Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 139 for the week of October, uh, 28th. Yeah, uh, we have a blizzard starting right now.

It's hard to believe that we are almost to winter. We've seemed to skip fall. Seriously. All of a sudden from summer to winter. Yeah, it was.

I got home, you know, I was, I was in Europe last week and I got home and yesterday it was 70 degrees outside. Yeah, beautiful day. And then today, Sunday, it's, it's snowing. You know, we got a little bit of snow on the ground already. We do.

And it's supposed to keep snowing and then be cold all week. Single-digit temperatures, I hear. Yeah. Yeah. Well, that'll be fun.

Yeah. Great stuff. Yay, winter. Uh, looking forward to that. Uh, you know, we do have some housekeeping stuff to go through.

Uh, we have a Slack channel if you want to, if you want to join over 1,100 of our closest friends in the, in the Colorado security community, you can jump out to the Colorado Equal Security Slack channel. Uh, the link to join that is on the front page of colorado-security.com. We also have a mailing list. So if you want to get the show notes delivered to your email every week, sign up for that. Go to colorado-security.com, go to the bottom.

There is a link to put your email in and we will get you those show notes. And if you love the show, this would be a good opportunity for you to maybe go into your favorite podcast player and do us a favor. There's not that— we haven't had all that many reviews, you know, maybe 40 or 50 reviews, and there's hundreds of you guys who listen every week. We'd love it if you take a minute and go out there and put a nice comment in the podcast listening app. That's how we find new listeners and hopefully get new folks into the Colorado security community.

And if you're afraid of those public reviews where people can see what you actually did, you could just review us with a friend, tell them how great things are, tell them they should listen to the podcast, that they should join the Slack channel, get the word out. And if that's not enough, if you're thinking, I've done all that, I wanna do more, we would love to have you be a part of our Patreon campaign. That is an opportunity for you guys to help subsidize the cost of this show. You know, Alex and I have been paying for this out of our pocket, and the Patreons have really helped, stepped up to do that. We appreciate you guys a lot, and of course, if there's other folks who wanna help us, please do.

And finally, Robb and I are lazy. We, we prefer not to do stuff. So if, if you would like to be someone who interviews people for our show, we would love to have interview volunteers. We have quite had quite a few of those lately. I think they've been pretty good and we'd love to have more.

Also, if you want to be someone that is interviewed, you think you have a cool story to tell, please let us know. We'd love to interview you too. And I tell you, the experience I've had from those who have been guest interviewers has been overwhelmingly positive. It gives them a chance to go meet new folks in the community. And it's really honestly one of my favorite parts about doing the show.

Maybe my favorite part is getting to meet interesting folks in the community. It's just hard to find the time to do all of them on our own. And it's great when we can get other folks to step up and help do that. Definitely. All right.

Let's go ahead and move into the news. Number 1, if you look at the top 10 list of best cities to visit on vacation from Lonely Planet, what do you think's on there, Alex? I'm going to say Dubai, Robb. Dubai is on the list. Yeah.

Hey, hey, good guess. That's great. I'll tell you what's not on the list. What? Austin is not on the list.

Austin is not on the list. San Francisco is not on the list. Who else is not on the list? Lots of people not on the list that are in the US. New York City didn't make it.

It's not on the list. But you know who is on the list, Robb? I do. Denver, Colorado. Denver, Colorado is on the list.

Top 10 cities to go visit on vacation. So if it wasn't bad enough for people moving here, now we're going to be inundated by all these tourists coming here. Leave money. It's great. It's great.

So we did. We did make number 10 on the list of top 10. What they said about us is that We have, we have great energy, charming boomtowns. And they talk about Red Rocks, craft beer like Great Divide, art and architecture at the Denver Art Museum. Just a few of the great things to do in Denver if you're a tourist.

The only other US city to make the list was Washington, DC, which I guess is not a surprise. It's a great place to visit if you're coming to the US. So top, top of the list, Salzburg, Austria. I have never been to Salzburg. That'd be fun.

Number 2 is DC. Number 3 is Cairo. Number 4 is Galway, Ireland. And I want to heartily echo, Galway is a fantastic place to vacation. I really loved going there.

Number 5 is Bonn, Germany. La Paz, Bolivia. Kochi, India. Vancouver, British Columbia. Dubai was number 9.

And of course, Denver was number 10. Yes. Good stuff. Next, over $1 billion has flown into venture from venture capital into Front Range companies this year. Yeah, we've done really well in Colorado.

They said 2018 was the peak of venture investment, kind of both in Colorado and nationwide. But 2019 has been really strong as well. Over $1 billion coming in. And a lot of that money is actually not coming from Colorado-based VCs. No.

And there was a lot of interesting stuff in this story, you know, from venture capital groups to angel investors, lots of different stuff in there. The thing that I thought was the coolest is one of the graphs that is in there that shows the, the funding over the years. And it's all pretty stable, it, you know, going up slightly, slightly, except if you go back to the year 2000, which was right at the height of the tech bubble. And investment at that point was like $4.5 billion. Wow.

Way, way, way above any other year. Yeah, really, really interesting stuff. The I found, I found this interesting, especially that they were saying in Colorado that really there wasn't any kind of venture capital scene until about 2009. That's when Brad Feld and Techstars and Foundry Group really started to make an impact. And we've seen a lot of growth in the last decade.

Yeah, I think, Robb, you'll also be interested that Guild Education, local startup, now has some money from Steph Curry. I did. I am a, I'm a Bay Area native and I am a Warriors and all other Bay Area sporting team fans. So go Steph. Hopefully that we see wild success there.

Wasn't Guild, uh, hiring a CISO recently? I think that they are. We had that on the show last week. Hopefully we get to see, uh, hopefully that person, whoever gets hired, gets to meet Steph Curry. Yeah, absolutely.

All right, uh, moving forward, uh, we have the new list, um, from Forbes about— or actually the Denver Business Journal's, uh, fastest growing private companies here in Colorado. Yeah, um, this takes into account, uh, size of the company. So you've got You know, small, medium, large, extra large, and I think you've got 6 or 7 companies that are growing the fastest. We marked a couple here. Ibotta, which we have talked about a number of times, they are a sort of a rebate coupony kind of company based here.

They were number 1 in the large extra large category with revenue in excess of $93 million, and Pax8 was the number 1 in the large category. So congratulations to them. We did not have any, um, of the known security companies on there, which is too bad. But no, I know previously, I think it was actually the Forbes, uh, fastest growing companies that we've seen quite a few security companies on in the past. So none of the security companies made this list.

Remember, this is just for private companies. Um, and so, you know, maybe that's kind of part of, part of the issue here too. Yeah, maybe Ping Identity would have been on that, Robb, but I wasn't, I wasn't gonna say anything, you know. All right, move it, moving ahead here. Uh, we have another article from, from Dish.

