Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is your newscast for episode 201 for the week of March 8th, 2021. Alex, we were just talking, the weather this weekend is, uh, is beyond gorgeous.

Yeah, it feels like we're actually into spring now. Uh, 60s and even 70s. It's beautiful out there. So it's, it's, uh, this is a good time, safe time for us to go plant our flowers. Is that, is that what you're saying?

Uh, I, you know, I'm a Master Gardener, Robb. I don't know if you knew that or not. So, uh, sure, go for it. So I was, I was just kidding. This is a terrible time to plant your flowers.

You will lose all of them when the big snow comes sometime in April. And clearly I was kidding that I am a Master Gardener. That, that part was obviously, uh, obviously kidding. Hey, let's, uh, let's jump into some housekeeping. We do have a Slack channel and there's a lot of people there talking about some interesting stuff.

You can join us there by going out to colorado-security.com and clicking on the Slack button. While you are there, go to the bottom of the page, sign up for our mailing list. You will get one email a week with the show notes when the new podcast comes out. We'd also love it if you went to your favorite podcast player and rated us and subscribed so you got this automatically every week in your podcast player. If you want to help us out even more, you could tell a friend, help us get some more listeners, and really help build the Colorado security community.

I mean, much bigger than the podcast is just making sure folks are plugged in with the community in general. And, you know, if you want to help us even more directly, we would love it if you'd support our Patreon campaign. That helps pay for the costs of the podcast. Exactly. All right, with that, Robb, let's jump into the news.

Did you know that, uh, Colorado is getting the country's first drone soccer league? You know, because, you know, I don't like to read articles, I spent quite a bit of time, one, thinking about what this meant before I actually, uh, clicked in and read it. You know, just from the headline, uh, unfortunately it is not very much like Quidditch. Um, That it is, it is on the— it's basically the idea here is that these drones are supposed to themselves go through the goal. They're not actually trying to put a ball in.

They are, they're trying to get in, um, on their own. Basically, the other drones are stopping them from going into the goal. Yeah, um, it's pretty cool. Um, I guess if you thought about the— a drone being the, the ball in Quidditch, it's a little bit like that. But, uh, but every drone is the ball, right?

Yeah, I guess every drone is the ball, and, and every drone is, uh some, uh, wizard on a broomstick too. So maybe you could, uh, actually, you know, mock that up, put a little, uh, little costume on your drone. Anyway, um, you know, this is actually— while it is, as they say, masquerading as aerial combat, it's actually, uh, a STEM, uh, program. So this— there's curriculum around it as well for 6th to 12th graders on how to build and fly drones. So my son goes to a STEM school and I was showing this to him and he's like, oh, that's cool.

I wish we had that. I'm like, well, go tell your school. You guys should do it. Obviously, this is a thing you can do now. Right.

This is aimed at you. This is exactly right. He's in 6th grade at a STEM school. I do think that it's a really cool idea. The fact that it's called the US Drone Soccer League made me think that it was for adults, but no, it's for kids.

And really, it's just getting going right now. So there's a few schools that are a part of it. And I don't know where— I know I saw that in the article here somewhere, but it is— the whole thing's being put together in combination with Wings Over the Rockies, which is awesome because they have, you know, they've been really getting out a lot more recently. I thought of them as a museum, and now it seems like they're really helping influence the community much more broadly. Yeah, and Robb, you know, to your point about this being for kids, just like anything that's for kids, I'm sure that there will be a lot of adults that will try and participate as well.

And parents who are very unhappy with whatever officials are there. Well, yeah, you know. All right, but good stuff. Let's move it forward here. We have an article that's— it's really a roundup of all of the funding that's happened in town in February.

It was a big month for funding. You know, we, we talked on our show about Red Canary raising their $81 million, but there was other big raises that happened in February as well. And this, this show— or excuse me, this, uh, article goes into it. Um, Sorry, go ahead, Alex. I was going to say, so there were $370 million in funding across 11 deals in February, which is a big number, but I also want to point out that in January, there were $600 million worth of funding across 12 deals.

So January was even bigger. There was one really big deal in February with Pocket Outdoor Media, which is a Boulder marketing They do magazines and websites really for outdoor living, and they raised $150 million in February, which is really primarily meant to help them do 5 different acquisitions of other companies. Still, that is a big raise, especially that was a Series B. That's a pretty big number for a Series B. Good stuff.

And of course, the one that's most important to us in this list was Red Canary and their $81 million Series C raise, which was in February. Yeah. It seems like after that, there were a bunch of what we call at work dogs and cats, like the little ones that are important, but there's a whole bunch of them. There's a $10 million one and then $2 million, $3 million, $850,000. So a bunch of little deals in addition to those couple of big ones.

Yeah. I think there were a couple of other technology ones in here that I thought were kind of interesting. I can't remember if we talked about it on the show or not, but I know you and I talked about it, Boulder's Strata. Which is a multi-cloud identity company, raised an $11 million Series A, which I'd never heard of them previous to that raise. And there's also another company called Collimator, which is a cloud-native engineering solution.

So anyway, it's tough. Well, I mean, I think the point, the reason we like to share it is just because there's so much money being poured into tech here in town, and it's worth knowing what companies are out there. So if you're interested in tech in the area, maybe take a look at this article and see what companies are going to be coming up fast the big ones. Robb, speaking of technology startups, Boulder's Left Hand Robotics, which we have talked about, I don't know, it was probably a couple years ago now, was acquired by Toro Company. So if you remember, Left Hand Robotics is the company that makes the automated snow blower shovellers, sidewalk clearers, whatever you want to call them.

And so now they've been picked up by Toro, which I think, as we know, is a a bigger maker of, uh, you know, lawn machines and that kind of stuff. Yeah, so Toro makes both lawn mowers and snow blowers, uh, which— and of course now Left Hand Robotics, they've been making these, um, these devices that, yeah, primarily they're used for snow blowing, but they actually, just similar to Toro, they do both, and, and it's actually the same device. So the device can have a different attachment on the front of it for, um, for snow removal versus for lawn maintenance. And now they're going to be part of a much bigger company and able to do this stuff at a lot more scale. So congratulations to that team.

