S1: All right, Mike, welcome to unsupervised Learning.
S2: Hey, thanks for having me, Daniel.
S1: Very cool. So I've been wanting to get you on
S1: the show for quite some time, and we've been talking
S1: about doing it. I really love what you're doing over
S1: there on Return on Security. I kind of see you as, like,
S1: the Nate Silver or the 538 of, uh, the security industry. Like,
S1: you just kind of seem to know what's going on, and, uh,
S1: just really impressed with what you're doing. Can you tell us, um,
S1: about what? All you have, uh, sort of in the
S1: hopper and going on in different projects you're doing.
S2: Yeah. Awesome. Uh, well, thanks for that intro. And, uh,
S2: and the kind words, too. I love that, uh, the
S2: concept of, uh, the 538. Um, you know, I really
S2: am just trying to at return on security, capture the
S2: entire industry, uh, of cybersecurity. Um, and I've, you know,
S2: through the years of working and I've seen a bunch
S2: of different variations of people looking at the industry from
S2: either a product centric kind of view or from an
S2: investment banking kind of view. Uh, or for like a
S2: public equities, like, you know, the big public companies that
S2: get traded and talked about a lot. Uh, but I've
S2: never seen anybody kind of pull it all together, uh,
S2: in a way that you can understand if you're not
S2: an investment banker. Uh, and so that was kind of
S2: one of the things I was trying to do return
S2: on security was to kind of catalog all these things,
S2: but speak for the voice of the practitioner, uh, and
S2: the CSO. And that's, that's kind of what led me
S2: to this. And just, um, most of my experience, uh,
S2: through security has been on the engineering side. So I
S2: was always kind of front and center with buying tools,
S2: deploying tools, operationalizing tools. Um, and I had a lot
S2: of opinions because of that. Yeah. So it just started, uh,
S2: kind of writing them down and, uh, capturing this stuff.
S2: And I thought, uh, maybe I can help other people
S2: understand this space better, too.
S1: Yeah, that's really cool. So who is the main audience
S1: like the ICP here? You mentioned CSOs. That definitely makes sense.
S1: So security leaders, but would you say also like senior
S1: practitioners as well like technical people or what do you find. Yeah.
S2: I would definitely say that. Definitely security leaders. Uh, and
S2: then a lot of the senior practitioners who are often
S2: the ones informing or advising the leaders on what to buy,
S2: what to what kind of direction to go in, what
S2: kind of strategy to put together. Um, and that I
S2: kind of made this also for me as I was
S2: missing kind of these aspects of what, uh, you know,
S2: the weekly newsletter could kind of give like, what's the
S2: market even look like right now? And what should I
S2: be thinking about ahead of time? Um, so I'd say
S2: that that audience of security people makes up about 80%
S2: of the audience. Um, the other 20% is actually a
S2: healthy dose of cybersecurity founders. Uh, they use a lot
S2: of it. What I produce is like market intelligence for
S2: themselves against competitors or whatnot. Um, and then a lot
S2: of the rest of that is also, uh, VCs or
S2: private equity funds, uh, who are also doing similar kind
S2: of market intelligence and trying to keep track of startups
S2: where they are in their journey and, you know, when
S2: they might want to raise more money.
S1: Yeah. That's perfect. I mean, I don't know how much
S1: that was an accident, but you really did create the
S1: best resource for all those different groups.
S2: Well, thank you. It was kind of an accident, but, uh,
S2: just kind of was born out of, uh, just like,
S2: just trying a bunch of different things and getting some
S2: kind of outside help, uh, from friends who were in finance. Um,
S2: so I kind of wanted to make it sure that
S2: they could digest it, too. So I asked some friends
S2: who do, uh, investment banking or, uh, M&A activities and say, like,
S2: how do you normally want to see financial data or
S2: money data, things like that, like what makes sense? And
S2: then I kind of try to apply that in security.
S2: And uh, it was honestly a lot of luck to, uh,
S2: putting it all together.
S1: Yeah, I feel like it's really congealed over, like the
S1: last year or so, like where you kind of found
S1: that voice and you found the audience and you know
S1: what they are looking for. Yeah, really, really strong. So
S1: I guess I've got a number of questions for you. Um,
S1: but they all kind of have the same theme, which
S1: is what the hell has been going on? Um, like,
S1: so for like the last, I don't know, I can't
S1: even remember how long it's been. Is it like three years?
S1: Maybe three years, maybe a year and a half where. So, like,
S1: the economy is like. Or in cybersecurity specifically. We had
S1: a boom. I can't remember when the boom kind of,
S1: I guess the boom was post-Covid. It was it was
S1: like a post-Covid, like hiring boom. And then there was
S1: like all this excitement and sort of froth. And then
S1: at some point, um, there was like, just like the
S1: crash that came after that. Right. So how would you
S1: describe this? Like, it seems like you've got to be
S1: like the, the, uh, the expert here and one of
S1: the top experts in the world on this, and I'm
S1: trying to find out, of course, it's multivariate, but, like,
S1: what was this? Was this all the result of anti-Covid
S1: or over hiring from Covid? Or was it maybe pushed
S1: back on? Um. Uh, policies inside of companies being a
S1: little bit too pro employee. And companies are like, look,
S1: we only I've got like this theory of like, uh,
S1: the Alaskan fishing boat thing where it's like, I need
S1: absolute killers on this boat. Only the best. And like,
S1: if you say your ankle hurts, you can't come on
S1: the boat, right? Right. If if your priority is your family,
S1: you can't come on the boat. You want work life balance.
