Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is the newscast for episode 250 for the week of August 7th, 2023. Alex, uh, happy, uh, happy 250th episode.

Yeah, um, it, it's pretty hard to believe we've made it to 250 episodes, Robb, but, uh, I also have some trivia for you. Yeah, I, I would love to hear your trivia. What do you got for me? So, so did you know that a 250th anniversary is— it's got several names actually. It could be a semi-quincentennial, It could also be a sestercentennial, or you could call it a quarter-millennial anniversary.

So what one of those 3 is what we are at. Well, I mean, quarter-millennial— is this, uh, is this some kind of a shot at the, uh, at the generation? I, I don't, I don't know. I, I don't believe in taking shots at those folks, so let's not use that one. Uh, the other 2 are too confusing, so I, I can't remember any of the 3.

So I think we can just say it's our 250th anniversary. I think we could say that, you know, you know, if you think, you know, 250 episodes over the course of what's it been like 7 years, 6, we started in 2017. So 6 and a half years. You know, that's, that means we did a lot of episodes at the beginning. And lately we've been moving to monthly over the last year and a half or whatever it's been.

250 episodes would take us another, man, another 12 plus years. So hey, let's enjoy, let's enjoy this 250. And let's not think about the future too much. Exactly. Yeah, that, that would be a whole lot, um, of more recording, and I, I can't imagine that we'll get to 500, but hey, you never know.

Well, I'm, I'm, I'm excited to have made it this far. I certainly would tell you, you know, when we, when we sat down and decided to do this, what it would have been like late 2016 when we, when we, you know, kind of committed we were going to make this happen. Um, if you told me we were going to be on episode 250 in 2023, uh, I would have said you're crazy. And obviously I feel super blessed to have made it so far. Thanks for being a partner on this and all the work we've put in.

It's been a great ride. Yeah, thanks to you too. It's better than I ever could have imagined. We've done a lot of great things and I know there's more to come too. A lot of good stuff.

Great community that supported us through this. And of course, to our listeners, thank you for being here with us, especially huge shout out to our patrons. Honestly, the support you guys give us, it really goes a long way. Financially, it's helpful, but really, like, just as a support and letting us know that there are people who believe in what we're doing, it's important. We appreciate those who do it.

All right, you know, couple of housekeeping things just like usual. We wanna make sure we get more and more folks into one of the other great things that we do, the Slack community, with, you know, not only, you know, almost 3,000 members now, but also really vibrant conversations in a lot of different channels. If you haven't got into the Slack community yet and you're in security and you're in Colorado, you're missing out. Go to colorado-security.com and click that Join Slack button, and we'll get you in there. Yeah, uh, we do also have a mailing list.

Um, we've actually started to expand slightly what we're using the mailing list for. Obviously you'll get the show notes in your email, but we've been sending a few other announcements like the volunteering event that we just had over this past weekend and our upcoming picnic. So you may receive some additional notifications besides just podcast stuff, but we're trying to keep that limited to group announcements also. You know, we would love it if you went to your favorite podcatcher and rated us and subscribed to the podcast so you get that in your feed automatically and people know how great the podcast is. You know, while you're at it, you want to help out the podcast, we'd love it if you tell a friend, get some more folks involved, not only with the podcast but in the community in general.

You know, the stuff that we're trying to do. Alex talked about the volunteer opportunities and the picnic that's coming up. We want to do more of these things. We want to, we want to continue to grow the impact of the security community through Colorado, you know, getting a little bit less introspective and more external-facing, really impact those around us. Help if you— if there's other folks who you think would love to be a part of that, you know, introduce us.

Let's get that person plugged in. Let's get them to be part of the community. And if you want to do more to help, we'd also love it if, if you would be a patron supporter for us. If you want to financially support the show, go out to Colorado Dash Security, click on the Patreon link, and get joined up. Awesome.

Let's jump into the news. Robb, if we couldn't talk about it enough, we have another Casa Bonita story. Casa Bonita has tapped a local Denver brewery to create their original house beer, or what they're calling the Casa Beer. Yeah, you know, I, I do wonder, you know, in our, what, 3-year saga of talking about Casa Bonita on a security show, um, if this might be it. You know, they've opened up again.

You know, you've been there, we've heard about your experience. Um, now we're talking about the fact that they have a custom beer. Like, you know, it might, it might be just about the end of, of us covering Casa Bonita almost monthly for, for quite a while. Um, it's been a fun story. Uh, it is interesting that there is a A Casa beer.

It's a, of course, a Mexican lager that that's been made specifically by Ratio Brewing Company. I'm interested to give it a shot. Maybe it's going to be good. Probably I'll get the margaritas instead, though. Yeah.

Also, as part of this article, they do mention that that's not the only beer that they have on tap. There are some other local breweries that have beers there as well. They're not specific for Casa Bonita, but Cervecería Colorado has their Mi Vida. Um, uh, Los Dos Patrios, which is a different Mexican restaurant but also a brewery, has their, uh, Fresa Loca on tap there, and a few others as well. So, um, pretty good selection of, uh, of Colorado local beers when you head to Casa Bonita.

But, you know, maybe you should, uh, check out the Casa beer because that's the only place where you can get it. Did you know that Los Dos was, uh, was a brewery as well? You know, they, uh, their Parker location Um, I think was a part brewery before they bought it, and so they started making beer there. And so yeah, so now they make beer. I didn't— I had no idea.

I mean, I've been— there's one really close to me I've been to, you know, a dozen times or a couple dozen times. I didn't know that they made their own beer. Pretty cool. You're gonna have to order one of their beers next time you're there. All right.

You know, another thing we talk about a ton on the show is Denver Airport. Um, you know, I feel like every time we talk there's some kind of new program that that kind of surprises me. I had no idea about this one. Um, apparently DIA was just, uh, just finished up a pilot program about this new way to ease your security line experience. And it's not what we talked about before with the facial recognition thing.

This is where you could actually make a reservation for your security time. Yeah, so, uh, I, I know a couple people that have done this and they said that it was pretty cool, but they've, they've started this program now and it looks like it's going to continue to, to have a reserved time, a 15-minute window at the, uh, the security line, uh, on the bridge. So it's only on the— I always think of it as the A gate security, but you know, you go over the bridge and the security gate's there. Uh, you have a 15-minute window you can sign up for up to 3 days in advance. Uh, so that way, uh, you don't have to worry about how long the line's going to be.

You know that you have an appointment within that window when you show up to go through security. Yeah, I'm actually really interested to give it a shot even though Like, I, I, I generally don't have bad security problems there cuz I, I've paid the money for Pre and I paid the money for Clear. Um, so generally I, I get to walk right through, but I'm, I, I kind of wanna see what this experience is like and figure out if this is a, a good option for family and friends who go through here. So cool that they're experimenting. You know, the, the bridge gate's always been a little bit weird.