Presumably, this is the kind of exit they were looking for. Yeah, good for them. And hopefully that we continue to have autonomous robots, but just under a different brand. Now, I know that the article said how much it costs for one, and now I all of a sudden can't remember, but it was like, what, $13,000 or something like that? I want to say it was like $30,000, $35,000 for one or something like that.

But I mean, even at that, that seems pretty reasonable. You know, I mean, if you're gonna hire people to do it, I think you can, you can see the long-term cost savings there. Yeah, I see it's $36,000 to buy one of these rigs. That makes a lot of sense professionally. It's probably not attainable for us to get rid of our own snow removal in our own houses for that kind of cost.

I think you're gonna have to, you know, Work a couple more years, Robb, maybe get a good exit from your next startup and things like that, then maybe you can get one of these for your yard. It doesn't seem like the smartest use of anyone's $36,000 right there. That's probably true. You can get half of your Tesla for that, can't you?

Oh, Robb, you're so funny. All right. Next, one more Denver startup, Denver CypherSkin, also closed on a $5 million Series A round, which is interesting. I guess we've talked about part of that through the times we've talked about them, but we've had so much news about CypherSkin, it's almost funny to me that they're finally just raising a Series A. Yeah. They've gone back and forth.

We've talked about them on the show as— initially, I think the first time we talked about them, this is a suit that people were going to wear to track movements and the military was interested in it. Then the next time we talked about them, it was this material is going to be wrapped around pipes to look for leaks, covering many miles of pipes for oil and gas companies. And those both made a lot of sense, but they've really been trying to find themselves. And it sounds like during COVID they believe they have. So between 2019 and 2020, they saw a 3,200% increase or growth of revenue.

So assumably, they're coming from a very small number of revenue at the beginning up to a formidable formidable one here at the end of that. And then they've also seen a 250% increase in number of employees over that year. So they've really had big growth and really they've, I think, settled themselves on being a company that's going to work with the DOD and on people versus on pipes, right? Yeah. I mean, I would imagine if they get to a point where they are big enough and can focus in multiple places at once, maybe you bifurcate the product line and do a couple different things.

But yeah, it sounds like for now they're focusing on the people side. Yeah, so congratulations to them. Like you said, I was surprised that it was just an A round. It feels like they've had a lot of momentum. Um, hopefully this, this helps them accelerate and, and get that growth point where they're, uh, where they're being bought by Toro in a year or two.

That's right. All right, uh, moving over, we have, uh, interesting— it's Colorado news only because a new company's coming to Colorado to sell electric vehicles. So I had never heard of Polestar, but it looks like this is a Swedish electric car brand that's going to be opening up a new store at the Cherry Creek Mall area. And this is directly competing with Tesla, and Tesla already has a store at Cherry Creek, and Polestar says, okay, well, you don't own Colorado. We're going to come get some of that big, sweet, sweet market.

Yeah. So I had heard of Polestar previously. There have been some reviews actually of some of the Polestar vehicles saying that they are on par, even better than Teslas, which is interesting to hear. They are a little bit more, I think, expensive on the low end, but they also look pretty cool. This is a company that was started as a spinoff of Volvo.

I think instead of trying to have Volvo electrify their cars, they decided to just make a different company and start from scratch. It's pretty cool for me to see another start-from-scratch electric car company that's actually coming to market and being part of the infrastructure for electric cars. Yeah, they do have 2 cars they're going to be selling, they currently sell. One's called the Polestar 1, which is a hybrid. It's $156,000 to start, so very expensive starting point for that one.

It has a 60-mile electric-only range, which is actually the longest of any hybrid car. 60 miles doesn't seem very far, but mostly you're thinking electric vehicles are going to have better ranges. Those hybrids are where you don't get the great range. But then the Polestar 2 is their fully electric car, and that one has a range of 233 miles, starts at $61,000, and it has a 408-horsepower engine in there. Yeah.

Yeah, pretty cool. The— yeah, that $160,000 hybrid, that seems like a little bit out of reach for most of everybody, but I mean, even at $60,000 for the fully electric car, I mean, while it's expensive, it's not that much more expensive than a fully decked out gasoline car. Yeah. I think it's neat to see competition in that space. To me, that's the big deal.

We don't want to be pinning our hopes on electric cars on Tesla and the big 3 car manufacturers in the US here. It's nice to have more options. Seeing these guys come in. And by the way, they have been beating Tesla in some countries around the world. I thought this was kind of an interesting paragraph.

In Sweden, they are beating Tesla. The Polestar 2 sold 504 units versus 246 for Tesla's Model 3. So almost doubling Tesla's performance in Sweden. Well, you know those Swedes, they like their homegrown cars. They sure do.

Yeah. Good stuff. All right, uh, moving on to the next article. Uh, again, another funding article here. Uh, Denver, uh, truck startup Fluid is raising a $63 million Series A ahead of a national expansion.

So you've probably seen these, uh, Fluid truck rentals being used by delivery companies— Amazon or UPS or FedEx or whoever it might be. I think as overflow vehicles. During the pandemic, there have been many more deliveries than previously. So they look like a lot of the other trucks, but have that Fluid logo on the side of it. But this is sort of their strategy is to be that overflow, the Uber of delivery trucks, for example.

And now they're raising some money to go nationwide. Yeah, I think we may have had this conversation before. I— the first time I saw a Fluid truck come to my neighborhood, I thought, ooh, does my neighbor get some kind of medical something delivered? Like, what's happening here? Uh, and, and I definitely didn't know that they were a Denver company for quite a while either.