S1: You're not coming on my crew. And so I felt
S1: that happening at the same time. And I just I'm
S1: not as close to the data as you are, so
S1: I'm wondering what you think. Cause the boom caused the crash.
S1: And where are we now? Yeah.
S2: That's a great question too. And I think honestly, the
S2: the crash was building long before Covid happened. Um, if
S2: basically if you look after the Great Recession in 2008, uh,
S2: in the US, when the housing market at the first crash, uh,
S2: and it effectively recovered around 2012, 2013, that was a
S2: time at which interest rates had become very, very low
S2: to stimulate kind of growth in the economy that stimulated investments, um,
S2: outside of traditional banks. And so money was a effectively
S2: very cheap to borrow, which, yeah, venture capital loves startup
S2: founders love and that uh, that the old habits from
S2: early days of Silicon Valley and like the pre com
S2: bust era continued on. So it was uh, it was
S2: very easy to grow a company quickly. It was very
S2: easy to raise a lot of money quickly. It was
S2: very easy to scale. Um, it wasn't impossible to, to
S2: raise a couple hundred million dollars and then go IPO
S2: in this time frame, which is, you know, kind of
S2: the ultimate goal of, uh, you know, companies to raise
S2: venture capital money. Um, so all of those things played
S2: out across the entire industry, like, uh, not just cyber,
S2: but the entire set of industries. Uh, it just so happened, though,
S2: at the same time, tech had a, you know, a
S2: total run. Uh, they did really, really well as a
S2: general sector. And then cybersecurity did even better within the side,
S2: that small sector of tech. And it almost seemed recession, uh,
S2: recession proof in some ways. Um, and any time there
S2: was news funding went up or investments went up, any
S2: time there was a breach, investments went up. Anytime there's
S2: global conflict, investments went up. And so like, it kind
S2: of just kept happening in cybersecurity. Uh, and so there
S2: was really a good ten year or so period in
S2: cybersecurity where things were just as good as they could be.
S2: It could only go up into the right. Uh, and
S2: so a lot of people flocked to that. A lot
S2: of investments flocked to that, uh, a lot of people
S2: that would have put their money elsewhere, dumped it all
S2: in cybersecurity. Uh, some became specialists, some became just tourist
S2: investors who'd, you know, invest occasionally. Um, and then as
S2: you go up to Covid area, Covid era policies had
S2: to kind of reverse all of this low interest rate
S2: phenomenon that happened across the world. Uh, and each country
S2: took a different approach, but the US took a pretty
S2: hard approach. Uh, the US Federal Reserve, that is, took
S2: a hard approach on ratcheting interest rates way up to
S2: kind of slow down the possibility of having another recession
S2: or even a depression in some ways. Um, and since
S2: most of the money in the world invested in tech
S2: and cyber comes out of the US or originates in
S2: the US, uh, that hit the tech sector super hard
S2: and hit cybersecurity sectors very hard. Um, so imagine where
S2: you've raised, you know, a couple hundred million dollars over
S2: the past 3 or 4 years prior to about 2022
S2: is when, uh, early 2022, when this happened. And then
S2: you might be worth $1 billion. You might be worth,
S2: you know, a couple billion dollars. But then now, because
S2: you've spent all this money and time and effort into
S2: growing kind of at all cost, as opposed to like
S2: growing a product market fit and growing like products in
S2: a way that people actually want to consume, not just
S2: to compete or winner take all. People are now left
S2: with like, wait, sales don't match what my valuation says.
S2: Sales don't keep up with the money I raise. And
S2: so there was a super hard reckoning, um, from a
S2: lot of things like operational efficiency became the name of
S2: the game. Um, so it was no longer enough to
S2: raise money. You actually had to, like, make money as
S2: a company, which, uh, kind of cracked me up thinking
S2: about it, but.
S1: Yeah, let me let me jump in there real quick. So, um.
S1: I've heard. Uh, do you listen to Scott Galloway?
S2: I have.
S1: Yeah. Yeah, yeah. So he talks about this a lot. How? Um,
S1: I'm not sure he says it like this, but there's essentially, like,
S1: two phases or two different vibes that a company can
S1: be in, which is like this. Kind of like a
S1: fantasy phase where you disconnect fully from the underlying financial
S1: fundamentals and you're just kind of operating on, like you said,
S1: growth at any cost or just like this state of
S1: belief and hype, kind of like a crypto surge or something.
S1: And it has its own gravity and it takes on
S1: its own form. And he said the same thing you
S1: just did, which is at some point there is a reckoning.
S1: Eventually you're going to get back to somebody. Maybe it's
S1: like the replacement management team. They come in and they're like, hey, let's, um,
S1: let's do something crazy. Let's figure out how much money
S1: we're making and how much money we're spending. Right. Um,
S1: so so this is really interesting. So you have an
S1: underlying economic thing, which is kind of the biggest. Yep.
S1: Then you have maybe related to that, you have this, um,
S1: transition of a lot of these companies going for that
S1: other style of company where it's not super tied to
S1: the product itself. And the I think Scott calls it
S1: like the fundamentals, market fundamentals. Mhm. And then um, then
S1: you have Covid in addition, which is another disruptor. And
S1: it sounds like all those sort of combine and. To
S1: form the build up, but also to form the crash. Yep.