Uh, actually, actually, actually from the Denver Business Journal, but talking about, um, how DISH has made— has come to agreement with the Attorney General from Colorado to get that Attorney General to drop out of a multi-state lawsuit which was seeking to, um, to stop the merger between Sprint and T-Mobile. It's kind of a weird thing here because there's 3 different companies involved. Yeah, I mean, so a little while back, um, Sprint and T-Mobile announced that they were gonna merge, and as part of that Um, the— there's not— they didn't think there was gonna be enough competition anymore in the, uh, the mobile industry, so they wanted to have another mobile provider. And so Dish stepped up and said, hey, uh, well, we'll build out a 5G network and we'll be that other mobile provider. So definitely good for Dish as part of this.

And so they really wanted that, that to happen, which is weird that you care about other 2 other companies merging. But, uh, yeah, so it's cool that they're promising about 2,000 jobs here. Um, going to be in Littleton at having their wireless headquarters at, uh, I think Bowles and Santa Fe, the, the location that they have there. So a couple, a couple other details here. As a part of that agreement to create a new wireless provider, DISH would be taking on the prepaid plans from both T-Mobile and Sprint.

So they take out a couple of different components from those companies to start the new DISH. Um, and so there, there is a little bit of interest in the merger there. And, and there's 2 things that the state of Colorado got out of this agreement. Number one, they got that agreement that the headquarters for the new wireless provider of Dish would be in Littleton, like you said. Yep.

Number two, that T-Mobile was gonna start building out a significant statewide 5G network, particularly in the rural areas. So not only are we gonna get that new headquarters, we also get 5G built out in the rural Colorado. And if either of these companies fail to live up to their obligations, they've agreed to pay $100 million and a penalty. Yeah, I think there are also some provisions from— for some low-cost plans from some of those providers as well. So that's another benefit to folks in Colorado.

Pretty cool stuff. Uh, next, California company SnapDocs plans to bring 635 jobs to Denver over the next 8 years. So it's not immediately. Well, don't ruin the surprise. I know, right?

You get— when I got to the part of the article where it says that they currently have 13 people in Denver, And they plan to hire another 60 to 80 through 2020. So it's kind of a long-term strategy for them to build this team out here in town. It is, but that's still a good number. Glad that they're going to be bringing people here. SnapDocs actually does a lot of work in the financial services industry.

They have a platform that helps people do e-closings. So that's pretty cool. Yeah. If you have— if you want to do a closing, you don't have a title person there or a, or a closer there. You can actually just have a notary be there instead.

And the title person can be remote. I think in some states pretty soon you won't even have to have, have that. Right now you are still required to have some of those documents wet signed, you know, so you need to have a person there and a notary and stuff like that. At some point there are going to be full e-closings. And so that will be pretty cool too.

They are going to be hiring engineers, customer support staff, and workers in both sales and operations in this office. So really across the board, well-paid positions as well. Currently they're at a WeWork at the Wells Fargo Center and they're looking to be in a more permanent space early next year. Next, Ping Identity had, which I think is an annual survey of people talking about how they feel about data breaches and actions they would take if a company that they dealt with had a data breach. This is actually a pretty big deal.

I, you know, I see a lot of survey data out there, but I'll tell you, being inside and getting to see a little bit of how the sausage is made, it was a big deal. Over 4,000 folks are surveyed, and that's distributed around the world. I think there was just over 1,000 people in the US and was like 800 in the UK and France and Germany. And so really not— we're trying not to focus just on the US market, try to get a broad perspective of what folks think about online brand reputation and how it would impact their willingness to do business with those companies going forward. Yeah, I think the big headline here is that 81% of consumers said they would stop engaging with a brand online after a data breach, which is a big number.

Yeah, and I always wonder about these numbers is, you know, the reporting of what people say versus what they would do. I don't think anyone would reasonably think that 81% actually would all walk away. However, you'd have, I assume, 81% who'd say, who'd take a real good look at it, right? Right. And give your competitors an opportunity to maybe step in, and it's a weakness you probably don't want to show.

A couple other— sorry, go ahead, Alex. I was gonna say, I would love to see if there could be some companion survey done with this that, you know, you look at companies that did have a data breach in the last year and poll people to say, you know, hey, you know, for this company, did you change any of your behavior with that company based on the data breach that they had? Yeah. Another data point that I actually thought was especially interesting was that the sharing of personal data was really relevant to these consumers, and more than half of them said that a company sharing their personal data without consent is more likely than a data breach to deter them from working with that company in the future. Wow.

That is a pretty cool— I think that goes to showing, you know, a data breach is probably not an ethical failing on the part of the company. It's, it's, you know, it's hard to secure stuff, whereas, you know, sharing things without consent, that, that's pretty much a lack of trust. Yeah, definitely. Anyway, interesting research. I hope you guys will take a look at that whole report and see what you think.

Next, we had a story this week in TechCrunch about Randori, who is a, a partially local company here with big presence in Denver. They released their, their first product, Randori Recon. Um, which is essentially like a, uh, you know, a black hat hacker in a box. Well, this one's more— but so the, the, I think the long term is looking to become the black hat hacker in a box. This one's more like looking for where are your external points of presence and what can you find.

Uh, what I love about it is, is rather than, you know, your general pen test or vulnerability scan where they say, give me your all IP, give me all your IP addresses, right? You know, tell me where your data centers are. Here they say, give me the, an email address for your company. And let me see what I can find out on my own. Um, so that's interesting.

They, they'd say that it's not desirable or useful for the, for their red team to have any, any knowledge about the company's defenses. They wanna figure it out as if they're a black hat. Yeah. Um, and this is a product that they have been developing in, in conjunction with some people here locally, um, for a little while now. So good to see that they've got that released.

Yeah, I think this is just number one. I do think that they're, they will have a follow-on product that is more like actual red team getting in to do exploits and so forth. Beyond just the perimeter searching. Next, we have a blog post from Red Canary. This is talking about how to detect SharePoint attacks via worker process activity.

So basically, you know, using the telemetry on your endpoints to look for SharePoint attacks. Yeah, again, this is one of those getting kind of deep blogs from Red Canary. I think if you're interested in getting into those details, it's definitely a good read. Looking at how the process trees work with detecting this activity. Very cool stuff.

So we don't spend a lot of time going through the details on these, 'cause they are very detailed. I would just say for those of you listening who run a security operations team or yourself think you might wanna become a security operations person, you gotta go spend some time on the Red Canary blog. They spend an absurd amount of time documenting and capturing what bad behavior looks like, and it's free. They just put it out there for the world to make the world a better place. I think it'd be worthwhile for your teams to learn from this kind of, information.

Definitely. Uh, next, uh, LogRhythm had a blog post this week talking about their newly announced, uh, unlimited data plan for their SIM. I guess there's some other SIMs out there that, that also claim to be unlimited, and they're, they're kind of casting some shade at those other companies. Um, they don't, they don't name what companies. I, I could guess what it is, but right, there's, there's a company that calls— they say they have an unlimited plan, but it's 7 figures, you know, millions of dollars, uh, in order to get there.