Like sometimes, you know, you, you think you're gonna go over there and it turns out it's closed and it's kind of inconvenient. Um, it'll be really cool if you can make your appointment and now it has its own value, you know, in and of itself. Yeah, I agree. One other thing that I noted as part of this, you know, they also talk about the other projects that are going on at DIA, which do also involve security, the revisioning of the Great Hall and all the renovation there. The thing that I noticed was that they say that that whole project is supposed to be completed by the summer of 2028.

So we've got construction to look forward for another 5 years. Yeah, I feel like that number has, has moved a couple of times. I know it's a big project, but 2028, my goodness, 5 more years on top of what we've probably already got 5 years into it, don't we? Yeah, I feel like it's an awfully long project. Anyway, uh, moving on to our next story.

Um, there's a new Denver company that, uh, that's— they're gonna be doing some zombie hunting. They're looking for zombie buildings across the country and, uh, using them for their new, their new project. Uh, Robb, what's that all about? Yeah, you know, the headline says new Denver company, but as you— as I read this article, it doesn't sound like this is actually a new Denver company. Um, Coble and Company looks like they've been doing construction for decades, um, but that they have recently started a new line of business, um, which is going into suburbs and finding office buildings that are maybe standing vacant or just not well utilized, maybe need a facelift, buying those buildings and turning them into their own coworking space called— oh, was it called Office Simple?

Is that what it was? Work Simple. Sorry, it's called Work Simple. So really, they're kind of a stripped-down WeWork, all focused in the suburban area. And their idea is, we don't want to be downtown, we want to be where those entrepreneurs are, who started their own business during COVID They want to be on time to get to their kids' baseball game.

They want to be able to, you know, they don't want to have the big commute to go downtown, but they still want to have a dedicated space for working. So they're really focused on where they're going and starting in Denver here on the Front Range. Yeah, and I— there, there is a new company spliced in here. Uh, that company is Office Evolution, and they're, um, it sounds almost like a, um, a small subsidiary or startup almost within COBOL, but I think it is technically a separate company that has teamed up with them to do this. But it sounds to me like, you know, that somebody started this Office Evolution concept and COBOL has the money to actually do it.

So they're teaming up with them to do it. But yeah, you got it right. I think that the— it's an interesting concept because there are, as they say, these buildings that are, you know, somewhat somewhat dormant and vacant, you know, what they're calling zombie buildings, and in the suburbs, and they're taking them over and completely gutting them and turning them into these offices that people can use. I thought it was interesting that the, you know, these really are supposed to be shorter-term use kind of offices, that the longest lease that you can sign for one of the offices there is a year. And it sounds like you know, they're encouraging even less than that.

So I think that they want people to, to use it and then, you know, either move on to permanent office space or, you know, potentially something else. Yeah, it's definitely interesting. I'm excited to see how this works. If, you know, if there's one in my area, I'd love to go sit in it and give it a shot. So, uh, if anyone, if anyone gives this Office Evolution or Work Simple thing a chance, uh, let us know how it goes.

We're— I know I'm curious. All right, uh, next we have a, a story. This is kind of an ongoing series of stories where, um, oh man, what's the name of the, of the organization? Colorado, uh, Founder— there's a Founder Coopetition. That's a hard word to say.

Coopetition, um, that is, that's, that's run by Startup Colorado, um, really looking to give $5,000 to different startups in the rural Colorado area who, who they want to help kind of jumpstart the company. So these are all like like launch, you know, seed, seed round type companies, um, who are looking for a little bit of funding. And, and this is, like I mentioned, we've seen this, we talked about this a couple times in the past, but there's a new round of companies who have been, who've honored and been given the $5,000. And, and Alex, do we want to talk a little bit about who these companies are? Sure.

There are 3 that won these $5,000 grants. Uh, the first is called Orion Labs. It's a robotics and machine learning, uh, research institution. Which is based in Nunn. I had never heard of— I'd never heard of Nunn, Colorado before.

You want to know where they're from? It's Nunnia. That's right, exactly. But apparently that is just north of Greeley, and they've created a system that helps outdoor robots detect and maneuver around obstacles.

Sounds pretty niche, but hopefully that $5,000 can help them. It sounds like they're going to use that to get the product a little bit closer to going to market. Um, the, the second one is called Nome, uh, with a K, K-N-O-M-E, and they use artificial intelligence and other technology, uh, to help and assist homeowners on routine maintenance and value-add upgrades. Sounds interesting. I thought Nome sounded really interesting and something I'd like to have a chance to take a look at.

Um, hey, you have questions about what do I do when this bat thing breaks? There's AI there that's going to help answer the question. What's most likely to be your solution. Uh, pretty cool idea. Yeah.

And the, the third one is called, uh, ChronoCards, and it helps, uh, mapping teams manage their workflow and quantify their impact. Not sure exactly what that means, but sounds interesting. I, I, when I read that, I'm like, what's a mapping team? Um, so I, so I Googled it. It's, it's just, it's talking about folks who do GIS.

But, you know, if you're anyone like oil and gas or land management or all these different industries that we're mapping where, you know, land is, is a big part of the industry. Well, that— there's a lot of GIS engineers, right? So this is to help GIS-type teams be better at what they do. I can certainly see that. Yeah, cool stuff.

So, you know, the, the interesting thing about this program is it's ongoing. There's another— I think they said there's another 4, um, rounds that are gonna happen before next May. Um, so if, if you or someone you know is in like that launch phase of a, of a new tech company, um, you're looking for some funding, you get a little bit just to go from here to there, uh, it might be worth applying here. Great, sounds good. Uh, next, uh, we have some big news about a, uh, a decision on the future of Colorado.

Uh, President Biden has made the decision to keep U.S. Space Command in Colorado, reversing the prior decision that was going to send it to Huntsville, Alabama. Yeah, obviously, you know, as Colorado residents, we're super excited to have Space Command stay here in Colorado. And I don't know enough about it to say what place is better other than to say Colorado is clearly better because that's, that's what we do here. That said, as I read this article we have linked, I got kind of depressed and sad, like, like, oh my gosh, what a controversial decision even this is. So let's just move on and say I'm really excited that we're going to get to have Space Command here.

And I look forward to the value that brings to Colorado. Yeah, it did seem, um, like there were a couple senior officials. One of them said it should move to Alabama, and one of them said it should stay. So while there are a lot of, I think, political figures that are up in arms about various decisions, at least it seemed like there were some people that, uh, that thought it should stay and some people that thought it should go. So maybe not quite that controversial.

Well, if there's one person who you expect to have a a reasoned response to this. It's a college football coach turned senator from Alabama.

Good times. Moving on. Hey, speaking of great news— that was ironic— um, it looks like there is actually a pretty big cyber attack that compromised data for students and teachers and administrators and all kinds of other folks who attended— how broad is this? Colorado's public high schools or colleges over the last like 16 years. Yeah, it seems pretty bad.