S2: I think that's a great way to think about it.
S2: And you know it. Also, you look at broader tech
S2: kind of, uh, plays that happened so largely, uh, tech
S2: sectors copy like people or companies in the tech sector
S2: copy each other. If, if a Facebook or a Google or, um,
S2: a Microsoft makes a move to reduce headcount, many of
S2: them follow suit. The other big companies and then companies
S2: start reevaluating. Maybe we should do that too. Uh, maybe
S2: the investors certainly come knocking and they say, hey, wait
S2: a second, shouldn't you be more profitable or more operationally efficient?
S2: Let's let's drive that cost burn down. Uh, and so
S2: that also added into the effect as well.
S1: Yeah. It, it feels like both of those are super contagious. The,
S1: the getting away from fundamentals is super contagious. In the hype,
S1: and then the returning of fundamentals is also equally contagious.
S1: Everyone's like, hey, what are we doing? Like, I'm talking
S1: to Chuck and Sally over here, and, uh, they're both
S1: saying we should get back to the books and we
S1: should absolutely do that. It's like fashion trends almost.
S2: Yeah, that's a good way to think about it, too.
S2: Like what's in vogue versus what's not. Um, and a
S2: lot of it, as much as people want to you
S2: believe that, like, you know, the market is is based
S2: on data and science and, um, hard proof. A lot
S2: of times, a lot of us just feeling like even
S2: investments are a lot of feeling, um, a lot of times,
S2: which is why, um, not all investments, most investments don't
S2: return any money. Uh, so, like, that's, you know, there's
S2: you can't predict some of these things. So you have
S2: to go with a bit of underlying feeling and gut.
S2: And so that is contagious as well.
S1: Um, yeah. Interesting. So what are some of the other
S1: trends that you're seeing that you're sort of tracking that
S1: you find interesting?
S2: So right now, I think we've had a little bit
S2: of a rebound effect because there is, uh, it's a
S2: kind of a macroeconomic phenomenon where people expect things to
S2: get better. And so if they expect it, it does
S2: get better. It's a strange, like, chicken and egg concept. But, uh,
S2: there was a bit of a rebound. Um, I've noticed
S2: that 2024, even in these first 12 weeks, is already, uh,
S2: almost as good as 2023. Um, and even though there's
S2: been less transactions, there's almost the same exact amount of money,
S2: so there's fewer transactions happening, but there are more, uh,
S2: profitable each time or more, more revenue is, uh, or more, uh,
S2: cash is exchanged hands each time. Um, and like the
S2: M&A has also kind of been one of those, uh,
S2: kind of second or third order effect knock ons that
S2: have come from the fallout of 2022. So companies who, uh,
S2: started in that time frame probably had a really tough time.
S2: They either sink or swim very quickly. Um, and I'm
S2: seeing companies who started early. Now they're getting acquired quicker,
S2: which is, you know, it might be, you know, a three,
S2: four year turnaround, uh, for an acquisition now as opposed
S2: to like 7 to 10 in some cases. So I
S2: think that is interesting. Uh, because, uh, the, the underlying
S2: premise there is like companies either need a lifeline because
S2: they can't survive and actually make sales themselves, and they
S2: need like to be absorbed or acquired into a larger company. Um,
S2: or they just have something that's so good that larger
S2: companies like can't iterate or can't innovate without it. So
S2: they buy it up real quick to try to get
S2: it off the market and try to stay relevant with
S2: the other large companies. Um, so I think that's that's
S2: pretty interesting. Um, another concept I would say is, uh,
S2: you know, obviously application security has exploded with AI. I
S2: think that's probably like one of the quickest and, uh,
S2: probably one of the better use cases to kind of
S2: help support that function. Um, and it feels a lot
S2: more tangible than, you know, an autonomous stock agent or
S2: like a, a replace your SoC. Analysts like levels one
S2: and two with a, you know, an all knowing agent.
S2: It may come their that way eventually, but uh, I
S2: think um, the, the first the shine has worn off
S2: of the first level of AI security or security for
S2: AI companies. Uh, and people are starting to see that
S2: there's like real tangible benefit and like the application security
S2: and the data security side.
S1: When you say the first layer, you mean pre this
S1: new gen of AI, you mean like the old AI
S1: security companies who were like. Yeah, automate the sock. But
S1: that was before Gen I. You're saying that the Gen
S1: I stuff is like injecting some real, real, um, energy?
S1: I definitely agree with that. But how? We're using it manifest.
S2: Yeah, I'm seeing some energy. So I think there were
S2: some last year, uh, you know, after after OpenAI and
S2: everyone came out or like, it's 18 months ago. So
S2: now there's a lot of early, early companies that were
S2: trying to do something with security as like as new startups. Um,
S2: most of them were just like, uh, proxies or casbs
S2: or just like basically a firewall to kind of limit
S2: the exposure that a company would have. Um, those had
S2: a quick pop and then they've kind of like trailed off.
