Automatically transcribed, so names and technical terms may be misspelled. The audio is the record.

The Colorado Equals Security podcast is your local source for regional security news, local events, and interviews with key individuals in the region. Now, here are your hosts, Robb Reck and Alex Wood. Welcome to Colorado Equals Security. This is your newscast for episode 251 for September 4th, 2023. Alex, happy Labor Day.

Thanks, Robb. You too. A whole day all for those mothers who've given birth. Is that what this is for, man? I was confused.

Is it for the Communist Party? The Labour Party? The Labour Party? Yes. That's not— it's— those are different.

It's a throwback to ye olde England. Is that— is that— I mean, I think we're just recognizing that labor sucks and taking a day off is great. Yeah. Or maybe labor is great and taking a day off is also great. Yeah.

I mean, everybody needs an extra day. Everybody needs a little time away.

So this is a holiday episode, as you could tell. Also, I had a party yesterday. Yeah, it was fun. Yeah, I'll leave it at that. It was fun.

I appreciate that you've, you've joined us this morning anyway. Yeah, bright and early. Rolled in at about 10 o'clock. It's bright, not early. Yeah.

Anyway, hey, before we jump into news, we have some housekeeping. As a reminder, we have a Slack channel with 2,500+ of our closest friends. If you want to join Slack and be part of the conversations and get together for our Colorado Equal Security hikes. We're going to do a second one here at the end of this month. Why don't you go ahead and go to colorado-security.com and get signed up?

Yeah, we also have a mailing list you can sign up while you're on the website. Well, we're actually starting to use it for a couple more things besides just show notes. We've sent out messages about our picnic that just recently happened and some other things like that, salary survey, other things like that. So we're branching out. It's not, not just show notes anymore, but Still weren't, you know, we're not selling your info or sending you spam or anything like that.

But Colorado Equal Security movement is growing. It is. It's moving. It's moving. Yeah.

So get on the mailing list while you're doing interesting stuff at your computer. Why don't you go ahead and rate us on your favorite podcatcher? It's probably on your phone, not your computer, and subscribe so the episodes get into your inbox every month without fail. Yeah. And you can tell a friend about us as well.

Get some more people involved in the movement and really help promote that. Finally, if, uh, if you have a little extra change in your pocket and you want to share it and help, uh, support the cause, help us cover our costs, do things like a free picnic that we have every year, then, uh, you can join our Patreon campaign and, uh, pledge a little money towards Colorado Equal Security as well. We'd love to have you as supporters. Thanks for our current patrons. We appreciate you guys very much.

It's not only financially helpful, but it's also like, I think, mentally helpful knowing there's folks who want to help keep the show going. All right, let's jump into some news. You know, we always try and start off with some interesting local news, and this one's— I thought interesting about a company that maybe I knew, but I don't really know. Teriyaki Madness. They're a Denver-based company.

I've eaten there once or twice. There's one not too far from my house. It's fine. It's a fast casual, right? Yes, it is a fast casual, sort of like Chipotle, you know, Modern Market, whatever.

Yeah, those companies. Yeah. So they They recently, um, are coming up, announced they're coming up with some new technology that is meant to make them, uh, going inside and getting from or ordering from them faster than going through a drive-through. Right. Yeah.

As opposed to going through the drive-through, you will, you know, order online or through an app or something like that. And then they will know, uh, based on GPS and other things like that where you are. So when you pull into the parking lot, they'll be like, yeah, oh, Robb's here to get his food. Let me take that out. Uh, yeah.

Basically as you pull up, there's They, the idea is they'll be standing at the curb to hand you your bag. That's pretty amazing. It's pretty cool. I'm curious how many times like somebody will pull in the parking lot, but they're gonna go to, you know, get a coffee first and, or, uh, you know, oh, there's, uh, this other thing in Kroger. I'm gonna go get some groceries and then I'm gonna go get my food.

And like, you got the guy standing there with the bag, like, what, where'd they go? And I, and I can't imagine anyone listening to this podcast having any issues with being GPS tracked by a fast food restaurant or excuse me, a Fast casual. Fast casual restaurants. Anyway, I, I, I now honestly reading the article kind of makes me want to try Teriyaki Madness. You know, get, go get a, it looks like 9 different bowls options they have.

