Why a CISO Bets on a Startup Over Crowdstrike: Robbie Tyrie, Fractional CISO

[00:00:00] [SPEAKER_01] This episode is brought to you by FastRamp2Revenue, the done-for-you new hire sales program built exclusively for cybersecurity companies. We bring the process, the frameworks, the training and the coaching, you bring your content, and we customize everything for your market and for your company and run the entire program for you. You don't have to pull a single person off your team to do it. Proven at over 15 cybersecurity companies? Get your new reps selling faster.

[00:00:28] [SPEAKER_01] Visit unstoppable.do to learn more. So let's say you've nailed the demo, you've got the POV going, you've aced that, and then on the buyer's side, the procurement team or the risk team get involved and they're wondering, they're scratching their heads going, why on earth are we working with an earlier stage startup rather than the likes of our big partners such as CrowdStrike, Palo, Zscaler, companies like that.

[00:00:54] [SPEAKER_01] Robbie Tyrie has made that bet more than once. He's been a big name companies as a leader, as a practitioner, and he's working with smaller companies now on the startup side as a fractional CISO. His math at the time was, what are you going to lose by working with a startup? You know, there's ways to mitigate the risk by doing that.

[00:01:19] [SPEAKER_01] You're setting yourself back only a small amount of time if it doesn't go right, but there's so much to gain from it. You know, he ran pen testing at a company called FNZ with a startup vendor that he then started working with. Now he's a fractional CISO for companies in the mid-market, the ones that many of you salespeople or your sellers, if you're a leader, are actually calling on right now. So in this episode, we talk a bunch of things, three things specifically.

[00:01:47] [SPEAKER_01] What a small vendor gave him that the big names couldn't in terms of capabilities and what he wanted back from it to make it worthwhile internally. The free trial he says a buyer can argue with and the point where he'd want to cut it off. And what JP Morgan did with Fortify and how he'd stop your best customers doing that to you. So a lot to cover in this episode. Here's Robbie.

[00:02:24] [SPEAKER_01] Well, Robbie, welcome to the podcast. Thank you, Andrew. Pleased to be here. I'm looking forward to this episode, not just because you're a fellow Scot, but also because we've got an interesting set of topics to go over today. And just as a bit of a coincidence, I'm actually in Scotland myself right now as my mom, so I'm not my usual habitat over here.

[00:02:45] [SPEAKER_00] You don't sound like a usual Scot, though, to be fair. You've been away too long, Andrew.

[00:02:49] [SPEAKER_01] I'm in that weird spot where I kind of joke that my accent is somewhere over the Atlantic because, you know, I'm in the US. People kind of recognize me. I'm like, oh, Scott. I come back here to Scotland and ever look at me like, what the heck is he saying? He's using words and accents.

[00:03:05] [SPEAKER_00] You're the ideal person to be interpreting to your viewers and listeners of the podcast here when nobody can understand me because that usually happens.

[00:03:14] [SPEAKER_01] If I have to do subtitles afterwards, I will. It's like the old episodes of Rabsy Nesbitt. You need the subtitles for the English folks, not just the international folks.

[00:03:25] [SPEAKER_00] I encourage everybody who's watching this podcast to look up Rabsy Nesbitt and educate yourself. Link in the show notes.

[00:03:34] [SPEAKER_01] All right, Robbie. So first of all, the most important thing we're going to do today to start off with is we're going to spin the wheel and we're going to find out what the questions we're going to ask later on in the episode are. Are you ready for me to spin this wheel?

[00:03:49] [SPEAKER_00] Yeah, go for it.

[00:03:50] [SPEAKER_01] All right, here we go. All right, you're going to be on the Cyber Donut hot seat. Okay, this should be interesting, actually, because Cyber Donut was a fictitional company we made up a couple of years ago. It was a startup. It was trying to get to $10 million in revenue at the time. And we had this whole thing over the year that we worked on. So we're revisiting Cyber Donut. But interestingly enough, from your angle, which is not going to be necessarily on the revenue side,

[00:04:20] [SPEAKER_01] but it's going to be on a different perspective from the security side. So I'll be interested to see how that goes. But for now, let's put that to one side and let's come back to that later on in our episode. So, Robbie, you right now, you're a fractional CISO. CISO, but years ago, you started working with startups when you were a practitioner here in the UK. Why don't you take us back to those early days of starting to work with startups, trying to work with them?

[00:04:48] [SPEAKER_01] What were you trying to achieve and what were your experiences early on?

[00:04:51] [SPEAKER_00] So it wasn't actually that long ago. I worked for a cybersecurity company, predominantly did penetration testing out in New York. And their market was startups, mostly startups. They've moved on since then quite quickly. But yeah, it was trying to help startups get a good understanding of where they were from a cybersecurity aspect. That usually meant let's run a pen test, right? Which is, to be looking back on it, it's not ideal.

