DataTribe Challenge Finalist: Cytadel

Welcome to the Cybersecurity Go to Market podcast for our special showcase episode where we're talking to leaders of the companies selected for the 2025 Data Tribe Challenge, where Data Tribe, which is the Cybersecurity Foundry, have identified five startups as being highly innovative in cybersecurity today. I am your host, Andrew Bonohan, and today we're talking with Manit Sahib, the CEO and founder at Citadel. Manit, welcome to the podcast.

Thank you for having me, Andrew. It's a pleasure to be here.

So maybe the pressure's on. They say over here that when they hear a British accent, they just imagine someone's a lot more intelligent than they are. So we're going to make sure that we uh we live up to that today, okay?

Oh, 100%, right? Um I shouldn't have brought my tie.

Well, as a former employee of the Bank of England, uh I thought you'd be out of three three-piece suit, pinstripe suit, you know, a whole tie.

Yeah, I mean, uh, it's pretty informal to be fair. I mean, shirt is fine, but yeah, maybe next time. There you go. There you go.

Well, listen, let's uh let's let's go back to not the beginning, but back a while anyway. What's the story behind you first getting into cybersecurity?

So let me do a little bit of an intro about myself and then hopefully that'll give you some context around, you know, my journey and and how I've moved into Citadel. So I'm Manit Seib, I'm an offensive security expert, so also known as an ethical hacker. As you mentioned, Andrew, I'm the founder and CEO of Citadel, and my background is UK government and defense. So I'm the former head of penetration testing and red teaming for the UK Central Bank, the Bank of England, where I use defensive techniques to protect the UK's payment and gold systems. I'm certified by the National Cybersecurity Center in the UK, because obviously you have to be ethical, under His Majesty's CSG check scheme, and I hold a number of accreditations for ethical hacking. And as well as being hands-on practitioner, I am an industry speaker, so I've spoken at the likes of SANS, global central banking, GISEC and release, and really to help CISOs understand the threats on how to build cyber resilience. So I've spent the last 10 years in offensive operations and the last seven in covert red team operations. And really, Citadel was born out of the frustration from seeing environments not secure. And it's not through fault of their own. It's really around the false sense of security with vendor security tooling or things that they've implemented with defense in depth, which have gaps. And what we learn at, you know, kind of the mature central banking level is we need to use a threat-led approach. We have limited time, limited resources. How do we cater for the threats that we face with the limited resources that we have? So using that approach, I think a lot of organizations try and do everything, but they don't really focus on where the gaps are. And really, Cindlow was born out of, you know, coming out of Gov, seeing that there was a demand in the industry to plug the gaps. And from there, you know, spinning off as just a services company. There was never like an end goal to be a product. It just started as services, and then just through demand, it grew. Then I faced the problem we face in the industry at the moment is that it's very hard to find skilled professionals like myself. So then I said, well, how do I clone myself? Right. And the easiest way was to create a product. And the start of this year, 2025, that is when Citadel focused predominantly on the product side, looking at AI to scale, and essentially offering that cyber resilience to more organizations.

All right, let's let's let's rewind, right? So I'm gonna go take you right back to it, looks like you joined PWC in February 2017, at least according to LinkedIn, that's your first foray into cybersecurity. Why, why did you move from being an IBM rational consultant, which, you know, I don't know much about rational, but not all that exciting, maybe into the world of cyber back in February 2017.

Oh Andrew, you're really going back there. You've definitely done your O Sin homework on me. Okay, so I graduated 2010 and I was a developer. So graduated as a developer. As you do, you just want to get a role. And I fell into the gap of developing tools for IBM. So as an IBM consultant, and Rational, which a lot of people won't know now, was before Git. So now we have Git for code management. Rational was the enterprise version of doing that. It's very expensive. So I did that for about five years, and I said, Well, this is getting boring. We have things like Git coming out, you know, it's a dying sector with Rational. I learned a lot from mature organizations because I also developed their tools and I was their third line support. And we had a lot of big names, which you could probably see from the CV. And then from there, I said, Well, I enjoy breaking things. And from an early age, I thought, you know, let me experiment with my siblings. Can I hack into their devices and things like that? So it's always tweaking with computers. And that is the point that I said, let me now turn into ethical hacking as a career. So I went out, did certifications while I was still doing my IBM role, and then you know, took the job out of Big Four. You'd name drop PwC. And that is what accelerated my growth. Because one of the things about Big Four, it gives you exposure to a lot of environments very quickly. So every week I was flying around, seeing different maturity of organizations, seeing the gaps that they face, seeing, you know, how how pen testing was just a compliance checkbox in some cases. And yeah, that's that's when the ethical hacker journey began.