And, and, you know, anything below that is never unlimited. It's all based on transactions, right? Yeah. Uh, good on Logarithm for going this direction. Um, it'll be interesting to see how that, you know, bears out in the market if other people follow suit.

Uh, finally, we have a blog post from InteliSecure. Uh, InteliSecure is a local MSSP really focused on DLP and, and really protecting your, your highest criticality, uh, data. Um, they're, they're talking about the, the closing the cybersecurity skills gap. And this is something that they've revisited from 2017, which I actually think we covered on the show back then as well. I'm sure we did.

A couple of things that they mentioned as part of this: be prepared to be a mentor, provide the opportunity for folks to learn, and then show a career path, right? So if you're— the idea here is if you're pulling in younger, inexperienced folks, you're gonna have to put in the time to make sure that they get up to where they need to be. All right, that is it for the news this week. Let's move over to the Slack message of the week. Big thanks to Andre Gaeta.

We love Andre, appreciate all his support for the show. Andre has been uh, sponsoring the Slack Message of the Week for the last couple of years. And on this, we recognize one person who commented in the Slack channel that we thought was worth calling out, and they get to pick one free item from the Colorado Equal Security store. And this week's winner was Rick Hill. Uh, Rick recommended Ray Dalio's Principles in Career Discussions.

It was a good conversation talking about, uh, principles and the kind of idea of radical, radical honesty. If you haven't either listened to a podcast with Ray Dalio or read the book, I think you're missing out. I'm not saying you can use all of it because it is a really big culture change to get to that point, to using his ideas, but it's good ideas. And I personally was interested in that. Awesome.

So Rick will get an item from the Colorado Equal Security store courtesy of Andre. So thanks again. All right. Let's move over to the event calendar. As a reminder, on the website, we do have a calendar of events.

Go out there, click on on the left on security events, you can see what's going on for the next 6 months or so. We, we just filled that up in the last couple weeks. Um, before we jump into the next 2 weeks, I just want to do a call out to Alex and I doing a keynote, um, at SecureWorld Denver on Wednesday morning. We're going to be doing a live version of this podcast, which, you know, I'm going to knock on wood, if, uh, if all goes well, uh, we'll be able to run that, that podcast next week on this show. Exactly.

And we'll do a little bit of news and a little bit of discussion, and then we'll have, uh, Dale Drew, who is the CSO for Xeo, as our featured guest. Yeah, looking forward to that. As Robb mentioned, SecureWorld is this week, the 29th and 30th, so you should go check that out. We will be doing the keynote. I'm also moderating a panel on, on the 30th in the afternoon on privacy, so that should be exciting as well.

All right, moving forward into the other events over the next 2 weeks, Prologis is hosting a China cybersecurity discussion on the 29th. SecureSet is doing their speaker series, Intro to Software Security with Tremaine Island on the 29th. On the 30th, IAPP KnowledgeNet is doing a CCPA, that's the California Consumer Protection Act, updates and top 10 things companies should focus on to comply. On the 1st, Colorado Springs Cybersecurity is doing their First Friday event down there. Also on the 1st, there is one of these trainings from SANS, is it SANS SEC504?

Mike Harris is doing it. I think you maybe know more about this than I do. Yeah, so this is one of their mentor courses. So Mike Harris is the person doing that. This is the, the first of several weeks of that.

They're doing those on Fridays. On the 6th of November, we have the 2019 APEX Awards. This is the Colorado Technology Association's annual event. Starting 3 years ago, we got a CISO of the Year award included into this program, and the finalists for CISO of the Year this year are Debbi Blyth, the CISO for the state of Colorado, James Carder, CISO for LogRhythm, and our own Alex Wood, the CISO for Pulte Financial Services. Pretty excited about it, looking forward to the awards ceremony.

Um, my money is on Debbi. Uh, next, on the 7th, Splunk is doing their First Thursdays at Topgolf. Um, also on the 7th, the CSA, the Cloud Security Alliance, is doing their Fall Summit. That's a full-day event. For those who aren't aware, they do a good job with this event, lots of good learning.

Recommend you, you take a look and try and make it over there. On the 9th, SecureSet is doing their extended capture the flag, beginner and professional. I, I don't have the event in front of me, but I think it was like 12 to 2 versus their normal evening events. So this is a little bit of a different different setup. So you take a look at that and make sure you don't just show up at 6 o'clock like you, like you do for most secure event, secure set events.

That is it for events. Let's go ahead and jump over to jobs. Uh, top of the list, we have Velocity Global hiring an information security manager. Uh, CenturyLink is looking for a lead security architect. Bank of America continues with their epic hiring spree here in Colorado.

They're hiring a secure advice— excuse me, secure usability architect. I thought that one was pretty interesting looking. PDC Energy is looking for a senior information security engineer. Charter is hiring a security engineer, a tier 3 SOC analyst. The U.S. Department of the Interior is looking for an IT cybersecurity specialist.

I'm not going to read the job code there. The GS-2210-14RF-DH. Yeah, I really only like the 2210-13, so the 14 is not going to— not going to do it for me. I prefer 15. I'm guessing that's a level, so I'd rather be a little higher.

Denver International Airport is hiring a lead information security auditor. Nice. Grant Thornton is looking for a risk advisory controls senior associate. Shutterstock is hiring a penetration tester. And PwC is looking for a cybersecurity and privacy associate.

All right, that is it for the newscast this week. Alex, we have one of our— once again, we have Ty Burke doing a Uh, interview for us as a guest interviewer, and he sat down with a friend of ours from a couple years ago, Patrick Walsh. Patrick is the CEO of IronCore Labs. It's been a couple years and IronCore Labs has made some changes, and I'm looking forward to hearing about those changes. As am I.

All right, well, that is it for this week. Uh, hopefully we'll see you guys at Secure World. Please come say hello to us on Wednesday. Like I said, Alex and I will be doing the keynote to kick off the day. Uh, Alex, are you gonna be there much— most of the day Wednesday?

I should be there pretty much all day Wednesday. I'll be— I'll just be around the keynote, so come say hi to me either before or after. Um, and then if we don't see you there, we'll see you guys again next week. Sounds good. Thanks, Robb.

This is David McGuire, Director of IT Security at QEP Resources. This is Colorado Equals Security for Colorado security professionals by Colorado security professionals. Welcome to Colorado Equals Security. I'm Ty Burke here with Patrick Walsh. Patrick is the CEO and co-founder of IronCore Labs.

Great to have you here, Patrick. Hey, thanks for having me. You're a repeat guest, so I'm sure a lot of the listeners are going to be interested to hear, um, you know, kind of what you guys have been up to since you last came on. Um, and we're excited to dig into that. Uh, for starters, tell us a little bit about who you are.