[00:05:21] [SPEAKER_00] But it does give you a good grounder from a technical perspective of where you actually are. It doesn't answer a lot of the questions that it's actually needed, like risk ownership, etc. So what do I do in the event of an incident? It just tells you where your gaps are and your infrastructure and what controls need, what technical controls need putting in place. Particularly handy if you're a startup developing software, SaaS solutions, because startups usually have a lot of change.

[00:05:50] [SPEAKER_00] A lot of new features on the software and vulnerabilities get introduced left, right and center. So having a pen test or regular pen tests was a good thing to do from a cyber perspective. So you know exactly where you stood from trying to protect yourself from the bad guys.

[00:06:08] [SPEAKER_01] What was it that caused them to say, now is the time to start doing this as opposed to three months or six months previously?

[00:06:15] [SPEAKER_00] Well, many factors, right? And it's the case when I'm speaking to prospective clients as well. There's many factors. One, as they've had a cyber event, obviously, they want to be more secure going forward. Two, if they need to be compliant for different regulations, regulatory, whatever, to satisfy their clients, to show, to give them some sort of certificate, say, hey, we're secure. You can trust us with your data.

[00:06:43] [SPEAKER_00] Or basically trying to get funding is another one. So if they are going out and looking at venture capitalists, et cetera, and going to the banks and trying to get more funding, they want to make sure that what you're doing is secure. And their product, their investment is going to be secure as well. So there is many different factors, but that's usually where we've seen in the most cases.

[00:07:04] [SPEAKER_00] Because particularly in the finance industry, I would say, you've got to provide evidence that you're developing secure tools or you yourself are secure before they'll do business with you.

[00:07:15] [SPEAKER_01] Yeah, my experience working at startups is they often don't take security all that seriously, even in the cybersecurity world, until they have to. And it's often where you're starting to fill in those questionnaires from those big banks or big companies like, oh, we got to have a policy for passwords?

[00:07:33] [SPEAKER_00] Exactly, yeah. Well, interestingly, the trend that I'm seeing nowadays with the startups that are actually growing, to say, I've got between 50 and 200 employees. It's usually still the CTO that's responsible for security. And then they get overwhelmed with it. And then that's when they give me a phone call. I'm going to say, can we get some support? But yeah, that seems to be the case. That's when the CTO seems it's got too much on their plate that they start needing to do something about it.

[00:08:01] [SPEAKER_00] And they'll take security seriously at that point. But you've got to be delicate because there is investment that's required for security. And I think it's good that a lot of companies are recognizing that it's a separate function because it's got its own skill sets. It's got its own challenges other than what a CTO does or an engineering team, for example. And I think having that separation of duties is quite key for a business to grow.

[00:08:26] [SPEAKER_01] When you go into these companies, let's say, for whatever reason, they feel like they've got to spend some money, create the program. What are you sensing their appetite is to truly invest? What's the minimum we have to do? What's the right thing we have to do? What's their mindset?

[00:08:42] [SPEAKER_00] It really depends where they are on their journey, where they want to be. I mean, if they've got a large investment, then obviously the budget's going to be better. But it's trying to explain to them that cyber, good cybersecurity is an enabler for business growth rather than just a bolt-on function that's another internal business operation with its own call center. Right? Because that can be the case in a lot of places.

[00:09:06] [SPEAKER_00] However, companies are starting to recognize that it is an enabler for getting new business in. If you can say that you're compliant to various regulations and you've got SOC 2, ISO 27001, cyber essentials, whatever, you're looking good. You're looking good to go to new clients because then they can trust you with their data sets or their operations or whatever it is that you're trying to sell them. So I try and look at it as a business enabler.

[00:09:33] [SPEAKER_00] That makes the conversation easier about how much they need to spend. I would say that there should be a minimum baseline. I try to get all my clients on a minimum baseline where they should be for what looks good. Obviously, there's what looks better than good. But having them in a good position, it doesn't actually cost a lot of money. It's getting the basics right. Like who owns such and such? Do you have a software inventory? Are you patching regularly?

[00:10:02] [SPEAKER_00] Do you have endpoint detection on? Are you good identity and access management? Are you stopping things like plugging in USBs? That sort of thing. Have you got a password policy that you mentioned, Andrew, earlier? Yeah. It's having the basics right. And to be honest with you, that doesn't cost a lot of money.

[00:10:19] [SPEAKER_01] Is it quite fast to get to a minimum level?

[00:10:22] [SPEAKER_00] Oh, yeah. Yeah. Really, it takes about one to two months, I would say. If you're going aggressively at it, I'll caveat that and say that you need to have support from the organisation that you're working with. Typically, that means the CTO or the head of engineering or they allocate some data to actually enable you to put everything in place. But it's usually quite quick to get things in place. And then it's a case of managing it from there. That's the tricky part. A lot of people forget.

[00:10:52] [SPEAKER_00] They usually just put the baseline in and say, thanks very much. You walk off the park six months later, you'll get another phone call. That is drift, right? Yeah, it's drift. Exactly. That is drift. Typically, what I usually see is around patching. Because that can be a significant, or not a significant, but it can be an overhead on companies to do patching. Particularly if you're working in a software house where you've got to keep library files updated, for example.