Yeah. I'm sure I should try one. I'd like, I mean, it's Colorado based. You may as well. I, I will say as I was reading the headline and thinking about this, if I'm going for the fastest getting food experience, it's always, I park and, and walk in.

It's almost always faster than going through the drive-through because there's so many lazy people who will run out of the car. And I, if I'm just willing to be a slightly less lazy, I can usually get through there quite a bit faster. That's true. That's true. That's, that's my tip for the day.

And now you can be lazy and faster. There you go. As long as you're willing to plan ahead. You have to plan ahead. You have to use the app, install the app, all that stuff.

Exactly. All right. Next story. We've actually got some big news stories that happened over the past month. 3 big stories this month.

This first one you may or may not have heard. Dish Network and EchoStar are merging back to form one company. Of course, these were one company in the past and then they split. And now they're coming back together. Yeah.

So Charlie Ergen is, you know, one of the richest men in Colorado, one of our billionaires, and is the primary shareholder for both of those companies. As, as they looked at strategically what makes sense for the companies, I think there's, there's, there's a lot of synergy here for the companies, not only from a business tactical perspective, but also from a financial perspective that, you know, EchoStar had a bunch of cash on hand. Dish could use some cash on hand. This, this merger gives them the chance to leverage each other's assets like cash, but also, you know, to leverage the shared spectrum that they both have. They both have bought billions of dollars worth of wireless spectrum.

Apparently, I don't— I didn't know much about this before reading this article. But, you know, Dish had a lot of the spectrum here in the US and EchoStar had a lot internationally. Right. They're, they're, joined together spectrum will allow them to do a consistent approach to delivering signal all around the world. Yeah.

I mean, it, it sounds like a good idea. Um, hopefully both sides will benefit in this new, uh, new company. And, you know, they say like, what are they going to call it? Like, is it going to be— I think it's gonna be Dish Network. I did not see it in this article, but I, I think I'd heard that other places.

Interestingly, the— I'm sure they'll still have both, um, brand names used, but I think that the the joint company will be Dish. The couple of things they did mention in the article is the CEO from EchoStar will be the CEO of the new company.

John Soeringa, that wasn't in here, but John Soeringa, who's the COO from Dish, will be the COO of the new company or the president and COO. So they're going to have a senior leader from both sides. A couple of interesting efficiencies they mentioned they can get. They can combine call centers. So instead of having to have a separate call center for Dish and EchoStar, they can have one.

And then they mentioned installers. They can have one installation crew, which that one kind of surprised me. I didn't, I didn't think about that in advance, but I guess it makes sense. Makes sense to me. Cool.

Moving on to the next big story. Ball Corp is selling off of their aerospace business and focusing solely on, you know, aluminum and packaging for their, their road forward. Um, this one was interesting too. Um, it sounded like, um, this was a little bit driven, uh, by the market in that the, the differences between the 2 parts of the company, um, Ball felt like they were undervalued because people didn't really understand the aerospace side of the business. And so they, they thought it was a better use, uh, to be able to sell that and get capital for that side of the business and, you know, rebuy some stock, have some money, do some other things.

Yeah. I, I love articles like this where they go through the news and we'll talk about the news, but then they, they often will just drop random facts about the companies in the stories. So, you know, Ball Aerospace, or as I like to call it, Ball Brothers Research Corporation, was founded in 1959 in Boulder and a little building there. And, you know, obviously has grown up into this, you know, this massive multi-billion dollar organization with 5,000+ employees since then. Really interesting that, you know, Ball Corporation itself was best known for, for a long time as the Mason Jar Company.

Right. That's all they really did. Well, that's what they initially did was build those Mason jars. Actually, they made Ball jars. The Mason Company made Mason jars.

I thought Mason was like the, like the type of jar, not the brand. Is that— I think it's a brand. I thought it was Ball Mason jars. Okay. Now, now we're going to look it up after this.

Apparently, if you're listening, one way or the other, errata coming. Regardless, we have a, we have a jar. Um, anyway, they, they, you know, we go from building jars into building a, an aerospace company. Um, you talked about kind of this financial market, uh, perspective where a company like, you know, now they're basically aluminum packaging, right? They build, they build cans, they make those little reusable recyclable cups.