Now it's interesting because I think there's I I kind of hear a lot of stories, or at least people alluding to the fact that people struggle to get into cyber, right? Right now, like here's the thing here. We're looking for an entry-level person who's got 10 years of experience, right? It's kind of like a weird thing. You went straight in at PWC. I would imagine that's not normal, right? You don't just show up at a big four and I did my search, I'm here for a job. They're looking for people, I don't know, maybe with with 10 years' experience doing that. So how did you get in there?

Yeah, so I think it was just industry industry experience that I had at the time. What people don't uh or maybe the misconception about ethical hacking is to break something, you need to first understand its legitimate usage. And because I spent a lot of time in organizations at, you know, IBM, I got to understand where are the failings for developers, where where, you know, they want to go out on Friday night and go to the pub, right? So there's gonna be code that they potentially miss. So as a developer, you start to understand where the gaps are and having that knowledge, then transition to ethical hacking was so important. So dealing with the support, dealing with the development, and then even through like the likes of PWC, like interview processes are quite long. So it wasn't just, hey, you're gonna take the job and go for it. There was a lot around like experience, your competency, you know, how you treat clients, having that kind of client-facing role. And and yeah, it it we still have this problem today, right? You've mentioned it around the skills gap. I think we're we're at a point right now where you need the experience to get the job, but there's not enough people offering the experience.

Yeah, it's a tough situation to be in. But let's go back. You you went you went through the finding story that uh you had for the company. It sounded like I'm sure I heard this right, that you were you were kind of working away, and then this year was the first time you said, okay, let's productize something. Is that is that did I hear that right?

Yeah, exactly. So you know, full disclosure, it was never designed to be we're gonna create a product or you, you know, we're gonna go VC route. It it just grew organically. So leaving gov, I had companies approach me. So I've worked with the likes of UN agencies, so I led offensive security programs for them. And it was just a demand that came to me from my experience to say, you've done it for X organization, can you help me? And I run out of hours, right? So it was how do I do everything? And that's when Citadel started to grow with the team size, offering the services, and then it and then I think the last two years, I started weaponizing AI for offensive operations. So I did a lot around weaponizing for deepfakes, which we now see is a trend, weaponizing AI for vishing, which is voice voice calling or you know, voice vishing, vishing. So, and then we see those threats now, right? So if you look at the likes of Scattered Spider, who's attacked a lot of the UK uh retail earlier this year, like the entry point was fishing. So I started weaponizing these attacks early on, and it and I did it for research and and talks. So it wasn't a big lift for me to turn around and say, right now we're gonna just productize it and be able to offer it to more people. And that's that's literally the journey that started in Jan this year. I weaponized AI for ransomware resilience operations. So we have our ransomware resilience as our use case to be able to go into an organization and understand the gaps, the blast radius, if ransomware was detonated, looking at business continuity, and we can do all that within eight minutes. And that's not just thrown out number, like you know, there's a lot of demos and a lot of work that's gone into it behind the scenes. And that's when, you know, it was a decision that we're gonna build this into a full-fledged product. Let's go out, let's get some VC funding, let's be able to scale because right now it's the execution speed that we want to grow. And yeah, hopefully that covers it. Indeed, that covers the question.

It's kind of interesting because I I think the what you do internally as you're offering your service and helps you find a service, that's not the same as offering a product to other people, right? The people sort of I think oversimplify the product eyes bit of it. There's a lot that goes into having something that's usable by someone who just installs something or logs in somewhere and just starts using it. So I'm wondering, did you get outside help for that? Did you have experience in the team about how to actually properly productize something?

I think it was a lot of time spent at the likes of Bank of England, looking at vendors, selling me tools, doing proof of concepts with them, and you know, having a pet peeve to say, why are we why are we looking at this tool? The tool doesn't do anything. It's such a pain to deploy. So I had a lot of experience, you know, just as a security leader. So, you know, as well as being the ethical hacker, I led the offensive security team. So a lot of the gatekeeping of like we need a new product coming in would come through our team to validate if it does what it says it does, is there a security risk? So it's just understanding like what are the biggest issues when you deploy a tool? What are the biggest issues, whether it's deploying agents across the whole estate, whether it's the procurement cycle. So that that's really come from it, really built my experience into like offering a tool in the space.

So you knew like I those the way that product did this and was really good, the way that one did that sucked. I hated how this worked, and I can't believe they had that in a way of this, and you're like to sit there, go let's let's put together our wish list of what a good product would would look and feel like, right?

