Jeremiah Grossman: The 1% of CVEs That Actually Matter

0:00:00.400,0:00:08.080
Only 1% of all CVEes have ever been exploited 
ever. So we have to ask ourselves what what

0:00:08.080,0:00:13.120
good is it to find, let alone fix a vulnerability 
that will never ever get exploited. It's a lot

0:00:13.120,0:00:20.080
of time and energy focused on something that 
provably can't work as only 1% of all founders

0:00:20.080,0:00:24.880
ventureback founders make even a dollar 
off their startups. This is really hard.

0:00:24.880,0:00:33.600
Meet Jeremiah Gman, CEO of Evidence and a 25-year 
cyber security pioneer. From serving as one of

0:00:33.600,0:00:40.880
Yahoo's first security officers to founding and 
selling major startups like White Hat Security,

0:00:40.880,0:00:47.760
he continues to shape the future of modern web 
defense. But if you press that patch everything

0:00:47.760,0:00:53.040
button too often without proper regression, you 
could shoot yourself in the foot and for a fact

0:00:53.040,0:00:58.160
cause financial loss. This is Hackers to Founders, 
a podcast about cyber security professionals who

0:00:58.160,0:01:03.440
have reached the pinnacle of their cyber security 
expertise and have ventured into new frontiers.

0:01:03.440,0:01:08.000
Whether it's launching innovative startups or 
making impactful investments in our industry,

0:01:08.000,0:01:11.760
my name is Chris Manestrad and I'm a 
vulnerability researcher best known

0:01:11.760,0:01:15.600
for traveling and meeting hackers from all 
around the world. and I'm using what little

0:01:15.600,0:01:21.120
extrovert skills I have to introduce to you 
hackers that are changing the world. You're

0:01:21.120,0:01:26.400
listening to hackers to founders with Chris 
Magestrad. All right, Jeremiah, welcome to

0:01:26.400,0:01:33.280
the show. Really glad to have you on. Good to 
have you. Uh, good to be with you, Chris. Y

0:01:33.280,0:01:38.720
All right, so um I want to start where everyone in 
security is at right now. Anthropic just dropped

0:01:38.720,0:01:44.880
a new model. Um, and I found a 27y old bug in 
OpenBSD and it hit a 72% exploit uh, success

0:01:44.880,0:01:51.360
rate against Firefox. Um, your blog post reframed 
the whole conversation. You said the surge isn't

0:01:51.360,0:01:57.200
really about the discovery problem. So, would you 
be able to walk us through that? Sure. Um, I think

0:01:57.200,0:02:00.320
first it's important to figure out what we're all 
trying to do here. I think at the end of the day,

0:02:00.320,0:02:05.440
we're all trying not to get hacked. You know, 
businesses trying to not have a financial loss.

0:02:05.440,0:02:09.520
And uh one of the ways that companies have 
breaches and financial loss are the exploitation

0:02:09.520,0:02:14.800
of vulnerabilities and uh you know that could be 
software of all particular types but they usually

0:02:14.800,0:02:20.400
center around a few types. So in the case of uh 
like the open uh BSD one if we're talking about

0:02:20.400,0:02:25.840
the right ones I think that was morely a more so a 
crasher. they couldn't really exploit the one the

0:02:25.840,0:02:32.320
details that they released and the Firefox ones 
are were cool no doubt worthy of fixing but those

0:02:32.320,0:02:36.480
weren't going to really impact anybody because 
you know they exploited Firefox but I don't think

0:02:36.480,0:02:41.280
they claimed a a sandbox you know jailbreak or 
anything like that whereas it could actually

0:02:41.280,0:02:47.280
impact anybody so worthy of fixing so there's a 
big difference like if you've ever written exploit

0:02:47.280,0:02:52.160
code or ripped apart exploit kits there's a big 
difference in finding a vulnerability and creating

0:02:52.160,0:02:59.200
a a real weaponized exploit that causes damage, 
right? Definitely. I mean, you can set up AFL,

0:02:59.200,0:03:02.560
have it crash, but if you're not able to actually 
weaponize it or figure out exactly what's going

0:03:02.560,0:03:06.640
on, then it doesn't really matter. And then even 
if you do, depending on the impact, maybe it

0:03:06.640,0:03:10.800
doesn't even matter as much. So, like the uh like 
the FreeBSD bone they found, I find that to be

0:03:10.800,0:03:16.560
genu generally interesting. I have a a background 
from Yao a long time ago on on FreeBSD. That one

0:03:16.560,0:03:23.760
was one was over NFS, if I remember correctly. 
So that was a remote exploitable vulnerability.

0:03:23.760,0:03:30.640
I believe they got root on that one. So that was 
cool. The problem is is that uh you never see NFS

0:03:30.640,0:03:35.680
on the internet remotely exploitable at least 
on anything significant. So I mean there's not

0:03:35.680,0:03:40.400
a lot of people running FreeBSD running NFS on the 
public internet. So what are you really going to

0:03:40.400,0:03:45.280
do with that one? You know it's it's cool for what 
it is, but as far as game changing in the world,

0:03:45.280,0:03:50.880
no one's going to get breached by that. Right. 
Right. and like uh I think there's fewer than

0:03:50.880,0:03:55.680
1% of the vulnerabilities that Mythos has found 
has gotten patched. You've been writing about the

0:03:55.680,0:04:02.000
remediation gaps since at least 2024. Uh does it 
feel vindicating or terrifying that the industry

0:04:02.000,0:04:10.640
has now uh come has to confront it as that 
machine speed? Well, so I've been in vulnerability

0:04:10.640,0:04:15.440
management since like 2001 with Whitehead 
security. So you know uh those were absack

0:04:15.440,0:04:20.160
vuls we were finding back in the day and if you're 
in volume management your entire job is to bury

0:04:20.160,0:04:25.840
your customers with vulnerabilities and everybody 
did that but the strangest thing happened is that

0:04:25.840,0:04:31.760
you know over the next decade or two yeah only the 
remediation rate only got to maybe 50% and that

0:04:31.760,0:04:36.800
was like taking 6 months to get there and the 
vulnerabilities that didn't get fixed were not

0:04:36.800,0:04:41.280
exploited you know so that you know that should 
give us cause to like rethink what we're doing

0:04:41.280,0:04:46.160
rethink what we're causing uh where we're calling 
vulnerabilities, at least high-risisk ones. Then,

0:04:46.160,0:04:50.400
you know, last couple of years, several years, 
I've been really investing my time into CVE

0:04:50.400,0:04:54.960
vulnerabilities rather than appsac. So, right 
now, we're sitting on, you know, similar problems.

0:04:54.960,0:05:01.600
Everybody's buried in vulnerabilities because 
we have 350,000 CVEes and everybody's buried in

0:05:01.600,0:05:08.480
thousands, sometimes millions of vulnerabilities. 
But here's what's wild. Only 1% of all CVEes have

0:05:08.480,0:05:15.040
ever been exploited, ever. So we have to ask 
ourselves what what good is it to find let

0:05:15.040,0:05:21.520
alone fix a vulnerability that will never ever 
get exploited. So it's something to ponder and

0:05:21.520,0:05:25.360
yeah and that's uh I believe that's that's how 
what you guys are doing with your company right

0:05:25.360,0:05:31.280
and focusing on those 1%s that are actually uh 
making an impact in the wild. Correct. Yeah.

0:05:31.280,0:05:35.440
Um it actually gets a little bit more specific 
than that. We kind of separate the two out. So

0:05:35.440,0:05:42.640
there's the world of CVES the you know the entire 
world and we know only 1% or so um have led uh

0:05:42.640,0:05:48.480
have resulted in breach the number is even less 
when you when you talk to the insurance carriers

0:05:48.480,0:05:53.280
and the incident responders when it comes to 
vulnerabilities that have to not just breach

0:05:53.280,0:06:00.560
but evidence of significant financial loss it's 
actually more like 2% it's a really tiny amount of

0:06:00.560,0:06:06.080
vulnerabilities that are actually causing us harm 
and that's where I really want focus because you

0:06:06.080,0:06:10.560
know I I don't want to be in the business of just 
finding vulnerabilities for the sake of finding

0:06:10.560,0:06:16.080
them and trying to convince customers to fix them. 
I want to help companies stop breach and and more

0:06:16.080,0:06:21.760
importantly financial loss, not just find a bunch 
of vulnerabilities that no one cares about, right?

0:06:21.760,0:06:27.280
And and in terms of like financial loss, you've 
said like for years that 50% of vulnerabilities

0:06:27.280,0:06:33.680
uh never get uh to be fixed or like you said it 
takes months. Uh why is it still true that in 2026

0:06:33.680,0:06:39.680
after billions of dollars of VC have been poured 
into vulnerability management? Well, vulnerability

0:06:39.680,0:06:43.840
management for the most part just finds the 
problem. It doesn't really help you patch,

0:06:43.840,0:06:48.160
but not that we really needed to help customers 
patch, but I think if you ask them, why don't you

0:06:48.160,0:06:53.040
just patch all vulnerabilities at all times? You 
know, honestly, they could if they want to. Most

0:06:53.040,0:06:59.680
of them have the automation to say push a button 
and just patch for the most part. Um they don't.

0:06:59.680,0:07:07.280
And for them, the the risk is very real. You might 
get hacked and you might have a financial loss,

0:07:07.280,0:07:11.760
but if you press that patch everything 
button too often without proper regression,

0:07:11.760,0:07:18.400
you could shoot yourself in the foot and for a 
fact cause financial loss. So, you risk the hack,

0:07:18.400,0:07:23.680
but you keep business going on. So, that's the 
calculus companies are doing, and it's and it's

0:07:23.680,0:07:28.240
uh it's difficult to fault them for it. Software 
is imperfect. If I just automated my patching

0:07:28.240,0:07:33.920
system all day every day, it's a high likelihood 
it's gonna break something, right? Yeah. And I

0:07:33.920,0:07:37.760
guess it would be on the dev team to to sort 
all that out, which could take like downtime

0:07:37.760,0:07:42.480
and everything else. Well, it's there's actually 
in that context there's three types of vans. I

0:07:42.480,0:07:47.360
could patch one from like, you know, Microsoft 
or Oracle or something like that, a CVE van, and

0:07:47.360,0:07:53.360
that goes to the IT or the IT ops team. And then 
on the apps side, you have the the vulnerabilities

0:07:53.360,0:07:59.600
in the code that we that we or the company wrote. 
And then it's a question of do I take developers

0:07:59.600,0:08:04.160
off creating revenue generating features to fix 
vulnerabilities that may not even be reachable,

0:08:04.160,0:08:08.800
may not ever be exploited. And then the other ones 
is that they have the vulnerabilities in the third

0:08:08.800,0:08:15.200
party libraries which are technically CVEes and 
that their code might depend upon a vulnerable

0:08:15.200,0:08:22.480
version. So, you know, these are very complex 
problems and but maybe we don't need to fix all

0:08:22.480,0:08:29.040
these. I know it's strange to say, but we're we're 
not seeing we're not seeing uh breaches that are

0:08:29.040,0:08:35.520
exploiting web app vulnerabilities like we were 10 
years ago. Okay. So, what are we seeing now then?

0:08:36.080,0:08:41.120
uh about let's say we take we start with the world 
of breach and financial loss because I read all

0:08:41.120,0:08:47.600
all the reports about 10 to 30% depending on the 
report is the initial access vector is a CVE you

0:08:47.600,0:08:52.480
know perimeter CVE and most of those are going to 
be a lot of those I won't say most are going to

0:08:52.480,0:08:59.840
be in VPN or edge devices and web admin portals 
another 10% or no I'm sorry I would say about

0:08:59.840,0:09:05.680
half or so are going to be credential stuffing 
account takeovers business email compromise

0:09:05.680,0:09:11.360
the most low tech uh things around um you know 
with you know those sorts of things and that gets

0:09:11.360,0:09:18.000
you most of the way of how breaches are actually 
happening. Okay, interesting. Uh pentesting as an

0:09:18.000,0:09:23.760
industry is basically like a one once a year 
compliance checkbox for most companies. Is

0:09:23.760,0:09:31.120
the annual pentest dead? And if it is, what would 
replace it? Uh, no. The compliance standards, it's

0:09:31.120,0:09:35.920
kind of like the compliance standards are like 
our the cyber security's version of no child left

0:09:35.920,0:09:42.000
behind. You know, those standards are going to 
be out there. Um, no one's going to change those.