S2: And then you saw the next iteration even after like, uh,
S2: OpenAI came out and the others, uh, of like replace
S2: the sock, but like in a different way than how
S2: they used to say, replace the sock. Um, now more
S2: of like, just like a the co-pilots, if you will,
S2: like the the everyone, every product now has an AI
S2: copilot and an AI chatbot to go with it. Yeah. Uh,
S2: even that's starting to lose its its shine now, and
S2: they're trying to get a lot more around help me
S2: automate the fix. So I think that that's a pretty neat, uh,
S2: iteration of it. Now, it's no longer just purely kneejerk, uh,
S2: you know, cover my legal basis. It's let me actually
S2: make appsec or things like that, uh, faster and more, uh,
S2: more concrete for all the parties involved. Uh, so I think, uh,
S2: that one is really interesting. Um. And then kind of
S2: at the same, the same time, uh, a kind of
S2: a smaller space that people don't really think about as
S2: much that I find really interesting now is the explosion
S2: of trust and safety, because, like, it's so much more
S2: important now to even understand which videos, which content, which
S2: anything you're consuming is real or not. And it's it's
S2: more than just a social media problem. It's becoming a
S2: company problem as well. Like it's a brand. It's a
S2: reputational problem. Um, that extends beyond just somebody making a
S2: deepfake video. So I think that's there's a lot of
S2: going on that. And then you add on geopolitical contexts
S2: and like wars on top of that stuff. And it's
S2: it's very interesting, um, like how you, how you sort
S2: all that out. And I think this is a place
S2: where I can really help.
S1: Yeah. Interesting one section I think's going to absolutely blow up.
S1: And I don't think um, I don't think there are
S1: many people playing here yet, but actually there's a decent
S1: number like, um, validation. Of ground. Truth is a space
S1: that I think needs to, well, is just going to, uh,
S1: blow up. So, so I, I see this as. Um,
S1: me and you having some sort of, like device. It
S1: might be on our phones. It probably will be on
S1: our phones because it's expensive to carry an extra device.
S1: So basically, you and I have a pre-existing, like, uh,
S1: signal connection. Mhm. So we go to get on this,
S1: this call right here. And um, like I've seen you
S1: move your hand when you move your hand also with me,
S1: you see, see the green glitching. Yeah. The green screen.
S1: Same happens with you. Um, and when, um, we get
S1: ready to do a call. I think we're going to
S1: do something like. Okay. Initiate, uh, pre-shared key connection or something.
S1: And you put up actually on your, on your screen
S1: and show a code which is corresponds to the code
S1: I have, which is part of the Pre-shared. Uh, now
S1: it's part of the video. As well. And so now
S1: we've validated that this video feed. With a combination of
S1: live and a combination of pre-shared. We have an actual
S1: connection and you're not a deepfake. Um, that SpaceX is
S1: going to absolutely heat up. The other one is going
S1: to get crazy is, um, AI agents acting as humans? Um,
S1: and calling APIs and everything, and basically IAM type companies
S1: or identity type companies basically getting a handle on who's
S1: human versus who's emulating human. Mhm.
S2: Interesting. Yeah, I think that all makes a lot of
S2: sense too. And it kind of plays into one of
S2: the earlier posts you've written about that. I don't think
S2: a lot of people have, uh, really, uh, done too
S2: much with or like looked too far into. But it's
S2: really you've got AI security, you've got security of AI,
S2: you've got security for AI, but you don't have anybody
S2: really talking about security from AI other than deep fakes.
S2: But like, that's just like the tip of the iceberg
S2: where this could go and what, you know, could be
S2: launched against you or as a person or as a company. Um,
S2: so I think that space, obviously it'll include misinformation and
S2: disinformation kind of signals, but there's got to be more
S2: than that. Like what else is being undertaken against me
S2: from a personal like an OpSec standpoint, almost. Um, so
S2: I think that space is going to just going to
S2: as people get more, uh, attuned to this and they
S2: get more paranoid, I think that's going to become, uh, um,
S2: have a greater impact on the world of privacy than
S2: privacy or regulation ever will, if that makes sense.
S1: Yeah. Yeah, I think that's right. Yeah. One way I
S1: like to think about that is like a, uh, and
S1: this is a little bit in the future according to like, this, this, uh,
S1: plan or idea that I have, but it's like a continuous, uh, defender.
S1: So you essentially have like a digital assistant, uh, which
S1: is what I call, like the permanent AI that you
S1: have with you. And it's a continuous filter for everything
S1: coming in to see you. Um, um, and it could
S1: actually detect when you're being, like, overly flattered for the
S1: purpose of manipulation because they're in sales. Yeah. Um, so
S1: one's like, oh, yeah. You know, that outfit looks really
S1: great on you. And by the way, I love that
S1: talk that you gave. I especially love slide number seven
S1: from your talk in Berlin. And, uh, and suddenly you're like,
S1: oh wow. I just feel really cool. And then they
S1: hit you with the sales pitch, right? Right. And so
S1: you could have something pop up in your glasses or whatever.
S1: It's like NLP detected manipulation, uh, expect inbound sales pitch
S1: or something like that, right? Or if, um, you're getting like,
S1: this really threatening language that's coming at you, it might
S1: actually just rewrite that for you. Um, so, uh, one example,
S1: I was talking with a friend named Joel the other night, and, um,
S1: an example of this would be like, say, someone's been
S1: traumatized by a partner and the partner is constantly emailing
S1: them or texting them or something. And the the texts
S1: are like they're life disrupting. It's like a paragraph of, like,
S1: nastiness and narcissism and like gaslighting and whatever, under the
S1: pretense that they're actually agreeing when to pick up the
S1: kid with shared custody, your AI just rewrites it. Pick
S1: up Jimmy at for. The whole paragraph is gone. It
S1: just leaves the content so it doesn't. It strips out
S1: all the triggers and everything. So I think that I
S1: filtering thing is really powerful. Yeah.
