end of the bar for most people, right? Yeah.

Steve:

[00.01.05.13–00.01.05.17]

Well, yeah, we’re the ones sitting in the corner saying, yeah.

Matt:

[00.01.05.17–00.01.05.19]

“Yeah, I’m done. Leave me alone.”

Steve:

[00.01.05.19–00.01.05.21]

Yep. But if you’re.

Matt:

[00.01.05.21–00.01.05.22]

Bringing me an…

Steve:

[00.01.05.22–00.01.05.46]

Old Fashioned, I might be willing to talk a little more. And hopefully that works for other people too, or when I decide to do that and break that. But there’s a lot of CEOs, I think, that lead well and are paying attention to their teams and take care of their team as they’re successfully leading a company and coming up with some new tech the industry really needs.

Steve:

[00.01.05.46–00.01.05.57]

There’s a lot of people I think are doing well at that. And those people I respect the most, right. Taking care of the EQ and IQ at the same time.

Matt:

[00.01.05.57–00.01.06.06]

Right. Yeah. Leading well. Yeah. Absolutely. Well, Steve. This has been a really great conversation. I can’t thank you enough for taking the time to do it.

Steve:

[00.01.06.06–00.01.06.11]

Yeah, absolutely. I appreciate you talking me into it, man. Been a great discussion, I think.

Matt:

[00.01.06.12–00.01.06.13]

It was a cold approach, right?

Steve:

[00.01.06.13–00.01.06.17]

Yeah, but it worked. It was good. But I appreciate it. Thanks a lot.

Matt:

[00.01.06.17–00.01.06.44]

And thank you again to the listeners here today. What I’m taking away from today is, you know, the startup model has given us lots of tools, lots of innovations that we rely on for defense every day. And the people building that and the funders and the supporters and consultants and advisors behind that are all pushing for the same outcome.

Matt:

[00.01.06.44–00.01.07.11]

We all want the same thing, but cybersecurity is a different beast and is a different creature, and it can’t always be fit into the same models out there. And, you know, our defenders and our practitioners are the most demanding. Trust is earned slowly. Products that are, you know, shipped before they’re fully baked and tested can quietly add risk instead of removing it.

Matt:

[00.01.07.11–00.01.07.47]

And the people approaching these practitioners about it, not taking the time to understand where this product can fit, can do more damage and even damage their own growth potential. So the game has changed, and it’s shifting for everyone involved: investors, builders. Today, the conversation reminded us that, buyers have more influence over this than we often think, in how we run pilots, who we vouch for, what we’re willing to pay for. And if we want security built the right way, we have to reward the people building it that way.

Matt:

[00.01.07.47–00.01.07.55]

So, thanks again for spending this time with us. And until next time, be well, stay curious and do good work.

Matt:

[00.01.07.55–00.01.08.28]

We really hope you enjoyed this episode of The Lock & Key Lounge. If you’re a cybersecurity expert or you have a unique insight or point of view on the topic, and we know you do, we’d love to hear from you. Please email us at lounge@armortext.com or our website: armortext.com/podcast. I’m Matt Calligan, Director of Revenue Operations here at ArmorText, inviting you back here next time, where you’ll get live, unenciphered, unfiltered, stirred, never shaken, insights into the latest cybersecurity concepts.