[00:11:18] [SPEAKER_01] It's funny what you were saying before about being a business enabler. I think it was the founder of Vanta who said that she realised after a bit of time that she wasn't in the business of certifications and things like that. She was in the business of sales enablement.

[00:11:33] [SPEAKER_00] Yeah. Yeah, it's important. It's important to stress that it is a business enabler. It's too easy for it to become a back office function and a cost centre. But if companies take cybersecurity seriously, then it can not only get you a new business, but it's a simple factor. It can protect yourself from losing money as well. So it's good to see that more and more organisations at the startup level are actually taking it seriously.

[00:12:03] [SPEAKER_00] Which is great for our industry, to be honest.

[00:12:06] [SPEAKER_01] Yeah. If you look at your career, Robbie, going back, you've always been in a role where you've purchased software from big vendors, but also small vendors from startups. How would you back in the day think about that in terms of, okay, do I go with the big name or do I try and find the startup that I should be working with in this one area?

[00:12:29] [SPEAKER_00] It's a great question. So I've worked at some very, very large organisations where I actually have taken risks and went with smaller vendors, startups. Right. One of them was the Pentest company that I went to be their CTO. They were new on the block, but gave me an opportunity to work with the vendor to build the tool around my requirements rather than an off-the-shelf package from a bigger player. And it also meant that you had, I felt you got better support from the smaller vendors.

[00:12:58] [SPEAKER_00] They treated you more on the human level. They could react faster in 99% of the cases. And you know what? At the end of the day, you've got a better deal as well. So like the CrowdStrikes, Qualys, et cetera, there are hundreds of thousands of dollars, right? I mean, for a large organisation, you'll be surprised that smaller vendors can actually provide a better service, but you've got to work with them.

[00:13:22] [SPEAKER_00] However, it's in your benefit because you can then define the tools and what gets built into the tool and the roadmap to meet your needs.

[00:13:30] [SPEAKER_01] You said you're going to work with them. What does that mean? What does the cadence look like? What's the interaction you're looking for?

[00:13:37] [SPEAKER_00] Yeah, there is a bit of effort on both sides, but it can be worth it. So I would say at least quarterly meetings to discuss what's went well, what could be done better, what their roadmap looks like, what your priorities are. I think a lot of larger organisations must attract. I mean, I used to talk about partnerships with vendors and I felt it was important to build partnership with vendors. And 99% of the cases you do that with an account manager.

[00:14:05] [SPEAKER_00] If you're working with the smaller vendors, you get to know the CEO, you get to know the head of development, you get to know the head of customer operations, etc. You can work across the organisation to make sure that your requirements are being met properly rather than just dealing with an account manager who's got several accounts that they're trying to juggle. And you're just a bit of part player, no matter how big you are.

[00:14:27] [SPEAKER_01] It's still a risk to make that jump. I mean, if you're a bigger company, how do you mitigate that risk? Right. What's your process to go through and say, OK, I know there's a risk, but here's some things I've done to know that it's worthwhile taking this risk?

[00:14:42] [SPEAKER_00] Yeah. I'll mention the word again, right? It's having a baseline of what's actually acceptable. Right. You can't compare apples to bananas about like you had a tool beforehand that did X, Y, and Z. You're now going with another vendor because you don't want X, Y, and Z unless you're purely looking to save money, which is good. But it shouldn't be the way you look at things. You want to make sure that you've got the capability that you're looking for. Right. So you can't compare apples to apples in this case. Right.

[00:15:10] [SPEAKER_00] But it's having a baseline of what's acceptable to you and making sure that both parties agree on that. And there's get out clauses if they don't meet it. And it's also having things like there's plenty of open source tools available. You can have just use an open source tool. It runs concurrently in the background as well until you're satisfied that that new tool is up and running to where you want it to be. You can do a lot of things like that. Yes, there's overhead on it, but it's worth it at the end of the day.

[00:15:36] [SPEAKER_01] I'm wondering if there's any examples that you can give where this actually worked out quite well for you. I don't know if company names can be mentioned or categories, something like that.

[00:15:47] [SPEAKER_00] Yeah, I mean, definitely. So it was OSEC who, while I was at FNZ, ran the whole pen testing function for that company. Now, FNZ had over 100 clients in the wealth management space. They ran continuous testing against all these clients. And it worked because the clients got to know the vendor as well. And the clients could, they had their own requirements above and beyond what I had.

[00:16:11] [SPEAKER_00] And they could then also work with the vendor and make sure that specific reports contained information that they wanted. Like there was one client who had wanted another six specific tests actually called out in the report. I think it was six. It was called misused case testing. And that wasn't part of the core product offering.

[00:16:31] [SPEAKER_00] But the vendor, OSEC, enabled that for that particular client, which gave a lot of kudos, not only to me running that entire team, but also OSEC itself. And it showed the capability from OSEC's side that they could do things on an ad hoc basis as well, which helped them going forward too.