So it's pretty cool to know that a Denver company has been able to, to fill in and step in, or step in and fill a need here for, uh, for delivery as the pandemic's obviously greatly accelerated the need for deliveries to homes. A couple of stats around this, Fluid saw a 6x revenue growth in 2020, not a huge surprise, and they've expanded into 9 new markets. They have about 150 employees right now and they expect to grow another 200 employees by the end of this year. So just massive growth going over there. And then another interesting thing, as a part of this raise, while it's not directly part of the raise, it seems like it's related.

Shortly before the raise, Fluid had come to an agreement with Lightning Systems, which is a Loveland-based electric vehicle company. And basically, they're going to work with Lightning Systems to order 600 electric trucks or modify some of their existing trucks to become electric vehicles as a part of the strategy for the company. And one of the investors in Fluid is the parent company for IKEA. And IKEA said, hey, we're trying to have a zero footprint philosophy. And if you guys are willing to do that, we're willing to put some money into your company.

So kind of a neat thing. Watch out, Polestar, here comes electric trucks. There you go. Yeah. Pretty good.

Congratulations to Fluid. I think similar to you, Robb, the first time I saw one of those, I thought, oh, is someone getting spring water delivered to their house?

No, no, no. It's just Amazon dropping something off. Okay. All right. So next story we have here is, it's actually about another raise, I believe, Dispatch Health.

So this is a local healthcare company, but what they do in terms of healthcare is a little different. I hadn't known about this, but basically they provide in-house services that basically mirror what you would get from an urgent care or an ER, but you're getting that directly delivered to your house. Yeah, and they've also expanded a little bit, adding some long-term care equivalent kind of services as well. You know, things that you might get from being admitted to a hospital overnight or, you know, at a skilled nursing facility. So they actually just closed a Series D, I believe.

Yeah, it says Series D and they raised $200 million. Yeah, that's a pretty big number. After a $135 million Series C. The headline here, the reason it is so noteworthy is they have now officially joined that unicorn category, that mythical unicorn category, which is a private company that's worth over a billion dollars. Based on this valuation, they're worth $1.7 billion. What I want to know, Robb, is when does inflation or something else kick in and they have to bump that number up?

$1 billion no longer a big deal for a private company to be valued at. Maybe they keep the unicorn number at $1 billion, but they add like a Pegasus layer that's even better than unicorn. Yeah, that'd be great. I think we should push for that. Well, congratulations to those folks.

They do mention that they're currently in 31 markets and they're going to be over 100 markets in the next few years. I love to see these options and having Anything that helps improve our healthcare system as a nation, I think, is just a good thing. Yeah. One thing I pulled out of the article that I thought was pretty cool, their CEO said that over the past few months, they figured out that since they've been growing so much, how to scale up quickly, and they've been adding new locations every 2 to 3 weeks over the last 6 to 9 months. That's pretty amazing.

Every 2 to 3 weeks, that's pretty fast. That is pretty fast. So, all right, uh, next story. Now we are finally getting into the security news. We had lots of non-security news this week, but, uh, lots of good stuff.

Uh, Ping Identity has joined the Decentralized Identity Foundation to advance open standards around personal identity. Robb, what does this mean? Yeah, so, so over the last, I'd say, well, about a year ago, Ping acquired a company that, uh, Showcard, which was really all about giving users the ability to control their own identity and their own claims, versus you having to use your Gmail or your employer account to claim who you are and get some credibility. This is basically for us to have it on our own. That's basically the idea of decentralized identity.

Everyone has their own identity, and it becomes trustworthy based on claims that are made by other folks on it. So Alex can can present to someone, hey, I'm Alex Wood, and I'm the co-host of Colorado Equal Security, and the reason you know it's true is because you're able to come back and take a look at what does Colorado Equal Security say about that? We validate it. So it's decentralized where there's not any one individual that's making decisions for everyone else. We're able to validate each other's claims.

Anyway, so that's the idea behind decentralized identity, and this is a new group that's really here to try and make it happen. So when I say new, it's actually been around for a few years. Ping has just joined, but it's relatively new new anyway, right? Coming out through the details of how do you do decentralized identity. And I know in the past, Ping has been a part of the Identity Defined Security Alliance.

And I personally think of this as being a very similar thing where it's different companies who all have a vested interest in making this new future come to light, teaming up together and coming up with standards and then helping figure out how to get those standards out into the world. Yeah, that sounds pretty cool, both the concept and the fact that Ping is trying to push that forward. So good stuff for them. All right, last story this week is a— it's actually a link to a webinar by LogRhythm. You know, I don't know that we— we haven't done very many of these ever where we talk about a webinar that's coming, but I thought that this topic was really interesting and worth our listeners setting aside some time to attend.

This is dissecting the Golden SAML attack that was used as a part of the Sunburst attacks. So I mean, everyone has now heard of SolarWinds lots of times, and, and we've used the word SolarWinds kind of as a shorthand for this series of attacks that occurred. Uh, the— this is going to talk you through what different things happened as a part of that, not just the SolarWinds part, but all the identity stuff that happened. You know, once they got into these environments, they didn't, they didn't just, uh, look around and leave. They started compromising the identity systems.

So LogRhythm has a— has this webinar coming up Uh, actually it's happened, but it's now recorded. You can see, um, that basically talks through all the details of how they attacked Office 365 and AD FS to, to get in there. Yeah, and I mean, I think that is one of the, the important takeaways from the whole, uh, SolarWinds fiasco too, right, is that, you know, this started as a, uh, supply chain, uh, attack, but, uh, after that there were a lot of novel things that the attackers did. That, that we can learn from in terms of detections and, and hardening and other things like that. So definitely the, the Golden SAML Attack is one of those.

So I recommend checking it out. Good stuff. All right. That is our news for the week. With that, we can jump over to the Slack message of the week.

Thanks to Andre Gaeta, who has been a continued supporter of us and the Slack message of the week. One lucky winner will get one item from the Colorado Equal Security store paid for by Andre. And Robb, who is our winner for this week? This week we have Joe McCallister. Joe, I actually was like, oh, I feel like Joe just won recently, but no, Joe won just over a year ago.