Um, you know, for those who may not have been subscribers a couple years ago, um, uh, who you are, you what your family's like, a little bit about yourself, and sure, start there. Well, so my background, I've spent a lot of time in security, uh, starting off with things like antivirus intrusion prevention research, um, and then, uh, and then I moved in enterprise SaaS software, spent a number of years there. And IronCore actually is in many ways is sort of the convergence of that for me. It's like where security and enterprise software meet. Um, and ultimately what I think is lacking in, in that space.

Tell us about Encore, um, you know, about the business, about the product, as much as you can there. Yeah, so we're a data privacy framework, which means that we help people get control of the data that they hold in their applications and then potentially give that control to their customers if they want to. Um, we— so we basically help them help developers to protect and manage the sensitive that they hold. Um, as a security company, we're kind of unusual versus most security companies because we sell mostly into engineering groups versus selling to like classic security buyers in IT and so forth. Our, our fundamental philosophy is that the, um, as much magic stuff as you can sprinkle around your network, you can only do so much if you don't have secure and well-behaved apps.

And so at the end of the day, you know, fix the app, fix the data, fix the problem. Okay, okay, cool. Um, so I want to dig into a bunch of different stuff. Uh, so you last came on the show, what was it, August 21st, episode 29. Now we're in episode, I don't know, 140 or something like that.

Um, this is 2017, so a little over 2 years ago. Um, Outside of work, what's happened? Give me something that's, you know, exciting that's happened to you. Have you met anybody famous? Have you had any crazy incidents or anything like that?

Uh, nothing crazy. Uh, I have a 3-year-old at home now, so, uh, that's, that's, that's its own set of crazy, really. And then I did go to Iceland. That was pretty cool. I'm, uh, I dabble in photography now and then when I get a chance, and that's pretty, pretty amazing place to go to do that.

What time of year did you go to that? It was fall. Okay. Um, so right around kind of this time of year but last year. Okay.

Uh, it was, it was gorgeous. I wish I could have spent more time there and taken more photos. Was that— were you there for a long time? No. So we did one of these things.

We were actually on our way to Europe and we did it on Icelandair, and they have a, a thing where you can basically lay over in Iceland for free. So, you know, in our case, we were going to Denmark. We spent a few days in Iceland on the way out, okay, which was a great deal. I wish we'd spent more time there. Okay.

I feel like, uh, although it should be the case, uh, founders, co-founders that I speak with don't take, you know, don't get a chance to— and then they admit it— to take, you know, week or 2 week-long vacations at any point in, in the, you know, scale-up growth stage. It's really good for you. Really hard. Yeah. Yeah, I need to figure out better ways to do that more.

Yeah, it's tough when you're founders, wear lots and lots of hats, and it's, it's hard if, if you don't have good, uh, ability to set those down. It worked out really well actually, so it's, it was encouraging. Yeah, to do again. How do you find time? Uh, you mentioned your 3-year-old.

Uh, I've got a son turning 3 in 2 weeks, uh, so I'm kind of in the same boat. But, but how do you manage your time? I mean, um, you know, if no one else was around, you could probably be working, you know, sunup to sundown and on the weekends too. Uh, and maybe you want to do that sometimes over the weekends, but, you know, you've also got domestic duties. Uh, how do you balance that?

Yeah, I mean, it's interesting. It's kind of my tendency. You're right. If there's no one else around, I'd probably just work all the time for better and worse, right? Uh, it's a forcing function for me actually.

It's really, it's, it's probably very healthy actually for me to, to have that. So I make a point of getting home for dinner every night, every night that I can if I'm not traveling, and, and, uh, spending time with my daughter. And then, you know, it's— for me, it's like, okay, I press pause on work for a couple hours every day from like 6 to 8. Yeah. And then I get back on the computer and try and chase down all the things I didn't get done during the day.

Yeah. Yeah. I found that if I can just turn my phone off or just put my phone like in a different room or something, it just makes those 3 hours with my kids like just so much better. Yeah. And I'm not stressed about whatever stupid email came through, you know.

I've really focused on, uh, so it's like my whole, my whole life from a work perspective is screen time, right? Yeah. And I've— yeah. And it's really bad when you find yourself like at the playground with the kid and then you're looking at your phone or whatever. And so I, I've been, been forcing myself to, to push that aside and not do that.

Yeah. And it's I actually picked up the Rubik's Cube as a way— because I get bored, right? And, uh, especially, you know, she's playing on the playground, I'm just sitting there. What do you do? You look at Twitter or whatever, some stupid thing that isn't really a good use of your time.

But, you know, and so, uh, that's my, that's my like fidget spinner, uh, now is that. It's a way to— and you also avoid the judgment of other parents at the playground. Look at that guy on his phone, he should be looking at his kid or something. Probably. He said, what a weirdo.

He's like— so in the, um, in the 2+ years since, uh, since you last came on the show, um, talk to us a little bit about the evolution of the business. So, um, you were in pilot mode back then, uh, you had a couple of customers, you know, you were kind of ready to launch later, later that year, 2017. Um, what's happened since then in terms of, um, you know, what you can share around the the product and/or the market. Um, you know, obviously I think you guys have raised some money since then. Um, tell us a little about, you know, just the evolution of IronCore since then.

Sure. Yeah, 2017, we had, uh, I think when we talked to you, we had just graduated from Techstars and, uh, we had just released some at least beta, um, products, I think, when we talked to you, and we were kind of getting out into the market. Um, it's changed a lot for us actually. It hasn't, it hasn't, right? The mission hasn't changed.

What we're doing hasn't changed. But we've learned an awful lot about the market and, uh, things from there. So like, for example, um, we put out a product that was really kind of SMB targeted, so people could just self-serve, sign up, start using it. And, you know, that worked okay, but we learned a lot about basically small businesses are not our target for sure. Not startup, not other startups, not, you know, plain and simple less sophisticated companies are not good targets for us.

We've basically become wholly an enterprise-focused company, and that's, that's where the sophisticated security buyers are in general, and that's, that's the where we've seen success. So even to the extent that we do talk to and work with mid-sized companies, it's almost always because there's a, there's an enterprise that's pushing them hard on doing better on their data security privacy requirements, etc. Okay. How are you guys, um, typically going to market right now? Like, is it direct?

Is it through, through partners? Or— so channel, you know, I don't know that there's a play for us for channel partners. Really? Yeah. It's, again, you know, it's a little bit unusual in that most channels sell into security organizations and into IT.

Um, I don't know of good channels. Maybe, maybe someone will tell me that I'm wrong, Um, that sell into engineering groups. So no, we do— we are very direct. And in fact, our marketing approach is very, very, uh, extremely targeted. You know, we pick companies we want to go after, we've picked the specific titles we're looking for in those companies, and then to those people, hopefully we're everywhere.