[00:16:53] [SPEAKER_01] One of the things I would be worried about if I'm a startup, I think, is getting over-reliant on the feedback from a small number of companies and then finding out that really what I've done is built custom software for a few companies. It's not really applicable to the market. Any advice about how to mitigate against that?

[00:17:10] [SPEAKER_00] That's a good question, right? But as Andrew said at the end of the day, every customer's got a different set of requirements, right? There's hardly ever anything off the shelf that works for everybody. Let's face it. It doesn't matter what application you're using in any situation at all. I'll guarantee you Amazon doesn't work for everybody. There's functions that people would like to see added.

[00:17:34] [SPEAKER_00] I think if there's the ability to have a feedback loop between the client and the vendor and you've got a good customer service, there's opportunities for all users to get their functionality added or even customized functionality added if a particular client's looking for it. But there's not one off the shelf solution that fits for everybody.

[00:17:58] [SPEAKER_01] Yeah, I think let's turn this around a little bit. So let's say you were approached by the founder of a new cybersecurity company that got two or three early adopters, design partners. But, you know, one of your clients is interested. How would you coach that founder to engage with, you know, midsize companies as more early adopter clients?

[00:18:20] [SPEAKER_00] I think it's just speaking from my experience, right? I mean, I've just spoke about what I did with OSEC and what the benefits were from there. It's trying to convince them that taking a risk, but it's a risk that you can calculate, a calculated risk, right? Based on what you're actually trying to get out of it and looking at the cost benefits as well. And 99% of the time, vendors will do it for free for an initial period as well.

[00:18:45] [SPEAKER_00] So you can get a trial and it's going to be a proper trial as well in a lot of cases. So is the risk really there at the end of the day? What are you going to lose? A couple of months time putting some effort in at your side for what?

[00:18:58] [SPEAKER_01] So they need to convince the potential adopter, look, there's not as much risk as you think there is, right? You know, really what's the downside to this?

[00:19:07] [SPEAKER_00] Yeah, exactly that, right? And there's going to be a cost benefit, right? Definitely. Otherwise, you would just renew your existing software. There will be a cost benefit to it, but there's also a benefit to the organisation as well by you being able to get bespoke things added in that are unique to you rather than what's available off the shelf or with your current vendor. And if it's a big vendor and you're asking for a feature, they'll probably turn around and say, one of two things.

[00:19:32] [SPEAKER_00] First thing is no, or yes, that'll cost $100,000 and we'll have it delivered in six months.

[00:19:38] [SPEAKER_01] Yeah, it's funny. It's funny that timeframes are interesting things for people, right? When someone thinks it's fast, it might not be the next person's view of what fast is as well.

[00:19:47] [SPEAKER_00] Yeah.

[00:19:48] [SPEAKER_01] Let's change this up again a little bit, Robbie, here. One of the challenges that I think a lot of startups have is they've got their first, let's say, five to ten customers. They've done it by CEO introductions, investor instructions, things like that. But now they're in the mode of saying, okay, we need to scale. But it's really hard to get into meaningful conversations with prospects these days for 95%, 98% of the startups out there.

[00:20:17] [SPEAKER_01] I'm wondering in your experience what's changed recently or what's changed in the last five years that maybe a startup might be or should be thinking differently about how they engage with prospects, how they open up doors at prospects. Are you trying to get on the subject of AI here? Might be. I don't know. I don't know. I feel like this traditional model was let's send emails, let's make cold calls, things like that, right?

[00:20:46] [SPEAKER_01] And it wasn't all that customized. It wasn't all that intelligently done. I was part of that world. That's what I used to do. I feel like these days it's way overdone, though. So I'm wondering what you're seeing as alternative ways to get in there.

[00:20:58] [SPEAKER_00] Look, nothing beats face-to-face interaction with people, right? Nothing does, right? There's the usual suspects, trade shows, but buyers aren't going to trade shows these days. I don't know if you've seen that as well, Andrew, but I think CEOs are getting really jaded with them because all they get is business card after business card and then 100 follow-up phone calls. I'm not seeing buyers go to trade shows at all. It's good for people like myself who wants to keep abreast of what's going on in the market.

[00:21:26] [SPEAKER_00] But I would say it's not a good place to actually do business unless you're doing business with MSPs or trying to set up partnerships. What I am seeing more of is startups actually creating their own events and attracting people that way. And that can be something as simple as let's have drinks in a pub somewhere, right? And inviting people, dinners, et cetera, to, I don't know, taking people to a Grand Prix, football, things like that, right? There's more of that happening.

[00:21:54] [SPEAKER_00] And that's good for meeting people face-to-face in a relaxed atmosphere where you can actually then start talking business a bit more comfortably, the less formal. There's a whole AI thing as well that's happening. You can use AI to do reach out, right? And it'll do it instantaneously as well. And it'll mimic you and your company and what you're doing. And it's great if you want to, like, if you've not got the capability to do cold calls yourself, AI can generate that for you.