0:09:42.000,0:09:47.520
For some reason, the world thinks doing a bunch 
of something equals value. It really doesn't.

0:09:47.520,0:09:51.360
You know, for my part, most of the compliance 
standards are a complete waste of money. There's

0:09:51.360,0:09:56.400
no correlation between doing a bunch of these 
things and lowering risk and financial loss.

0:09:56.400,0:10:01.600
There's nothing. There's no evidence that anything 
does this. Um, unfortunately, we have to spend a

0:10:01.600,0:10:06.880
lot of time and effort dealing with compliance 
rather than doing actual security because look

0:10:06.880,0:10:12.320
at how the compliance standards are set up. It's a 
controlbased framework. Do a bunch of these things

0:10:12.320,0:10:18.880
and we hope it'll work. And what what do the 
standards update every 3 to 5 years, right? How

0:10:18.880,0:10:25.360
often does the adversary adapt? Every 18 months 
to two years. Like that's a failed model. like

0:10:25.360,0:10:30.480
it can't possibly work. That's interesting. 
So, do you think that uh we should have less

0:10:30.480,0:10:34.960
regulations in terms of compliance? If we're going 
to have regula, if we're gonna have regulations,

0:10:34.960,0:10:41.920
they need to be uh out outcome outcome based um 
based in based in actual risk. Like meaning the

0:10:41.920,0:10:47.200
standard should say uh if a company is breached, 
you suffer the risk, you suffer the loss,

0:10:47.200,0:10:52.160
not your customers. And they'll figure this stuff 
out real quick because I'm not sharing any secrets

0:10:52.160,0:10:58.320
here. Everybody knows how this works. sense 
like oh and I'll give you an example uh software

0:10:58.320,0:11:03.520
liability you know how much of cyber security 
exists because vendors ship crappy software

0:11:03.520,0:11:09.920
and they know it you know so why do we have to 
spend billions dealing with everybody else's

0:11:09.920,0:11:17.040
shoddy software why don't they take reliability 
for their own software yeah that's something I I

0:11:17.040,0:11:22.560
used to work at a simile and and we would look 
at uh network devices on hospital networks and

0:11:22.560,0:11:26.560
I'd look at some of these and I'm These are like 
like it would it would be a product and it would

0:11:26.560,0:11:30.800
get sold to another like bigger company but then 
the development and updating of the firmware would

0:11:30.800,0:11:34.880
stop and it's like these things are still like 
in hospitals. They're still live and it's like no

0:11:34.880,0:11:40.800
one's updated this firmware in the past like seven 
years. Yeah. Yeah. It's it's crazy. And maybe in a

0:11:40.800,0:11:44.480
hospital environment there might be good reasons 
why you don't want to touch it if it ain't fixed

0:11:44.480,0:11:51.760
or broken. But but that sort of thing happens all 
over the place in every domain, you know, like you

0:11:51.760,0:11:56.880
do we we don't get away with that with cars. Like 
you sell somebody a car or a toaster, if it hurts

0:11:56.880,0:12:02.640
someone, the manufacturer is liable. Everything 
in the world except software and security. It's

0:12:02.640,0:12:10.160
interesting. Yeah. Uh you've been a vocal and a 
vocal critic of the CVS for years. You've said

0:12:10.160,0:12:15.520
it tells you how bad a bug could be in theory, 
not whether it's exploitable in the environment.

0:12:15.520,0:12:22.560
What replacements in CVSS in a world where AI can 
generate thousands of findings overnight? Well,

0:12:22.560,0:12:30.240
it's a good question. Um, CVSS exists because 
we had a pri prioritize vulnerabilities in some

0:12:30.240,0:12:37.360
possible way generically. We needed something 
because if you remember way back in the day, we

0:12:37.360,0:12:43.520
had a way fewer systems, way fewer vulnerabilities 
where we really could scan for everything and we

0:12:43.520,0:12:48.240
really could fix everything. And then over time, 
the attack surface got bigger, the number of

0:12:48.240,0:12:53.520
vulnerabilities got bigger, and we simply couldn't 
patch it all reliably. We just couldn't do it. So,

0:12:53.520,0:12:59.600
we needed a way to prioritize. And so, um, the 
makers behind CVSS, I really don't even know who

0:12:59.600,0:13:04.000
they are. That did the best they could of which 
vulnerabilities we thought were most important.

0:13:04.000,0:13:09.600
And we took a big guess. The guess was made 
because there was no actuarial data. We didn't

0:13:09.600,0:13:14.720
really know what the adversary was exploiting or 
what they're going to exploit. So, it was a guess.

0:13:14.720,0:13:22.560
And the guess was wrong. So, I'm not a at this 
point I'm not a big fan of scoring vulnerabilities

0:13:22.560,0:13:27.920
in general. I'm a big fan of just fixing the 
vulnerabilities that the adversaries exploit

0:13:27.920,0:13:34.800
because the the number of them is very tiny. 
Okay, that's interesting. So uh how much of cyber

0:13:34.800,0:13:40.160
security industry's valuation is built on selling 
tools that find more problems that no one has the

0:13:40.160,0:13:45.680
capacity to fix? A lot a lot a lot of it but uh 
it's kind of hard to say. I've never really done

0:13:45.680,0:13:51.840
the calculations one could um I think at least 
the CVE vulnerability management space the act of

0:13:51.840,0:13:58.960
finding vulnerabilities probably 3.5 to 5 billion 
in revenue every year that's two that's out of 250

0:13:58.960,0:14:04.960
billion of the industry. So it's it's notable, 
but it's not that big. If you add appsec to it,

0:14:04.960,0:14:09.120
maybe a couple of billion more. It doesn't get 
big. I mean, people are spending a lot of money on

0:14:09.120,0:14:16.080
on firewalls and seam devices and managed MDR and 
those those are huge spaces. Okay. What what are

0:14:16.080,0:14:26.240
the top three spaces? Uh I think I I really don't 
know. I think EDR is huge. Managed MBR is huge,

0:14:26.240,0:14:31.440
but I really don't know. All right, that's fine. 
I I I have I have no idea before honest. I thought

0:14:31.440,0:14:36.640
you maybe So So there I I don't bother to look 
because I chase problems. I like finding big

0:14:36.640,0:14:41.600
problems and whatever solution whatever company 
solves them. Cool with me. Cool. Yeah, I'm excited

0:14:41.600,0:14:46.960
to to talk more about the the things that you've 
been doing uh in the next chapters. But uh uh let

0:14:46.960,0:14:53.360
me ask you about this. So uh MSPs are sitting on 
let's say hundreds of SMB clients who don't even

0:14:53.360,0:15:00.000
know what CVE is. uh with the volume of finding 
goes to 10x overnight, does the MSP business model

0:15:00.000,0:15:08.720
break or is it a big opportunity they haven't 
had before? Uh yeah, I think uh I don't know

0:15:08.720,0:15:14.080
how MSSPs work at least at the bottom end of the 
company range. Are they really burying their small

0:15:14.080,0:15:18.240
customers and tons of vulnerabilities and then 
you have to think what happens if they purposely

0:15:18.240,0:15:22.800
don't inform them because the volume is too big? 
That that puts them in a tough tough particular

0:15:22.800,0:15:27.760
bind. So yeah, I think at the end of the day, 
everybody's just going to get that much more

0:15:27.760,0:15:32.320
buried in critical vulnerabilities, supposedly 
critical vulnerabilities. I don't know if there's

0:15:32.320,0:15:37.600
a way around that. Um, I could tell you at the 
other end of the spectrum, I'm aware of different

0:15:37.600,0:15:43.200
insurance carriers that scan their their insured 
for free and when a new vulnerability pops up,

0:15:43.200,0:15:50.560
they might report it to 2% of their customers that 
actually have it. Interesting. Do do they know

0:15:50.560,0:15:54.960
that the other customers have it and then they 
just start reporting it or they they just so low

0:15:54.960,0:15:58.560
in terms of the amount of people to actually 
report it to? It's it's more the the latter.

0:15:58.560,0:16:04.720
It's it's so incredibly low because if you have to 
imagine in the world of vulnerability management,

0:16:04.720,0:16:10.240
the way companies compete is by who can bury 
your customer in vulnerabilities deeper than the

0:16:10.240,0:16:17.280
other guy. More vols equals more value. Yeah. In 
insurance, it's the exact opposite. you're going

0:16:17.280,0:16:22.960
to use the carrier that makes you do less. So less 
volumes equals more value for those guys. It's a

0:16:22.960,0:16:30.960
complete opposite. So the carriers are playing 
this little game of chicken. They want to find

0:16:30.960,0:16:37.040
uh they want to find less to get the account 
but not uh but not so little that they suffer a

0:16:37.040,0:16:42.080
loss. So they have a balancing act there. Is it 
less vol or would you say it's like less work?

0:16:42.080,0:16:45.520
Because maybe it's like the same thing. Click the 
button and then it's all patched and then think

0:16:45.520,0:16:49.680
everything's fine and that's what they like, the 
shiny button. Uh, depending on the carriers, they

0:16:49.680,0:16:59.200
might be scanning for a couple of thousand bones 
total, not 350,000. Okay. All right. Let's say um

0:16:59.200,0:17:04.480
let's say a founder closes a $5 million series 
A and they get their first enterprise customer

0:17:04.480,0:17:10.880
asks for a sock 2 and a pentest report. Their 
instinct is to find the cheapest vendor on G2.

0:17:10.880,0:17:16.000
What would you actually tell them to do? Find 
the cheapest vendor that you can do exactly

0:17:16.000,0:17:21.920
that. Yeah. Um I I in that context, I'm a belie, 
you know, you're going to have to do what the

0:17:21.920,0:17:27.680
customer requires you to do. You know, whatever 
they think is uh best, but I would never trust the

0:17:27.680,0:17:34.720
security of my company to some vendor anyway. 
So, you know, so I will instruct my IT teams,

0:17:34.720,0:17:40.160
my security teams to uh do the best we 
possibly can to secure our environments

0:17:40.160,0:17:44.960
and we'll do whatever the SOCK 2 requires us to 
do, but I'm going to make sure that when you're

0:17:44.960,0:17:52.080
dealing with someone else's vol data, it's going 
to be locked down. Got it. Got it. Uh what's the

0:17:52.080,0:17:58.640
dumbest thing you've seen small companies still 
doing in 2026 that any decent hacker, human or AI,

0:17:58.640,0:18:05.520
uh would walk right through? I I don't know 
about the latter but um lack of MFA. We have

0:18:05.520,0:18:11.280
about three maybe five security controls in cyber 
security where we can prove that work. MFA is one

0:18:11.280,0:18:19.760
of them. Consistent MFA across your edge devices, 
web admin portals, email, whatever. MFA works. Use

0:18:19.760,0:18:26.960
it. It's it's easy. It's annoying sometimes, but 
that one works. Just do that. Yeah, definitely. I

0:18:26.960,0:18:31.360
appreciate that. Yeah, I I think over the weekend 
like I kept getting notifications uh saying like,

0:18:31.360,0:18:35.280
"Oh, are you trying to log in?" And I checked 
the IPs and it's like it's from all over like

0:18:35.280,0:18:40.000
Eastern Europe. I'm like, "No, none of this is 
me." And I'm glad like it's asking me. So, and

0:18:40.000,0:18:45.520
like everything I have is multi MFA 100% all over. 
And that's where that I've been noticing because

0:18:45.520,0:18:50.480
I I get to talk with lots of DFIR companies 
all the time that are doing investigations and

0:18:50.480,0:18:56.800
uh one of the things they say is that the customer 
said and thought that they were using MFA and they

0:18:56.800,0:19:01.680
were but they weren't using MFA everywhere. They 
just didn't know that because the policies get

0:19:01.680,0:19:07.120
weird. So that's uh so that's one of the things 
that hap that happens is that it's not consistent

0:19:07.120,0:19:11.920
MFA everywhere and that's the one that they need 
a little bit of help with like are the configs

0:19:11.920,0:19:18.800
on MFA correct? Like imagine just one admin 
that's not MFA and you that might be toasting.