Um, the, the things that make that kind of a company attractive, low, no, low pro or low costs, you know, growth, all these things are not the same things that make an aerospace company. Right. Basically, a government contracting company, much slower, longer term. Yeah. They're gonna have to be big capital outlays in order to get returns over quite a while.

So when they're, when they're being valued by the markets, people just don't know how to do it. So separating these companies allows them both to be optimized toward the way that they're gonna be valued and, you know, get, get value back for the shareholders. Yeah. And, and one of the things that we didn't say, it's, it is BAE Systems, which is, it's a British company that also is a government contractor, is the one that's going to be buying this. They do have an American subsidiary.

So that's who's going to actually own it and hopefully help with regulatory approvals and things like that. Yeah, they said that after this acquisition of Ball Aerospace, BAE's overall revenue will be 47% from the US. So it's not like this is like a little tip dipping a toe in the water. This is, you know, they're just about half focused on the US. Also, the the deal is going to be $5.6 billion.

But I also noted that they did say that after it closes, Ball is supposed to net like $4.5 billion. So the, the process of closing and the taxes and whatever else is going to be, you know, a little over $1 billion. Well, I imagine that there's some lawyers who get a cut of that too. There's probably some lawyers. Yeah.

Those, those investment bankers, they usually like to make a little bit of money. So I suspect that, you know, there'll be some money spread around. But hopefully this is a good thing. You know, it's a little sad, I think, for For those of us, I don't really know the companies that well, but you know, I think of Ball Aerospace as being our hometown aerospace company. And you know, now they won't be.

Now they'll be a British company. Yeah. Anyway. Yeah. All right.

Moving on. Next, we have a story about this year's Inc. 5000. And we've talked about this list several times in the past. This is the 5,000 fastest growing companies. Yeah.

And every year, a new list comes out and we talk about the ones that are from Colorado. Yeah. You know, it's a— we have a a few fewer on the, on the list this year. Um, but you know, going through the top ones on the list, uh, Crusoe Energy, I've heard of them. I don't know much about them.

I had never heard of Blazy Susan. Did you know Blazy Susan? I didn't, but it's a great name. I immediately Googled what in the heck is this thing? And it's almost exactly what it sounded like to me, which is like kind of a hip lazy Susan.

Like it's a, you know, if you don't know what a lazy Susan is, it's like a spinning plate or tray that you can either put in a cabinet or put on a table to like turn the food toward whoever it is. And these are like kind of, you know, modern, I don't wanna say garish maybe, but you know, with, with branded stuff and, and like, I don't, I don't know how these people are growing at what is it, 4,000, 5,000%, but obviously they've, they've caught on somewhere. And if you, if you need to buy a thing for a person who's got a little bit of spunk, maybe take a look at Blazy Susan. My first thought looking at it was it was something related to the marijuana industry, but Okay. I mean, you know, maybe you can spin your, your weed around on the, on the Blazing Susan.

Maybe you spin your weed around on these Blazing Susans. I think you might wanna take a look at the website. I think, I think that that's happening there. The next one was Omni Interactions, which I also don't know. Evolution Veterinary Specialists.

Fluid Truck, which we just talked about quite a few times, right? They've, they've had almost 3,000% growth. Yeah. The another one on here down at 243 is Sondermind, which I believe we've talked about once or twice, or at least I know of. Um, most of the other stuff I don't, I don't recognize.

So I bet you that if we— this, they just had like the top Colorado ones, that one's in the top 400. I think if we went down the list further, we would see some of the, the old faithful security companies and tech companies that we know. I'm sure Pax8 makes the list somewhere. That's a lot of work, right? But we didn't do that much work this, this month.

Um, anyway, that, that it's nice to see a lot of growth and, and it's nice to see some new names on the list as well, right? Uh, speaking of growth, our next article is about VC funding in Colorado. And, well, it's not actually about growth, but, you know, VCs help people grow. Yeah, this article, I think there's 2 different perspectives you could read it from. You could read it from the perspective of, look at how Colorado is growing relative to all the other states in the West.

We are the fastest growing of the Western states. We also have a higher percentage of overall VC money than everyone but California. Yeah, California is like 35%. But then we were number 2 at like 2.5 or something. It was almost 3%.

Washington State was, was behind us. So there's, there's a really good perspective. And then there's the perspective where actually Colorado overall has had a decrease in VC funding in the last year. While there have been some states that have actually had increases. Yes, I think that covers it very well, Robb.