[00:22:24] [SPEAKER_00] But I'll stand by it that there's nothing better than meeting people face-to-face and building relationships. Yeah, it can take time, but you'll get better conversations. And you're only really needing that one or two to actually kick off. And to be fair, Andrew, right, you need to have a good product at the end of the day. You really do.

[00:22:42] [SPEAKER_01] Yeah, I feel like one of my things I've been wrestling with in my mind for the last six months is in this age of AI, suddenly the more human things stand up. Because I think, to your point, I think a lot of people default to let me just play the volume game, throw an AI something at something and, you know, hope that something sticks out there. Whereas I think those that try and be more human, connect one-to-one, you know, things like that, they're the ones that are going to win at it in the end.

[00:23:09] [SPEAKER_00] Oh, yeah, and it's building a brand as well, right? I mean, everybody's, I mean, there's a lot of startups in the market. There's a lot of AI startups in the market. There's a lot of, in fact, you'll hardly ever find a company these days who's got a SaaS product that doesn't have AI, some sort of AI capability, a chatbot, whatever, right? AI is out there all the time, but it's all about building your brand and doing it in a method that you're going to get the best response from. And I don't think that is AI because it's cold. It's not human.

[00:23:39] [SPEAKER_00] So, yeah, that's definitely ways to engage with your market without using AI. And I think the people who do that get appreciated more.

[00:23:49] [SPEAKER_01] You said trade shows, you were kind of knocking them a little bit. What do you mean by trade show? You mean like InfoSec or RSA or? InfoSec, RSA, that sort of thing, yeah. Yeah, okay. Yeah, if I, I'm trying to remember the exact numbers, but I think Black Hat this year, they were talking about having 400 vendors there, I think. Now, 400 vendors is still only 10% of the total number of cybersecurity vendors, for one.

[00:24:16] [SPEAKER_01] And they're in that big hall and it's, you know, same words in a different order as what you hear, what you see often. There's always exceptions I know that do very well, but many don't, unfortunately. So, if we're not going to do those things, and let's say we've done the state dinners and the football games, things like that, what else? What other ideas do you have for people to say, here's some things you should at least try? It might not be the silver bullet, but here's something that's worth trying.

[00:24:41] [SPEAKER_00] I think, well, free trials is, free trials, if it's a software company, right, that you have. Free trials is a way to go, but actually do it in a managed way. Don't have it running for months, say two-week free trial, month maximum, with engagement throughout it. So, actually doing a, like a mini case study for that particular client is probably a good way to go about it, because then you can prove your product quite easily.

[00:25:09] [SPEAKER_00] And there's no risk from, we talked about risk from the client's aspect earlier, there's no risk doing it that way. The only downside is there's a cost element to the vendor and the time that the client's got to put in it. But it's getting in front of the client in the first place, it's a tricky bit. Yeah. But networking, partnering with MSPs, you'll be surprised using your own networking to get introductions to other people. It's probably a good starting point as well.

[00:25:39] [SPEAKER_01] If you were partnering with AI security company, I'm wondering if you've got any thoughts on not starting with the security team, for example. Say, okay, AI is enabling the business, why don't we talk to the business? Do you think that would be something worth trying or would it just annoy the security team that you're going around them is what they might feel like?

[00:26:01] [SPEAKER_00] I've actually done that approach in the past. And yes, it does annoy the security team because it can make them look bad. And you've got to be careful with that because at the end of the day, they've got to be your stakeholders, your main stakeholder in the organisation. So you want to get off on a good foot. You've got to be pretty confident that the relationship you've got with, and I'll be honest with you, if you've gone to the business, it's probably a chief operating officer because they know everything that's going on in the business.

[00:26:28] [SPEAKER_00] They're the ideal candidate if you can get a hold of them to actually have that conversation with. And do you know what? They'll be up for it. They'll be up for doing it because they're interested in what the technological side of the company is up to as well. They want to make sure that they're doing their job properly. So the chief operating officer is probably the right person to approach, but you've got to be careful how you manage it.

[00:26:50] [SPEAKER_01] Right. You've got to have the right message, right? I would imagine you can't be, you know, all three teams are missing this stuff, you know. So how do we go about, let's think out loud here. How do we go about trying to get in touch with the CEO then? I mean, we could use traditional methods, but any other ideas what we could do?

[00:27:09] [SPEAKER_00] You could. The traditional methods is just like, well, check your connections on LinkedIn. You get to know who the chief operating officer is, the CEO. You can use your connections to get an introduction, that sort of thing. It's just, I don't think there's a silver bullet here, Andrew, to be brutally honest, or everybody would be doing it. I mean, you tell me, I've got my own business. I'd like to speak to all the CEOs at the ICON, but I only know so many.

[00:27:35] [SPEAKER_01] Yeah, I think it's funny. I've got a friend who he started up his business recently where he was doing, like some are doing, AI consulting for medium-sized small businesses, right? How do you go and do stuff like that? And he didn't go, I believe, to even the technology teams often at these companies. He went to the business side. And what he was doing, I think, was he was going through local business groups.