And they haven't released all of the details yet, but I think that this could include— it could include things like Social Security numbers or student identification numbers depending on what data they had on a particular individual. So that's not great. Speaking specifically about the people that could have been affected, if you attended a public college or university between 2007 and 2020, if you attended Colorado— a Colorado high school between 2004 and 2020, if you were a teacher and had to be licensed between 2010 and 2014, and there's another 3 or 4 different categories of this too. It sounds like an awful lot of data, and hopefully we hear more about it, but Um, it doesn't sound great. Also, um, as per normal, uh, people will be notified and will get credit monitoring and all the appropriate things like that to make sure that, uh, since your data has been lost, it isn't used in a malicious way.

Yeah, you know, as I was reading this, you know, the first thing I do is think, oh, I wonder how this impacts me and mine. Um, I think the only person on this list impacted from my house is me. I was, I was in I was an MBA student at Colorado State during this time period. But your family, I'm guessing everyone but you maybe, is that right? Yeah, I think it is.

Wyatt might be missed. I'm trying to think of when his first year in high school, what year that would have been. But yes, my wife is an educator and she had to have been licensed, so that likely will affect her. Um, and then yes, so I think many people in my household will be affected by this. And I'm sure for those listening, many people in your lives will be infected.

This, this article gives like no— all, you know, as a security person, I want— it gives all the info that I don't want, right? I want to know, all right, what happened? When did it happen? What are they doing about it? There's just none of that type of information here.

This is, this is just to say, hey, you should be worried, um, and more to come, right? Basically, that's all there is in this article. Yeah, and I, I'm— my suspicion is that the investigation and everything is probably still ongoing. So, um, at this point, this is probably the information we're gonna get until, uh, you know, some future date. All right, let's move on to some better news.

What do we got next? Uh, I don't know if this is better news or not. Uh, next, um, Denver-based CyberGRX, uh, is going through some layoffs after they were acquired by another company.

Process Unity, which folks may have heard of, which I think does similar things to CyberGRX, has purchased them and they're going to combine their platforms together. CyberGRX, it sounds like, will continue to exist as a brand as part of Process Unity, as well as the CyberGRX office here, but the company will now technically be headquartered in Massachusetts where ProcessUnity is based. Yeah, I think of it as a good thing that CyberGRX is— you know, they've been a security stalwart here for years. They've had an exit and they're partnering up with someone else to continue with their mission. I don't think of them as competitive.

I would have said ProcessUnity was more like a GRC tool or like a one-trust type of platform. There's some automation to help you with compliance, but not like a repository of third-party assessments like the way CyberGRX is. So I think there's good synergy there. The, the layoffs are based on the fact that, you know, when you, you have 2 corporate infrastructures and, you know, you go into one company, you just don't need all the, all that, um, those folks. Um, good news is our friend Dave Stapleton, the CISO for CyberGRX, is, is now the CISO for the combined company at ProcessUnity, um, and is going to have a chance to, to build out that program.

And, um, really, you know, I'm excited for that. I'm excited for the future of what those guys are going to do, and we look forward to continuing to talk about Um, hopefully the great news there— there's the number in here was the combined company is going to have 250 employees, um, and CyberGRX is bringing 130 of them in. So obviously a strong CyberGRX presence in this new company. Yeah, I did like in the article also that they said, um, even though that there were some redundancies and they obviously had to get rid of people, they were trying to find places for as many people as they could internally instead of, uh, instead of letting them go. So, you know, maybe, um, not the job that you were doing, but there was an opening somewhere else that you could potentially fit into kind of thing.

So that's good news too. Yeah. And one other thing we didn't mention is while the CEO of Process Unity is remaining the CEO of the combined company, Fred Kneipp, who was the CEO of CyberGRX, is the, the president of the company now. So obviously he's going to have a big say in how things go, and I imagine most operations will roll up under Fred. Nice.

All right, cool. Uh, our next article is a, is a blog post from Laris, um, and this is a look at the new SEC's, uh, rules that were, that were just published. Uh, they call it Strengthening Cybersecurity Practices: An Overview of the SEC's Latest Rules. Yeah, so, um, this goes into the, the recent SEC guidance that came out for public companies around, uh, cybersecurity and risk management, and they talk about the kind of the highlights of what was in those SEC rules, including the need for comprehensive risk management and a strategy around that, making sure that you have appropriate governance and board oversight of your risk management and cybersecurity programs, and the, the need for disclosure, pretty quick disclosure actually, of material cybersecurity incidents. And the material word is very important as part of this.

Yeah, I'll say the only thing that I've heard as people have been talking about these SEC rules, um, the only thing people seem to really stick on is this— was it 4-day? Um, 4-day, yeah, disclosure. Um, that's the only— like, everyone's like, whoa, wow, 4 days is fast for all public companies. Um, and then as I read this Laris blog post, it doesn't say 4 days, it doesn't say any kind of timeline. So I'm kind of curious how you write this blog post without giving that detail.

Yeah, I'm surprised that they didn't put that piece in here as well. But I mean, I don't know, 4 days, if you had been subjected to GDPR or something already, you know, 4 days shouldn't be a huge stretch for you. I think that the interesting thing for me is that they, you know, they did put material in as part of the wording there in the SEC guidance. And because, you know, material is a financial term, right? So it's got to be something that really affects your company.

It's not that you have to give, uh, notice every time that someone clicks on a phishing email. You have to give notice when, um, there is a cyber incident that's going to affect your bottom line, or in this case, since it's the SEC, really, uh, something that could affect your investors and, you know, the way that, uh, their investment in your company is. Yeah, I, I do— I think it's important that you called that out. Materiality is a well-understood concept in your finance and your executives understand materiality. They— if you go to your CFO, you can probably just ask, hey, what's, what, what's the dollar amount for material— materiality at our company?

And they can probably just tell you, hey, it's $12 million, or hey, it's $150 million. Once you, once you have that understood, it makes your conversations a lot easier. You know, what's the, what's the, the most likely upside or most expensive this breach could become? All right, well, if it's only $2 million, then it's not going to be material for us. I think that's really useful and a good way to think about this.

Yeah, and I have a feeling people will probably hedge and report lots of things that aren't material but are, you know, maybe close enough in some people's eyes that it could be. But still, it's not going to be everything. So I can't imagine that this is going to be a huge amount of incidents that get reported. But maybe, I don't know, maybe we'll see greater transparency and visibility into incidents that affect public companies. Yeah.

All right, good stuff. Uh, our next story we have from another local security company, Coalfire. Um, Coalfire has a press release this week, or maybe it was a couple weeks ago— no, it's just this last week— announcing the release of their groundbreaking offensive security platform called Hexeon. Alex, what is Hexeon? Um, it is a, uh, let me find the marketing words in here.