And to everyone else, they probably never see us. And so, um, it's very, very directed, very hyper-targeted enterprise sale process that we run in, in terms of opening that up. And Um, you know, it's interesting. So you guys are, are selling to developers who are notorious for not wanting to be sold to, right? You mentioned the self-service piece.

Um, so is that— is that— does it look like, um, you know, pushing content or a blog or something to kind of get the developers saying, wow, these guys actually know what they're talking about? You know, kind of almost creating a little bit of, you know, brand awareness, maybe demand gen, if you want to call it that, on the marketing side. And then from there, allowing them to kind of get, you know, into the product, onto the website. Um, and that's when I guess the magic probably happens for you guys. I mean, yeah, but we— so interestingly, content marketing is definitely the best thing for developers.

And if you're talking to technical people, you really need to have your white papers or your other, like, you know, there needs to be meat on the bone. Or, or the way I usually think of it is it's really frustrating. People will, especially venture capitalists, will sometimes ask us, what do you, you know, how are you like similar to Company X? And it'll be a company I've never heard of before. And it's like, well, hang on, let me go look.

And I'll spend 10 minutes on a website and still have no idea what they're actually doing, right? Because the security space is so full of companies that are like all smoke and no fire, right? You get, or it's at least really hard to find the fire if there is any. And, and so, uh, but if you're selling engineers, you can't get away with that. Like, you got to be mostly fire and very smoke, or else you're gonna bounce them pretty fast.

We don't typically sell to your average developer though. That's a mistake we made early on, is thinking that your average developer would be really interested. Your average developer is not sophisticated, and then it's not even their concern. It's not the thing that they're thinking about. It's really the, the architects, security architects, or just general enterprise architects, software architects.

Those are our people. They're, they're the people, they're the ones who get it. They're the ones who are looking for solutions like us. Um, they need the data privacy toolkit that they can plug into their stuff because their job is to figure out all those, like, this, those itties, like the, the scalability, the reliability, the maintainability, the security, right? And, and their job is to figure out how the enterprise software gets built so that those things aren't screwed up in the process.

And, and so they're, they're, they're the ideal— they're our target. We, you know, we talk to architects. That's our favorite. We also talk to engineering leaders and product management, um, leadership, but, but at the end of the day, the architects are the people that are, um, real core folks. That makes sense.

That makes sense. Um, so as you guys have grown, when did you, when did you kind of— what was day one of IronCore? 2015. So we were, we were founded in 2015. We were kind of in a research phase largely at that point, you know, so we we spent a bunch of time, um, testing, testing ideas against the market, figuring out how to solve some of the hard problems.

So in that time, um, you know, business has obviously grown, um, and there's probably— this is kind of a question more for the entrepreneurs out there, but, uh, who are probably building something great and, and that may know that something ahead is going to affect their business, but they're not quite sure how. And so, in the time that you guys have been up and running, you know, if you look back at your 2015 self, and it's not that long ago, but I'm sure for you it's probably seemed like decades, you know, what are some of the things that have happened or affected your business that, you know, you never could have anticipated? Maybe it was, obviously GDPR probably played a decent role. Um, any other kind of government regulation, um, anything that, that you just, you know, you couldn't have, you couldn't have forced, you know, saw that it was going to happen? I mean, I think so.

GDPR and CCPA are big tailwinds for us. They matter a lot. You know, I, I described us as a data privacy framework and not as a data security framework, although we're effectively both.

You know, it's because the driver for what we do is more about privacy, or at least privacy laws, than it is about security and fear of breaches. Like, that for some reason, the fear story talking about Capital One or the latest idiocy in the market, right, is, is mostly noise that people kind of don't act on meaningfully. But privacy is this big tidal wave that's coming over the tops of people's heads that they need to get ahead of. And that's where a lot of drivers are. And for one thing, it turned personally identifiable information, PII, into a sensitive class of data.

So before it was like health data and financial data and everyone else kind of skated. Now anyone that holds personal information is like right there with the healthcare companies and the fintechs, right? They're, they're like, um, you don't get to skate anymore on this, this idea of, oh well, I just don't hold that type of data. So, so that's the tidal wave that's like propelling things in many ways. Um, we did, you know, so, uh, when I started IronCore, I left Oracle and I, I ran a pretty big division on the engineering side there.

And the thing that's interesting is even at that scale, you get beat up a lot. By your enterprise customers about who can see my data, who's looking at it, what about your DBAs, what, you know, there's all these open questions. And that was even in 2015, right? It's gotten a lot worse since then. So one learning we had, you know, we, the market has been maturing, it's been really evolving over the last couple years.

So for example, 2 years ago, one of our hypotheses was that customer-managed keys was a thing. That is this idea that, uh, in a— if, if you're gonna— if you're a big enterprise and you're gonna buy from a SaaS provider, you can ask for your data to be encrypted and you hold the keys to your data, or at least the master key to it. And, um, and we had seen a lot of demand for that or requests for that happening, and so we thought, well, this is an easy application of our technology. Um, we had a real hard time moving that needle 2 years ago. And if you fast forward to this year, it's, it's like that market is radically developed.

So it's gone from customers, big enterprises asking for it, to big customers saying, no, seriously, um, you do that or we're not going to renew. And that's a, wow, that's a significant forcing function that's helpful to us. So this, this thing, like, you know, Salesforce has done it, Box has done it, Slack most recently did it. They called enterprise key management.

And there's tools in the market for the enterprises to, to manage their keys that are, that are customer-managed keys, but there aren't really tools for the SaaS providers to, to provide this feature. So that's something that we're, you know, we're really loving right now. You know, it's really good for our business. The, um, the customer-managed keys trend is like single sign-on was 10 years ago when that started to become an enterprise requirement for enterprise SaaS software looks very similar to that. Okay.

On the data privacy side, are most of your customers domestic? Are they overseas as well? I would say they're all multinational. Okay, I'll stop there. But how do other markets, particularly Europe, I don't know, view your product?

How do those conversations go versus, versus some of the, you know, quote-unquote buyers or customers who might be here in the United States? It's really similar. Yeah, I mean, um, you'd think it would be different. There's certainly more of a bent towards privacy, at least, um, sort of as a, as a, as a, um, philosophy in Europe, right? But it isn't about you know, oh, I want my own personal privacy.

This is about like, hey, okay, we now, you know, Company X, we have an obligation to understand how our— how this data is being used, where and by whom. And we're giving it to these third parties who are giving it to third parties who are giving it to third parties. You know, how do we get our arms around that, right? And there's, there's IT checklists that are a mile long and other, other kinds of things, but ultimately, at the end of the day, they're trying to get the control back so they actually have, you know, independent audit trails of accesses of their data, for example, right? That's, that's probably the biggest thing that customer-managed keys gives them at the end of the day, is that, that and the ability to revoke access to that data if their partner turns up in the news for some reason, right?