[00:28:04] [SPEAKER_01] And he would do presentations or whatever, breakfast, whatever it was, right? To get in front of people. And he wouldn't talk necessarily about the technology, but he would talk about ways to get going, approaches, things like that. And he was perceived to be the expert. I wonder if there's something similar on the security side, if you're a sales rep.

[00:28:25] [SPEAKER_00] Yeah, I have done that. I have partnered with my local chamber of commerce, but I have given a talk. I got some business on the back of that with a chief executive officer of a company who came along to listen to me. And then, yeah, as time goes on, over time, you become known as the cyber guy, right? And that does open doors. But you've got to make sure that the audience is the right audience that you're speaking to as well. I mean, there's things like a chamber of commerce. It's got plumbers in it and it's got estate agents.

[00:28:55] [SPEAKER_00] And it's not your market, do you know what I mean? But yeah, everybody knows somebody in there. I actually, I was speaking to somebody and Royal Bank of Scotland actually have got a business group and they meet up, I think it's monthly. But it was interesting because somebody went to it and it was full of older women, right? And somebody described it as a knitting club, right?

[00:29:19] [SPEAKER_00] But they said to me, it was brilliant because you got speaking to these women and it turns out the majority of them were wives and husbands who owned massive companies. And you got an introduction that way. And I was like, oh, well, that's interesting. Why am I not going to that? But yeah, it was just bizarre that there was this networking group of full of women who either had their own business or were married for people who had their own business that you wanted to speak to.

[00:29:47] [SPEAKER_01] Interesting. So I wonder in our world in cyber, what those equivalents are and where you find them, right? I always hear from people, oh, yeah, we've got our Slack community and it's just full of security leaders and no vendors will ever, which I totally get. But there must be creative ways that we could think about not just going to the reseller event, not just going to the local ISACA or ISSA event, but something else, right? There's more on the business side.

[00:30:13] [SPEAKER_00] Yeah. I'm going to OOS, OOS Scotland is next week. So I'm going to that, see what that's like. The universities are a good one to partner with. So I partner with Tayside University. I'm giving a talk there next month, actually later this month, actually. And you'll find that they get sponsored by various companies. Now they'll attend these meetups. So there's opportunities for you to speak to companies who are sponsoring the smaller events.

[00:30:40] [SPEAKER_00] You can then try and get a good introduction and a follow-up meeting afterwards through that.

[00:30:46] [SPEAKER_01] Yeah. Yeah. Robbie, have you got any experiences of companies who hire field CISOs, right? They have the, I don't know, former CISOs or former SCU leaders who go join the vendor and they're essentially an evangelist for the company out there at these types of events. Have you got any experience of doing that or seeing that work?

[00:31:08] [SPEAKER_00] So I do it with a couple of MSPs that I partner with. So they bring me in as their sort of CISO under a white label. So yes, yes, I do. It does work definitely as a good idea. But unfortunately, in the majority of cases, they're tied to the MSPs who have got their own products to sell. So unless you're partnering with them, you've kind of had it because it's a closed book of what you're allowed to buy.

[00:31:34] [SPEAKER_01] Yeah. If I was, let's say, going back to my example, right? The founder approaches you for advice on various things. And they said, you know, we've got, let's say, five people, eight people in the sales team right now, but we're going to go hire two field CISOs. We're not going to add more quota carrying reps. We're going to get people who can go out there and evangelize for us. Would you say that's a good move or do you think that's a bit too aggressive, two people doing that? What would you say?

[00:32:00] [SPEAKER_00] I think one's enough, right? Because it can get confusing after that because you're representing that organization as their field CISO. You've got more than one. So it can get a bit awkward. But it brings, it's just, you've got the same problem that you can only, the company that the field CISO was talking to can only buy products from the company that the field CISO was working from. Do you know what I mean? That's the problem.

[00:32:25] [SPEAKER_00] And that's kind of, it's difficult then for new vendors to get into that, to get in front of the client at that point.

[00:32:34] [SPEAKER_01] Yeah. You mentioned before you're doing a lot of AI governance work right now. Is that what people are coming and saying? We need to do so. You need someone who's done this before.

[00:32:42] [SPEAKER_00] Too much AI governance. I can't understand. I think I was saying to you beforehand, I can't understand why everybody's just wanted an AI governance review at the moment. It's just, the world has just exploded, which is, look, it's great, right? I'm not complaining. I just don't understand why AI's been about for years. But all of a sudden, everybody's now realizing that, hey, we've got some issues. We need to get a review done. Maybe it's the new EU regulation that's came about.

[00:33:06] [SPEAKER_00] Maybe it's people realizing that AI's just been out in the wild too long and they now need to control it. Which I think I'd like to hope is the case, rather than them having to meet a new regulation. But yeah, my business is doing a lot of AI governance reviews at the moment. And it's not much different than doing a security review. It's like, well, who owns the AI data? What are you actually using AI for? What personal data is going through it?