There were some other facts in here that I'm trying to find one of them. One thing that jumped out to me that I thought was interesting was that there are, I think it was 19, but I'm trying to find the number in the article here. Oh, sorry, 16 US states that had no venture capital finding or funding. Excuse me. And it of course makes me curious what those states are.

Does it have the list? It doesn't have it there, but maybe if we dig in, there's some links in here, we might be able to dig into this. That sounds like work to be done. It does sound like it. Actually, I think if we look at the map, we can see it.

Looks like Alaska and Hawaii don't have any money. Anyway, we're not gonna go through the whole list, but interesting stuff. Colorado, you know, we still are a healthy place to get funding. You know, the ecosystem that folks like Brad Feld have built here has grown and is growing, and it's nice to see. Nice to see that progress.

You called it earlier. One of them is Wyoming. So not a surprise. Anyway, moving on. All right, what do we got next?

What are we talking about next? We have a story about a grant that was received here in Colorado from the— was it Small Business Administration? Administration? Federal, right? Yeah.

Yeah. So there was a different states had the ability to apply for these grants. And this, this was applied to by the— oh, shoot. ODCO.

EDIT or something. Colorado's Economic Development Fund. They, they worked with the Pikes Peak area and the National Cybersecurity Center to put together this grant proposal. And really, the thrust of what they're trying to do here is they're going to use the money to build a new program to help small businesses across Colorado with cleanups after cyberattacks and some other resources. This obviously, obviously NCC is a big part of this, right?

Because they had been working on building that, that resource center to help small businesses. And I'm guessing that they're going to use this funding to jumpstart that. Yeah, it sounds like some of it will be on education, training small businesses, and some of it I think will be for responders to help, as you mentioned, with some of those incidents. So, I mean, overall, great. It's wonderful that we have this million-dollar grant.

Um, the, uh, Colorado Springs, um, Small Business Administration group, uh, I forget their name now. Also, we're doing a great job here today, Robb. Um, they're the ones I think that are sort of taking the lead, even though every state was allowed one submission. Right. So like you had to come together as a state and decide who was actually submitting.

So it was the Economic Development Commission that actually, uh, is the primary on the grant. But I think you know, most of that is going to be the Colorado Small Business Development Council. Yeah, it'll be interesting. It does look to me like there's more of a focus down in the Colorado Springs area. They mentioned specifically that these resources will be available for everyone in the state.

But as I read through it, I'm like, yeah, okay, but it's going to be headquartered down, down in the Springs, which, you know, makes a lot of sense if NCC is a big part of it. They also thanked Murray Security Services in there with our friend Sean Murray. Uh, who is the, the president of that and now, um, or owner, I guess, and now, uh, president of the ISSA, uh, International Board. Yeah. Congratulations to Sean on both of those.

Uh, all right. Next story we have is another big merger story. And this one is coming directly from the security world. Uh, Ping Identity, which if you, if you got to go through their, their history real quick, you know, venture capital backed from like, you know, 2002, 2003, they got bought by private equity in 2016. They went public in 2019.

And then last year they got taken private again by by a big private equity company called Thoma Bravo. And then as of last week, or was it 2 weeks ago now? I think it was last week. Thoma Bravo officially closed on a deal to acquire another, a direct competitor to Ping called ForgeRock. And they, as soon as the closure happened, they announced that they are merging ForgeRock and Ping together.

And under what it sounds like, it'll be under Ping Identity, definitely under Ping Identity leadership. Right. Yeah. And I believe also, it's not mentioned in this story, but I believe the Headquarters is still staying here, as you know, since Ping leadership is the one that's going to be in charge. And, and yeah, so interesting.

It's not that it's a surprise after, after Thoma Bravo bought ForgeRock, but I was actually surprised with the speed, like, you know, the day that the deal closed, like, we're announcing that these 2 companies are coming together. Yeah. And obviously, there's a ton of open questions if you're a customer of either one of them. I think there's probably a lot of folks who don't know the, the breadth of these 2 companies together. It's, it's really pretty impressive.

You know, Ping has had, you know, most of the Fortune 100 as customers, all the big banks, all these other folks, uh, for, for quite a while. ForgeRock is like the number 2 competitor in that space. So in the large enterprise hybrid identity space, these 2 are the big players. So they're, they're going to have, you know, a lot of coverage in, in You know, when I see you talk about Fortune 500, there's a pretty big difference between the Fortune 50 and, you know, Fortune 400 to 500, right? Like, they play much more on the larger side of that.