0:19:18.800,0:19:22.880
I can also see like some compliance standard 
of like is are we using MFA and it's like well

0:19:22.880,0:19:26.800
we're using it here so yes and then it'll pass 
compliance and you don't even like look anywhere

0:19:26.800,0:19:34.160
else and it might be yes today yes everywhere 
today and for whatever reason tomorrow no you I

0:19:34.160,0:19:39.280
mean that's that's the challenge you know somebody 
changed the config I think I think one of the most

0:19:39.280,0:19:44.080
interesting ones I've ever seen was like it had 
MFA that you had to you that you could use but

0:19:44.080,0:19:48.880
the only I think the only option was SMS and it 
didn't give you anything else And I was like,

0:19:48.880,0:19:54.320
well, I prefer if it was like token based 
something else, but if SMS today, I don't

0:19:54.320,0:20:03.360
know if if that's all you got. I I mean, I'll take 
that over. Yeah, definitely. All right. So, uh,

0:20:03.360,0:20:07.760
you pushed for years that security vendors should 
offer warranties. Put your money where your mouth

0:20:07.760,0:20:14.880
is. Why hasn't the industry adopted it? Uh, and 
would warranties even mean anything in the world

0:20:14.880,0:20:21.040
where new O days are dropping every day? Oh, I 
I would actually disagree. Um I I think I did

0:20:21.040,0:20:26.720
pioneer the idea 10, 12, 15 years ago, something 
like that. And I did it and I now I'm aware of

0:20:26.720,0:20:30.960
hundreds of companies that are that are doing 
it behind this. They're not well advertised,

0:20:30.960,0:20:35.680
but it's in their their licensing agreements that 
they're taking on liability for what they deliver.

0:20:35.680,0:20:40.640
Um it's not everyone. I wish it was everyone, but 
you know, Sentinel One has it. Crowd Strike has

0:20:40.640,0:20:47.120
it. You know, there's lots of companies that have 
it. And uh I think customers aren't used to asking

0:20:47.120,0:20:53.760
for it because somehow we've convinced them that 
uh vendors shouldn't be responsible for the claims

0:20:53.760,0:20:58.640
they make uh in their product. And I absolutely 
think they should. The military grade encryption,

0:20:58.640,0:21:07.040
right? Yeah, sure. Now we're going to 
see mythos ready functionality. Oh god.

0:21:07.040,0:21:14.160
Mythos ready. Yeah. All right. Um, 
so if you were sitting across from

0:21:14.160,0:21:20.320
uh the CTO of a 50 person fintech who just 
raised a series A, well, it's the 60-second

0:21:20.320,0:21:27.040
version of what they need to do for security in 
the next 90 days. Oo, good job. Uh, good one. Um,

0:21:27.040,0:21:31.920
I think, uh, I'll I'll be the self-s serving 
one. Is that, uh, get you get your basics down,

0:21:31.920,0:21:36.000
whatever we choose those to be, that would 
be, uh, perimeter scanning every day for

0:21:36.000,0:21:40.960
the vaults that matter. I could do that for them 
if they wanted to. Um the second one is is that

0:21:40.960,0:21:47.120
um uh MFA everywhere number three and uh the third 
one is canaries. No matter how much prevention you

0:21:47.120,0:21:53.920
have um the adversary will find a way in if 
they want to and canaries are a very powerful

0:21:53.920,0:22:00.240
uh underutilized tool. You know what I've learned 
in 25 30 years of cyber security you're going to

0:22:00.240,0:22:05.040
get breached but the breach doesn't hurt you. The 
dwell time of the adversary is what really gets

0:22:05.040,0:22:12.160
you. Like if you gave me you 24 hours a week on 
a bank with root, how much money and damage are

0:22:12.160,0:22:19.280
we really going to do even with a week on a bank? 
Um it's, you know, give us six months, it's hours,

0:22:19.280,0:22:24.000
you know. So if the if you can cut the dwell time 
with a canary, that one's huge. Interesting. How

0:22:24.000,0:22:29.040
many companies do you feel are actually utilizing 
canaries or should be utilizing canaries? I want

0:22:29.040,0:22:33.600
to say the number is at least in the thousands 
because one I'm a big fan of uh Harunir over at

0:22:33.600,0:22:39.120
Thinst and there's that's one company that does it 
and I think their customer set is in the thousands

0:22:39.120,0:22:43.760
at least but there's hundreds of thousands a 
million companies out there that can benefit

0:22:43.760,0:22:49.520
by this and uh you know I would like to see that 
market explode a lot more that it has. It's just

0:22:49.520,0:22:56.880
it's a really cheap high signal low-noise solution 
that we should really use more. Okay. All right.

0:22:56.880,0:23:02.080
Cool. Now, I'd like to try something the news 
like a little lightning round. So, I'm gonna ask

0:23:02.080,0:23:06.720
uh I'll have I'll say one thing and then you 
have like two options. So, you can pick one

0:23:06.720,0:23:12.400
and then have like a one-s sentence answer. Okay. 
All right. No nuances, just the gut answer. So,

0:23:12.400,0:23:20.320
here we go. All right. Uh sock two, useful 
or theater? Theater. Okay. Annual pen test,

0:23:20.320,0:23:29.520
alive or dead? Dead. Bug bounties solved or 
broken? I don't know what you mean solved or

0:23:29.520,0:23:34.800
broken. I'm sorry. Uh let's say solved as in like 
it's it's helping security and the landscape and

0:23:34.800,0:23:40.080
everything we want it to be in apps. Broken 
means it's just a failed system that is not

0:23:40.080,0:23:48.560
helping out as a whole. Solved. I I think it's 
a uh dollar uh dollar value. That's good. Okay.

0:23:48.560,0:23:58.960
And then cyber security insurance in 2026. Buy it 
or self-insure? Buy it. CVSS scores keep or kill.

0:23:58.960,0:24:06.640
Can I do ignore? Yeah, sure. Ignore. All right. 
Uh, vibe coding. AI generated code. Net positive

0:24:06.640,0:24:14.960
or net negative for security? That's a good 
one. Net positive or net neet positive. Yeah,

0:24:14.960,0:24:22.480
I think so, too. I'm I'm having fun building 
stuff, even if it's like 50%. Okay. Uh, compliance

0:24:22.480,0:24:29.760
driven security, necessary evil or actually 
evil? Actually evil. Actually evil. Do you want

0:24:29.760,0:24:37.360
to expand on it? It's a It's a lot of time and 
energy focused on something that provably can't

0:24:37.360,0:24:46.560
work. Fair points. Pick your compliance standard. 
Any one you want. And has the adversary that goes,

0:24:46.560,0:24:54.000
"Oh my god, no. That company's PCI compliant. Like 
that's these things don't happen. That's right.

0:24:54.000,0:25:00.560
That's true. They're 82% compliant. I'm going to 
stop here. I forget what the ISO number is. Uh

0:25:00.560,0:25:06.480
we got to ignore that one. They're ISO compliant. 
Yeah. Yeah. Come on. Database is encrypted. Let's

0:25:06.480,0:25:14.240
stop here. Can't find the hardcoded credentials. 
Anyways, uh the CISO role in five years, bigger

0:25:14.240,0:25:21.120
or smaller? Uh it depends on how you mean bigger, 
but there's going to be more CESOs in the world.

0:25:21.120,0:25:27.280
Okay. All right. Excellent. Perfect. All right. 
So, let's get into uh the story time. So, now it's

0:25:27.280,0:25:31.600
going to be about you and your life and everything 
that you've been building and everything. So,

0:25:31.600,0:25:38.320
um you told me that you I discovered White Hat, 
Sentinel One, Bit Discovery. Um everyone's heard

0:25:38.320,0:25:42.800
this many of times. Uh let's go into when you 
hacked Google when you were 18 years old and

0:25:42.800,0:25:49.680
then they hired you. Uh, that was Yahoo actually. 
Yahoo. What' I say? Google, not Yahoo. Sorry. Uh,

0:25:49.680,0:25:54.000
if an 18-year-old did this today, would they get 
a job offer or do you think they get a federal

0:25:54.000,0:26:00.000
indictment? I don't think they get either. I 
think uh they're they're fill up. Um, yeah,

0:26:00.000,0:26:05.200
I think at the time I was like 19 or 20 at the 
time, I found a vulnerability in Yahoo and uh

0:26:05.200,0:26:10.320
this was like this predated Google. Google came 
later if you could imagine that. And uh the these

0:26:10.320,0:26:15.760
these days like you I don't know how many bug 
uh bounty hunters get hired by those they find

0:26:15.760,0:26:20.240
uh vaults for. I'm sure it happens. It's 
just not terribly likely these days. Yeah,

0:26:20.240,0:26:26.160
we have a whole bug bounty program. So it's 
different vibe entirely I suspect. Yeah.

0:26:26.160,0:26:31.920
Um so White Hat ran 15 years before Synops. Uh 
Sentinel one was the highest value cyber security

0:26:31.920,0:26:38.480
IPO in history. Bit discovery exited to tenable. 
Three different outcomes. What was the one thing

0:26:38.480,0:26:51.680
you tell a security founder you wish someone had 
told you before White Hat? That's a great one. Uh

0:26:51.680,0:26:56.800
I thought people that were were older and more 
experienced than me knew what they were doing.

0:26:56.800,0:27:00.960
That's funny. It's every founder I've ever spoken 
to says the same thing in security. They're like,

0:27:00.960,0:27:04.400
"Yeah, I just thought the adults knew what was 
going on." And then I started looking around.

0:27:04.400,0:27:08.720
They didn't. And I was like started to push 
my ideas and they're like actually yes it's

0:27:08.720,0:27:12.960
terrific. The ones that accepted it right there 
there's some of them I had great mentors some

0:27:12.960,0:27:19.360
helped but by and large the number of people that 
were actually helpful were very very small and

0:27:19.360,0:27:25.280
uh they they ran into two problems is that they 
only had an experience of one like they only had

0:27:25.280,0:27:32.320
one win to get to their position. So they might 
have been good, they might have been uh fortunate,

0:27:32.320,0:27:36.960
but the thing is is that they a lot of times they 
had experience from an era that was no long that

0:27:36.960,0:27:42.960
was past. They were they were created or they had 
30 years of experience about that point, but it

0:27:42.960,0:27:48.640
was really like five, you know, carried forward. 
So those are the problems that you run into at

0:27:48.640,0:27:53.600
at the end of the at the end of the day. Here's 
what everybody's got to know about this whole take

0:27:53.600,0:28:00.800
some venture grow fast is only 1% of all founders 
ventureback founders make even a dollar off their

0:28:00.800,0:28:07.120
startups. This is really hard in risk and you're 
going to have to live with your choices. So make

0:28:07.120,0:28:13.120
the choices yours not the not not the VCs. Yeah, 
that makes a lot of sense. I think I think what is

0:28:13.120,0:28:18.480
it like a they're always help hoping to unicorn 
and you have to invest in so many companies or

0:28:18.480,0:28:23.120
divide up or what is it like a build a fund with 
multiple people so that you can diversify the the

0:28:23.120,0:28:28.480
risk right yeah the there I found like because 
I I don't want to take credit for Sentinel one

0:28:28.480,0:28:32.000
I was there early but that's a different founding 
team over there those guys are really good I don't

0:28:32.000,0:28:36.320
want to take credit for their work but there's 
different types of startups there is the what I

0:28:36.320,0:28:42.240
call the kamicazi model raise as much as you 
can grow as fast as you can and really hope

0:28:42.240,0:28:46.880
that you'll get acquired before the music stops. I 
mean, that's the the whole model there. The other

0:28:46.880,0:28:53.520
one is a more uh more progressive slow growth 
option. I call it optionality where you take a

0:28:53.520,0:28:56.880
little bit of money, you grow a little bit. Take 
a little bit more money, you grow a little bit.