[00:33:36] [SPEAKER_00] Where are you storing it, et cetera? This sort of thing. What's your rule sets look like? Do you have a policy? It's all basic stuff that companies do not have. It's good. I think it's needed in the industry. And I think this is going to be a new industry on its own in the next year. I can see it going that way already, to be fair.

[00:33:56] [SPEAKER_01] What are you finding out there? Let me say it a different way. What I've heard is a lot of security people feel like the train's left the station, is what they say. The business has gone off and just said, just do this. And as long as they're standing there going, well, let's do it sensibly.

[00:34:13] [SPEAKER_00] Yeah. So let's simplify it. So companies have been using AI tools to enable them to do business functions faster, cheaper. Right. And they've been cutting back on a lot of human stuff. Right. If we like it or not, that's just the way the world's went. Right. But the AI tools have started to become so embedded in organizations that nobody's controlling it. And the train has left the station. In the majority of cases, client data has been, I'll give you an example, right?

[00:34:42] [SPEAKER_00] I came across an organization, I won't name names, but they were using customer application forms with data, financial data on it, personal PII information on it. And they were just putting us into chat GPT to run a summary of it that then they could then dump onto a spreadsheet. And then that's the data. It's in the world now, right? You can't, it's left the station, you can't get that back. So there has to be controls put in place. Now, there's two ways that you can put controls in place that I've been recommending.

[00:35:11] [SPEAKER_00] One's an MSP server, which is a rules engine, which is a bit of Muggleware, where all commands from all AI chatbots, whatever, goes into this. And the rule says, yes, that's allowed or no, that's not allowed. And the company configures the rules. The other way that I've been recommending, you might be surprised at this, is building your own LLM for that company and just managing it in-house yourself, rather than buying an off-the-shelf package. You can control it so much easier then.

[00:35:39] [SPEAKER_00] So that's the two things that I've been recommending companies do. But it's hard because businesses have been relying on AI to do business functions faster and cheaper. And now you're getting people like me coming in and saying, yes, I'd still like you to do that. I'd still like you to be an enabler from a security perspective, but I need you to put these controls in it. That is going to slow it down in some capacity, but they have to be careful.

[00:36:06] [SPEAKER_01] I've sensed there is this bit of disillusionment from leaders of big companies going, we're spending a lot of money on the big names out there. They're taking our data and they're improving their products with our data, whether they say that they're going to do it or not. Is this really the right thing to do? And one of the options is let's create our own. How realistic is that for companies to build their own medium language model or large language model?

[00:36:33] [SPEAKER_00] Yeah, it's surprisingly easy to do. And for a mid-sized company, I wouldn't say it was too expensive. You can do it for under $5,000. There is an overhead. There is an overhead, Andrew. You need to keep it managed. You need to have somebody who's looking after it, be that your cyber team, be that your IT team or be that your new AI team, whatever you want to call it. So there is an overhead there. How easy is it to do?

[00:37:02] [SPEAKER_00] You can have it up and running in a matter of weeks quicker than that, to be honest. It's not difficult. I don't even think it's very expensive to run either. There's a lot of configuration if you've got tools embedded already, AI tools embedded already. Is it worth doing? I'd probably say the reviews that I've done so far is probably about 60, 70% of the companies have said, yes, definitely do it. But you'll get benefit in the long run for it. So yeah, I think there is a benefit from it.

[00:37:32] [SPEAKER_00] And it's easy.

[00:37:33] [SPEAKER_01] Yeah, as a complete layman, it seems there's a disconnect for me that you hear all these AI gurus go to work for the big companies and they get paid literally tens of millions to go do it. And then the other side, you hear people like yourself saying, well, you could probably build your own in 510k and the rest of it. So I'm wondering how that plays out. What do you lose by trying to build it yourself?

[00:37:56] [SPEAKER_00] Do you not think these companies that pay the AI gurus hundreds of thousands of dollars a year are just doing it to make their board look, hey, we've got an expert in AI. We're okay. Do you not think there's a part of that about it? It's having a bit of a confidence factor. The reality is that they'll be, I'll guarantee you, they'll be recommending what's built internally or self and they can do it pretty cheap.

[00:38:17] [SPEAKER_01] Yeah, it'd be fascinating to see how this plays out, right? Because I think there'd be many people who'd be thinking, at least let's build our own models. I don't know if your impression is the same as mine, which is you hear people saying, well, do we really need this whole catch-up software anymore? Do we need Salesforce? Why don't we just build our own CRM? I'm a little bit skeptical about whether that's actually what's going to happen, but I do think the underlying LLM stuff might be where it goes. I don't know, what's your thoughts on that?

[00:38:46] [SPEAKER_00] Oh, yeah. And there's companies that are actually getting on the bandwagon now that are actually can provide this service where they'll come in and basically give you the hardware, the software, train you up how to do it. Very, very fast for a fraction of the cost, to be honest. So, yeah, I'm starting to see things change in that space very, very fast. But that's the nature of AI, isn't it? It moves so fast.