It's like, uh, it's like Cambridge Analytica a little bit, right? It, it isn't, it isn't, because it's a business situation. But if you think about that The most interesting thing with the Big F and Cambridge Analytica is that they wrote a letter to these guys and said, hey, please delete that data. And then they sent them a questionnaire and they said, hey, did you delete that data? And those guys said, yep.

And then a little while later, this whistleblower comes out and goes, nope. Yeah, right. Nope. Oh, they didn't have control of that data, right? They handed it out and then it was gone.

Okay. That's the problem. Okay. Um, now go back to the fundraising side. So, um, what's that been like for you?

Um, you know, you as an entrepreneur, um, I know, I think the last podcast you started a business in college, I want to say. Uh, so it's not your first go here, but, um, but fundraising, you know, speaking to either angel investors or VCs or whomever it might be, um, what's that been like for you? And again, there's there's inevitably folks listening to this who, who have that idea and they're thinking about it, um, and maybe they're not comfortable, you know, getting outside themselves or, or networking or whatever it may be. But how, how has that process been for you guys? It's gone pretty well.

You know, we, we've raised a little over $3 million to date, mostly from regional institutional VCs, a couple of angels in there. Um, so we're, you know, we found that it's a very supportive community. Um, I think some of the lessons learned are— I guess I have a lot of lessons learned, actually. Um, I'll give you 2. One of them is, if you're a security company, don't start a slide deck that talks about all the breaches that happen, because every security company, to most investors who aren't really savvy in this space, sounds the same.

It's exactly the same problem statement, it's the same solution statement. It's that— and so I'd say You know, if you're talking about Equifax in the first third of your deck, or maybe anywhere, you probably already screwed up. You just sound like an amateur too. It's low-hanging fruit. It's easy.

Yeah. So I wouldn't do that. The other thing I would say as, as my kind of probably highest tip is if you're pitching a VC the first time you're meeting them, you're probably, you're probably doing it wrong. I mean, if you have to use do. But, um, you know, by and large, I think, at least in my experience, investors don't like to bet on people they just met and they don't know anything about, and regardless of how good your pitch is.

And so, you know, it's their job to know what's going on in the startup community. They'll take a coffee with you. Don't put— like, leave your slides in your backpack. Don't pull them out. Don't do a full pitch.

In fact, say it's not a pitch. Ask them what they think you think— what you think they might need for— sorry, what you need from their perspective in terms of what it would take to be fundable, stuff like that. You start a relationship and they start to watch you and see progress and see you hit those things, highly likely they invest in you then. So like, if we look at our investors and the people that pulled that trigger, any significant check was from people who basically have been watching us for a little while. So that would be my, my thing.

And when we look— looking forward to future fundraising. You know, the VC thing is like crack. Once you go down that path, it's hard to get off it. And, you know, um, so, uh, you know, into the future, that's, that's something that's on my mind, is how to build relationships with sort of the next level of investor ahead of asking them for money when it's not like handout, right? Yeah, before that time.

So it's, it's almost like a, it's almost like a large enterprise sale, right? Like you're not gonna pick up the phone and say, hey, I got this great idea, you know, here's what it costs, blah blah blah. It's a little bit about building the relationship and obviously putting some meat behind your offering, but also making sure that you stay visible to the right investor at the right time. So it's much more of like a relationship sell than it is like a— I don't mean sell, but you understand where I'm going with this. Well, no, of course it's a sale.

I mean, you And yeah, you're right. I mean, if you're thinking about it as like an SMB sale where it's turnkey and someone's just going to cut you a check, it's wrong. If you're looking at that as something that's going to take a year or something to develop, and it's very much like an enterprise sale. And actually, it's interesting because there's in the VC world, like the enterprise sales world, there's a lot of stakeholders, many of whom are quasi-invisible. You know, it's really interesting to figure out how that works.

Um, the better you understand it, the more you understand what's happening behind there. For example, um, VCs will often offer to be helpful and say, oh, you know, who are you trying to sell to? Yeah, Company X, right? Yeah. Oh, I know, you know, put you on the phone with a buddy I know who's there, right?

That's diligence. They don't call it that, but it is, right? They're, they're, they're looking for, is that person ready to buy or not? And, and their review on that is how they're making a decision, right? So that's— that ends up— these people that they introduce you to are stakeholders.

I see. That you have to sell also. Maybe that's obvious, but, um, but much like an enterprise sale where you have different personas, different people, they're coming at it from totally different places. And it— but unlike an enterprise sale, sometimes they're throwing completely the wrong people at you, right? They don't understand you enough.

Well, no, I mean, they're like, you know, I know someone who knows something about security. You know, this isn't necessarily your buyer or anything, right? And, um, it's just a lack of understanding if that happens. Okay, okay. So, um, when you started the business a couple years ago, um, as you and co-founder, just the two of you, correct?

Um, and now you've grown. Um, what, um, we know that talent is scarce in, you know, security community. There's tons more open jobs than there are candidates How are you guys, and this is something I think everyone who starts security company, business division, leading, any leader, they struggle with, is number one, attracting talent, and number two, retaining them, keeping them around for longer than 6, 7, 8 months just because someone's gonna give them a call or an email that says, hey, I've got a better job, it's gonna pay a little bit more money. So what are you guys doing maybe internally with your culture or to develop people, or how are you making this a place that people want to go to? Yeah, good question.

I'll break it down because it's two different things. One is attracting talent. Um, I mean, one of the things with that is— so I learned a long time ago when we started doing threat research stuff in antivirus, we were looking for people who knew how to do reverse engineering of software, right? Very specialized skill set. And we had an extremely hard time finding people in the US who could do that.

It turns out most of the antivirus companies are in places like Malaysia and the Philippines and Eastern Europe, and ultimately we ended up having to open up, uh, an office in the Philippines to get the talent that we needed, right, for that. Um, and that experience has stuck with me, both, both in terms of how much I dislike large, uh, time zone management issues, but also in terms of like Um, if, if you're, if you're, you know, hyper-local, that's good for some things, but it's bad for others, especially for recruitment. So one thing we do is we're a semi-distributed company. We're not too distributed time zone-wise, but we're somewhat distributed. And we've built our culture around that such that, you know, people— most, a lot of interactions and questions happen on Slack, and, and we do video calls with things so people don't feel left out.

And it allows us to recruit a little more broadly, which is good. The other thing we do is we're very, very mission-focused. You know, I, I, uh, it was important to me that the next company that I founded had a mission orientation to it, something that people really cared about when they join. Because you can't— we're not going to compete against the salaries that Google and Amazon is throwing at engineers today, especially, right? Engineers are the problem because the the inflation in salaries is enormous.

And, um, if you, if you can't find people who are just bought in on, sold on this idea that like, look, people are building software wrong, data security is a massive problem, it's affecting all of us, it's really, you know, I don't mention Equifax and Capital One. Well, like, it pisses me off when, when my data is, is breached because people aren't doing it right. And, and, you know, it bothers me personally and it bothers most everyone who's working at IronCore. Having that where you care is important. Like, it's our number one filter in hiring, and it helps with retention.