Hit the nail on the head, and this is what Citadel is all about. So I have a real issue with breach attack simulation tools. And at the time I tested, I think there was eight in the industry. I test, we tested all of them, and the biggest thing was they're like atomic tests. So it's like a checklist to say, you know, my controls are working at 100%, which we know that's not the case, and I'm gonna go through a checklist. But we know in the real world that's not the case. There's gaps, we have legacy systems, every environment is different. There's overlaying controls, so it doesn't cater for tailored environments. And this is where, you know, you see the manual pen tests or red teams come in and say, well, we can do everything and we can tune it to each organization. And then when AI became a thing, now we can take our techniques and our knowledge, put it into AI, not for the secret source, but essentially to scale, so we can do the decision making that we would do. So it's going in between like the pet thieve of breach stack simulations, not doing what it's supposed to do and giving that false sense of security, and then not being able to do a full red team because it takes too long and it's very expensive. So it's that sweet spot in the middle.

And I'm interested in who you're targeting for the product. Is it red teams at companies and governments or is it wider than that?

So at the moment, you know, we I'm targeting Gov financial institution because you know, both of them are my background. We have a retail, again, they have they're not as mature, they don't have as many controls, even manufacturing. But the idea is you can use it in in two ways. You can use it where you're a CISO and you don't have an internal red team. And we are like your extension, you're a where the extension being your red team, and then you can use it if you have an internal red team to say, do it yourself. We have in the product and built an override mode. So while it does it for you, you can click some buttons and it'll do the decision making. And obviously, I've kept human in the loop because that's so important for regulated environments where you can have kill switches, but there is an override. So if a red team wants to say, right, we want to be able to leverage this, they can do that as well.

So if you're a so I'm always fascinated by this because a lot of salespeople, my world go to market teams in cyber, work on the defensive side, right? That's just the way it is. A lot of layers of defense, there's lots of products. I don't know what the number is, but there's there's supposedly 3,800 vendors in cyber right now. I bet that 80-90% of them are in defense as opposed to the offensive side, right? So this this whole world that there are red teams and the size of them and what they do is is actually a little bit new or or different to what most listeners will have will have come across. One thing I'm fascinated about is is how many companies actually have red teams in place? You know, how far down the financial services stack, for example, do you go before you go, yeah, once you're at, I don't know, 5,000 employees or 1,000, or maybe that's when they tend to not be able to afford to have a red team. Where does that stand in your mind?

Yeah, so it's it's a great question. Specifically in the UK, if you're a financial institution, you have to do a red team every three years. And that is governed by the Bank of England, right? So coming from my background, and it's called the CBES framework, which is now into the EU. So EU has Dora, which has just come out earlier this year, and Dora TLPT. So anyone in financial institution touches payment, whether it's the third party, will have to do a red team in the EU. And we see the CBES framework copied and pasted into like Singapore, Hong Kong. So it is now a global standard to say you need to conduct a red team because you need to have that assurance. The easiest way I explain it is in the UK, we have MOTs, the cars. I don't know, like a car inspection. For your car to go, for your car to go on the road, it needs to be inspected every year. And if it fails, it can't go on the road. So the red team is the assurance that your company can survive a cyber attack across people, process, and technology, and we've exercised all the response against it. So that way, there is that kind of compliance checkbox of saying it's done. So to come back to your question, how many organizations do it? A lot of them are mandated to do it now. And in the likes of the mature environments, they will have their internal red teams looking at emerging threats, looking at, you know, state sponsored, you know, coming from Gov, that's one of the big threats we see. But as well as that, now we're seeing ransomware gangs like kids being able to do leverage basics, right? To get into organizations, encrypt them, demand whatever amounts of money. So there is a shift in the industry happening at the moment. And we talked, you talked about defensive tools. Now, put this across: if the defensive tools work, why is this problem getting worse? And it's really comes back to the pet peeves of you know, vendors creating tools for the sake of creating tools, and we have defense in debt. We know there's no single bullet, but there's no one out there to say this tool works, or actually this tool is talking BS. And I find this through a lot of my testing at the moment and the clients that I work with, even EDR vendors or endpoint vendors, they say they stop ransomware or they say they stop on attack. And I've got three major EDR vendors right now that with bypass and like, guys, you need to sort this out. And they just want to close their eyes and say, no, no, no, don't publicize it. And this is where, you know, coming back to my government, my mission-focused approach, I want to enable CISOs to have a true picture of what they're buying and where they're wasting money and saying you've got overlapping controls, or this vendor refuses to acknowledge they have a big issue. So use this so that we can be secure.

So for the CISOs that don't have, can afford or don't have an internal team, this is almost the alternative is you go hire bodies, you know, on a contract basis, or you hire a company to do it for you. This is the alternative to that, right? Wouldn't it be good if you could do it more continuous? Wouldn't it be good if you could get more real time, I suppose, as opposed to once every six months or once every year information about what you're doing, right? But if you're if you're a sister with a red team, it's it's like Red Bull, let's give you wings, right? It it gives them a whole extra dimension to what they can do. Yep. I like that. I like that. Yeah, Citadel gives you wings. There you go. No, no charge.