S2: Well that makes a lot of sense. And it kind
S2: of plays into the whole like, uh, personal digital sovereignty
S2: and like being able to control that aspect of you
S2: online and offline. Uh, that makes a lot of sense.
S1: Yeah. Yeah. And the other one that I think is
S1: really interesting is like, um. We're going to have to
S1: validate true content. This one I've not seen a space
S1: really heat up yet with either, and maybe because it's
S1: just so hard, but, um, essentially watermarking and validation like
S1: trusted feeds so that um, for, for example, I love
S1: UFC stuff. I'm all into fighting stuff. So when I
S1: watch fight videos now, I'm having this really weird experience
S1: where I'm having fight videos narrated by Joe Rogan. And
S1: I'm like watching the fight video and I'm enjoying it
S1: and I'm like three, four minutes in before I finally
S1: catch some weird word. And then I realized for the
S1: entire four minutes. Joe Rogan is a multi-millionaire. I am
S1: on a very small YouTube channel. Um, he didn't come
S1: to this channel and narrate this. Interesting. This person went
S1: and collected all the clips and he just got the voice.
S1: He wrote the script. Um, or maybe even I wrote
S1: the script, but it's all being set in Joe Rogan's voice. Um,
S1: which is fairly harmless. I mean, it makes the videos
S1: quite nice, uh, quite enjoyable, but, like, what happens when
S1: that's actually news instead, right? What happens when that's something
S1: really important? Um, or if it's like a Joe probably
S1: doesn't care. Maybe he does. I doubt he does. But
S1: a lot of, uh, Hollywood celebrities actually would, and definitely
S1: government officials really would. So, um, that thing should either
S1: either have a fake symbol or lack an authentic symbol. Right?
S1: Whereas the official symbol coming out of, uh, Rogan's feeds.
S1: Should have the have the symbol right or lack the
S1: fake symbol. That is an entire industry that's going to
S1: be a multi-billion dollar industry. Um, yeah. And I'm sort
S1: of just waiting for that to happen.
S2: I think that's a really good concept too. And I've,
S2: you know, I've talked to actually a few startups who
S2: are doing that. Exactly. But they're they're trying to basically
S2: create truth out of multiple sources for news reports. And
S2: the goal of this, you give it to corporate communications
S2: teams to let them decipher what's real and what's not.
S2: Like who actually said this thing. And it really comes
S2: down to using AI to go find, uh, the original
S2: sources or the original, and the original shares the original
S2: posts and then tie it back, kind of like to
S2: information actors on the back end to say, oh, this,
S2: this post that was widely shared by this person on
S2: Facebook originated from a Russian disinformation mill. This person is
S2: also associated with these 12 other things. It has a
S2: high degree of chance that this is all fake. And
S2: so then it gives you like kind of risk scores.
S2: Then you can say corporate cops can say, we know
S2: this is fake. Uh, next one, you know, so they
S2: can they can move on and they can then have their,
S2: you know, just kind of situational awareness per, per company
S2: around that. But then that could that could easily extend
S2: to like video contexts as well. Um, but it's it's
S2: fascinating a time to be in this space just because it's,
S2: I think the, the, uh, technology hype cycle and the
S2: curve has it occurred it occurred like every other, you know,
S2: platform we've seen with like, mobile and cloud, which might
S2: have taken ten years. But this a lot of this
S2: has happened in like 18 months. And it's gone through
S2: a couple iterations of that loop. Um, so it's just
S2: so hard to keep up with it all, uh, and
S2: know what you're actually looking at.
S1: Yeah. I don't think it's even close to where it's going.
S1: It's it's not even close. I mean, I'm very much
S1: I'm a self-described, uh, very pro AI, but I feel
S1: like I see this really clearly, and we're barely getting started. Um,
S1: so when I hear about AI hype and there, you know,
S1: there's some places where, uh. People got over their skis
S1: and they got overly excited about a very small thing,
S1: like a giant company that generates. I don't know. Uh,
S1: Midjourney images and sells them or something. That would be
S1: more crypto like, or more NFT like, where it's way
S1: over inflated for what it is, right? Right. Whereas most
S1: of I, especially the stuff we've just been talking about,
S1: hasn't even started yet. And it's not even possible without AI.
S1: The hype cycle is not even. It's not that it
S1: hasn't got to the top. It hasn't even started yet.
S1: And that's not counting for like the real, the real
S1: core stuff where all of your entire corporate data is
S1: inside of a data lake. That I can see. And
S1: now you could basically ask any question and take any
S1: action as a result of that, which is kind of
S1: the long term thing. And people haven't even really started
S1: doing that because of the limitations of context. Windows and Rag.
S1: It's like that's all still building up. There's there's a
S1: few hype phases that are kind of really small and inconsequential.
S1: But the ultimate S-curve of AI, I think, is just starting.
S2: Yeah. No, I totally agree. And I think, um, you know,
S2: we it's one of those things you can't even imagine
S2: it because we didn't even imagine generally available. I on
S2: your phone like 18 months ago, at least the average
S2: person didn't. Yeah. Um, and now the average tech person, like,
S2: uses it multiple times a week. Um, and even the
S2: average non tech person is starting to at least know
S2: what it is in general. Um, which is, which is
S2: pretty impressive. Um, but yeah, we're just kind of scratching
S2: the surface on what's, what's possible there, which I think
S2: it's going to take kind of like a step function to,
S2: to get that next level of AI security kind of realm. Um,
S2: you know, every investor I talked to has that as
S2: part of their core thesis. Now they they have to
S2: do AI, some variation of security because nobody knows where
S2: the rocket ships going, but they know it's a rocket ship.