0:28:56.880,0:29:01.840
And that's what we did with with Bit Discovery. 
There's no right or wrong way. It's what makes the

0:29:01.840,0:29:07.280
most sense for you and that style of business. 
Okay. Um, for people that are interested in

0:29:07.280,0:29:12.640
starting in security and having their own business 
and building out a product, do you think that it's

0:29:12.640,0:29:18.160
better that they do bootstrap or take money um, 
work with any of the existing VCs? What's your

0:29:18.160,0:29:22.080
kind of initial thought and strategy there? That's 
a good that's a good question. It's I think it's

0:29:22.080,0:29:26.720
more of like a lifestyle choice you want to do, 
but I think the question starts before that. Um

0:29:26.720,0:29:32.080
what I what I try to do literally every single 
day is I try to talk with one CISO or customer

0:29:32.080,0:29:37.440
every single day and I ask them the most basic of 
questions. What is if you could snap your fingers

0:29:37.440,0:29:43.360
and remove one problem today what would it be? And 
then then I asked them the qualifying question is

0:29:43.360,0:29:48.240
you could have picked any problem why that problem 
if you solved it how would that change your day

0:29:48.240,0:29:54.160
and if you have that uh that conversation at least 
once a day every day for like a year you're going

0:29:54.160,0:29:59.520
to get find interesting themes of what problems 
to actually solve from that point now you know

0:29:59.520,0:30:04.160
what problem to solve. You really don't know the 
solution yet. Maybe the solution requires you

0:30:04.160,0:30:10.080
to dedicate two years of your life non-stop. No, 
you know, no outside paycheck. And maybe at that

0:30:10.080,0:30:15.280
point you need to take like a more kamicazi style 
approach you know to that sort of thing. Another

0:30:15.280,0:30:20.000
solution might be far more simple and you can say 
I can five code my way to this solution in six

0:30:20.000,0:30:24.960
months and maybe in that case you bootstrap it. 
So there is really no right answer. It's just look

0:30:24.960,0:30:31.760
at the problem the solution do your homework and 
then make the business choices around that. Yeah

0:30:31.760,0:30:36.480
that makes a lot of sense. Start with the why. 
Um and then as it drives you you'll be able to

0:30:36.480,0:30:40.800
figure out the answer and learn what has happened. 
what's worked and what hasn't worked through that.

0:30:40.800,0:30:45.760
I think a lot of people they start they'll see 
a product or like AI and like great now I can

0:30:45.760,0:30:50.160
build this thing not knowing if anything's like 
useful in the world for it. Don't don't do that.

0:30:50.160,0:30:55.600
And what I have found is you talk with enough of 
these customers over and over again. People want

0:30:55.600,0:31:00.720
problems solved. They want to help you and to say 
I I need your help solving this problem. I'm going

0:31:00.720,0:31:04.720
to give you some solution ideas here. Just tell 
me what you think. Be as honest as you can. I'm

0:31:04.720,0:31:08.640
going to build some product. Will you help me? You 
know, I want to try it out. And it's so, you know,

0:31:08.640,0:31:13.360
what I what I've told people in the past, I have 
nothing to sell you. My hope is with your help,

0:31:13.360,0:31:18.880
I'll have something cool to sell you that solves 
a problem tomorrow. Okay. So, uh, as you started

0:31:18.880,0:31:23.680
in many businesses, another question like I think 
a lot of technical founders, especially in cyber

0:31:23.680,0:31:26.960
security, they're really good at building the 
thing or they know exactly the product. they

0:31:26.960,0:31:34.800
know how to solve it, how to to manage it and and 
bring um you know the solution to the problem,

0:31:34.800,0:31:38.480
but maybe they're not skilled in the sales 
portion of it. So, what what's some advice

0:31:38.480,0:31:44.080
that you have for brand new people that want to 
get into uh starting a business or consultancy,

0:31:44.080,0:31:49.280
whatever it is, and they need to figure out 
exactly how to get that first sale? Yeah,

0:31:49.280,0:31:56.960
technical founders consistently have this problem. 
It is what it is. And I'm, you know, and this is a

0:31:56.960,0:32:03.040
this is an opportunity for people to improve 
really and themselves at the end of the day.

0:32:03.040,0:32:07.120
If you, let's say you get a an angel investor, 
they're not investing in the market, the product,

0:32:07.120,0:32:10.560
the problem, or anything. They're investing 
in you. You're going to have to sell yourself.

0:32:10.560,0:32:14.400
You're going to have to share with everybody 
why this problem is meaningful, why you're

0:32:14.400,0:32:20.320
going to why you're going to dedicate your life 
to this, why this customer must buy your product.

0:32:20.320,0:32:25.200
How can you expect anybody else to get excited and 
sell your product if you can't? You got to be the

0:32:25.200,0:32:31.600
first sales guy. So, I I know it's a it's a it's 
a harsh answer. Learn it. I know people are shy,

0:32:31.600,0:32:35.200
don't like speaking, you know, don't like selling, 
don't like asking for money. You're going to have

0:32:35.200,0:32:40.640
to do it. You're going to have to. Yeah, that 
makes that makes sense. All right. You said that

0:32:40.640,0:32:46.720
um founders should talk to at least three types of 
people every day. Who are they and why? Uh I try

0:32:46.720,0:32:50.640
to it's it's hard sometimes, but I try to make a 
discipline. And I've been doing this for a while.

0:32:50.640,0:32:56.800
One sales guy, one business partner, one customer, 
could be a CISO, could be an engineer every single

0:32:56.800,0:33:03.520
day. And I'll ask them the same questions. What's 
your biggest problem? Why that problem? What would

0:33:03.520,0:33:08.800
it mean to solve it? And what's getting in 
your way? Um or in the case of the sales guy,

0:33:08.800,0:33:13.040
why aren't you selling twice as much? Not to 
question their skill set, but I really want to

0:33:13.040,0:33:17.360
know is like, is it a market problem? Is it a 
collateral problem, messaging problem, product

0:33:17.360,0:33:23.600
problem? And then you have those over and over and 
over again. And you can be smart, but I just like

0:33:23.600,0:33:28.480
doing my homework. I find those themes, you know, 
over and over again. I'm trying to find the number

0:33:28.480,0:33:34.000
one problem I have to solve today. You know, I'm 
I'm not trying just to do a bunch of activity for

0:33:34.000,0:33:39.440
the sake of activity. I want to find the one 
thing that moves the needle. Okay. So you talk

0:33:39.440,0:33:43.440
to these three types of people before you decide 
exactly the problem that you want to solve or once

0:33:43.440,0:33:48.480
you have the problem solved then you go to those 
three types of people uh around your specific uh

0:33:48.480,0:33:54.080
problem. Uh I'll do it pre-comp. I'll do it while 
I'm operating the company. I'm always asking them

0:33:54.080,0:33:59.360
you know what the number one problem is you know 
like in the case of like let's say I talk with one

0:33:59.360,0:34:04.560
customer what's the number one problem today you 
know that sort of thing. Then I have to talk with

0:34:04.560,0:34:09.200
one of my sales guys, you know, like what's 
uh why whatever your ch whatever's going on,

0:34:09.200,0:34:13.120
whatever you're selling, why aren't you selling 
double? The leads are bad, the marketing sucks,

0:34:13.120,0:34:17.600
the customers don't understand me or whatever. 
And then I can once I know their world, I can

0:34:17.600,0:34:21.600
help them solve it. And the same the same kind 
of questions with a business partner, you know,

0:34:21.600,0:34:26.000
that maybe they're trying to help sell on my 
behalf and that sort of thing. So I really I want

0:34:26.000,0:34:31.440
to solve the problems that are meaningful to them. 
You mentioned business partners. What was like an

0:34:31.440,0:34:37.840
experience that you had with somebody and you said 
I want to be in business with this person? Um I

0:34:37.840,0:34:42.320
just like you know in this in in this world I like 
working with passionate people that want to solve

0:34:42.320,0:34:47.760
a problem that want to do great things and you 
know if I meet someone like let's say a business

0:34:47.760,0:34:53.280
partner where I have this like I'm going into van 
management. I want the partners that are excited

0:34:53.280,0:34:58.160
about finally solving van management. People hate 
this problem like with a passion. They hate every

0:34:58.160,0:35:03.520
venue. They hate the whole problem. They're buried 
in vans. They'll never get out from under this

0:35:03.520,0:35:08.720
uh you know this big weight, this huge backlog. 
The business in the board has no idea what they're

0:35:08.720,0:35:13.920
doing. All you say is we patched x number more 
CVE today. Yeah, but what do I get? Will we not

0:35:13.920,0:35:18.320
get hacked? Well, maybe it's a free country, you 
know, that sort of thing. Like, and so everybody

0:35:18.320,0:35:24.720
wanted this problem to go away. So, that seemed 
fascinating to me. What? Why has haven't people

0:35:24.720,0:35:29.920
in the world solved this problem yet? So I get to 
dedicate some number of years to my life to giving

0:35:29.920,0:35:37.520
it a shot. Excellent. Yeah. I'd like to um talk a 
little bit about uh your ventures. So at Grossman

0:35:37.520,0:35:43.680
Ventures now uh you're seeing pitch decks from 
every security category. What's the one type of

0:35:43.680,0:35:50.480
company that you keep funding? And what's the type 
you keep passing on even when the metrics look

0:35:50.480,0:35:55.840
great? So, uh, you know, when you're an investor, 
it's you could like the people, you can like the

0:35:55.840,0:36:00.160
idea, you can like the product, but it could be 
the valuation's off. You know, something's wrong

0:36:00.160,0:36:03.680
with the world, something's wrong with the 
customer. So, for us, we're very picky. So,

0:36:03.680,0:36:08.240
we have to get very, very specific with our thesis 
because we're not we don't operate like a normal

0:36:08.240,0:36:12.160
fund. The a normal fund will fund 10 companies 
per year because they have the bankroll to do

0:36:12.160,0:36:17.280
it. Yeah. You know, Grossman Ventures is like 
is a is a collection of cyber security experts,

0:36:17.280,0:36:23.360
maybe 40 of them, you know, together. And 
uh we we have very particular needs. We'll

0:36:23.360,0:36:27.760
make three investments per year, something 
like that. And the only reason people take

0:36:27.760,0:36:32.080
our money cuz they don't need it, is that we can 
be helpful to them in a way that the average VC

0:36:32.080,0:36:38.080
uh can't. So the ones that we like, what we 
focus on is companies that are very early where

0:36:38.080,0:36:44.320
the teams have found the problem organically. 
It's personal to them. They want to solve this

0:36:44.320,0:36:49.360
problem no matter no matter what. They didn't say 
I want to do a company. Let's find a problem. No,

0:36:49.360,0:36:54.480
they found the problem at their job. They quit to 
solve this problem. We like that because running

0:36:54.480,0:36:58.640
a startup is impossibly hard. If you're not 
passionate about it, it's just never going to work

0:36:58.640,0:37:05.680
no matter how good the idea. The the second uh the 
second criteria is that there's lots of ones that

0:37:05.680,0:37:11.040
uh help reduce risk of breach and things like 
that. We like to focus on the ones that reduce

0:37:11.040,0:37:16.640
the odds of financial loss, not necessarily 
breach. It's a subtle but important distinction

0:37:16.640,0:37:23.360
uh for us. the ones that we think could result in 
lowering of financial loss because we like ROI,

0:37:23.360,0:37:28.960
right? And when those two things happen and then 
we like the team, we like the product or approach,

0:37:28.960,0:37:32.320
then that's going to be a good buy and good 
things are going to happen. So like for instance,

0:37:32.320,0:37:36.160
we made three investments last year. One was 
in Rude Evidence, the one that we're running.

0:37:36.160,0:37:44.320
The other two already got acquired. So yeah, I 
when I spoke with um Avivic of uh Square Yeah.