So time goes very quickly. But Joe is our winner this week. He shared a link to a podcast, which I basically, I want to amplify his recommendation. There is a Darknet Diaries, is a security podcast. And I'd say that compared to us, like the difference is we're here talking about news, local events, we do some interesting interviews.

He is all about telling stories, stories about interesting breaches, about just things that happened early in the security timeline. Really enjoy his podcast in general, and this specific story was about the LinkedIn breach. I'll be honest, I almost didn't listen because I thought I knew everything there was to know about the LinkedIn breach. Turns out I didn't. There's a lot of surrounding information that made for an interesting story, and I just wanted to echo Joe's recommendation.

Once again, congrats to Joe, and of course, we appreciate you being a part of the community, and you'll get to pick one piece of sweet coffee. Colorado Equal Security swag for your, for your own. Awesome, good stuff, and congrats, Joe. With that, why don't we move over to events? Yeah, our first event— oops, sorry, Alex.

A lot of great stuff coming up. Go ahead, Robb. Yeah, and of course, if you want to see all of the great stuff that's coming up, go ahead and swing over to the Colorado Security website, go to our calendar of events, and you can see many months of events. But over the next 2 weeks, we've got a handful of good stuff starting on the 9th. ZapCon is happening.

So as a reminder, Zap is the technology that underlies StackHawk, and they are going to have the first ever ZapCon. Uh, on the 10th, Denver ISSA is doing a meeting, Zero to One: Building a Security and Privacy Program from the Ground Up. And this is not starring Janelle Hsia. We have errata from last week, right? Errata.

Although I did hedge, I thought I, you know, it— I thought it did have Janelle, but it does not. So no Janelle. So it's Doug Brush and, uh, Christopher— is it Leitz? Leitz? I don't know.

Christopher. Yeah, something like that. All right. Next event is on the 11th. It's ACES, the local physical security company, doing an event called Your Personal Brand Matters.

On the 16th, another ACES event. They are doing a Women in Security Coffee Chat with Tanya Taylor. Also on the 16th, the Cloud Security Alliance of Colorado has their March meeting. On the 18th of March, ISACA Denver is doing their March meeting. And finally, on the 19th, it's, it's the start of March Madness.

So this event, actually, if you're waiting to the 19th to do this event, you're probably too late, or mostly too late, uh, where Douglas— or sorry, Jason Jaques is putting together a bracket for folks to, to compete in March Madness. So if you're someone who loves to, to spend lots and lots of time looking into all the different teams and, and then end up losing because you picked the better team to win, uh, this is probably for you. And if you're also someone who likes to randomly pick teams and somehow win anyway, go ahead and join up. We'd love to have you join. So go out to the Slack channel.

And where are they supposed to go on there? Do you know? There is a fantasy sports channel on the Slack channel, so you can go there and check it out. Jason is helping to promote, but Grant Sturgis, I think, is also involved in terms of being the administrator for the site doing this stuff and collecting entries and that sort of thing. Oh, awesome.

Well, thank you very much, Grant, for doing that. Yeah, good times. All right, uh, those are the events. Let's move over to jobs. Robb, does Ping have any jobs this week?

Yeah, I got a couple security jobs I'm hiring for. We're still working on our program manager role, uh, and I'm also looking to hire product security engineers. So if you're interested in either of those, reach out. All right, Freshworks is looking for a VP of cybersecurity. Uh, the city of Colorado Springs is hiring a security analyst too.

Also, there was, there was another Colorado Springs, uh, City of Colorado Springs position as well. I think it was a senior, not it, not a 2. So even if you're more experienced and wanted to work at the City of Colorado Springs, there's another job out there. Zoom is looking for a security documentation and engagement specialist.

First Bank is hiring a manager of information security. I did want to say about Zoom, they're actually hiring a bunch of different positions. I think there was 5 or 6 that I scrolled through to pick the one that was there. So if you're interested in working for Zoom, take a look. There's a bunch of security roles here in town.

Yeah, they seem to hire a lot of people here, which is good, but surprising to me. FirstBank is looking for a manager of information security. Western Union is looking to hire a leader in information security. They don't— I mean, the job description gets into more details. I did find this kind of an interesting title.

What does that actually mean? Just leader of information security? You have to click to find out. Couchbase is looking for a senior manager of information security/GRC. Vail Resorts is hiring a security analyst.

And finally, Trimble is looking for a director of cybersecurity. All right. I think that is it here for the news, but we do have an interview this week. Jason Jaques sat down with Renny McPherson, and Renny is a partner— he's actually the managing partner at First In, which is a capital firm that focuses on technology. And I think they've also specifically been focusing on security investments.

I'm very excited to hear this one, so it should be a good interview. Good stuff. All right, Alex, we'll have a good one. Go enjoy the weather while you can. I'm sure it'll be miserable in a few days.

That's right, enjoy it while you got it. Thanks, Robb. Hi, this is Mary Haynes, VP of Network Security at Charter Communications. Welcome to Colorado Eco Security, for Colorado security professionals by Colorado security professionals. Hello, Colorado Equal Security.

I'm Jason Jaques. This interview is with someone new to Colorado, Renny McPherson. He's the managing partner with a VC firm called First In, and they focus on security startups. This was a fun interview. Hope you enjoy it.

Renny, great to have you on the podcast. Thanks for joining me today. Thank you, Jason. Excited to be here. Yeah, I'm very excited to have you, and so is the Colorado Equal Security community.

They came up with a ton of questions for you. So, I'm super excited to share some of those questions with you and get some of your answers. But before we kind of dive into that long list of questions, I do have a few of my own first. So, I'm curious, tell me a little bit about yourself, where you're from, and how did you end up in Colorado? Sure.

Great. Yeah. I grew up in New York City. Originally, and after a career, a short career in the military, lived in the Washington, D.C. area for the better part of a decade and a half. And this past August, we moved to the Roaring Fork Valley of Colorado.