It's a comprehensive offensive security SaaS solution designed to continuously identify and track risks throughout the vulnerability management lifecycle. Yeah, does that explain it for you, Robb? Yeah, it sounds like it's really here to help, um, customers who use this thing figure out what vulnerabilities in their environments are worth acting on most quickly. Uh, yeah, that, that's, that's the gist of what I think I got here. To me, it sounds a little bit like a, um, a Cobalt.io or, uh, uh, uh, Penterra or something like that.

These sort of these, you know, semi-automated penetration testing platforms. Things that, that potentially go beyond just vulnerability scanning, but are potentially more scalable and automated than, you know, an individual person doing penetration testing. I don't know that to be for sure, but that's what it sounds like to me based on what's in the blog post. Yeah. And I'm curious if, if this is a rebranding of an existing product, a new version of an existing product, or if it's a whole new thing, because they've certainly had vulnerability scanning as a as a product for years, right?

As a, as a managed service even. So I'm curious what this, what this actually means strategically, what's different there. So if any Coalfire people are out there and they know, let us know. We'll, we'll follow up if you let us know what's going on here. Awesome, sounds good.

Uh, last news story this month, uh, we have a blog post from Red Canary talking about, uh, an intro to, uh, Linux EDR, but also it's, um, it's called Contain Yourself. So it's, it's talking a little bit about, uh, containers and Linux containers and using EDR to monitor those containers, which, um, I think is, is pretty interesting. Yeah, I mean, I think that this is the kind of thing that a more traditional Linux or Windows sysadmin might want to read as you think through what does it mean to move to containerization from my security perspective. Uh, where would— you know, I'm used to putting agents inside my— all of my OSes. Um, do I need to put an agent inside my container?

How do, how do I get coverage there? What's the right way to do it? What's the trade-offs if it's inside versus if I'm trying to do it from a, from a host. Um, I, I love the, I love the fact that they go into a lot of detail, right, a lot of background, so you understand, um, what the dynamic here is. What does it mean to do containerization?

And then, all right, what are the, what's the security benefits of doing these different options? Of course, Red Canary does a monitor of Linux EDR. Um, that's, that's one of their product offerings. But I feel like there's a lot more details here that are useful than than just the sales pitch. Yeah, one of the things that I like too towards the, uh, end of the, the post is they talk about some challenges that EDR vendors have around, um, monitoring this, this type of thing, right?

Um, because it is very different than, you know, monitoring a Windows or say a Mac, uh, via EDR. So, um, I think that that is— it's interesting and, uh, and educational as well. All right, good stuff. That is it for news. Let's move over to events.

As a reminder, we have a calendar of events at colorado-security.com. You can go see all the stuff that's coming up. You know, there's quite a bit, quite a few things coming up all the way through the end of the year now. So, so we get signed up and take a look at that. But first, on August 10th, there is an event here, How to Protect Sensitive AI Data in Vector Databases.

Holy smokes. What do I— how did I get this? I don't know what I'm looking at here. But now I am intrigued and I might have to go check that out. The second event that we have, CSA Colorado on the 15th of August, is doing a Rockies night.

I think this is actually before their conference. Isn't that correct, Robb?

You know, you tell me. I'm looking at— I'm trying to figure out this. You're still trying to figure out the AI and vector database stuff? I did figure it out now, but go ahead. Good times.

So yeah, I think that this Rockies night for CSA Colorado is sort of the precursor to the the conference that they have coming up? Well, so it's— so the CSA thing is their August, like, community day. The conference itself is not coming up till, like, October though. Ah, got it. So I did figure it out.

August 10th, it's— it is IronCore Labs, who we have the interview with today, Patrick Walsh, the CEO. They have this about how to protect sensitive AI data in vector databases. This is interesting. Vector databases. This is interesting as you're looking about potentially doing like a large language model inside your own organization.

How could I secure this? This is going to be a podcast— or should be a webinar talking about how to do this, and it's just coming up on the 10th. Take a look, link will be in the show notes. Now that we've got that out of the way, uh, let's talk about the busiest day in August. On the 23rd of August, there are 3 events.

Uh, the Let's Talk Software Security group is, uh, talking about Getting Buy-In: Impactful Communication for Software Security Business Cases. ISC² Pikes Peak is doing their August meeting, and Denver OWASP is doing a meeting talking about API security, a CISO perspective. So if you want to, if you want to be learning all day long, you just hop from one meeting to the other. You will have to drive, um, from Denver to Colorado Springs and back, um, but it seems like it's probably worth it if you need to get some CPEs, you want to have some fun. There you go.

Finally, on the 28th of August, LIFT, the, the women's security group Um, that's, that's, uh, associated with the CSA here. Uh, they're doing a Lift Up Your Golf Game event. Uh, so this is for women in security to get better at golfing. Um, fun event. It's, it's more social than it is educational.

And if you want to get signed up, go out to the— click on the link in the newsletter and you'll get there. Sounds good. Let's jump over to jobs. Uh, we have some interesting jobs this month. Uh, first, DeVita is looking for an engineer, comma, security Parentheses IT.

Homebot is hiring a security operations manager. I assume this is working with our friend Christopher Leitz. Christopher's a great guy, and I think you'd enjoy working there at Homebot. Bank of America is looking for a senior data security engineer. StarRes is hiring a data privacy manager.

Workday is looking for a senior cyber threat intelligence engineer. Salesforce is hiring a senior incident and vulnerability manager. Deloitte is looking for an incident management senior specialist in their confidentiality and privacy practice. We have an interesting mix of jobs this, this month between like these last few are just massive companies— Workday, Salesforce, Deloitte. Yeah, we have some, some, and Bank of America, right?

Then we have some smaller companies with, with, um, Homebot, StarRes. This next one, Movement Mortgage, uh, is a— they're looking for a cybersecurity cloud engineer. I, I assume that this would be working with Scott McCandless, who just moved over there recently as a manager, um, working for Michelle Wilson, who's the CISO there. Um, great couple of great folks, and I imagine this will be a great opportunity at Movement Mortgage. Uh, CoBank is looking for a senior cloud security analyst.

And finally, Colorado PARA, the The Public Employees Retirement Association, maybe. I know it's the retirement fund. Um, they're hiring an information security engineer. Um, and as we already discussed earlier, since my wife is in public education, um, I would love for someone good to go there to, uh, protect our retirement savings. So if you take this job, Alex will— Alex will give you whiskey to drink every time you need it.

That's true. I guarantee it. You heard it here first. All right, well, that is it for the end of news. We have an interview this week, as I mentioned before, with Patrick Walsh, the CEO and founder of IronCore Labs.

Um, Alex, anything else before we go? Uh, I think that's it, Robb. Good stuff. All right, well, we have a little bit of a different transition, uh, this, this month, and we'll look forward to talking to you guys again in September. Thanks, Robb.

Hey ChatGPT, what's new? CSA Colorado is hosting an incredible conference in Denver on Wednesday, October 25th. Really? You mean CSA Colorado, the, the local chapter of the Cloud Security Alliance? The one that puts on all those great meetups, networking events, and happy hours?