How do you figure that out? Like, what's the question? Or maybe it's a post-interview discussion you all have to say, this, you know, this woman really cares, or she doesn't really give a shit. You know, like, well, we usually have— everyone does some checks on kind of passion for the space and understanding of like, you know, do you care about privacy? Do you care about data?

You know, how do you think about these things? We also do, uh, we always have at least one person do what we call the values interview. Okay. So this is the idea of this— it's more, more than just that. We have other values that we filter for, like curiosity, for example, is one that we think is extremely important to someone who's going to be successful here.

Um, and we, we craft scenarios usually to try and test these types of things and say, you you know, what do you do here, how do you do that? It's hard, it's hard to interview for that, um, but it's kind of important to us, so keep trying. Yeah, I mean, you know, early on you gotta— you can't— with, with, you know, early hires, those are pretty critical, right? So you gotta make sure that, um, there's so many people, um, there have been so many experiments. I know Google's led a couple and, and Microsoft's led a couple of, of basically teams who may not— I don't know exactly what it is, but it's like teams who may not work together or put together the best product or service or whatever it might be, but they gel like, you know, 10 times better than the next team.

It's the— I mean, the big one is this idea that there's safety in disagreement, right? That's the— that's some of the best I do a lot of reading on like organizational psychology and different things, but the thing that— the biggest takeaway is that, um, if there's not a feeling of safety on a team, especially a safety to speak up and talk about things, that's, that's the ultimate killer. Yeah, we, we do our best and we generally do pretty good to filter for that. In fact, some of our values have to do with people who are prepared to speak up when they think something could be better, you know, right? It's like if you're in a startup, the rate of improvement matters kind of more than your starting point by a lot.

Yeah, you know. Yeah, right. And so if you don't have people who are willing to challenge, um, then you're going to have a hard time. And so I think that's important. But then also there's retention.

I mean, you know, that there's just table stakes. So we pay 100% of the best healthcare plan for people and their entire families. That's awesome. It's probably unusual for a startup. It's certainly unusual for a big company.

And, uh, we just don't mess around. It's like, look, whatever you're sacrificing to be at a startup, it's not going to be your health, it's not going to be your family, you know. And, and so, uh, uh, it's just a philosophy of sort of we're all in this together, we're all in the same boat, we're all rowing. Let's, let's like make sure everyone's taken care of. So that's part of how we do those things.

That's awesome. Those are, those are really important things for, you know, a lot of reasons. Um, are you guys hiring right now? Uh, we just went through a hiring round. We've— we're, we're on pause, but we're always looking for good people, and we can hire if we find good ones.

So, um, you know, feel free to reach out. Okay. Um, talk to us a little bit about, uh, here we are on Colorado Equal Security, obviously, um, and, uh, it's a, it's a really healthy environment and ecosystem. Um, what, in your experience, um, what does kind of the outside world think of Colorado and And I've got the good fortune of having lived and worked in the Bay Area, lived and worked in Colorado, and, you know, being able to compare those 2 landscapes. Obviously vastly different, but there's a lot of substance here, you know, across Colorado.

So if you're at, you know, a conference or an event, or maybe it's an investor meeting or whatever it might be, what are they saying about Colorado security? So I haven't really heard people talk specifically about the region. Okay, but what I do have happen, especially— so, you know, the 2 main centers of course are DC and San Francisco for security companies. Um, but when people learn we're from Colorado, I, I very frequently hear something to the effect of, oh, you know, Red Canary is out there, or Ping Identity, or LogRhythm, or, you know, they look at some of the— Swimlane sometimes comes up. The, um, folks that, that are doing well, they, they like to highlight that they're aware of other security companies, you know, generally speaking, later stage.

I don't know how, how, uh, the earlier stage companies are on that, but I'll say this too, you know, we get a lot of inbound interest from, from VCs and other, like, private equity and other kinds of things like that. And, uh, you know, there, there are people with basically theses around, um, how the privacy laws are changing things in that there's a lot of opportunity there and they're looking for folks that are figuring it out. And so, you know, um, I, I also spent a lot of time in the Bay Area and I lived there for many years. Um, you grew up there, right? I grew up there.

Um, I grew up there. I spent a lot of time there. The, uh, um, I don't think it's a big disadvantage to be in Colorado. I think there's, there's a class of VCs who think you're nobody if you're not. But I think that's a vanishing class, to be honest with you.

It just doesn't make sense, right? You can't, you can't hire and retain people meaningfully in San Francisco because it's so expensive and because they can jump so easily to the next thing. And so like, it's a terrible— financially, it's a terrible place kind of to, you know, there's a lot of talent, but there's a flip side, and the big companies are eating it up. Yeah. Um, how are you guys— who I don't know if you can share who some of your competitors are, but like, what is the, you know, as you're out in the market, your number one?

I mean, I love the 100% healthcare thing. That's really interesting. But maybe on, you know, just from a business standpoint, who you guys are going up against and kind of what the value prop or differentiation is. So, you know, if you can answer a part of it.

So what we have is a data privacy toolkit. We have a bunch of tools that can be used in different ways inside applications to control data depending on what you're trying to achieve. So we can achieve things like, suppose you're a company, let's say you're a teleconferencing company and you have recorded conference calls. And maybe right after they're recorded, you do some things, you transcode them and you transcribe them when you do some things. But then after that, you're holding this data that's effectively toxic data to you, right?

It's— it can only— bad things can happen from this. It's probably— it's very possibly regulated information in those calls. You don't really know what's in there. It could be talking about people's health or finance or anything, right? Um, and if you— if something happens where someone gets into your, your infrastructure, that's a real, real risky thing.

It's a bad look. Bad look. Um, so like in that scenario, we can help people lock up that data such that their customers can access it but they can't. Their ops people can't. They're— in some cases it's worrisome, like if people have overseas ops people, they get 24/7 coverage on that, on uptime.

Uh, that can be a problem for some customers, right? This is the type of thing where you just lock it and you say, yeah, we don't have any persistent access to that class of data. We have other patterns where you have access to all the data, but the customer ultimately gets access to it. The things that we're doing, we don't see anyone else doing. So we mostly compete against do-it-yourself people who are trying to figure out how to solve these problems.

They're trying to use the other tools that they have available and thinking about like, ah, can I use Amazon's key management server to accomplish my needs? Well, probably not if you have to do per-tenant encryption, or, you know, and it depends a lot on on the details. So from, from the perspective of, of the landscape, um, we're not bumping up against people, you know. From the perspective of hiring, of course we bump up against everyone. Yeah, right.

But, but from the perspective of like what, what we're selling today, it's, it's fairly wide open, you know. It's a space we really want to own. And, you know, I mentioned we're very targeted in how we do our marketing campaigns, so the people we're targeting, maybe we hope, are everywhere. Um, but to people we're not targeting, it's like, who again? Yeah, yeah.