0:37:44.320,0:37:49.680
Square. Square. Yeah. Yeah. the other I think he 
was on episode four or five. So yeah, we had him

0:37:49.680,0:37:55.120
on here when he was Yeah. getting money from you 
guys. So it's super cool how that circle backed

0:37:55.120,0:37:59.920
and we get chat with you now. Yeah. Um you know 
we're going to be different from VCs also normal

0:37:59.920,0:38:05.280
VCs because we actually know cyber security. Most 
of them don't. So I met Vivec I understood how he

0:38:05.280,0:38:10.160
solved the problem. We knew the problem he was 
solving intimately well from our background. We

0:38:10.160,0:38:15.680
saw how he was going after it. Um how he was going 
to market. We're like okay this is an easy yes.

0:38:15.680,0:38:20.960
Let's do this. So, did you know that the 
acquisition was going to happen so quickly? No,

0:38:20.960,0:38:25.840
actually, it's it was in this way unfortunate 
for us that it did because we would like for

0:38:25.840,0:38:31.200
it to grow in value. So, we had a great win. It's 
not a it's a great outcome, but I would have liked

0:38:31.200,0:38:37.120
for it to be a five-year investment to to have a 
bigger upside, but you know, the VIC did great, so

0:38:37.120,0:38:42.640
I'm not going to begrudge him in the least. He did 
great. That's amazing. Okay. Yeah. And then um in

0:38:42.640,0:38:47.040
Mutual Friends and stuff like that, you also know 
Jordan Wines, correct? Yeah. Um I haven't that's

0:38:47.040,0:38:51.520
a name I haven't heard in a long time. I Yeah, 
we we had a great time a long time ago. Yeah,

0:38:51.520,0:38:58.160
he's um Did you guys you guys were at Defcon? Was 
that how you guys had met previously? No, he was

0:38:58.160,0:39:02.240
uh I think he was at I think it was University 
of Florida years ago. Florida. Yeah. Okay. Were

0:39:02.240,0:39:06.880
you there, too? No. No, I was running Whitehead 
at the time and he was he was pretending to be a

0:39:06.880,0:39:11.360
journalist. So, he would interview me for apps 
stuff. So I'm like and I knew what he could do

0:39:11.360,0:39:15.680
and I'm like you're a journalist. They don't ask 
questions like this and so we just became friends

0:39:15.680,0:39:20.800
over this over over the years. Nice. Nice. Yeah. 
I think Yeah. You mentioned the the interviews in

0:39:20.800,0:39:29.200
uh episode one. He's my first guy. Yeah. Yeah. 
Cool. Cool. All right. So um what's a problem

0:39:29.200,0:39:34.400
in security you'd start a company around tomorrow 
if you weren't doing the current company with root

0:39:34.400,0:39:43.440
evidence? Uh come um yeah I'll give some ideas. I 
like anything that detects breaches you know like

0:39:43.440,0:39:49.120
a canary. I think there's a lot of innovation left 
to do in canaries and both deployment managing and

0:39:49.120,0:39:52.800
all that sort of stuff. There could be lots of 
different approaches to it. I you know again I

0:39:52.800,0:39:58.400
love the thinks guys a lot but I think there's 
much more to be done there. Um I think there's

0:39:58.400,0:40:03.440
lots more to be done in MDR. You know, one of 
the companies that we invested in last year,

0:40:03.440,0:40:11.440
uh, Wire Speed got acquired by Coalition and, um, 
more cost-effective MDR that just works. That was

0:40:11.440,0:40:18.560
a great one. There's lots more opportunity in MDR 
out there for the right solution. Um, and then,

0:40:18.560,0:40:22.400
uh, did you say you invested in them last 
year and they already got acquired? Yeah,

0:40:22.400,0:40:25.920
it was like a six-month investment, ninemonth 
investment, something like that. Dude,

0:40:25.920,0:40:32.960
like is this this can't be common in the VC world? 
No, it's it doesn't happen. It's crazy. Wow. Um,

0:40:32.960,0:40:37.040
you know, it in in those cases we're probably just 
lucky. I mean, we knew what we were looking for.

0:40:37.040,0:40:41.760
The founders are good. We knew the problems really 
well and they got picked up really quick. Um,

0:40:41.760,0:40:45.600
right now we we look at a ton of companies 
this year. We made uh we made an investment

0:40:45.600,0:40:49.760
this year. Um, we haven't yet announced it yet. 
We're pretty jazzed about one that we made,

0:40:49.760,0:40:54.240
but we're looking for others and we're extremely 
picky. So, we have to say no to lots of really

0:40:54.240,0:40:58.080
good guys with really good companies, but for 
whatever reason, it's just not a match for us

0:40:58.080,0:41:02.960
because we want to be very specific. Um, we don't 
we don't have the luxury like the other VCs of

0:41:02.960,0:41:10.160
being wrong eight times out of 10. So, when we 
pick a bet, it has to pay off. Got it. You know,

0:41:10.160,0:41:13.760
maybe now maybe it's a good time to if you want 
to say like what are some of the companies that

0:41:13.760,0:41:19.920
you're looking for or happy to, you know, take on 
or or at least have a conversation about? Uh, you

0:41:19.920,0:41:23.360
mean the name or like the types of companies? Not 
names, types of company. Yeah. Yeah. Types. Oh,

0:41:23.360,0:41:28.640
yeah. Just anything that focuses on financial 
loss. I want to hear like look at how the

0:41:28.640,0:41:34.000
adversaries are breaking in. Look at where the lo 
the financial losses are coming from and anything

0:41:34.000,0:41:40.960
that counteracts that is huge. It's huge. We have 
tons of fraud. Um business email compromise is

0:41:40.960,0:41:46.160
still rampant. Um you know that the sort of thing 
just look at where the losses are coming from. Not

0:41:46.160,0:41:52.800
the breaches, the losses and find ways to uh to 
take that down. And then another question. And

0:41:52.800,0:41:57.840
so do you guys focus on specific products of uh 
products rather than service-based companies or

0:41:57.840,0:42:04.000
you do either or? Uh if the solution solves the 
problem, we do like scale. So like for instance

0:42:04.000,0:42:09.200
um you know you have to think of VC as just 
putting fuel on a fire. The company has has an

0:42:09.200,0:42:14.640
idea and you throw money on it whether it's sales 
or product development and it just goes faster.

0:42:14.640,0:42:21.600
It's just fuel on a burning fire. So there's 
certain style of companies you know whether it's

0:42:21.600,0:42:28.160
SAS or product I don't think we have a a great 
preference there only that with our help the

0:42:28.160,0:42:33.040
company will grow really really fast one day and 
we'll get acquired to go IPO one day that's good

0:42:33.040,0:42:40.480
enough for us. Okay. What separates a security 
service firm that grows from 1 to 10 million from

0:42:40.480,0:42:47.040
one that stalls out at half a million? Uh that's 
a good question. Sometimes it's a market problem,

0:42:47.040,0:42:51.040
sometimes it's a solution problem, sometimes 
the company is designed wrong. A lot of times

0:42:51.040,0:42:56.000
companies will have to grow, they'll have a ratio 
for number of customers to employees, you know,

0:42:56.000,0:43:00.800
they don't grow with pure software, you know, 
whether it's SAS or product and things like that.

0:43:00.800,0:43:06.000
So that's that slows things down a bit. Sometimes 
the market just isn't that big. I got I got hit by

0:43:06.000,0:43:10.160
that in NABSC back in the early days. I probably 
could have started White Hat 5 10 years after when

0:43:10.160,0:43:16.560
I did and done just as well. Um so you know market 
timing is an issue you know things like that but

0:43:16.560,0:43:21.040
there in that way there's two different types of 
companies there's the companies that you go into a

0:43:21.040,0:43:26.720
nasonent market that doesn't really exist and you 
evangelize that has the benefit of that there's

0:43:26.720,0:43:31.280
no real competitors or these strong ones big 
behemoths that you have to take on but you have

0:43:31.280,0:43:36.800
to get the market to justify brand new spend in 
budget so that's that's a tall mountain to climb

0:43:36.800,0:43:42.320
then you can go into an existing market that I 
did with Sentinel 1 uh into antivirus at the time

0:43:42.320,0:43:48.240
that became EDR and we're up against Semantic and 
McAfee. So, tons of money everywhere, but you have

0:43:48.240,0:43:52.960
to you have to slay the giants. So, it's just a 
different strategy and which one do you want to

0:43:52.960,0:43:58.160
take on, you know? So, Van Management, I'm going 
into like one of the oldest unsexiest established

0:43:58.160,0:44:05.440
spaces with three behemoth companies and what can 
we do, you know? So, I I know no one thinks uh

0:44:05.440,0:44:10.480
management is solved. Everybody wants some new way 
to think about this and no one likes any of the

0:44:10.480,0:44:14.240
products that are out there. So, it seemed to us 
it was a good opportunity to create something new

0:44:14.240,0:44:19.840
in the world that people liked. Yeah. Yeah. And 
talking about slaying the dra the the giant or the

0:44:19.840,0:44:24.640
dragon right now in the world of AI, do you guys 
see a lot of people that are presenting you guys

0:44:24.640,0:44:29.200
with different types of AI agents or ideas and 
stuff like this? Yeah, all the time. Um Yeah, all

0:44:29.200,0:44:34.000
the time. And sometimes it makes sense, sometimes 
it doesn't. um the one we just funded a few weeks

0:44:34.000,0:44:38.640
ago that we'll hopefully we'll announce within the 
next month or something like that. Um we're we're

0:44:38.640,0:44:44.480
already helping them but uh they're AI based. Um 
the challenge with the AI AI ones is everybody's

0:44:44.480,0:44:50.400
using the same models models and and what we look 
at with AI companies is that imagine if one starts

0:44:50.400,0:44:55.840
to get traction you and and everybody sees it you 
could vive code and copy that thing because they

0:44:55.840,0:45:03.280
have the same models. It's very easy to copy a 
working AI company. So where's the moat? The now

0:45:03.280,0:45:08.880
a lot of really powerful AI companies have no 
moat but they have momentum and traction which

0:45:08.880,0:45:14.640
is fine but we like the ones that where they they 
model the training data is based upon proprietary

0:45:14.640,0:45:20.880
data that no one has. So we have to we we like to 
find those. It's just because they don't have it.

0:45:20.880,0:45:25.920
It's not an automatic no but they have to have 
something else that makes them competitive for

0:45:25.920,0:45:34.480
and durable for a longer term. Yeah, that makes 
sense. Okay. Oh. Um, so let's see. Uh, it looks

0:45:34.480,0:45:39.920
like Are you at Toy Box right now? Is that the 
background behind you? Yeah. Nice. So, for my for

0:45:39.920,0:45:47.040
the viewers, it's a luxury car club in Boise. Um, 
from infosc founder to luxury car club owner. Um,

0:45:47.040,0:45:53.680
what's your through line and how does running a 
club of car people compare to running a security

0:45:53.680,0:46:02.240
company? One has nothing to do with the other. 
Um, so, uh, I've I've always been into cars. Um,

0:46:02.240,0:46:07.040
I've only somewhat recently had enough, uh, 
capital and, you know, having paid for my life

0:46:07.040,0:46:12.160
and everything so I can afford cars. So, what 
happened was I bought a lot of cars. And what I

0:46:12.160,0:46:16.960
really needed was like a three-bedroom house with 
a 20 car garage, but they don't make those. So,

0:46:16.960,0:46:20.720
I thought, you know what? I really need a place 
to hang out since I work from home like a lot of

0:46:20.720,0:46:26.000
people do. How about I just make a car club for 
people with the same problem as I do so we have

0:46:26.000,0:46:31.440
a cool place to work and we can park our cars so 
we could buy more of them and this place happened.