So we live in Snowmass in Aspen. And We, both my wife and I, as kids and teenagers had grown up spending some spring breaks out here in Snowmass, and we came to the conclusion with young children that it was now or never to move to the Mountain West and specifically to Colorado. We are thrilled to be here. Uniting our love of the outdoors and what we both see as a burgeoning tech and security ecosystem. We're excited to be in Colorado and excited to do what I can to be part of this growing ecosystem.

Yeah, that's awesome. Colorado is excited to have you. And now that you have moved to Aspen, I'm curious, if you have new hobbies or if your hobbies have changed at all. Well, the, the, the main thing is that I realized while I thought I was a half-decent skier, clearly compared to those who've lived here for years, that is not the case. However, I do enjoy downhill skiing and hiking and walking, and, uh, I plan to add one new phenomenal outdoor hobby per season.

And I think that'll give me about 3 years of new hobbies given mountain biking, fishing, uphilling, Nordic cross-country skiing, snowmobiling. So I'm eager to really embrace the outdoors. I've always loved the mountains and loved the outdoors and excited to hopefully take it to the next level. I like the mindset. That's a great way to embrace it.

Okay, a couple more questions of mine. Your mother was a soap opera star. That's, that's what I've heard. I think you told me that before. I have to know more about that.

What, what's that story? So my, my, my mom, um, is just an incredible dynamic person and was such still is incredibly fun, was such a fun parent to have as a child. Growing up, she has a great story herself that I think should resonate with entrepreneurs. It certainly was a lesson I remembered a lot when we were building our operating business, Red Owl, and I was out doing a lot of the business development and sales. That story is that raised in a time, I won't disclose her exact age, but it was, you know, she was raised in a time where, as a, you know, in her community, there weren't a lot of women that worked sort of outside the house.

And her dream was to be an actress. She had a first husband and had a sort of, stay-at-home kind of life, but they ended up not being together for the long haul. And she auditioned for a commercial, and she auditioned for another, and she auditioned for over 100 commercials. Finally got her first break, which I think for any of us who are entrepreneurs, former entrepreneurs, that resonates with. And then You know, then it started coming.

She was the One-A-Day Vitamin girl. She was in a ton of commercials, and then she got a break onto soap operas. And for my entire childhood, she was on the same show, which is called Guiding Light. It's now unfortunately off the air, but it was one of the original soaps on the radio and then on CBS. So she was on CBS's Guiding Light for something like 26 years as a cast member, first as a, you know, one of the core cast and then as a mother, then as a grandmother.

So she really saw it all and had some really important storylines and it just served as an inspiration. And, you know, I like to hope that both her ability to, read people and create an early sort of an ease with people to get to know them quickly is something that I at least got a small fraction of, but she is a really special person. Yeah, that's fascinating, and the perseverance to keep trying and trying, like 100 auditions. That's impressive. That's right.

Yeah, yeah, exactly, exactly. And I know that you also had your own podcast called Numbers and Narrative, and I'm curious about this as well. How did you get into having your own podcast? What was, you know, what led you to begin it, and why did you end it, or or stop it? I did.

One of my closest friends and I, who had met writing a story for our college newspaper many years ago, nearly 20 years ago, he and I came together shortly after I had left my operational role at Red Owl, the cyber business that I built with other military and intelligence veterans, and I was building another company, a bootstrap services company, and I really wanted to think and work deeply on people who were in the middle of building things. He and I got together and thought, we've all read the books about some of the tech and entrepreneur heroes, and While those are important to read, I wanted to think more about what is it like when you're in the middle of building your company? His interests were a bit broader than that, more on some policy issues and other things, but we alternated shows, so I would record a one-on-one, then he would record a one-on-one, And we started with some of our good friends who were doing interesting things and then branched out from there. This was early days, half a decade ago, which the growth of podcasts has really been something since then. We both had a lot of fun with it.

And the reason why we ended up shutting it down is that we started to get some really, sort of at the edges of our network, some guests who we thought were, they were really, they were more and more influential, bigger deal people, and not that our early guests weren't, but we didn't know them as well. My podcast co-host, Joe Flood, and I had a heart-to-heart and said, we either need to double down and really start doing more with this, probably paying someone to edit it really well, step up our game, or else we should shut it down. Because in those days, we would just hit record, let the conversation flow, hit stop, and post it, which fortunately, we had some people that were pretty, everyone was pretty articulate, et cetera, but it really, we just made the decision to shut it down. It had started as really a fun thing for him and me to do, but we noticed that it wasn't totally focused. It wasn't really thematic.

It was kind of our people who we thought were doing some interesting things. So, if I ever do a podcast again, it will be more, much more focused than that one. It's funny that podcasts tend to run their course, for sure. What's interesting about the Colorado Equal Security Podcast is in a lot of ways, it's community-driven. And so, That's why it just keeps going and going and growing.

So it's kind of cool. I did notice your podcast sort of rebooted a little bit last year in quarantine. Did you do any of that or was that the other gentleman? Yes, that was Joe. So Joe Flood did a little coronavirus reboot as the pandemic was first hitting and sort of did a Again, just sort of with, with some people, close-in people in, in his, our network.

And, um, you know, I think it was just maybe a dozen sort of quick-hit episodes just for fun. But, um, yeah, that was, uh, that, that was the, the short-lived, the short-lived reboot. Okay, okay, good stuff. All right, you ready for, uh, Colorado Equal Security community questions? Great, yes.

Let's, let's dive into those. So these come from the Slack channel. Anyone out there, any listeners out there, feel free to join. And yeah, these are all sourced from the community. So let's start with this.

What do you do differently or better than other VCs in the early-stage startup space? Right. So that question sounds like it could be any institutional allocator challenging us to why we are so good. So First In answers those questions fairly frequently. Also a very fair question for entrepreneurs to ask.