S2: So they, they want to latch on in some way. Yeah. Um,
S2: and uh, it's, it is going to make some really
S2: cool stuff possible that otherwise wouldn't be. And I think, uh,
S2: I also would not be surprised in terms of trends
S2: to see like the, you know, the 1 to 2
S2: person security unicorn company. Uh, yes. Like they oh, you
S2: can just build out your own complete attack surface management
S2: platform using AI and self-hosting it or, um, and as
S2: long as you can, uh, then learn the sales motions
S2: and get that going, you can get bootstrapped, you can
S2: get going, you can get funding, um, or may not
S2: even need funding. So I think like it's going to be, um,
S2: a pretty open world. Uh, which would be better, I
S2: think for like, you know, competition would be better for
S2: practitioners eventually. Um, because all that stuff is constantly expanding
S2: and collapsing in the market, like, because security is not
S2: a winner take all market at all. Like from a
S2: product standpoint, it's a many, many people can be winners
S2: in this space as well. Um, even if some of
S2: the players are trying to act in a zero sum way,
S2: like there's there's not a singular like dominant player across
S2: all fields. There's like pockets of dominance across multiple fields. Um,
S2: so I think it's just going to make that bubble
S2: even bigger and maybe, maybe more challenging for practitioners for
S2: a while. I hope I can help with that with security,
S2: like make a little more sense of that. But, um,
S2: it's going to be interesting.
S1: Yeah, I think you're absolutely right.
S2: There's the there's the big trend of, uh, you know,
S2: personal digital sovereignty, like that kind of concept of being
S2: security secure from AI and all the kind of attacks
S2: on you as well. Um, there's going to have to
S2: be some more iterations around, uh, improvements in AI security
S2: in general for it to be like the next iteration
S2: for like for to be beyond just like I think
S2: a lot of what we've seen right now is just been, uh,
S2: adding AI to existing capabilities as opposed to AI creating
S2: the new capability. Uh, so we're not quite there around
S2: that curve yet. And then once whoever makes that next
S2: step is going to, like, do really well. Um, but
S2: it's obviously there's, uh, there's a context and there's a
S2: data problem that has just got just expanded now with the,
S2: with AI. Um, because more, more AI means more cloud workloads,
S2: which means more tech service means more configuration mismanagement. All
S2: these things are just have have expanded. Um, like you said, I, uh,
S2: exaggerates the thing or highlights the thing. It isn't the thing. Yeah.
S1: Yeah, I like what you said about a single person
S1: company launching and getting really big because you mentioned like, oh,
S1: as long as they can learn the sales motion well,
S1: what if they don't have to because they just hire
S1: an AI company? Yeah, that's automated sales. Right. And then
S1: you hire a company that's automated support and then you've
S1: got automated like uh, EA's. So you've got like your
S1: personal assistants and basically all of your company infrastructure is
S1: kind of mostly outsourced. Service companies that are AI based.
S1: And then you basically have, like yourself, a co-founder and
S1: maybe 1 or 2 people. Yeah. And maybe it's just you.
S1: And like one person I would say is probably one
S1: of the smallest versions. I'm sure there will be actual
S1: single founders who make pretty big companies as well. Um,
S1: Altman's been talking about that as well as the first unicorn.
S1: One person. Yeah. So I think that's very possible. Um.
S1: What about the balance of private equity VC versus startups like.
S1: I feel like this last down period. Oh, by the way,
S1: what are the years for these? These periods? 21 was
S1: that the start of the down?
S2: So 22 was like the start of the down basically. Okay. Yeah.
S1: 22 we started the down 23 was down and 24
S1: were starting to see the uptick.
S2: But yeah a bit of a rebound. Um, and um,
S2: you know 2021 late 21 had a few signs of distress,
S2: but not like no one thought the fed would raise
S2: the rates so high. Yeah. Or keep on raising it.
S2: And like the so that it just kind of had
S2: like a an iterative effect there and just like kind
S2: of kept making things worse.
S1: Right. So 22 and 23, uh, private equity did really
S1: well because they're swooping in, grabbing things. Right?
S3: Yep.
S1: And VCs did not do so well. Startups didn't do
S1: so well. And now there's a whole bunch of companies
S1: that are kind of sitting out there. They've been growing
S1: slowly and they're kind of large and bloated. Mhm. I'm
S1: sure you've seen a bunch of these and they're just
S1: kind of like stagnating. And every time they have to
S1: go to investors, investors are like tired of hearing from them.
S1: And they're like yep you got to do something like
S1: I've heard the same thing. You're not growing. It's not
S1: super exciting. Um, what does this look like as things
S1: start to boom now? And I think it's going to accelerate,
S1: but who knows. But as it starts to boom, who
S1: starts to benefit? Uh, I guess the private equity benefits,
S1: if the stuff they bought cheap starts to be worth more,
S1: that's pretty obvious. But I guess VC and startups are
S1: the main benefits if things start going up. Is that right?