0:46:31.440,0:46:37.120
Nice. And then yeah, go ahead. So yeah, so I I you 
know it's managed. I don't I don't spend a lot of

0:46:37.120,0:46:42.160
uh time operating this particular business. 
I I spend time on on the tech companies. I

0:46:42.160,0:46:47.760
just wanted this one to exist. This one's it's 
fun to have. Yeah. Yeah. Did you pick did you

0:46:47.760,0:46:53.280
pick Boise for a specific reason while a lot of 
the VCs are here in uh Silicon Valley? Um we've

0:46:53.280,0:46:59.920
been uh you know my team and I we've been working 
remotely to each other for uh 15 20 years now. So

0:46:59.920,0:47:05.200
we could be anywhere. In fact, I don't think many 
of us have ever lived nearby each other. So, um,

0:47:05.200,0:47:12.080
what happened was a long time ago, um, I was I was 
I grew up in Maui, and that's where I was spending

0:47:12.080,0:47:18.080
the last, uh, 10 years. And I bought a second 
home in Boise, so I could be near California,

0:47:18.080,0:47:23.120
could travel there, but not have to live in 
California. And, uh, we bought a house, visited

0:47:23.120,0:47:28.240
it, and the pandemic broke out and we couldn't go 
home. They canceled air travel back to Hawaii for

0:47:28.240,0:47:33.840
weeks and months. And we looked around and said, 
"We'd like it here." So, we stayed. So, I moved

0:47:33.840,0:47:41.360
by accident. Okay. Nice. Nice. And then, um, let 
me ask you about this. So, you're a black belt in

0:47:41.360,0:47:47.840
jiu-jitsu. You host cyber security BJJ smackdown 
every year at Black Hat with, uh, Forest Griffin

0:47:47.840,0:47:54.080
uh, showing up. What is what has jiu-jitsu taught 
you about Averia thinking that's the security

0:47:54.080,0:48:00.640
industry hasn't figured out yet? You know, I I 
you know, I could make up things in the class.

0:48:01.360,0:48:07.600
But but I don't look at it like that. I like it 
cuz it's like we work behind a computer. We make

0:48:07.600,0:48:14.080
money every day and and life's, you know, easy in 
this way. So jiu-jitsu is very cerebral. I like

0:48:14.080,0:48:19.840
it. It's very hard physically. It's it tests 
your emotions. I just like it for that reason

0:48:19.840,0:48:25.920
that there's a person there that I'm trying to 
exert my will over and they're my and they're

0:48:25.920,0:48:30.400
trying to do the same thing to me. And it's 
it's just honest in that way. It's not forms.

0:48:30.400,0:48:36.640
It's not kata. They tapped or they did it. It's 
it's honest. I like it cuz it's it's hard. It's

0:48:36.640,0:48:42.240
very deep. There's a lot to learn and it's just 
honest. I just like it. What at what age did

0:48:42.240,0:48:54.000
you start? Uh jiu-jitsu. I think 24 26 something 
like that. Okay. I started at 33 32. So well uh

0:48:54.000,0:48:59.280
I think when I was 16 I started you know Hawaii. 
You you fight a lot coming from Hawaii. So, I was

0:48:59.280,0:49:05.200
uh did kickboxing for many years and then uh you 
know, I lived in Silicon Valley for a lot of years

0:49:05.200,0:49:08.880
and that's where I picked up jiu-jitsu because 
UFC was just getting started at that point. So,

0:49:08.880,0:49:15.680
that was pretty awesome. And uh and then I've 
been doing mostly jiu-jitsu, but MMA and Muay Thai

0:49:15.680,0:49:22.720
as well. So, you know, it's just it's just all 
fun. Yeah. Yeah. I can I I relate to that. like

0:49:22.720,0:49:28.320
uh after work I'll go to jiu-jitsu and like I'm 
white belt still so like I just I I get used to

0:49:28.320,0:49:33.680
just sucking and it's like yeah I I suck. I'm 
horrible at this but every day you get a little

0:49:33.680,0:49:38.720
bit better and it's like all right I kind of know 
how to do this. I'll I'll revisit this once we you

0:49:38.720,0:49:43.600
know do this technique either live or you know in 
a year and a half when we retach this again. But

0:49:43.600,0:49:47.920
it's just it feels good when and you sometimes 
you can't notice that you're growing and other

0:49:47.920,0:49:52.640
people like no you're you're doing well and it's 
like well I still feel like [ __ ] so like I suck.

0:49:52.640,0:49:58.480
But I it starts to once you it's just one of those 
things you just keep doing and the more the longer

0:49:58.480,0:50:03.840
you do it you're going to see improvements if not 
in yourself once the newer students come in and

0:50:03.840,0:50:07.840
they don't know what they're doing and you know 
exactly what to do. You're like or maybe more or

0:50:07.840,0:50:11.360
less what to do then you're like oh I definitely 
know I shouldn't be doing what you're doing right

0:50:11.360,0:50:16.960
now. and then like let me teach you. That's that's 
that's how you know right there because with your

0:50:16.960,0:50:20.400
training partners, you kind of get better at the 
same level. So there's no point of reference. You

0:50:20.400,0:50:26.080
don't get the point of reference until a new 
someone new comes in or you compete. So yeah,

0:50:26.080,0:50:30.320
especially in competition. Yeah. Yeah. I I 
like it. And uh you know, you develop some

0:50:30.320,0:50:34.800
real friendship. So you know, like you know, like 
it's about as close and personal as you can get

0:50:34.800,0:50:39.120
to someone right there when you're fighting them 
like that. Yeah. When they're literally sweating

0:50:39.120,0:50:44.320
on you. Yeah. Uh yeah and it's like it's fun it's 
great because it's like it's it's a lot of just

0:50:44.320,0:50:48.080
different walks of life of people that that come 
around to security and stuff like that and it's

0:50:48.080,0:50:52.240
just a it's fun and networking. I'm happy that you 
made something for cyber security. So I definitely

0:50:52.240,0:50:57.120
want to come and check that out. Please actually 
you know how it started was is that um you know

0:50:57.120,0:51:02.560
in the industry you know at conferences everybody 
goes out uh at night you know drinking and in bars

0:51:02.560,0:51:06.960
and I don't I don't drink. I don't you know it's 
nothing against it. I just don't like it. I would

0:51:06.960,0:51:11.920
prefer to go do jiu-jitsu. So I started going 
out to jiu-jitsu at night during conferences and

0:51:11.920,0:51:16.080
someone saw me what I was doing and one person 
came and the next year another person came and

0:51:16.080,0:51:21.520
all a sudden there was 15 years later there's a 
huge event with professional UFC fighters. So I

0:51:21.520,0:51:28.000
it's pretty spectacular that I get to do these 
things. Yeah. Yeah. That's amazing. I've I was I

0:51:28.000,0:51:34.320
think I started Defcon in 20 in Defcon 21. So it's 
been over a decade at this point. And when I was

0:51:34.320,0:51:37.600
going younger I was like yeah let's party let's 
have fun. Now that I'm older, I'm like, I don't

0:51:37.600,0:51:41.200
I don't really want to do that anymore. I really 
care about my health. Maybe I'll go for a run, as

0:51:41.200,0:51:46.480
sane as that sounds, that's super Vegas heat and 
or like I want to go work out. I think I went to a

0:51:46.480,0:51:52.960
a I think I went to what was it? Um Offensive Con 
in Berlin. And then like this on the second day

0:51:52.960,0:51:57.520
I went to like one of their gyms and did a sauna 
and I was like and then I went to the conference

0:51:57.520,0:52:01.680
afterwards. I'm like I feel amazing and everyone's 
like feeling hung over and everything. So yeah,

0:52:01.680,0:52:05.600
I mean there there's a lot of like-minded people 
around. I saw Defcon, like Defcon, they have

0:52:05.600,0:52:11.600
people that do uh cycling, soccer, and all sorts 
of things like that. It it it doesn't have to be

0:52:11.600,0:52:15.680
a drinking culture. If you're not into that sort 
of thing, there's other things you can do. Yeah.

0:52:15.680,0:52:19.280
I I think I think it's always been pushed out 
as a drinking culture type thing, and it's like

0:52:19.280,0:52:24.240
uh it's different. And Defcon has itself has 
changed significantly. Have you or have you been

0:52:24.240,0:52:30.160
there at the convention center as of recent in the 
past few years? Uh no, I have not. Um, I think my

0:52:30.160,0:52:34.240
first Defcon was like six or seven way back in 
the day when I was at some at place called the

0:52:34.240,0:52:42.080
Alexis Park. Yeah. Yeah. And uh, so I I go there 
every couple of years or so like that just to see

0:52:42.080,0:52:46.240
the sites and have fun. The fact of the matter is 
Vegas gets on my nerves and by the end of Black

0:52:46.240,0:52:51.200
Hut because I've been at Blackout like three, four 
days and I'm like spent on Vegas going going to

0:52:51.200,0:52:55.920
another security conference. Even it's freaking 
cool. I love Defcon. I just can't stand any more

0:52:55.920,0:53:00.800
Vegas. Yeah, that's fair. I think everyone after 
three days of Vegas, they're just tired of it. And

0:53:00.800,0:53:04.640
especially if you're going annually every single 
year, at a certain point, you're just like, uh,

0:53:04.640,0:53:10.800
every time everyone's like, "Oh, we're going to go 
to Vegas." I was just fine. Well, you know what?

0:53:10.800,0:53:15.280
You take them up on their offer and go to some of 
the gyms. Go to go to Syndicate with Forest. Go to

0:53:15.280,0:53:21.040
Extreme Couture. Go see Randy, you know. You know, 
so there's amazingly good gyms there. And then

0:53:21.040,0:53:28.400
and you know, take if you're into jiu-jitsu, go do 
that. Yeah, definitely. I yeah I trained I started

0:53:28.400,0:53:36.560
in uh Colombia is where I started at uh Gracie Bar 
there in Medin and then I did I went to Italy. I

0:53:36.560,0:53:43.680
was living there for about two years. So I also 
trained there and it was the it was and then I I

0:53:43.680,0:53:46.400
came to the back back to the United States and I 
was training here. I'm originally from the United

0:53:46.400,0:53:50.480
States from California Bay Area. Um, but when 
I started the whole class was in Spanish and

0:53:50.480,0:53:55.520
I like kind of like you know second grade Spanish 
or second year high school Spanish and then Italy

0:53:55.520,0:53:58.640
it's all in Italian. I'm just like trying to 
like translate that and then I finally here

0:53:58.640,0:54:04.480
I can actually ask my questions of like okay why 
do I need to be in this position? Why uh you know

0:54:04.480,0:54:09.440
does tripping help here versus not and like why is 
this and like before I was just I tried to ask and

0:54:09.440,0:54:13.680
they they couldn't tell me and I'm like I have to 
like look it up and stuff. It it probably is even

0:54:13.680,0:54:22.480
harder than uh trying to work your way through 
the uh the Brazilian accent, I'm sure. Yeah. Yeah.

0:54:22.480,0:54:27.680
When you travel, do you also do you also bring a 
gate with you? Oh, yeah. Yeah. I've uh I've been

0:54:27.680,0:54:33.760
doing that for 20 years. Um I've been literally 
been to quite literally 100mmies around the world.

0:54:33.760,0:54:37.920
It's been awesome. Excellent. Excellent. What are 
some of your favorite ones that you've been to and

0:54:37.920,0:54:45.920
why? Um, a long time ago I was at uh before they 
were them. I was I took a class at uh with Henzo

0:54:45.920,0:54:50.960
Gracie when he was with uh uh John Danaher. I 
took a class in New York with Danaher before

0:54:50.960,0:54:56.880
Danaher was Danaher. So that was pretty awesome. I 
I got same uh area. Uh I got to train with Marcelo

0:54:56.880,0:55:05.440
Garcia. Um I was in Torrance for a while. I got to 
train with uh um what's his name? Um Hener Gracie.

0:55:05.440,0:55:10.320
I got to train with Hixon and another place over 
there, you know. So, just a lot of just, you know,

0:55:10.320,0:55:15.920
legends of our sport that were just really, really 
fun. You know, I was up in San Francisco. I It's

0:55:15.920,0:55:24.000
on my uh my Instagram channel training with uh 
uh Nick Diaz and Jake Shields and those guys. So,

0:55:24.000,0:55:27.440
you know, I lived in San Jose for a lot of 
years, so a lot of good fighters came out of

0:55:27.440,0:55:32.960
there. I took a wrestling class with Dan Daniel 
Cormier once. Just we get to do cool stuff with

0:55:32.960,0:55:37.760
Nice. Yeah, I think Royy's Gracie is coming out 
here sometime next month and he has a seminar.