That at the lower end, I think that, you know, you're going to see a lot more of the Octas and the Microsofts, but at the very high end, FortiRock and Ping are the two. So it'll be interesting to see how these things go and, and how they continue to serve their customers really well. A couple of interesting things about Thoma Bravo, you know, They, in addition to owning Ping, they are the owner for LogRhythm, you know, another big security company here. Yeah, Proofpoint, $12 billion company. Yeah, SailPoint, which is another big identity company.

And I didn't realize that until this article, they own Sophos. Um, oh yeah, it was like a British— I thought they were a British— yeah, I think they used to be. Um, so a lot of, I mean, a lot of security companies in Thoma Bravo's portfolio. Um, you know, they've, they're obviously, you know, what, maybe the biggest hitter in our space and doing a big, big deal here. Yeah, you brought up SailPoint.

It'll be interesting to see if sometime down the road they also try to integrate SailPoint into the new, uh, merged, uh, Ping and ForgeRock, because, you know, it is a complementary product to those products as well. In, in those large enterprises, SailPoint has a really big perspective as well, but they do a different thing. So I could see, I could see, I could see either way. Um, and, and one of, one of the other nuances, it's just worth mentioning for those who don't know, In the identity space, companies like Ping and ForgeRock, they look at sales kind of bifurcated into, we're selling into a workforce scenario, which is you're going to use our product to help your employees get access to their resources, or we're selling into a customer identity scenario, which is your customers are going to use this experience in order to get access. So think about, you know, you sign into Amazon or Netflix, that sign-in process, that's a customer identity experience.

That you're, that you're getting versus, you know, your work experience. Both Ping and FordRock have doubled down. They've invested really heavily in customer. Like, I think that— I don't know for sure. I think somewhere around the majority of their revenue is coming from customer.

So there's a, there's an interesting play there as well where SailPoint's all— I think, I think it's all basically workforce identity, right? Yeah. Interesting. Interesting stuff. All right.

Moving on. Next, we have a Coalfire article talking about how Fortune 500s are building brand value by communicating security posture. First couple words, trust and transparency. You build this by really being transparent with what your practices are and what you're up to. I think as I read this article, it's an inspiration— no, aspirational article more than it is a state of the world type of an article.

I don't know that I believe that many Fortune 500 companies are actually Um, they're winning because of how good a job they do with, with security. Yeah. I mean, it depends on the, on who you're selling to, right? Like who, I don't know. I'm sure I could find somebody like T-Mobile.

Like, hey, yeah, exactly. T-Mobile is, is winning for sure. I mean, this is, this is the challenge. I see lots of companies who have, you know, numerous breaches and then not a lot of impact as a result of that. Right.

And that, that's the, I guess that's why maybe I'm a little bit skeptical. It seems more aspirational than reality to me. Yeah, I mean, I think to your first word, it could be inspirational also, uh, you know, maybe inspire you to do a little bit more on this front and, uh, as a security practitioner, do things to, uh, to encourage and enable your company to, to show off its security posture and maybe help, who knows. But yeah, I mean, I guess I think it's a great trend to see companies at least trying to be better at these things and talking more about it and you know, having an answer when someone says, why should I trust you with my data? Well, you know, here's what we're doing.

And of course, we're not perfect, but I think it's great that they're making that progress. Yeah, for sure. One other little thing that I wanted to call out that I thought was interesting. They have— most of the article talks about, you know, why you should be doing this. But at the bottom, it's essentially, you know, how can Coalfire help you do this?

And, and one of the points was client SME sales call support. That basically you could have a Coalfire person get on the phone with your, one of your customers or, uh, potential customers to, to sort of, you know, explain how good you guys, you are at your compliance. And I'm thinking like, no effing way. Like, I, I do not ever want an auditor or anybody else that, that I'm paying to do something for me on the phone with one of my customers. But you're a CISO and your company is lucky enough to have you.

There are probably companies out there that, that don't have a CISO and they're, and they're like, who would I put on the phone? Right. Okay. Maybe Coalfire. Okay.