S2: Yeah. I mean that's that's exactly right. So like, if,
S2: you know, if the bets the P made at the
S2: acquisitions and like the takeovers they made and they and
S2: they and by the way, P has been very good
S2: at buying companies and making them super operationally efficient for
S2: a couple of years, getting a return on their investment
S2: and selling it. Uh, they just had a much better
S2: time doing that, you know, the past couple of years
S2: than they had before. Um, you know, VCs, a lot
S2: of when it comes to, uh, venture investing, you know,
S2: most investments don't make money at all. Uh, and typically,
S2: only a very small portion of what you invest in
S2: actually makes up 80 or 90% of the the value
S2: that you get back. Um, and so, uh, some did
S2: really well, uh, at the time and some and, but
S2: a lot of them did not. So like they, they
S2: struggled their companies shut down, uh, funds shut down. Uh,
S2: they didn't return any money to their investor base. Um,
S2: so that's all bad. And that makes it harder to
S2: raise more money next time, or get people to commit
S2: to give you money to go invest next time. Um,
S2: you know, there's a couple carry overs that will be constant. Um,
S2: we're we're too close to when operational efficiency was the
S2: king to go away from it now. So it's like, yeah,
S2: we might be bouncing back, but you got to be
S2: a lean bounce back. You cannot be overinflated. I agree you,
S2: you never hire at 200, you know, percent or like bro,
S2: you know 1,000%. Like the memory.
S1: Is too fresh.
S2: Yeah, it's too fresh. Like, I think we have to
S2: have another 4 or 5 years of, like, a bull
S2: run for them to say, yeah, forget that. Let's just
S2: go big again and like, uh, but you also have
S2: to remember at the same time, the goal posts have
S2: been significantly moved on both ends of the spectrum. So
S2: now you have to have less people be operationally efficient
S2: and burn less cash. So that's bottom in the spectrum.
S2: At the same end, if you want to go public,
S2: it's a lot more of a higher barrier now. So
S2: it's not you can't just be a $1, a 1
S2: billion uh, valuation. You need to be three, $4 billion valuation.
S2: You can't just be a $100 million in RR, which
S2: used to be the magic number to make companies go public,
S2: or at least start the roadshow. Now you need to
S2: be 200 or 300 million. And so like the pole
S2: or like the, the the narrowing of the pyramid is
S2: like gotten like even tighter now. So you have a
S2: lot more competition, which means sink or swim is like
S2: a lot more aggressive. Um, and so that's why everyone
S2: has kind of been decrying, oh, platform ization is finally
S2: happening in cybersecurity. Like we're finally going to have less vendors,
S2: which is will never, ever be true. Um, it'll just
S2: go through pockets of of consolidation. Always like to explain
S2: it as, uh, it's more of an accordion like parts
S2: of it are open and like expanding and parts of
S2: it are closed and contracting, but you're still like you're
S2: making music, but you just like but it's not going
S2: to look like, you know, one company, Palo Alto, is
S2: not going to rule them all, even if you want
S2: them to, um, tomorrow and like so this they will
S2: never be that one. True. Uh, so it's now become
S2: harder to, to do that. Um, and then all the while, like,
S2: private equity is still going to have a pretty good
S2: run for the next 3 or 4 years, because a
S2: lot of those companies who raise money in 2020 or
S2: 2019 or even 2021, some of them are still just
S2: limping on, and they may have another a few more
S2: years of runway before they need to go private. Like
S2: they may have raised too much money, like some of
S2: these companies raised close or more than $1 billion in
S2: funding may not have anywhere else to go. Uh, and
S2: less like a Cisco or like a, you know, a
S2: Microsoft buys them, uh, so either they'll die a slow
S2: death or they'll go take, you know, they'll private equity
S2: or go shape them up and, you know, possibly dismantle them,
S2: possibly resell them. Um, so there's a lot of more
S2: complexity now, I think, than there used to be, uh,
S2: in terms of, like, making a go of it.
S1: Yeah. Interesting. I really like your accordion thing. I think
S1: that makes a lot of sense. I do think platform
S1: migration is absolutely a thing, I think. That's like the
S1: permanent home for anything that I used to have this
S1: thing where it was like, idea. Um, then, um, application, then, um,
S1: operating system. So it's like things move through that phase
S1: where it's like, uh, it's like a web app or
S1: a little utility or something, and then it gets brought
S1: into the OS and it's kind of absorbed the the
S1: knowledge is now so known and understood that it just
S1: becomes part of the furniture.
S3: Right?
S1: Um, but especially with AI. So I think one of
S1: the biggest things happening with AI is the fact that
S1: it's so much easier to start a company and actually
S1: be effective, kind of going back to the whole, um,
S1: unicorn thing. But forget about the unicorns. Like I'm about
S1: to launch a SaaS myself and it's just me. And
S1: like a dev.
S3: Nice.
S1: And it's a full size, right? It's a full size.
S1: It's like end to end like it. And there's a
S1: million people like me who are doing this because of AI.
S1: So that is the accordion, but the bottom of the
S1: accordion or whatever. The new ideas, the new companies, the
S1: new sauces that are out there for the platforms to
S1: pick and choose which features they want via acqui hire.
S3: Is.
S1: Going to be much larger because I think the barrier
S1: to get in to be a startup person five years
S1: ago is way higher than it's going to be in
S1: two years from now.