0:55:37.760,0:55:41.840
Do you think it's worth it to go? I'm at the 
point I I don't know if it's like well I'll be

0:55:41.840,0:55:47.520
one of like maybe 100 students, but it could be 
a fun experience. I I really don't know. Um yes,

0:55:47.520,0:55:52.400
I think it would be. Um mostly because it's 
like it takes and usually seminars are about 2,

0:55:52.400,0:55:57.200
three hours. So you get to dedicate two three 
hours of focus during your day just on getting

0:55:57.200,0:56:01.600
better at jiu-jitsu. You know, learning the 
techniques, finding those little things. You'll

0:56:01.600,0:56:06.240
meet new you'll meet new people. I think it just 
keeps your keeps your passion up. And the other

0:56:06.240,0:56:13.600
one's opportunity. Let's say you didn't go. What 
would you be doing? Yeah. Nothing. Right. So go.

0:56:13.600,0:56:17.760
That's true. That's like the book uh or that thing 
that's like just just say yes. It's like yeah,

0:56:17.760,0:56:22.800
if you got to go out and just go do that rather 
than saying, "Yeah, I trained this morning. I

0:56:22.800,0:56:28.560
have uh nothing to do later, so I'll probably 
do jiu-jitsu or weight train or something like

0:56:28.560,0:56:34.720
that." Yeah. Good. It's good. How often do you 
gym? Uh, weight training versus jiu-jitsu. Um,

0:56:34.720,0:56:38.880
I started to get a little bit older, so my 
body was breaking out. I was getting like sore

0:56:38.880,0:56:43.360
sore and different things. So, for longevity, I 
started a strength and conditioning specifically

0:56:43.360,0:56:47.360
for grappling. So, I've been doing that for a 
number of years now. So, I do that four days

0:56:47.360,0:56:52.640
a week and I do about three maybe four jiu-jitsu 
classes a week. Okay. About eight. So, it's that's

0:56:52.640,0:57:00.000
about the limit of what my body can physically 
tolerate. Okay. Nice. Nice. Nice. Nice. All right.

0:57:00.640,0:57:06.400
So, uh, another section I like to do is ask for 
book recommendations. So, uh, one for first-time

0:57:06.400,0:57:11.920
founders, one for CISOs, and then one that has 
nothing to do with work or anything else. Oh,

0:57:11.920,0:57:20.720
first time founders. I'd have to like look 
through my library. That one's difficult. I don't

0:57:20.720,0:57:29.120
I I wouldn't I couldn't even begin. Napoleon 
Hill. Um, I lean startup. I kind of No, no,

0:57:29.120,0:57:35.280
no. Absolutely not. No, no. All those are fine 
books, but that's not what I would recommend.

0:57:35.280,0:57:39.840
Sure. Yeah. Um, yeah, take your time if you want 
to look it up. I'm I'm I'd rather have a strong

0:57:39.840,0:57:50.480
answer than like something just just mentally 
on the top of your head. Um, let's see. Uh,

0:57:50.480,0:57:55.920
man, uh, you know, I really couldn't give a 
strong book recommendation in those areas.

0:57:55.920,0:58:02.160
It's read them. It's good educ education. Um, but 
I read books all the time. Just I read different

0:58:02.160,0:58:07.360
books whether it's like the alchemist and 
I just got done Oh yeah. Good. Good. Um,

0:58:07.360,0:58:12.320
heads in beds. It's like if you read Kitchen Con 
confidential for Anthony Bourdain, there's one for

0:58:12.320,0:58:18.880
uh hotel concierge that I found was pretty 
pretty hilarious. Yeah. Interesting. Um, and

0:58:18.880,0:58:23.520
the uh the one I picked up now, I don't know what 
to get. I don't know what to make of it. It's a

0:58:23.520,0:58:28.560
um meditations. It's like the the collection of 
works by Marcus Aurelius. And see what he Yeah.

0:58:28.560,0:58:35.360
Yeah. Yeah. You know, see what he has to say 
there. Is it meditations? Is that the the No,

0:58:35.360,0:58:40.400
the art is No, the the obstacle is the way was 
another book I was recommended that I read is

0:58:40.400,0:58:45.840
also by Marcus. It's really good. Yeah. So, 
I've just looking forward to those. You know,

0:58:45.840,0:58:50.720
I there's plenty of how-tos online. You don't 
you know, if you want to read the startup books,

0:58:50.720,0:58:57.120
completely cool. Nothing wrong with it. But I read 
for the fun of learning stuff. I want to I want

0:58:57.120,0:59:02.320
to know things. Yeah. Are you learning more how 
to books as of recent? Are you learning more uh

0:59:02.320,0:59:10.000
books about people's experiences in walks of lives 
that you have not walked yet? Um I'd read a lot of

0:59:10.000,0:59:15.920
all kinds of diverse things. I'll read religious 
texts and philosophy and science and all all sorts

0:59:15.920,0:59:20.720
of things. I'll read fiction like you know like I 
mentioned the alchemist and things like that. It's

0:59:20.720,0:59:25.840
whatever I pick up that particular day on a flight 
or something like that. It could be an audio book,

0:59:25.840,0:59:32.080
but not, you know, not not really. Um, I think 
for most of the tech stuff to get to keep up,

0:59:32.080,0:59:37.440
blogs and white papers and reports and social 
media usually keeps me pretty fresh. Every once

0:59:37.440,0:59:42.320
in a while I might need to read a tech book. Um, 
the other thing I like is certain podcasts. Like

0:59:42.320,0:59:50.000
I like Planet Money a lot. Um, and from that I 
get ideas on different stories about businesses

0:59:50.000,0:59:55.120
that have succeeded or failed in the past and 
why I like studying businesses like the history

0:59:55.120,0:59:59.840
of Coca-Cola, you know, that was interesting, 
that particular brand. I come from Idaho, so

0:59:59.840,1:00:05.840
I read the story about how the potato farmers out 
here uh cornered the futures market from Chicago,

1:00:05.840,1:00:12.080
you know, so that was pretty wild, you know. 
So, I'll read things like that. Um, but I just

1:00:12.080,1:00:18.960
I like learning stuff. So, usually like a well 
well to bring it back to martial arts, you know,

1:00:18.960,1:00:22.800
if you just know jiu-jitsu, you're going to lose 
a fight over someone that's wellrounded. So,

1:00:22.800,1:00:27.680
I like being wellrounded in my education. Yeah. 
Well, that makes a lot of sense. And I think where

1:00:27.680,1:00:33.120
I'm the weakest now is I'm probably the weakest 
on AI. You know, I don't I I kind of know how

1:00:33.120,1:00:38.320
to use it. I know have no idea how it's made. 
You know, the terms are still baffling to me.

1:00:38.320,1:00:42.480
You know, I have no idea why they named the 
models after Pokemon characters. It's such

1:00:43.840,1:00:51.520
So, I'm still I'm learning to learn a lot more 
about that. Yeah. Interesting. Yeah. I I've been

1:00:51.520,1:00:56.800
what have I been reading recently? I I read also 
like true crime cyber security ones. I've I've

1:00:56.800,1:01:06.560
dabbled in somebody recommended one, so I did, 
but um yeah, we got Okay. All right. Yeah. All

1:01:06.560,1:01:11.200
right. So, uh what's the most excited What are 
you most excited about over the next five years

1:01:11.200,1:01:17.840
in security? own work and your own life. Uh 
five years in security. I'm uh I'm dedicating

1:01:17.840,1:01:22.480
my security life to this particular company 
and solving this this one particular problem

1:01:22.480,1:01:29.600
because imagine if 30% of the breaches that cause 
financial loss are owed to van management. Wiping

1:01:29.600,1:01:36.240
out onethird would be a huge needle mover. I 
like that one. And you know one of the pieces

1:01:36.240,1:01:40.960
of tech that we get to build is just like we did 
at Bit Discovery. We get to download a copy of

1:01:40.960,1:01:45.280
the internet and assign ownership to every asset 
on the internet. We get to know more about what's

1:01:45.280,1:01:52.800
going on the internet than anybody. So like I 
like that part a lot, the tech part of it. Um

1:01:52.800,1:01:59.600
so you said life in general. Yeah. Yeah. Work and 
life. Yeah. Uh you know, so I get to do that sort

1:01:59.600,1:02:04.400
of work. I get to work with brilliant people. 
I get to talk to customers all the time. So,

1:02:04.400,1:02:09.680
and I I get to go to Black Hat and do, you know, 
cool things like that and run a jiu-jitsu event.

1:02:09.680,1:02:14.560
And then in life in general, I guess when I'm not 
doing that, I get to drive uh drive cool cars,

1:02:14.560,1:02:19.520
do martial arts. So, that's pretty awesome. And 
uh like I like we mentioned earlier, I'm going to

1:02:19.520,1:02:25.680
go try to compete at Worlds in September after a 
black hat. So, yeah. So, Got it. Life is never a

1:02:25.680,1:02:32.160
dull moment. Have you competed at Worlds before? 
I did. And I I I accompanied a friend of mine uh

1:02:32.160,1:02:38.480
uh down to the Worlds last year. He was a purple 
belt and he won Worlds as a purple belt and I was

1:02:38.480,1:02:44.800
like so inspired and I was like just jazzed. 
I'm like, "Okay, okay, fine. I'll do it." So,

1:02:44.800,1:02:49.840
um I competed once this year cuz I'll I'll try 
to get better. I'll try to get more in shape and

1:02:49.840,1:02:54.400
everything, but I think, you know, for me to do 
well, I just have to get my mind right. So, the la

1:02:54.400,1:02:59.920
the last tournament uh I was in, I I fought just 
one guy. He was like five-time national champ. Um,

1:02:59.920,1:03:05.360
very tough, very tough guy. Um, I lost in like the 
last three seconds by two points. I didn't tapped

1:03:05.360,1:03:12.080
or anything like that. But what I what I learned 
from it is you fight like you train. I wasn't

1:03:12.080,1:03:16.720
fighting him. I was sparring with him. And I was 
really disappointed at myself afterwards. So,

1:03:16.720,1:03:22.320
I'm telling my training partners, I'm you're 
gonna fight me. Yeah. So, I'm not going out

1:03:22.320,1:03:28.000
like that again. I'm I'm gonna go there to fight. 
So, yeah. Yeah, I have a story off of that one,

1:03:28.000,1:03:33.200
I think. So, yeah, I said I competed last weekend, 
uh, yesterday, literally, and then two weeks ago,

1:03:33.200,1:03:42.160
I also competed at BJJ tour and, uh, for that one, 
I it was two people in my bracket. I I fought the

1:03:42.160,1:03:47.760
first person and I I was submitting him and then 
he like he's about to tap. I was like, "Come on,

1:03:47.760,1:03:52.640
do it, do it, do it." And he he tapped and I let 
go. And then the ref came by was like just looking

1:03:52.640,1:03:56.880
at both of us because the the ref didn't call 
it. And I was like, "Oh my god, no." Like I did

1:03:56.880,1:04:00.960
I just I accidentally tapped too early and like 
because that's how you do when you're training,

1:04:00.960,1:04:05.040
right? So I just I thought like, "Oh, it's like 
when you're training." So I looked at I was like

1:04:05.040,1:04:08.480
staring at the guy. I'm like, "Say say you lost. 
Say you lost, bro." In my head. And he's like,

1:04:08.480,1:04:14.400
"Oh yeah, I lost." I was like, "Oh my god." 
I guess next time you take him unconscious.

1:04:14.400,1:04:18.960
Yeah. I just got to hold him like, "Yo, Raph, he's 
turning blue." Yeah. Or something. I don't know.