Yes, there can be only one. Hey Bing, tell me more about this conference. This is a unique event, perhaps the first of its kind. The entire day is focused on discussing the intersection of AI and cybersecurity. That sounds incredible!

So it's gonna be about how cool AI is? Oh, it will be much more than that. The conference will cover the AI revolution in cyber, including the risks. Risks? ChatGPT, what is Bing talking about?

There are so many. Ethics, privacy, leadership concerns, threat vectors. We are, after all, in a brave new world. Wow, what else can you tell me about this conference? Our keynote, Sarah Ault, is an expert in ethical AI.

She will start the day by giving us a lot to think about when it comes to trusting this fast-paced technology. All of the speaking sessions will be entirely curated around AI and cyber. Hey Bing, do you have anything to add to this? The low price of admission includes breakfast, lunch, a networking happy hour, and a few surprises. Surprises, huh?

You are such a tease. Where do I register? Early bird is open now, and we do expect to sell out. Just go to csacolorado.org and you will find the registration link on the homepage. This is Darren Wiener, president of the Colorado chapter of the Cloud Security Alliance.

Join us for AI and Cybersecurity: Revolution and Risks. Early bird registration is open now, and we do expect to sell out. That's That's October 25th at the Cable Center in Denver. Go to csacolorado.org and click on the registration link. Looking forward to seeing you there.

I'll be back. All right, welcome to Colorado Equal Security. This is, uh, our interview portion, and this is Robb, and I'm sitting today with Patrick Walsh. Patrick, this is the 3rd time we've had you on the show. We were just talking, it's been since 2019 since you were last here, and previous to that it was 2017.

Um, you know, you've been, you've been working at IronCore Labs for man, for what is that, 6 years, 7 years now. Um, love to give you a chance to, to tell us what's happened in the last few years. But first, you know, you got some beautiful mountains behind you as you're doing a Zoom meeting here, looking, looking at it. What, what are the mountains behind you and why do you have those as your background? Well, those are the Boulder Flatirons and that's my view out the window.

So I, I put them behind me on the, on the thing to save you from seeing, uh, uh, just a boring office. You get up into the Flatirons much? Do you enjoy it? I love to. I love to go hiking in the Flatirons.

Yeah, it's one of the more convenient hikes living here in Boulder, just to— and there's a whole bunch to choose from. It's wonderful. We have such great weather here. Yeah. Yeah.

Well, awesome. I don't— you know, we don't need to bury the lead too far. I know you guys have done a ton of work since we last talked, but why don't you take us through kind of the genesis of IronCore Labs and what your initial proposition was and how that's evolved over the last several years? Yeah, thanks. And Bob, thanks for having me back.

I'm super happy to be here. It's kind of fun to revisit. So IronCore, we started this IronCore because my co-founder and I were working at Oracle, and we kept getting these just massive security requirements from our customers. We were in the Oracle Cloud, our customers were large companies with big security concerns, they were worried about like how many people within Oracle could view their data and all these kinds of of things. And, you know, those are hard questions to answer sometimes.

And every new company we acquired, we had to kind of refigure out how we were going to deal with all the different layers of security stuff for those products, many of which didn't have really good starting points. And so we decided to leave and form IronCore as a way to kind of make it so that developers wouldn't have to reinvent the wheel over and over and over again, or get it wrong over and over and over again, then have to reinvent and kind of solve these problems inside applications. So the mission for IronCore has always been to secure the data inside cloud applications, and to make it very easy for developers to build cloud application applications that are, that are like, truly and provably secure, meaning not— it doesn't mean breach-proof, but rather it means that you know who has accessed and when they've accessed, and you can orient how that control is. And you can you can create layers of security that are extremely meaningful, as opposed to kind of most of the practices today where one stolen credential can often be sufficient for catastrophe and so on and so forth. So that's what IronCore does.

That's where we've been focused for many years. We've sort of, you know, we've had this evolution in different directions a little bit for how we go about solving that problem. And, you know, we started with thinking end-to-end encryption was gonna be the thing, right? And I think that's probably what we've talked to you guys about in the past is the end-to-end encryption. Type of a use case?

Is that encryption? You know, for us, it's basically everything comes back to encryption. And so not really tokenization. I mean, it can be used much like tokenization if you want it to. But it's, it's a little bit— it doesn't necessarily— so most tokenization systems, you basically move the sensitive stuff from one system to another.

And there's a reference from the one system to the other. And in our case, we just actually say, let's lock it up. But then the information has to sit somewhere, right? What's like it— yeah, maybe, maybe I'm missing the nuance. The, the data at some point has to be accessible, and that's right.

Yep. And so, so what, what is, what is the difference then in your, your mind? Like how you guys are solving this problem, how's it different? Well, let me, let me give you a couple things to, to chew on for that. The first thing is let me, let me tell you what we call application layer encryption.

That is to say, the idea of encrypting data before sending it to the data store, before going to like the database or the S3 bucket or whatever, as opposed to the infrastructure or transparent or disk-level encryption that is the common standard for today, where if you have access to the S3 bucket, you see everything that's in the S3 bucket with no barrier to you seeing it. If you encrypt it first and you get access to the S3 bucket, it's a bunch of garbagey data. Right? So we believe that application layer encryption is a much stronger approach because it's easier to control, many cases, the keys, and also because you're controlling the keys in different ways than you're controlling the data, and that creates a much higher bar for attackers to get past. That's— this is for server-side encryption.

With end-to-end encryption, of course, you can even orient it so that the keys are on the client and the server can't view it at all, ever. So we have these different patterns that we support that allow you to basically level up the security. But then the question that people often have is, well, but once you make it all garbage data to the database or whatever, how do you— like, how can you use the data, right? And how do you make sense of it? And that's where we get into this whole data-in-use encryption stuff, or kind of like, more broadly speaking, this category of products called PETs, or privacy-enhancing technologies, whose purpose is to like lock down the data and it'll only allow you to use it in very in certain special ways or in certain conditions.

And in our case, we take an application layer encryption orientation to this, and we have a bunch of operations you can do on encrypted data if and only if you have access to the key. So you can do things like full-text search or doing matches of various kinds over the encrypted data. So that's— and that's new to We didn't have that aspect of the business when we last talked, and we've been building on that a fair bit to add more and more capabilities over the encrypted data so that you can like keep data in a like meaningfully encrypted form. Because the disk level, it doesn't matter until someone turns off the server or pulls up disk, right? You know, you do it at the application layer and it does matter if you protect that key well.

Yeah, it's always been interesting to me as, as a, uh, securities person working for security companies, many customers, you know, talk about requiring disk encryption for our SaaS applications running in AWS. I'm like, like, what's the, what's the threat, you know, profile they're looking for? Someone breaking into the AWS data center, taking the hard drive? Yeah, like, it's just not a realistic risk. I mean, it's— you're right, it doesn't stop any kind of attack against a running server.