Yeah, sure. Yeah. I mean, it's possible. Good luck with that. Um, I, I could maybe see if, um, if in pri— uh, preparation for a call or something like that, you needed to be educated on something that you were talking about, you know, maybe you could work with one of those Coalfire SMEs to educate you so that you can talk better to a customer.

That, that seems fair. Yeah. That's good stuff. All right. Uh, next blog we have from the Bite Back Law blog, Husch Blackwell.

Um, this is, part 2 of a series where they talked about how to be prepared for the new SEC guidance and regulations. Uh, in that, in that first part of the series, they were talking about what those new requirements are. Here in part 2, they offer ideas for preparing, uh, the required disclosures, um, in annual reports. Like, hey, okay, you're supposed to do these things. Here's how we recommend you do it.

Yep. Yeah. And I think, um, I think they had some suggestions in the prior Um, this starts at suggestion number 4. Um, and so basically they're talking about, um, preparing your risk management process and, you know, making sure everyone's clear on how you came to these decisions, what you, uh, put into your risk management process. So, um, you know, that wanted to be substantive so you're not just kind of hand waving and then, uh, something happens, the SEC is like, hey, you know, you're not really taking care of what you need to take care of.

I mean, to me it all reads like, hey, you should treat this more formally than it might have been treated in the past, right? You know, if you're making decisions, write down when you made them, who made them, why you made them. Have a log of the risks and how those turn into the decisions that you've made. Like, I know for you and I, we've been doing this for a long time, but there's a lot of companies that, you know, they don't do this and they're making decisions like kind of ad hoc, maybe in a ticket somewhere. Like, hey, have a central place that you can show like how you came to these decisions, why it's risk appropriate and, and be willing to share those if you need to with the SEC.

Yeah. A couple other things that they mentioned, uh, they talk about third-party vendors. Um, obviously, you know, if you don't have a good third-party vendor risk management process, you need to make sure that you do because that obviously is a big risk area these days. I think the thing that was the most interesting to me in this article was they talked about how, uh, you're basically gonna have to share more probably than you would want to, uh, to the SEC as part of this stuff. And especially if it's part of the breach notifications, it's possible that that required oversharing could lead to action from a different government entity like the FTC or something like that coming after you.

Because you, you had to disclose that certain things happened. Yeah.

I appreciate Husch Blackwell, you know, giving this content for free to us. And as we're, as we're all thinking about how do we get our companies ready for this, I Hope you all take a look. All right, that's the last news, but I have an update. So if you remember last month, we announced the Hexion platform from Coalfire and on the show, like, hey, what does this do? Can you tell us some more?

This press release doesn't have much info. Well, Coalfire responded and provided quite a bit more information about what this thing looks like. I sent over a handful of questions and got very thorough responses that I will not read every word of, but that honestly, I appreciate them spending, taking the time. So I asked the question, like, what are the capabilities that Hexion offers? And if you remember, they were like, hey, this is our next-gen, um, security assessment platform, and right, or vulnerability management.

I can't remember the words they use exactly, but I'm like, well, what are the capabilities that we get here? Are we talking about automated pen testing? Is it manual testing? Is it dynamic analysis? What does it have?

And they actually gave a list of the services here. So attack service identification, so ASM, attack service management stuff, asset discovery, vulnerability trending, vulnerability risk scoring and prioritization, contextualized findings, real-time communication— I don't know what that means— and unified reporting and dashboards. So, you know, obviously a platform to help you discover where your assets are, help you figure out where the vulnerabilities are, how important those vulnerabilities are, and to report on those things. Yeah, I will note also that prior to that, that bolded list, there is another point that they said, which is Hexion is an offensive security SaaS solution Uh, that provides comprehensive and continuous vulnerability management. Yeah.

So on one hand, that sounds to me like automated pen testing. Um, but on the other hand, they don't mention that as part of the service. So maybe it's just taking in the results from everything else. Well, it's vulnerability, it's, it's vuln scanning, right? It's not pen testing.

I don't, I don't, this doesn't seem like pen testing to me. I think that they, they, well, I, I, I specifically asked the, the question, um, uh, shoot, uh, whether it, whether it was like related to other services, and this is a brand new one, right? They built this thing from scratch. Um, they, they said that, uh, uh, they saw an opportunity to disrupt the market. Yeah, of course they did.