Uh, that's, that's probably in our next phase. Yeah. Has changed that. Has Techstars done much to help you? So you were a graduate of Techstars, um, um, and, uh, last time you're on the show, there was, um, you know, it was a big part of, of IronCore's identity, and I'm sure it still is, although it's probably evolved.

What have, um, you know, kind of what, what's the relationship been like for you in the last couple of years, you know, maybe since the last podcast, or, um, how are they continuing to support you? Because I think a lot of people know what Techstars is at a high level, but, but they might not know kind of all the services that are offered or support or things like that, you know, throughout a company's life cycle. Yeah, I mean, I think for me the best way to think about Techstars is is to, to hold them aside for a second and, and just understand that startups run on, on reputation and relationships a lot. You know, it, it constantly like kind of astounds me how those things tie back in. And Techstars is a lot about— I mean, they give you some credibility up front, but your reputation is, is on you, you know.

Yeah. And, you know, but if you're— if you have humility, if you, if you're authentic, you know, they and they're, and they're fans, and they're fans of most of their companies, they're going to talk to you. And there's this whole behind-the-scenes buzz stuff that happens, especially in the venture investing space, you know. And, and it's really hard to have visibility into that, but it's, it's happening. And people hear about you, and I heard you're doing really good.

And you're like, well, how did you hear that? You know, right? You know, there's this, there's this whole thing there. And, and so, um, I think Techstars is surprisingly effective at, um, at helping companies in, uh, some of those kind of softer ways, but that are actually easy to discount but, um, uh, hard to overestimate the effectiveness of those things. Yeah, yeah.

Okay. Um, are there like— is it— I mean, is it like a monthly or quarterly, um, you know, time frame with which you get together with them and they support you? Is it like every day you're them, or what is that? No, I mean, I don't talk to Techstars the company, right? You build relationships out of Techstars.

So with mentors and with the people who manage the program, and then it's sort of the cadence— it's different for different of us in our class, you know. For me, it's less often but, but warm. Um, and, uh, and with specific individuals, they do a lot of like mixers and networking events. I tend not to go to many of these. I'm highly selective about what I go to.

I have a— I try to balance uh, um, working a lot in, in home life. And, and so, uh, um, you know, networking mixers are sort of— yeah, yeah, they're, they're like an easy thing to drop from 6 to 8, for better or worse. That's the one time in my day I'm at home. Yeah, exactly, exactly. And so what, you know, very occasionally I go to those things.

I think other people maybe get more out of, uh, out of the Soleil alumni networking, uh, than I do. I, I'm more For me, it's been more about— I mean, I think we continue to get a lot of value out of it, but it's not like— no, I'm not calling them daily or anything. What are kind of your current challenges? So, you know, you guys have grown this business. And, you know, if you want to get to the next milestone, however you might define that, what's going to be a hard thing for you?

Obviously, hiring is always going to be near the top, but what are some of the other challenges that you guys are anticipating to kind of get to your next growth stage or whatever, you know, however you might define that? Yeah, I mean, startups are like video games, right? It's like, ah, you beat the boss and you feel real good for a minute, and you're on a new level, and you've got like all new sets of challenges, right? You know, I beat Koopa. Yeah, here we go.

Yep, yep. And Koopa's back, so, uh, he's bigger this time, spits fireballs pretty much. Yeah, so that's, that's it. I mean, it's, uh, it's just the, the constant struggle. You don't, you don't do a startup if you don't like struggle.

And, and, uh, you know, we're, we're like, I feel like we're, we've really leveled up. 2019 has been a banner year for us. I think 2020 is going to be really interesting. We're gonna— one of the— one of our challenges is because we're a developer toolkit and an enterprise sale, we have, we have timelines that work against us in a lot of ways, right? So we have, um, we get tangled up in projects that, yeah, it's like not, not anything to, you know, we're a piece of a project, but we're not, uh, like the timeline of the project has almost nothing to do with us.

And so interesting. Um, uh, you know, what we need to do is we just need to scale, and that, that'll all balance out anyway with that. Um, you know, we've, we've had like— we had a lot of projects that finally landed and really hit in 2019. It was a, it was a big breakout year for us. Um, we had our first profitable month in September.

All right, have that again in October. So congrats. Yeah, right, that's great. Thank you. So, uh, so we're Um, we're in good shape right now.

Things are going well. But, but yeah, the next, the next level is how we scale it and how we, um, how we challenge some of those timelines and bring them down. I think there's lots of things we can do, uh, and in kind of all areas, from, from our marketing side to our sales side to our, to our product, to, to tackle those. And, you know, got our work cut out for us. Is that, um, you know, this October 21st, 2021 or 2022, you know, a couple years from now, maybe we'll have you on again.

But, um, where do you see, you know, what are you trying to have accomplished, um, across any of the deliverables, whether it's fundraising, whether it's marketing and branding, or headcount, or market penetration, or, um, you know, again, just fast forwarding 24 months, um, you guys, you, you know that you I've been doing the right thing over the past 24 months if X. Well, we have, we have, um, a big hairy audacious goal, BHAG, that by 2022 will protect— BHAG, have you heard that before? I've not. It's, uh, I think, I think Collins, uh, coined that one. But anyway, the, uh, um, our, our 5-year goal from 2017 looking forward, so to 2022, is to secure the data of 1 of the internet-connected population.

Wow. And so, um, that's how we'll measure, measure success in that time frame, is like, have we, have we reached broad adoption where whether people know it or not, we're protecting their data and we're keeping it safe? And that's, that's what we're measured on. And, you know, we're, we're actually already getting there. It's, it's kind of, it's kind of amazing.

Um, there's a project that should go live next year that'll bring us close to 1%. We have another one that's probably towards the end of next year that'll protect the healthcare data of every citizen in a small Asian nation. That'll knock us up a little bit more. So we have— we're— I think we can do it. That's what we're looking at, you know.

Yeah, it sounds like you guys are making some good progress. Yeah. What else? What else do people need to know about you? About IronCore, about Boulder, Colorado, that, uh, that we haven't touched on?

I mean, if you're not thinking about data— if you're, if you're in a tech company and you're not thinking about how you deal with that data meaningfully, not just like the old school, put it in a database, yeah, your application is going to govern who can access it— that's, that's not it anymore. The world has moved. The, the, the old perimeter-based, we'll secure the network thing is not it anymore. And so if you're not building for the future, you're probably making a mistake. And I'd be thinking a lot about your data, what data you hold, what data you need to hold, what kind of trust is required and whether or not you can earn that trust from large companies and how you might do that.

That's the world now and more so into the future. Very cool. Very cool. Well, thank you for coming onto the show, Patrick. It's great to hear about the success you guys are having.

Are having, and we look forward to more in the future. Yeah, thanks for having me, Ty. Learn more about the Colorado security scene at colorado-security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember Remember, Colorado equals security.