The only, the only thing I can think of that makes it valuable enough to say everyone should do it anyway is what happens to those hard drives when they go bad? Are they, are they shredding them or are they tossing them in the dumpster out back? And if it's encrypted, then you don't have to worry too much about— but you know, if it's disk-level encrypted, then it doesn't matter if they're throwing them away or not. Yeah, it's a fair point that there is— it's, it's a, it's a nice and, right? Like, hey, do this.

By the way, there's some more important things you should be talking about than rather than focusing on that. It's not protecting your data on a running server, and in the cloud, the servers are running 24/7. So, you know, your data is unprotected 24/7 is basically what it comes down to. Yeah, yeah, good, good stuff. All right, so, so talk, talk to me about like what, what you've learned over the last few years as you've, you've come in.

You know, it sounds like a relatively similar story from the beginning to today. What have you learned? What, what What's evolved? Yeah, I mean, I think it's all about understanding where the needs are and where the market is sharpest. So everyone wants to have a more secure application, but of those who are really paying attention to that, the question is, where do people have money burning a hole in their pocket saying, we actually have to have this now?

That is the goal of every startup, is to figure out that product-market fit where you find the part of the market that just has to have it, right? And so, you know, frankly, that's what we've been up to. We've been trying to figure out sort of the different angles and niches. And as we've been going, it's been changing pretty dramatically sort of under our feet as we go. Because, you know, when we started, so 2017 is really when we got going.

And, you know, GDPR went into effect in 2018, for example, and CCPA in 2020. And, you know, those things have taken a little while to get spun up to speed in some ways. These are privacy laws and these privacy laws are now major drivers of business. It's not just specifically the fact that they basically say that you have to treat personal information as regulated data. It's that in part, but there's a whole bunch of these fallout splinter kind of things like the EU has these— this part of the GDPR, which is the EU's privacy law, has these clauses about international data transfer, right?

And basically they say, hey, like, EU citizen data, it's okay if it goes to a country that we consider to have adequate privacy protections. And on and off, the US has had— has been blessed as an adequate country, but But the courts keep striking it down and saying, no, it's not adequate, and literally putting it in the bucket. Canada is the good guy, they're adequate. US is in the bucket with China.

The thing is, then it comes down to, oh, well, what's a data transfer? Can I just keep European citizen data in Europe? Well, it turns out that's not good enough because if anyone from the US can access it, that's considered a transfer, even if it's possible and not being done. And that's all because of this idea that the US has these laws that basically confer no privacy on non-US citizens. So from a US intelligence agency standpoint, if it's not a US citizen, it's fair game.

It doesn't matter. There's no warrant required, really almost nothing that gates their access to or use of that data. And that creates all this friction around Hey, these people deserve due process for their privacy rights, but the US isn't going to grant it to them. That's why they're in the same bucket as China. So anyway, things like that.

Data sovereignty is this general concept of what I'm talking about, which just basically means whose laws control who has access to that data. If the US government has to work with their partners in Europe to gain access to it, then data sovereignty is preserved. If they can gain access to the data without working with their partners, data sovereignty isn't preserved. Turns out that's creating a ton of pain in the market, especially for SaaS providers. And so we've spent a lot of time on that particular problem, uh, in recent times.

But that's it. Yeah, it's evolving. Yeah, I'm super interested to hear this because what you're saying isn't— I mean, it's not that different than what we've been hearing since 2017, right? It's just what you're— it sounds like what I hear you saying is the hypothetical, hey, we got to do something about this, people are actually feeling the need to do something about it now. Because mostly I've seen companies kind of ignore it and pretty successfully ignore it.

Yeah, right. No, exactly. Other than a few big fines for, you know, some big-name social media companies, maybe. Yeah. So, right, that's, that's the sort of the difficult thing about secure— maybe security products in general, but especially ones like this, because security historically is the problem of the security team, and the application developers, it's not their problem.

There's a whole different team for that, right, or whatever. And so we're playing in this space, this kind of intersection of security and application development where there isn't always motivation to do the right thing, or, you know, some companies will, but it's not necessarily across the board. And what's interesting about these types of regulations I'm touching on is that it is forcing change and Especially when it comes to hurting sales. So we have historically been focused on cloud application companies because they sell globally to European customers and others, and that gets them tripped up on this stuff. But all that said, we're actually like— our mission, without changing our mission or anything else, we have like a whole new opportunity ahead of us that's, that's like super interesting right now.

That to me changes a lot of the equation. So, well, I mean, before we close up, I, I, I'm just curious, what, what size companies have you seen as you talk about SaaS providers, uh, internationally selling SaaS providers? Are you talking about SMB, large enterprises, smaller companies? Where has your sweet spot been so far? Yeah, I mean, to date our sweet spot has been mid to large size companies.

That said, we get a fair number of inquiries from, from smaller companies, especially European small companies who are much more tuned into the privacy and security things than the US small companies tend to be. But that's not universal. So, you know, if small companies in the US who want to sell to big companies instantly trip into this bucket. So it's, it's definitely more about whose data, what data they're touching, and whether or not their customers are forcing us, because that's what's interesting is the market. When I talk about like the drivers, the market forces it because a buyer of SaaS isn't going to buy it if they don't trust the security of it.

And the more sophisticated buyers, which is generally speaking the bigger ones, not 100%, but then yeah, that's, that's gonna, that's gonna drive them to say, no, you got to do X, Y, and Z, you got to like, show me you can take care of our data before we sign this deal. Yeah, that makes sense. All right, so I'll let you— let you change it. What's the new opportunity that's in front of you guys? So yeah, for us it's kind of more of the same in that we're working on encrypting sensitive data for specific things and then allowing it to continue to be used in sensitive data and sensitive— in specific ways without general access to the data being available.

And but now then there's this whole new class of data which is which is circling around all these new systems in artificial intelligence land. So, if you think about all the kind of breakthroughs we've been seeing this year with ChatGPT and OpenAI stuff and these things, it's significantly changed sort of the way AI is built. And I mean that in this way. So, in my history, I've been a part of a number of projects that use machine Most of those projects have spent 90% of their time on building models. It's all about like building, testing, it's not working, trying to figure out what inputs messed it up, trying to tune it, build it again, test it, try some different techniques, rinse, repeat.

Like all the time is spent on building the stupid models.

Now with these large language models and these, you know, large, large image models and so forth. They're just general purpose. They're extremely intelligent. They're not things that people— they can tune them if they want to sometimes, but they don't really need to tune them. It's no longer about building a model or maintaining a model or testing a model.

It becomes all about how you apply a model, how you make sure the model isn't hallucinating, how you can use the model on your private data so that you can do amazing things and build all kinds of efficiencies. But that's where everything's running into problems today. So according to Gartner, half of AI projects never make it to production because of security and privacy concerns. And of those that are making it to production with these like new large language models and stuff, the majority of them are focused on public data, right? It's like, here's a chatbot to tell you about the documentation on our customer support site or whatever kind of stuff.