Marketing person said this, obviously. Um, but, but honestly, like, it seems like a pretty good product that, that— or a good idea. I haven't seen the product's quality, but it sounds like a pretty good idea. Um, I did ask, uh, how this differs from their hosted vulnerability scoring, uh, scanning system Um, and really this sounds like this is, this is just much broader, right? They're able to take, um, a lot more inputs into this than the vulnerability scanning system by itself.

Cool. Good stuff. All right. Uh, so that is it for the news. Let's go ahead and jump on over to our event calendar.

Of course, if you go to the website, uh, we do have a, uh, an event calendar there where you can see all the upcoming events, but we're going to talk through some of them that are happening in September. Oh yeah. Starts off on September 13th. ISSA Denver has their, their monthly chapter meetings. Those are going to be both in the Tech Center and downtown.

So if you want to go to lunch down in the Tech Center and then go downtown for dinner, you can meet with ISSA on the 13th. Sweet. On the 14th, ISACA Denver is doing their September chapter meeting, which has a topic of getting started in blue teaming and advanced concepts and testing strategies for auditing SAP. Yeah, so it's worth calling out that those are actually 2 separate talks. That this is like a, it's like a long day.

It was like 10 to 4 or something. So you're, you get quite a bit of CPE, quite a bit of time if you go to this, um, with 2 different topics. Cool. Uh, on the 19th, we have 2 events. Uh, first, the CSA Colorado chapter is doing their September meeting.

They're going to be talking about the API security landscape, uh, what folks are seeing in the field. I think someone from Salt Security was coming to that. And also on the 19th is SecureWorld Denver. Alex, you and I are going to be there. Uh, we're doing, I think, the closing keynote panel.

Um, it's gonna, it should be fun. I think I'm moderating and we got a few other folks who are gonna be joining you on that panel. Yeah. And I think we're gonna put the interview on the show after. That would be great.

Knock on wood. Yep. Um, I'm also helping to facilitate a lunchtime conversation. Uh, this is, um, about forensics and, um, we have one of the folks from, uh, local or I guess federal law enforcement, but that is local talking about that stuff. And, uh, I will caveat that with it is a, it's a VIP session.

So you have to be on the VIP list to get in there. I didn't even know it existed apparently. Uh, on the 21st, Let's Talk Software Security is doing an operating models for modern software security conversation. And then finally on the 27th, ISC² Pikes Peak is doing their September meeting. Yeah.

Let me just go one into October. Um, we might not record, but before then, ISA Automation and Leadership Conference. ISA is an industrial, uh, Automation. I don't remember what the S stands for, but Society of Automation maybe. Um, and our friends, uh, Don McLaughlin, Chris McLaughlin, and, um, and Scott Reynolds are a part of this, leaders of this chapter and are part of this and asked us to talk about on the show.

So if you're interested in automation, IoT, manufacturing, could be a really interesting conference. Nice. Uh, let's jump over and talk about some jobs. A lot of leadership jobs this month, and I didn't do it on purpose, but there was— I just kept running into leaders, like a lot of directors and manager positions open. Cool.

Uh, first, Ibotta is looking for a Director of Compliance. RingCentral is hiring a Director of Security Programs. Western Union is looking for a Senior Manager of Information Security. Holland and Hart, our good friend Joe McComb, uh, who, who won the Colorado Equal Security Most Admired Award last year, he is looking to hire an Information Security Manager. So you'd be working directly for Joe.

Uh, Astroscale is looking for a Security Manager. Excuse me, security manager slash FSO. It's like facility security officer. Charles Schwab is hiring an information technology asset manager risk governance. That comes in with our longest title of the week.

Well done. FlexCentral is looking for an IT security and compliance analyst. And speaking of working for great people, Sean Fredrickson, a good friend and former coworker of mine, is the new head of security over there. So I'm sure this would be working for Sean. Next, I get to say this one.

Quantinium. Quantinium. Quantinium. Quantinium. Quantinium.

Quantinium is hiring a senior cybersecurity engineer. If you go and get that job, let us know how it's pronounced. Please, please. Craydon is looking for a cybersecurity analyst. And finally, Motive Care is hiring an IT governance analyst.

This is probably working with our friend Bill Randall over there. Oh yeah. He's the head of GRC over there. Awesome. Well, that is it for news.

We do have a feature interview this week, though, Alex. Who do we have?