1:04:18.960,1:04:26.160
But uh yeah, I think that's also super true. I 
mean, I think we only have like one comp day and

1:04:26.160,1:04:31.280
uh even then I'm I'm probably being too soft 
and stuff like that and like at least as for

1:04:31.280,1:04:34.880
sparring and stuff like that. Yeah, I I like the 
people I I work with and stuff like that. Some

1:04:34.880,1:04:38.800
of them I'm a little bit bigger than and I don't 
want to actually like hurt them or take them down

1:04:38.800,1:04:44.320
like aggressively, but um but I like what you 
said about doing uh being well-rounded. We do

1:04:44.320,1:04:48.560
um I do jiu-jitsu two days and then right before 
each of those classes, one of them I do wrestling

1:04:48.560,1:04:54.720
and the other one I do judo. And uh no one every 
single time when I'm doing competition now like

1:04:54.720,1:04:58.880
I think the three people I've done this when I 
grab them like judo they always give me the inside

1:04:58.880,1:05:03.840
because they have absolutely no idea how valuable 
that is and then I am instantly already starting

1:05:03.840,1:05:07.840
on top and and doing all right. What one of the 
things uh that you might consider just to make it,

1:05:07.840,1:05:11.840
you know, because you're you're always going to go 
against people that, well, I say always, they're

1:05:11.840,1:05:14.880
not going to be as good as you or you're going 
to be bigger than them and stronger than them,

1:05:14.880,1:05:20.560
you can handicap yourself. I actually did this 
uh a lot coming up. I would weight train heavily

1:05:20.560,1:05:25.120
right before class, like 45 minutes for an hour 
of heavy weight training where I could not use any

1:05:25.120,1:05:29.440
strength during class. I didn't have any left. All 
I had was technique and cardio, and that helped

1:05:29.440,1:05:34.720
out a lot. I don't even have cardio, so I just 
would sit there with half a technique, I guess.

1:05:35.520,1:05:38.960
And then when the brown belts come in, they're 
like, "All right, let's spoiler. All right, here

1:05:38.960,1:05:45.200
we go." So, but there's there's ways to handicap 
yourself, like do 20 20 30 push-ups between

1:05:45.200,1:05:51.920
switching training partners and things. Yeah, I 
was I I would work out every single day and then

1:05:51.920,1:05:57.200
Tuesdays and Wednesdays is when I would do uh the 
the either the judo, the wrestling, and then the

1:05:57.200,1:06:02.480
jiu-jitsu. But in the morning, I would also go for 
one hour of like body uh weight training and stuff

1:06:02.480,1:06:07.440
like that, heavy lifting during my bulking and 
then I'd like eat lunch and then like go those

1:06:07.440,1:06:14.400
those are the hardest days. Um yeah. Um yeah, as 
I gotten older like it's it's tough to heal faster

1:06:14.400,1:06:20.960
and things like that. So I have I have to train 
very deliberately unlike before. I try very hard

1:06:20.960,1:06:26.320
not to get hurt. Do you focus on like recovery? 
I know that some people get super super focused

1:06:26.320,1:06:29.840
in like recovery even more than like the actual 
like working out portion of it. And some people

1:06:29.840,1:06:32.880
just do the working out portion and don't even 
care about the recovery side of things. I don't

1:06:32.880,1:06:38.480
even know what it means to focus on recovery. Like 
you drink some water, you sleep. I don't take any

1:06:38.480,1:06:45.600
like crazy TRT or anything like that. So no, it's 
just water, sleep, and that's about it. And keep

1:06:45.600,1:06:50.320
flexible. I don't know what else am I supposed 
to do. I've been Yeah, that's a good question.

1:06:50.320,1:06:54.320
It's like I mean I and I don't know if I'm just 
doing it and I don't even need to be doing it,

1:06:54.320,1:07:00.080
but I'm starting as white belt right here, you 
know, and I I'm like second 30 year in right now.

1:07:00.080,1:07:07.520
Um but I'll do I'll still take like um turmeric 
and black pepper um and then magnesium to like

1:07:07.520,1:07:12.960
release the the nerves at the end of the evening. 
Um so little little things like that. Nothing like

1:07:12.960,1:07:18.800
nothing prescribed yet. Probably not. I think, 
you know, for me, I think my diet is okay and

1:07:18.800,1:07:24.240
uh but uh you know, I I did, you know, I did I 
was doing a lot of blood tests to see where I

1:07:24.240,1:07:29.680
was at. I was I was doing a lot of supplementation 
with vitamins and things. And you know, for me,

1:07:29.680,1:07:34.640
I couldn't find the difference in my performance 
at all. I was healing at the same rate. I could

1:07:34.640,1:07:40.080
run just as far, train just as hard. I So, I just 
kind of stopped all of it. It's like it was it

1:07:40.080,1:07:45.760
became too tedious for the benefit to me. So, just 
eat properly, sleep, drink some water. Good. Okay.

1:07:45.760,1:07:52.640
Good. Yeah. I started blood work this this year 
and uh I I'll have a local model that I'll give uh

1:07:52.640,1:07:56.960
my blood work and stuff to and it's like okay what 
what are you like tell me be my doctor because I I

1:07:56.960,1:08:01.840
don't know and then yeah I'm getting some better 
results but I think uh over the time maybe just

1:08:01.840,1:08:06.480
like every six months or once a year do it again 
just to see how things are going. But it doesn't

1:08:06.480,1:08:09.680
sound like you have to do it like constantly is 
what you're saying. Well it was just to hit my

1:08:09.680,1:08:14.240
baselines. I was doing a blood test like every 3 
months to see where my levels are at things cuz

1:08:14.240,1:08:19.440
I would I did do supplements for six months, see 
how it do, do supplements again for six months,

1:08:19.440,1:08:27.040
come off of it six months and I really couldn't 
tell a a difference. Okay, got it. All right,

1:08:27.040,1:08:32.480
so I got I got one more question and uh we can we 
can either wrap it up sooner or we can ask a few

1:08:32.480,1:08:37.040
more fun funner questions, but um let's start 
with this one. Uh, where should people find

1:08:37.040,1:08:44.240
you and who's one person in your network you think 
should be on the podcast next? Oh, okay. Um, let's

1:08:44.240,1:08:49.360
see here. People can find me. I'm uh I'm mostly on 
LinkedIn these days, which is crazy. How am I on a

1:08:49.360,1:08:55.200
Microsoft platform talking cyber security? It's 
very strange. I used to be on X, but you know,

1:08:55.200,1:08:59.760
several years ago that devolved into a nightmare 
and I wasn't having any fun on it. So, LinkedIn,

1:08:59.760,1:09:06.480
reach out, say hi. Um, that sort of thing. Um 
and then uh on the podcast that would be I have

1:09:06.480,1:09:12.160
uh two great uh co-founders um Robert Arsnik 
Hansen who you probably know that name. And then

1:09:12.160,1:09:17.040
uh you know great cyber security pro couldn't do 
it without him. And then also a childhood friend

1:09:17.040,1:09:22.000
other co-founder Lex Arquette. He's head of our 
product. He helped me found White Hat back in the

1:09:22.000,1:09:28.000
day. He was he's the one you can you can blame for 
the uh the Facebook interface be well before IPO.

1:09:28.000,1:09:31.840
So that's that's what he does. So probably one of 
the best product guys out there. So he builds all

1:09:31.840,1:09:36.080
our software. So those two guys would be great. 
All right. Excellent. Love to have them on. How

1:09:36.080,1:09:40.560
did you meet them? Because they they've been with 
you through multiple vet uh you know veterans and

1:09:40.560,1:09:46.240
and foundings of different companies. What made 
you guys even considered the first company and

1:09:46.240,1:09:52.880
then say let's do it again and let's do it again. 
Um let's see here. Uh Lex, our head of product and

1:09:52.880,1:09:57.040
I we were childhood childhood friends from Maui. 
So we've been running little stupid little you

1:09:57.040,1:10:03.120
know side hustles and businesses forever. Oh nice. 
And uh when we left Hawaii, I went to do uh Yahoo

1:10:03.120,1:10:07.440
um and tech and things like that. He went to 
go be a Hollywood actor because that's what

1:10:07.440,1:10:12.560
he does. Um mine was work mine was working out. 
His wasn't. So he came out and did tech with me

1:10:12.560,1:10:18.880
and inseparable ever since. And then uh Robert, he 
was living in Silicon Valley at the time with me

1:10:18.880,1:10:25.440
and we met each we're both in APSAC so we met up 
at at a at a conference once at a local event and

1:10:25.440,1:10:30.720
uh we both had ideas for a very particular hack we 
were doing um browser hacking in browser internet

1:10:30.720,1:10:35.840
hacking back in the day because we had specialties 
there and we started doing research together and

1:10:35.840,1:10:41.680
uh we didn't do companies together for quite some 
time because he you know he already had one and

1:10:41.680,1:10:48.080
then uh later we did Bit Discovery together and 
that was our first one. Okay. But um but but he

1:10:48.080,1:10:52.880
was working at White Hat back in the day. He just 
didn't he didn't f he didn't found it back then.

1:10:52.880,1:10:58.560
Okay. What are some of the things like uh because 
you know you you started multiple companies. Was

1:10:58.560,1:11:03.520
there ever a moment when you thought like hey 
like you know I can start a company like I

1:11:03.520,1:11:07.680
could actually do this or you ever thought like oh 
maybe I I can't and I'm not the guy to to start a

1:11:07.680,1:11:15.520
company. Oh I never had a doubt ever. I think I 
I always had a doubt the other way like I don't

1:11:15.520,1:11:20.960
think I could keep this job. I I think I'm plainly 
unemployable. Okay, got it. So you you were like I

1:11:20.960,1:11:25.600
I definitely can start the things or I want to 
start the things. Am I actually I don't dare I

1:11:25.600,1:11:29.360
say I don't I don't want to say like am I bad 
at security? Was that ever in your question

1:11:29.360,1:11:35.040
in your head or you're like no I'm just Oh yeah. 
Oh I guess we what do we call it here? Imposttor

1:11:35.040,1:11:39.600
syndrome is rampant in our space because we work 
with some brilliant people. Everyone's brilliant.

1:11:39.600,1:11:47.120
I think I maybe kind of got over it maybe a couple 
of years ago maybe. So yeah, um I wouldn't worry

1:11:47.120,1:11:51.920
if I've you know really in real talk I if anybody 
has that don't even worry about it. Just go go be

1:11:51.920,1:11:57.200
of value. Go solve problems. Be of use to people 
and the don't worry about the rest. Okay great. Is

1:11:57.200,1:12:02.000
there anything that you'd like to talk about or 
discuss that we haven't brought up today? Uh no

1:12:02.000,1:12:06.480
we covered a lot of ground. This is fun. If we if 
we'll come back if you want me to. We'll go talk

1:12:06.480,1:12:10.240
some other things. Sure. Sure. Yeah. You know, you 
should you might you might consider doing one of

1:12:10.240,1:12:16.480
these at uh in in Vegas. Do a bunch. I'd love to 
do that. Where Let's say I did do it. Where do

1:12:16.480,1:12:21.520
you think would be the best way to set that up and 
and how to execute it on a very nice professional

1:12:21.520,1:12:26.560
level? G give it uh what I would do first is reach 
out to the Black Hat media team. Just tell them

1:12:26.560,1:12:30.080
your your your podcast or do a show, whatever 
you want to tell them how you describe yourself

1:12:30.080,1:12:33.760
and go and ask them because they probably get 
that request all the time and know what to tell

1:12:33.760,1:12:38.080
you. And if they get a good answer, great. If they 
don't, reach out to me and we'll figure something

1:12:38.080,1:12:43.360
else out. All right, definitely do that. Yeah. 
All right, Jeremiah. Well, thank you so much for

1:12:43.360,1:12:48.160
your time. It's been a pleasure having you on the 
podcast. I I can't wait to to follow up with you

1:12:48.160,1:12:52.560
and and chat with more of your team uh and have 
them on here as well. Right on. Thanks so much,

1:12:52.560,1:12:58.240
Chris. All right. Thanks so much. Hey, thanks for 
sticking around with us this episode. If you're

1:12:58.240,1:13:03.040
enjoying these conversations, do us a favor, 
like, subscribe, and share it with somebody

1:13:03.040,1:13:08.720
in the security community. Coming up next, I sit 
down with Jeremiah Grossman, founder of White Hat

1:13:08.720,1:13:15.200
Security, Bit Discovery, and CEO of Root Evidence, 
his new company, Rethinking Vulnerability

1:13:15.200,1:13:20.080
Management. He's one of the most respected 
voices in ABSSE, and this conversation you

1:13:20.080,1:13:27.920
won't want to miss. I'm Chris Magis, founder of 
Red Security Global, and we'll see you next time.