And, and it's not the, you know, when I think about this stuff, I think, holy crap, the types of things this could do. Like, I could have an AI that could know about what's going on in my life and tell me. I could say, hey, what's important right now? There's like, well, there's these 2 emails, these 3 bills, and this other, you know, whatever. Like Imagine the time it could save me cutting through all that stuff to just know what's, what's kind of coming up right now.

And, or, or as a company, I could be like, hey, what's, what's going on in the company right now? It's like, well, you know, the retention stats are, are dropping right now, and it, you know, there seems to be some, uh, correlation with stats dropping around customer support satisfaction, you know. And, uh, I would go look into that. Like, this stuff could be super powerful if applied to private data, if that wasn't this massive of blocker to adoption.

I, I mean, I see what exactly what you're saying. The being able to ask general questions and have— they have a pool of knowledge and they understand how to speak, you know, our languages well enough that we can have a conversation. You don't have to be— you don't have to be focused on the models to say, well, here's my risk score to be associated to these activities, right? Which is the big problem we've had with data over time. And you started talking about some of the real problems there.

So we've all played with ChatGPT and seen some pretty cool stuff. I've been playing with Bard and I've had lots of cool places where it does a great job creating content, but I've never seen success for it helping me make decisions. At least I haven't yet. And I'd love to see, you know, is that a thing you guys think that you should think is like, is here soon? Because when I hear the idea of what's important in my life or what's important in my company, and it has all the data to say, hey, I can answer that for you, that sounds incredible, right?

Sounds incredible. So people are building models now to work on tabular data and make that more powerful, and then interplay these things. So, and then the other thing is they're actually quite good at summarizing information and picking out data. So you can, you can have, you could feed in your corporate strategy document, you can ask it questions about like, well, What is engineering going to be doing? What is this going to happen?

Like, how is this going to get done? Or what is the cost for this other thing? And it will summarize and pull out all that data for you. And these AIs, they absolutely can be trained on sort of what you pay attention to and learn from that. That's not the large language model, but then the large language model comes in so that you can— you play with these different models together, right?

The large language model comes in so that you can have a discussion about what should be surfaced, what's important, what's not important, or whatever it is. Imagine you pick whatever use case you want, because these general-purpose AIs make it so that you can basically operate over images, over natural language, just as if you were working with a person, but you can dump all kinds of knowledge into it first. And so that's where— that's this idea of giving it context so it doesn't hallucinate. You can say, ah, I want you to answer my question, based on these inputs, which is my entire SharePoint in Microsoft or whatever. And so anchor your things to that, cite your sources, and now give me a response.

And then you get way better information. So now you don't have to go searching for the right document or the right whatever. And you can actually sort of get— take a lot of the friction out of a lot of jobs people have if, again, if you get to apply it to the private data. Okay, so I mean, obviously the AI is, as it becomes AI, is gonna, is gonna change the world. How does, how does IronCore Labs help with that?

Yeah, we're all about unblocking that value, right? It's the, it's the idea that there's tons of value just, just, um, waiting to be uncovered with these new AI technologies, but that has a tremendous reluctance from adopters in applying them to anything that's confidential, secret, regulated, et cetera. So that means the entire healthcare industry wants to use AI data for all kinds of things. It makes sense, whether you're insurance side or you're doctor side. But one, you have to worry about hallucinations, and two, you have to worry about the privacy of the data there.

And that goes for pretty much every industry you could name, and even just general corporate reasons. Everywhere you turn, all the good stuff is private. And so by By helping people to use that, we can make it so you lock it up and then you can interrogate it while it stays locked, but only those with the key can interrogate it at all. And no one can get access to that data meaningfully unless they have that key. So that makes the whole thing way more secure.

Even if you're hosting it with third parties, even if you want to use the hottest cool stack in AI stuff, you get to do that without having to be held back. But wouldn't, in order for this to work, wouldn't you have to, wouldn't you have to be integrating this like at the provider level with OpenAI or with Google or whoever, Microsoft? If I'm the customer trying to use encryption, like I'm just sending them gibberish, right? So how do you actually integrate? Yeah, yeah.

So no, good point. We can't magically secure OpenAI as part of this. So, so if you want to get technical on it, there's a couple of things we do. We have sort of reference architectures on how you can do this. So we would, we would say, look, if you need the whole thing, whole pipeline to be encrypted, then for now don't use OpenAI.

You know, we know that Microsoft is working on confidential compute environments. They have confidential compute environments for models that works with the NVIDIA H100 GPUs, which is this confidential compute GPU which can be applied to this. It's all really super cool stuff, um, and you need to either run your own model, do use one of the open source ones, use Facebook's LLaMA or something like that for the large language, and, um, run it yourself or run it in a confidential computing environment. Those are your options right now. OpenAI doesn't yet offer that.

They'll have— until they do, I wouldn't use OpenAI for this stuff personally, outside of the toys and the testing. But then the second thing is, when you, when you want to ingest all of your private information and then be able to use that information as context for questions. There's this step in between that— it's all about this thing called embeddings, vector embeddings. Okay, so you run, you run these documents or these images or all these things through the model, through the large model, and it produces the model's understanding of that in this format called an embedding. And the embedding you can think of as like the memory of AI.

Okay, just like As you know, you're listening to this right now, your, your mind isn't like recording a word-for-word snapshot of it. You're picking out all the meaning, and that's what you're retaining and putting away. It's the same thing that these models do. They pick out all the meaning as far as they understand it, and they retain that in these things called embeddings, which then you store in another new thing called a vector database. We secure all that memory.

We allow you to search over that memory to surface up the right parts of the memory that are relevant to a particular question. And then you provide that as context into the model for answering questions. So it's kind of 2 parts. One side is about sort of securing the model itself. Right now, the best thing for that is find a startup or someone who's doing confidential compute over large language models, or run it yourself using one of the open source models.

And then the other side is how do you secure all the data, which is to say basically the model's copy of all your data, your sensitive data, you run into it, and that's this vector database side of things. And that's where our encryption is happening. So you guys will get brought in to a company that's already, you know, well down the path toward their, toward building their own internal, you know, internally hosted LLM. Um, and, and you're in— but they're looking for a better level of security, you know, maybe it's privacy perspective, maybe it's just security in general, and, and you guys will integrate with that. Is that, is that right?

Yeah, I mean, any— anyone who's trying to take advantage of all the cool new stuff with private data is going to be looking at where the, where the private data gets seen and by whom. And on the model side, the best answer I have for you right now is the confidential compute. We may well provide something like that in the future. It's certainly something we're looking at as a way to be able to handle the entire arc for people. But in the meantime— and then the second thing is the byproducts of it, which are as sensitive as the inputs were.