We're gonna put that as a I'm gonna put that as a tagline, right? Yeah. So essentially the the the snapshot the snapshot is we verify defenses before attack is due. And with AI, and I use AI very carefully, you know, I I hold integrity very high. So for for me to use AI, like there has to be it's not AI just writing a report, like we are actually using AI. So with AI attacks now coming, if you see the likes of Microsoft who got hacked last year, and it was because they had a legacy tenant, right, with a a legacy account that was valid. And it just took someone some time to figure it out. With AI, things like that are going to be picked up very quickly. So wouldn't it be nice for you to have the same skill set, the same knowledge, and be able to identify these weaknesses before the attackers do? And that's essentially what Citadel does.

Yeah, I feel that I think you hit on something there, which is a hot button of mine right now, which is I think everyone uses AI somewhere in their product, right? It'd be stupid not to. But there's a difference between those that have, as you say, use it to choose a nice report or do a better workflow and those that it's actually built into their capability, usually from the ground up, you know, natively built in. I feel like if if the attackers are coming at you using it like that, you better be able to respond like that because trying to just bolt on something that was built 10 years ago with a bit of AI on the side is probably not gonna be able to keep up and and have the intelligence that you really needed to have.

Yeah, a hundred percent. And you know, I was reluctant, even though I'd been weaponizing AI for offensive operations for two years, even at the start of this year, when I said we've got a product now, I didn't even add AI to it because I'm like, well, I'm not gonna join the massive buzzwords just for the sake of having AI. And then, you know, we tweaked it and we we put decision making into the whole flow. So within five and a half minutes, I can get into an organization, be able to understand what are the files that I need to encrypt, be able to exfiltrate them, prioritize which files have the most amount of money, determine blast radius, encrypt the devices, right, and then give you a whole executive report of where you went wrong. So that is the point where we're like, now we'll add AI, not just hey, we can spin up a few commands with AI. So yeah, we're, you know, we're we're I hold integrity very high for what we do. And that's why, you know, in this industry, in Cyber specifically, trust is a big element, right? If you if you break that trust with your client, even with the CISOs or or the community, then there's no recovery from that.

Yeah, and you have the advantage, Manita, of being able to go back to your experiences of saying, well, I know how trust was broken with me in the past when I was at a couple of different places you were, right? Working with vendors. I'm not gonna repeat that. I'm gonna make sure that I uh I I maintain a high integrity, high, high trust relationship with my my customers and my prospects. I'm interested, slightly very different question. Let's get out of your comfort zone, which is the product and what you're doing. As you're looking forward, what do you think is the most important thing for you to absolutely nail? Is it the product itself or is it the distribution and sales of that product?

Great question. So I would look at it with trust and integrity first, right? So this is this is the core, and that enables us, enables us to build a product which people enjoy using and it gives them results. We already have, you know, and again, not to just say we we have, you know, with the likes of the team, we have a professional network of distribution. But I want to be able to go to the network and say, we have this tool, which is a no-brainer, right? And you would be silly if you didn't use it because it's reducing your risk or giving you insight as to how you would be compromised. So for me, it's really nailing down the product with that trust and integrity and giving people actionable remediations that they can put forward. And just from that, you know, the distribution comes and then you have the word of mouth and with the thought leadership that I'm doing with my speaking events, you know, I can run demos and I can show, like, hey, we compromise this environment or even a lab in this space of time. This is what we need to do to protect ourselves going forward. So come back into your come back to your question, the product first, and then we'll look at the distribution.

Yeah, and and I think there's no better salesperson than a delighted customer. Not just a happy customer, but an absolute delighted customer because then they become evangelists for you, right? But yeah, as you look into the rest of this year and into 2026, what's the big goals for a unit team?

Well, the three-year goal, and then we can then we can do it in the back.

Three-year goal? Yeah, you start off with a three-year goal. This is incredible. Come on, tell us.

So, okay, so where AI is going at the moment, right? We're gonna come to a point where security tooling or security vendors are gonna be building AI for defenses. And, you know, we want to be able to hook into that to have like some auto-remediation. And where I see in like the three years, every enterprise will have this AI red team sitting alongside its SOC. So Syndel intends to be that engine powering it. Within the within the next year, I aim to have 12 to 15 enterprise clients using this solution continuously and giving us the feedback. But it comes back down to that product distribution. I want to make sure they're happy and then from there be able to then expand.

Cool. Well, I love that. Well, listen, we wish you every success next week for the Data Tribe Challenge. You're you're gonna be in DC next week, I guess. Is that right? Yes, so we'll do. We'll look forward to that and then uh wish you every success for 2026 as well. Thank you so much, Andrew, and it's a pleasure to be here.