And the short answer is that we seek to partner with a pretty specific demographic of entrepreneurs, first and foremost, which I will loop back to. And within that demographic of entrepreneurs, we only invest in 2 to 3 companies per year, which for a seed-stage firm is fewer than most. We are more concentrated than other firms. So the relative dollar amount going into those companies is greater. And as a result, while I think every VC would tell you that they add value to your company, we have very tangible ways of doing so.

I have built a team of venture partners who all have very specific and relevant skill sets for seed stage, very early stage venture. So we invest typically when a company may or may not have revenue. They may be on the precipice of revenue. They may— in one case, we invested in an inception stage company. We'll invest at seed when maybe there are a few pilots and V1 of a product.

And I have a team that— I've been on the business side for a number of years, but we have a team of 2 technical diligence partners who are venture partners, one of whom co-founded Red Owl Analytics with me and now runs his own security, cybersecurity product firm focusing on operational technology, Dr. Josh Lo Spinozzo, after a career in Army cyber, as well as a gentleman named Bobby Toohey, who had worked at the NSA and in various units within the Navy and other parts of SOCOM, Special Operations Command. So those 2 are able to conduct really high-level technical diligence. They also have excellent networks of software developers, VPs engineering, data scientists, data engineers, et cetera, which are extremely helpful because those are hard skill sets to find. We have 2 people that are— or 3 actually, in addition to me— that are very focused on sales and go-to-market. Ish Boyle, who had been a Marine Corps veteran and worked at Splunk as a top sales producer, now at Zscaler, who has a great network and really has helped our portfolio companies with go-to-market and sales strategy.

Art Carell, another Marine veteran who helped FiscalNote grew from $0 to $75 million ARR, so watched it and did it, built it. He's now at Anduril, a pure-play defense tech company. And then Ethan Oberman, who is the founder of SpiderOak, an early data privacy company, and now really a mentor to founders, someone to empathize with them. And then we have just a phenomenal intern, Lizzie Kenter, who's a computer science major at Middlebury College. So we actually do help in recruiting tech talent, building out the sales org, going to market.

And the other thing I'd say to answer that question is we are looking for typically people who fit a couple different demographics. One is, We're looking for people who are building dual-use technologies. When we find them, they are often very relieved that we're not totally focused on commercial ARR only, annual recurring revenue. We understand that large enterprise companies always have to then go get the biggest client, the biggest enterprise client in the world, government, US government, Defense Department, massive IT customers, and we understand that, we're open to it, we like it. So that's one thing, dual use, and the other is, we often back people who have served in the military and/or the intelligence community, and that's important because that is an underrepresented founder demographic, and one doesn't hear it hear that talked about a lot, but there are so many veterans for whom they've done incredible work, they've seen firsthand some of the modern threats to the enterprise, and often they are the ones who can benefit from our, you know, shared understanding of that world, as well as the team that we've built, having been in the private sector now and in the commercial space for many years.

So we're looking for those military or intel community vets, maybe who've worked then at another company, got some commercial experience, and are ready to start building the cybersecurity cloud data enterprise SaaS companies of tomorrow. That is an awesome answer. And it's so comprehensive that I think you have answered a bunch of the other questions on my list. So well done. Well done.

The next question, you did touch on this, but kind of curious if you want to expand at all. So how do you assess and make decisions on where to invest? And what in particular are you looking for in a company or founder? Yeah. So we have the team, we've all been builders of early-stage startups and/or growth stage, and one of us now has been working on the public side in tech companies for years.

So we're able to do a couple of things. Well, one learning I had and the team had, I am the one full-time member of the team, but we have a pretty actively involved venture partner group comparatively. One thing we learned since launching First In a year ago is focus. And I want to be a I want to see many opportunities. I want to be a good member of the community.

I want to not miss anything. And that mindset, I think, is critical for early-stage investors. That said, we really refined into, okay, if it's not cyber or adjacent, Something to do with one of the 2 companies we backed last year is a cloud workforce protection, cloud security posture management, a governance risk compliance layer for hybrid and multi-cloud environments.

That is adjacent to cyber. It deals with the ongoing migration to the cloud. You and I, and probably the community here knows that there are still a number of organizations that may tout that they're totally on the cloud that are really still half or more on-prem. But really focusing in on that and just saying to people who referred investment opportunities into me or entrepreneurs who reached out, we don't invest in fintech, we don't invest in companies that are reinventing something having to do with the real estate industry, and just being more comfortable with that. So I think that one, getting really tight on, we are seed-stage security, cybersecurity, and related investors, that's what we're good at.

That was one big learning of the last year. So just being in the right overall place. And then within that, we're looking for teams who have solved these challenges or seen these challenges firsthand. As many of your listeners are familiar with, a lot of what end up being the best companies are from people who, their title probably before was not CEO. And were very comfortable with first-time founders.

They had been solving problems in the enterprise as a practitioner or a leader of practitioners, and now they're saying, okay, this— many of them were security researchers, as is the case with the Colorado-based company that was our first investment. They were security researchers identifying vulnerabilities, patching them, and now building companies to address those ever-growing vulnerabilities. Those are the types of people that we look for and with whom we like to partner, those who've seen it and done it before, and maybe who have a mix of military and commercial experience on the core founding team. Okay, awesome. Great answer.

What areas of security are you most interested in? Yes. So I think, again, as many of your listeners are very familiar with, the world is ever more connected every day with devices, Internet of Things, COVID, many people working from home, that has just increased the number of vectors of attack. So within security, we've gotten excited about a couple things recently, and one I'll loop back to, which is, we didn't have a thesis laid out for this, but when we met the founding team of the Colorado-based company Phylum, P-H-Y-L-U-M, who had firsthand experience with patching vulnerabilities for a Fortune 500. Earlier, they'd worked in the government, and they helped us understand within the world of open source and see it— something we think about is there are all these wonderful themes of technology innovation.

Many of them, though, just need better security, you know, period, right? So open source is a great example of that. Fileum addresses that. Their goal is to be much broader in sort of a comprehensive DevSecOps platform, but they're starting with identifying better for enterprises dependencies within open source code that could contain malware, that could be vulnerabilities. That, that is something that, you know, they learned firsthand.