And so far, like, our initial offering is very specifically around those, those byproducts. But yeah, we're looking, we're looking at the whole process very carefully. Yeah, I think it's just, you know, I'm sure we have listeners who, who don't have a lot of experience with this, and I I want to go a little bit into like where I would imagine companies seeing this, you know, become really valuable. I, I know most companies in the last several years, if they're at any scale, have had a, like, a business intelligence project. You know, they talk about creating a data lake to dump stuff from their CRM and their ERP and their HR systems and everywhere to try to get really good insights into a dollar that's invested over here turns into this value to the business.

And hey, it looks like, you know, we get some insights around which departments are efficient and which are not. Just a lot of different stuff, right? And but generally the way I've seen those projects go is it starts with like follow the money and it probably starts with follow top line money. We want to increase sales. How can we increase sales?

How can we, you know, increase impact of of additional money poured into the business, then maybe you look at the other part of money, you know, how do we manage expenses, how do we reduce, you know, loss of money through these things. And people start putting in more and more systems into their data lake with, you know, maybe a Tableau front end on it to try and visualize some learnings, right? But it— everything I've seen in the real world has been humans doing an awful lot of figuring what's worth doing here. Absolutely. What I think I'm hearing is, as I just kind of put the pieces together, is you could use that data lake you already created and you could start to use that to train this LLM and start asking questions and figure out, does it have the data to answer those questions?

Is there more data to put in? What can it start to give me insights on? Which really would give you a lot more value than your business intelligence project that you probably are not getting the value out of you want. Today? Well, in some cases it might, it might actually leverage it.

Like, I'm paying attention to what a lot of startups doing in this space, and some of them are basically doing what the analyst would do there in terms of pulling together queries, and then they're basically formulating those queries. So your natural language basically gets translated into a query, which then goes live over the data. That's one way that this can happen. Um, there's a bunch of, there's, there's a bunch of different patterns here. They're all emerging, right?

This is still a fairly new area, but I will say that Yes, you can also ingest the data and have it notice things. That's also super interesting because then that's— there's the sort of the on-demand, hey, like, where's our cash going kind of question or whatever, right? And then there's the, like, you know, tell me what's different this quarter or whatever kind of stuff. And it's It's, uh, uh, the large language models play in. The— there's going to be a lot of data models that are coming out.

I think the visual models are also playing. Like right now, uh, it's easy enough for us to search over a Word document, but maybe not as easy for us to search over a directory of images. But, but, you know, all those things. And then previously we had to do, um, we had to like get the keywords right, you know, try and figure out how to filter out the cruft that was from words that are ambiguous producing extra results and all that. Those things go away with this tech because you can do this semantic search where you're searching by meaning instead of by word.

And you can do this, and then you can hone it down, and then you can query off of what you just found as the realm of matching things. And yeah, I find it extremely exciting that the more First of all, with these general purpose models, they give us a way to interact with data and documents in a way that we never have before. And then new models that are coming out that people are trying to make more general purpose, so that everyone doesn't have to sit there trying to figure out if their model is actually accurate or not, but you apply these more generally.

They're becoming super powerful across the board as more and more and more folks produce these things. And they're they have their different uses, but you can combine them and string them together to get powerful results. Yeah, it sounds like there's an awful lot of value to be unlocked here. There's, there's probably a lot of value to be created by companies who can make it easier to go from where you are today to being able to have those questions answered. Um, there's, there's value in, in making it secure, you know, please, you guys are playing, and, and, you know, the people internally who are listening who can who can embrace this rather than resist it, I think are going to be able to add value to their companies and probably to their own career by, by embracing this as well.

So I mean, a lot of really cool stuff. Yeah. What, what is this? What, I mean, what's it look like the last few years? You know, how big are you guys today?

You know, you're still, you're still here in Colorado. Are you hiring all over the place? How's that all look? We are. You know, it's been, it's been an interesting ride through COVID.

We had people, we, we had sort of a couple centers of operation and it's kind of scattered a bit. We're still based basically Rocky Mountain West. We, we had our best year ever last year. We about doubled our revenue, and, uh, and we're growing and doing really well. We have a ton of interest in the new Cloaked AI product as people get their arms around these different, um, new solutions.

It's, it's interesting because it's like this new type of data. Like, we're not asking people to go back and lock up data that they've held in a certain way for years and years. We're saying, oh, it's this whole new type of data, here's how you do it right, which is a kind of a refreshing sell for us. And, uh, um, so yeah, I mean, we're doing, we're doing quite well. We're, uh, um, things are pretty exciting and they're moving.

Like, there's a lot of, a lot of pieces moving right now. We're, we're developing partnerships and other things at a pretty fast rate at the moment. Are you guys hiring? You looking to hire people these days? We will be very soon.

Yeah. What kind of folks should be, be looking at your website to get hired? Uh, I mean, so we'll be, we'll be expanding our sales team quite a bit and marketing and partnership team because of all the partnerships we are working on. Uh, we'll be doing some developer relations and some engineering, so a whole swath of things. On the security side, for people with security, we, we aren't currently hiring security, but stay tuned because we might.

Yeah, I mean, but like, you know, the whole go-to-market, lots of, lots of those folks in the area, people who have a sales experience with with security engineers. Awesome. That's fantastic.

What else should I ask you about? Anything else been going on that you want to talk to us about?

Yeah, I think all the interesting stuff right now in our area is either in the cool technologies specific to like, how do you actually operate over encrypted data? That's one direction that goes kind of low level on the technology side. The other side is sort of like, what's going on with policies that's driving changes? Why is Meta's Threads not in Europe? Why is Google Bard not in Europe?

What is the White House saying is going to change in security? I think that stuff is super fascinating.

The White House's cybersecurity strategy that they came out with in March is— I could talk about that all day because there's some pretty fascinating stuff in there. If it it, if it makes it to reality. Awesome. Well, well, Patrick, I, I love hearing the progress you guys have made. It's super cool that you're able to, to, to find a way to add value to what, you know, one of the biggest revolutions we're going to see in our lifetimes here with, with AI becoming more, um, mainstream.

Looking forward to hearing what that looks like, you know, 18 months from now or something. We can circle back up and, and just see, see what you, what you've accomplished. Let's do it. We could put together some fun demos. Maybe we can, maybe we can interrogate your previous Colorado Equals Security podcasts and find out, you know, what your favorite themes are to talk about and things like that.

I bet we could. Here's what you'll find. You'll find that I do not like blockchain or Austin, Texas. That's what you're going to learn when you interrogate all the data. A lot of smack talking about blockchain and Austin, Texas.

Well, well, blockchain got its comeuppance already, so you can.

Austin, Texas must be coming soon then. I mean, I don't know. They're they're certainly melting under the pressure at the moment, I think. All right, Patrick. Well, thanks again for joining us, and we'll catch up with you soon.

Yeah, thanks, Robb. I appreciate you having me. Take care.

Learn more about the Colorado security scene at Colorado Dash. Security.com, where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.