[00:39:13] [SPEAKER_01] I feel like I learned something last week, and by this week, I'm already out of date on some new thing that's come out.

[00:39:18] [SPEAKER_00] Well, you know what? It's like AI. So you go in the chat to a GPT and you ask it a question. Ten minutes later, you'll ask it the same question. You'll get a different answer.

[00:39:26] That's true.

[00:39:27] [SPEAKER_01] That's true. That's so true. So, Robbie, listen, on that note, let's go back to the spin the wheel game. We came up with the Cyber Donut hot seat. And to remind everyone, Cyber Donut was a company, a traditional company from three years ago in the podcast, where we sent a lot of episodes around how do we help Cyber Donut get to $10 million. And here are, well, Cyber Donut's back. So let's reveal the question below the hot seat and see what your thoughts are. So here's the situation.

[00:39:57] [SPEAKER_01] Cyber Donut landed one of your fractional clients as an early adopter before you started working with them. Right? So you came in and started working with them afterwards. They signed up a three-year deal, escalating price, cheap to start with, obviously, increases over time. But nine months in, half the roadmap of the vendor is just your own company's custom requests and things like that. And the product's starting to only just work for your client, essentially. Right? It's almost like a custom development project for that client.

[00:40:27] [SPEAKER_01] How would you work with the leadership of Cyber Donut to help them realize that's what's happening and help them realize they've got to be a bit more aware of the world out there and not just this one client?

[00:40:37] [SPEAKER_00] Right. I see why you asked this earlier then. You kind of touched on this earlier. Right. So what I would do, right, is I would get a round table set up for Cyber Donut's best clients, shall we say. Right? And get them sitting around the table and going through the roadmap and having a voting system about what they want in it and what they don't. A priority system, in effect. You've got to make sure that it meets all clients' requirements. I'll give you a real world example of this.

[00:41:07] [SPEAKER_00] For a major software company who actually had this problem was, have you heard of Fortify? The software analysis company?

[00:41:17] [SPEAKER_01] Yeah. From the early 2000s, right?

[00:41:20] [SPEAKER_00] Yeah, that's right. Yeah. So JP Morgan were a massive client of Fortify's. And JP Morgan went and dictated what the roadmap for Fortify looked like. And that meant that Fortify found it increasingly more difficult to sell to other clients. But to solve it, what I would do is I'd get a round table together with several clients of Cyber Donut, discuss what the priorities should be, and have a voting system to get everything that should be in there.

[00:41:49] [SPEAKER_01] Were you at JP Morgan then when Fortify was working? I was at JP Morgan, yeah. Okay. And what did it take for, did Fortify and leadership realize this and were worried about it? Or were they thinking, no, no, we're good, if we can build for JP Morgan, you know, we're going to have something for everyone.

[00:42:05] [SPEAKER_00] Yeah, I think they were quite happy to take JP Morgan's money, to be fair. Is that what it was? Who would then? Yeah. I mean, I would.

[00:42:12] [SPEAKER_01] Yeah. If I was the leadership at JP Morgan, I think it was good and all, but I'd be worried that what's the longevity of a company that's really developing software just for us, you know?

[00:42:21] [SPEAKER_00] Yeah, you might as well buy it at that point. There you go, right? Yeah, exactly. Yeah, no, I think having a discussion across clients, right, is good for a vendor, a small vendor, to actually help build the product in the way that suits many clients. And it's not just clients that are in the same market, they can be in different markets as well.

[00:42:41] [SPEAKER_00] So cyber companies can be in finance, manufacturing, healthcare, et cetera, and having a representative who can actually discuss what looks good, what could look better, what they would like to see. You'd be surprised what can cross-function across different markets that other clients would actually want. What I found, because I've been through that myself, right, when I was at OSEC, a lot of clients wanted to see better reporting.

[00:43:08] [SPEAKER_00] And if one client in one sector had a good idea, it usually translated to the rest of the clients, to be fair. So, yeah, that's probably what I would do.

[00:43:18] [SPEAKER_01] All right. Well, on that note, Robbie, thank you so much for joining us on the podcast on this sunny but windy day here in Scotland.

[00:43:26] [SPEAKER_00] You're more than welcome. And it's still raining where I am, and I'm just, what, about 30 miles from you? Yeah. So, yeah. So give me half an hour and I'll be raining here as well. Yeah, give me half an hour, yeah.

[00:43:36] [SPEAKER_01] All right, Robbie, thanks for joining me. You're welcome. Hey, Andrew here. One last thing. If you enjoyed this episode, will you do me one small quick favor? And that's just send it to a friend. Simple as that. Your podcast player will have a share button somewhere.

[00:44:02] [SPEAKER_01] Click that and then text it, slack it, email it, whatever is easiest for you, to someone you know who you think might want to listen. That's the best way you can support this show, and I really appreciate you for doing this.