They tried to deploy the legacy tools to do that. And, you know, found that under the hood, many of those are, are much more manual than people might like to think. So they thought, how can we automate this? That is something that is, is really important. And we We made that initial investment a year ago.

I'd point out our venture partner, Josh Lo Spinozzo's company, Shift5, which, like the Phylum team, Josh and his co-founders had done some research into threats to operational technology, specifically vehicles, so think planes, trains, tanks, et cetera. People who are— we are most excited about finding people who are living this on the front lines, and then saying, we have to build a company to address this threat. That is what we want to spend the next decade of our life or so doing. And people who are seeing these evolving threats firsthand, and who we believe are solving problems that are not just so narrow that they won't have commercial markets. So we're fine if the addressable market today of whatever is being solved is not that big, but we assess, not in 10 years, because you don't want to wait forever, but that in a couple of years, this market is really going to pop, and that there is a real problem that is being solved.

Yeah, that actually leads to my next question, which was, what does success look like for a company you invest in? And you just started hitting on that. Sure. So first and foremost, as I said, we really want to be partnering with entrepreneurs who need at a deep core level, who need to build the company that they are building. That's going to be a defining part of their career.

And we've partnered just in the first 2 investments with entrepreneurs who are closer to the very beginning of their career and entrepreneurs who have already had a lot of success and are building— it may be their last operational business that they create. So have sort of 3, 4 decades of experience before launch. But in both cases, it's people who have dedicated themselves to doing that. So as First In, we want to be investing in companies where we and they don't have to achieve a front-page news, multi-billion-dollar exit, to constitute success for 2 reasons. One, because what they've built is important and is having impact for security in the enterprise, and that's the first real metric of success.

They, and we alongside them, have achieved that. And 2, in terms of dollar amounts, we invest early enough such that for our LPs, the people who invest in First In and then allow us to deploy capital into companies, that we can still achieve an 8x, 10x, 15x at an exit price of $100 million, $200 million. So we're looking for people that are dedicated to building what they are building for a sustained period of time, and who measure themselves by the impact they have on the enterprise. Thereby, as fiduciaries for our LPs, we will be able to provide an excellent return, even without the massive, massive top-line outcome. I like it.

What's the best pitch you've ever heard?

Or potentially, what's the worst pitch you've ever heard? Either way.

While I can't say that one pitch of any portfolio company was so much better than any other, what I will say Jason, and this is a topic I think about pretty frequently with my venture partners and try to get input from other early-stage investors, is this. Many of the investments that I have made as first in or before first in, as an individual angel seed investor, most all of the investments I ended up making, I really connected with the pitch on the first pitch. So probably, if I thought about it, last year when I transitioned from an angel seed investor to doing this full-time, there might've been 4 or 5 companies out of the 100+ that we had meetings with where it just resonated so much with me on that first time, that we, in our tracker, elevated it on day one from new opportunity to meet with, to conduct full diligence, take this super seriously. And of those handful, maybe it was 5 or 6 that we wrote investment memos on, we ended up getting there with 2 of them. And I'm trying to think, there were a number of other companies that we wanted to like, we did like, but it didn't initially hit us that hard.

None of those ended up getting there at the end of the day, zero of that other group of maybe another half dozen or 10 that we pursued some diligence with and and really tried to get it, but just weren't as excited about it. And I think that's a reflection of the ability of the entrepreneur, and we're dealing with highly technical companies. And while I do have 2 very technical partners, venture partners, I myself am more from the business background. So if an entrepreneur, even a highly especially a highly technical entrepreneur, can make the case so clearly in an initial 45-minute meeting that I get it and understand it, that entrepreneur probably is going to, in my view, is going to be able to convince not only highly technical people, and granted, Several of our companies sell into technical parts of the enterprise, but they're also going to be able to do that such critical thing, communicate. They're going to be able to communicate to potential hires, both technical and non-technical.

They're going to be able to communicate to the broader community, partners, the media, and other prospective investors. Several companies that were just— could not communicate the value of what they were doing beyond the highly technical discussion of it. We did not get there. I hope in all of their cases, but especially a couple of those companies, are able to get to that level of success, But to me, one needs to be able to be self-aware enough to understand where the person is with whom they are talking and communicate the value of what they are doing. Use an analogy, make that person connect with it at a get through to that person?

Because we're dealing with companies, Jason, at the early, early stage where they're not handing us a spreadsheet and saying, look at this, 300% year-over-year growth, several million in revenue.

The numbers don't yet speak for themselves. So to bring it back to my old podcast, Numbers and Narrative, You need to be able to have that narrative side as well at the seed stage and acknowledge that you are the one that needs to tell the story to go alongside with the important work that you are doing. I love it. I couldn't agree more. I mean, you have to be able to sell the idea to really everybody.

So good stuff. So here's the next question. Looking back, were there any technologies you wish you had invested in, or what's potentially your biggest misses or biggest hits? Great question. So I think one of our misses.

First of all, I'd say that having made this transition to full-time investor at First In just a year ago, it's probably too early to see most of our misses in the cyber domain. While I did my best as an angel investor, earlier, maybe I didn't yet have the huge deal flow to be able to tell you, I missed on what went on to become the biggest exit ever.

I will talk briefly about one opportunity that is not in the cyber domain, but— and that I think given again, I don't know if I would have made the investment, but a very close investor friend of mine showed me a company a year ago that was just so cool. It was such a flyer. And I said, I was just getting started with First In, we couldn't have done it as First In. It was hard for me to think I could have used any of my own capital to do it, but that company is literally a flying car company, and it just did 2 incredible things within very recently. One, it announced an order for bookings that United Airlines was buying, I think, $1 billion worth of their vehicle.