S2: Yeah, I think that's true. And I think, um, I
S2: agree with everything you said too. And I think, you know,
S2: the concept of bootstrapping or just doing it on your own,
S2: with your with your friends and family support, uh, is
S2: going to become a lot more realistic, um, than it
S2: used to be. Like, you see this in other industries,
S2: but you don't really see it much in cybersecurity. Like
S2: maybe like think of, like canaries, like kind of the
S2: only one I could think of that's, uh, truly like,
S2: kind of bootstrapped, but like most. Uh, you know, it's
S2: hard to get behind that model. Um, and I think,
S2: you know, a lot of things that I've been trying
S2: to also help people kind of realize the return on
S2: security is that, like, you know, understanding, like who the
S2: investments or investors are behind a given, you know, company
S2: you can kind of see, like repeatability and like track
S2: records of success or like playbooks they use often. And
S2: you kind of say like, okay, I know that it's
S2: going to, you know, backed by this company, their goal
S2: is to be acquired by a bigger company. That means
S2: if I invest in this now, it may not be
S2: here in four years, three years or whatever, whatever contract
S2: they're trying to get me to sign. So like, I
S2: kind of need to think about that, um, based on
S2: kind of where it's come from. Um. But it's. I
S2: agree that it'll be easier to get in a startup,
S2: it'll be easier to get a lot more traction and
S2: actually get paying customers, especially if you then go back
S2: to like using AI to enhance what you know or like,
S2: fill in the gaps of what you can't, you know,
S2: do where you couldn't have done before is easily like
S2: it's yeah, it's it's going to it's going to skyrocket.
S1: Yeah, I'm really excited for it. Well, um, this has
S1: been fantastic. So tell us, um, in addition to your
S1: return on security, which is the newsletter and the overall brand, uh,
S1: what are what other stuff do you have brewing? Do
S1: you have like, uh, reports coming out, new research, like products,
S1: anything we should be aware of?
S3: Yeah, I've been.
S2: Trying to, uh, write a bit more on the blog
S2: this year. Try to just try to get more of
S2: my thoughts out there as possible. Um, I've kind of
S2: gone back to doing kind of monthly, and I'm going
S2: to be releasing a quarterly roundups as well, because I
S2: want to be able to track these things over time. Um, like,
S2: I'm big on kind of showing like look backs and saying, like,
S2: this is where we were last year this time, or
S2: this is where we were last month this time to
S2: kind of help understand trends. Um, so I'm just kind
S2: of really increasing the output of because I want to
S2: be a true resource. I want to be like the 538, uh,
S2: I want people to be able to use it and
S2: actually consume it. And, um, I also plan to do
S2: I'd like to open source the data and have somebody,
S2: some data science people say, like, all right, tell me
S2: what you can come up with. Like what? What is
S2: interesting like either, you know, run some models on it,
S2: run something and let's let's see what, what ideas you
S2: come up with, um, and what kind of trends you
S2: can uncover from a data science perspective. Um, so I
S2: think that's pretty fun.
S3: Yeah.
S1: Um, yeah. Yeah, I want to mention that that that's
S1: something that's super awesome about what you do. You have
S1: the data. You've been collecting this data in a very
S1: sort of manicured and, um. Detailed way in rigorous way
S1: this whole time. So you have this data set and
S1: you put out different products around it. Um, I love
S1: the idea of when I go to the site. Um,
S1: I would love like a dashboard that is very much
S1: like FiveThirtyEight, which FiveThirtyEight really only spins up for, like
S1: big elections. I'm sure it's getting big right now, but like,
S1: I would just like to. Get quick narratives like, remember
S1: the thing we talked about, okay, what was 2021? What
S1: was 2022? So what I would really love is like,
S1: just explain the whole thing. Starting five years before Covid,
S1: the thing that you did, you said, look, we have
S1: this build up of general economics. Then we had Covid
S1: happen or whatever. If I could get that in a
S1: paragraph or one sentence or a full page, imagine dragging
S1: this kind of related to the thing I'm getting ready
S1: to release. Imagine dragging your explanation from one sentence of
S1: 15 words all the way to a full page of analysis,
S1: but it's exactly the same thing that you described, right?
S1: So it's like, give me the the TLDR of the
S1: entire security space. Yeah. Um, and then you have different
S1: graphs there, right? It's like, show me VC performance. Show
S1: me the number of startups, show me like whatever. And
S1: I feel like that's what I'm getting from you in
S1: your newsletters. So I feel like that could be like.
S1: Definitely like a future direction for you with like, this
S1: really rich front page dashboard. And it's just like it's
S1: like a. It's like a universal dashboard to just state
S1: of the Union.
S3: Yeah, I love that idea.
S2: I love that idea too, because I kind of like,
S2: I think about what I do is like, almost like
S2: a public utility. I'm like, I want you to use it.
S1: Like it is. It absolutely is.
S3: Already I love it, I love it.
S2: That's it's I love that idea too. I'm definitely gonna
S2: noodle on that one and try to figure out how
S2: to how to do it. Because I want to share more. I,
S2: I've made so many like great like connections, and I've
S2: learned so much just by doing this. And so I
S2: want to be able to like kind of share it
S2: back as much as possible.
S1: Yeah. Well, I encourage everyone to go check you out.
S1: It's our return on security. Absolutely. The the best and
S1: really the only newsletter in that space. Just absolutely crushing it.
S1: Can't wait to see what you do next. And thanks
S1: for coming on.
S2: Awesome. Thanks so much for having me. It was great talk.
S3: All right.
S1: Take care. Thanks.