And 2, that they went public or are announced to go public, I think they're still subject to regulation, in a SPAC deal, as many are. The company is called Archer, A-R-C-H-E-R, and my friend John McCormick, who has just been able to see the future in broad industries, made that very prescient investment. The reason I bring that up is, for him to go around a year ago to sophisticated investors and raise money for his own, like I do, he's a very early-stage investor, he was raising deal by deal at the time, and say with a straight face, we're going to invest in this eVTOL, this essentially flying car company, When is it going to hit? When is the shift going to happen? Is it 10 years out?

Is it 18 months out? Did you already miss it? Looking at that, I am so proud of him as my friend. And I think it just shows that while that wouldn't have fit First In's mandate, when you're investing in the early stage, just being being open to people who are capable of building those expert teams, they'd assembled a great team of engineers already, the 2 leaders of the company, just being open like that is really an important thing. And I will think about that company and his success in that for for a long time to come.

Yeah. That's great. That's definitely great. So I am not going to get through a lot of these questions because I'm looking at our time. Let me make sure I hit on a couple of key ones.

So you have invested in a Colorado company called Phylum. Any others? So I think we're going to invest in 2 to 3 companies per year. And I would love for one of those per year to be a Colorado company, if not both. I am still getting to know the community here.

I have been so thankful to the many people, venture investors, company builders, service providers who have met with me, all unfortunately, or mostly via Zoom or phone, But we absolutely want to be seeing more Colorado companies. Phylum is a great start, and I think that's going to be a wonderful Colorado security story for years to come. But we certainly want to be meeting and investing in more Colorado companies in the years ahead. Awesome. Another question.

So DEI, so diversity, equity, inclusion, it's I'm kind of curious your thoughts on that. And follow-on question, how, where do you advise your startups to find talent? Right, right. Very important question. We as First In, we view our work with military and intelligence community veterans as our important work within diversity, equity, and inclusion.

We would include veterans in that category. We do include veterans in that category. And this is an underrepresented founder set who often have gone, served their country, come back, and don't have access to capital. They don't have the networks that they're— they have operated at a technical level, equal to at least some of the best engineers who just happened to, instead of going and putting on their hat and working at, call it the Army, within the cyber realm, they went and worked for a brand-name Silicon Valley company. That person is going to have a much greater chance of raising a large amount of capital to kick off their own business than would the military veteran.

So So for us, that is the lens that we look at first and foremost. It's the veteran lens. And not every company we invest in will include a veteran, but the first 2 that we invested in as first in, Phylum and Cavionics, both are led by military veterans.

The nexus at which we invest, military intelligence community veterans, hardcore tech building in the enterprise. You know, these are things beyond just military veteran, but other pieces of diversity and inclusivity are, you know, notoriously harder to find. So we, you know, we'll do our best to do so.

Finding talent, I think, with the world being much more open to remote-first, remote-only companies, that has cracked open, that has just cracked open the talent pool. And that is a good and bad thing for startups, as everyone is learning. Why? It's a good thing because if a startup is based on the Front Range in Denver, or I met with someone who's a CTO of a cybersecurity business that he leads the tech team out of near where I live in the Roaring Fork Valley, out of Carbondale, and that is great because now you can go find talent that's resident in any part of the country or globally. The negative there and the hard thing that startups are all learning firsthand is, and I can tell you stories about even the companies that I've backed, who has dozens or hundreds of people on their internal recruiting teams?

The largest tech companies in the country, companies that used to not consider themselves tech companies that now do. Some of the largest financial institutions, others. With everyone working from home, or many people working from home these days anyway, those companies have learned how to figure out network connectivity from the home, et cetera. As a result, they are now much more open to remote workforces, and they know just as well as anyone else, frankly better because they have very mature recruiting organizations, how to find that good talent. So this is a huge, huge issue.

It's a huge opportunity and a huge defining challenge of the era in which we are now living. And even in a, whenever it happens, post-COVID world, it's still going to be a huge opportunity and challenge for startups. So, you know, that's why we take so seriously our technical team and their connectivity to, you know, trusted groups of technical practitioners and our go-to-market leadership at First In who help, who have their, just their finger on the pulse of sales engineers, regional sales managers who may be looking to leave companies to go sort of take a bigger risk for a bigger reward at a startup. Yeah, yeah, makes sense. On the lighter side, do you watch Silicon Valley?

I watched the early seasons, absolutely. And while I have never lived in Silicon Valley, certainly can sympathize and empathize with some of the characters and the themes that they've handled on that show. So then the question here is, how true to life is that show? And follow on, have you had any real-life moments similar to that show? I think that the best satire is based on, cuts pretty close to home.

So while thankfully I haven't, or maybe not thankfully, but I haven't experienced sort of some of the worst of what they parody in that, I think there are many themes there that are pretty dead on. That said, one, we are huge proponents and huge fans of tech innovation and what good it does for the world. Where we see our role is ensuring that all of the wonderful tech innovation that's happening, that people can feel secure in this new world in which we are living, that people aren't living with anxiety of, you know, is my computer going to get shut down? Is my bank account going to get shut down? Is our water supply going to get cut off?

Is, you know, just the ubiquity of ability to attack, you know, what can we do to help secure this, you know, beautiful— the beautiful technology that's being built every day and is so important for our society. Yeah, yeah. That's great stuff. This has been a lot of fun. I'm glad you joined the podcast.

How do people find and follow you on social media? Well, thank you so much. This has been great for me, and the questions that you asked and the others asked were all just phenomenal and really made me think. Hence my long answers as I was trying to think through those questions myself. So that was terrific.

I am not a large proponent of social media, so essentially I just live on LinkedIn from the social media perspective. And then our company, First In, it's just that we are first in where we will be publishing more of our own thoughts and writing. There are only a couple things up there thus far. Awesome. Well, Renny, I appreciate it, and thanks for joining me today.

Thanks so much, really appreciate it, Jason. That concludes my interview with Renny McPherson. Be sure to follow and support Colorado Equal Security on Patreon. This is Jason Jaques saying be safe out there.

Learn more about the Colorado security scene at colorado-security.com, where you can information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado Equals Security.