More importantly, where does this person work? So we have Brandon Stewart, who is the CEO of a local security startup. We have been trying to figure out how to pronounce it. Google gave us three different answers. It's over helpful.

Google is over helpful. Yeah, and it is N E. R-E-U-S, which is the name of a Greek god. It's either Neros or Nereus, or one of the pronunciations like Nerus. Nervous. I'm nervous.

Anyway, we don't know. And we're excited to— I bet Brandon will say it. And we'll know in just a minute or two. Looking forward to hearing. Thanks.

Big, big thanks to Frank Victory for doing this interview for us. And Uh, to Brandon for, for being willing to talk to us. Good stuff. I'm looking forward to hearing it. All right.

We'll talk to you guys again soon. Thanks, Robb.

This is Josh Ryan, network manager for Ultra Petroleum. Welcome to Colorado Equals Security, the podcast for Colorado security professionals by Colorado security professionals. Good morning. Good afternoon and good evening, Colorado Equals Security. This is Colorado Equals Security podcast.

My name is Frank, a guest host here. And I have the awesome pleasure of interviewing Brandon Stewart. He is the CEO, right? The CEO of Myriad Systems. Yeah.

I should know that before I get onto the podcast. Yeah. It's like, welcome Detroit. And everybody's like, you're in New York. And he's like, welcome New York.

Yeah. Myriad Systems, no doubt. Myriad Systems. I think that we're in Colorado. At least I hope we are.

If not, Robb and Alice are going to be really, really upset with me. I was looking though at your tagline. Which said Navigating the Future. What is that all about? So I've been in IT pretty much my entire professional career, and one of the things that I think is really important is to, is to understand— if you've ever sailed or you've ever whitewater rafted or you've ever been in kind of a fluid environment, I think being able to look out far enough over the bow of whatever you're on and being able to see how things are developing so you can place yourself in the right place for success.

And I think that's very applicable to technology, right? I mean, I don't know how many startups we've seen with great ideas, bad timing, right? Or kind of okay ideas and excellent timing because of a security vulnerability or a risk or whatever the story was. They succeeded in other places that even more well-resourced or more brilliant founders just floundered. So I I think it's about timing and that navigation of the future in technology is understanding kind of geopolitical inputs that are going to be impacting what's going on as well as technical developments that are going to be impacting geopolitics.

So I think all of that kind of moves together. So that's what I would say. It's more about looking out far enough in advance and not being myopically focused on this thing today. Well, that's interesting.

What is your feeling about things when you mentioned geopolitical items in Ukraine, right? I mean, how did that impact us from a technology standpoint? So my belief is that we're getting to actually live and experience in a hot war a lot of the projected action items that would have been taken in today's world, right? So we're looking at I think you're looking at a very consistent and persistent effort from one side to disrupt critical infrastructure and the day-to-day lives of the Ukrainians that are, you know, living through this to try to degrade or erode morale. So for instance, one of the big things that we focused on at Nereus is operational technology security, and it's one of these things that people in the security world talked about for 30 years.

I mean, I remember going to a conference— I won't mention who the customer is— and going into this room, and there's this very brilliant data scientist at the front. This was like 20 years ago, and the guy had this idea. He's like, we're going to take all the data on the electrical grid, and we're going to put it in a supercomputer, and we're going to run testing and analysis, and we're going to figure out what threats are on the electrical grid. And I remember, man, like 20 years ago being like, can we just lock the damn door? Just do some like real simple stuff to maybe CYA and then you can play your moonshot game.

So I think it's been one of these things that certainly has been talked about over and over and over again and no one really dealt with it. And now all of a sudden, as we're watching Ukraine unfold and what's actually taking place, I feel like the customer base and certainly the people we're supporting, which is US-wide and starting to become global, We're starting to realize that it's not just a water treatment plant for a city's municipal system. This is manufacturing facilities. This is R&D and things that are making America actually work. Our production lines, our facilities, those are vulnerable, right?

And you get a lovely ransom attack on, let's say, a production facility that's cranking out anything of real value. Now you've got real loss of money, you've got loss of time, you've got loss of effort, and you've got embarrassment. And that's hitting your bottom line and that's hitting kind of the American economic system. So anyway, long-winded story to basically just say, yeah, I think that's what we're seeing a lot of now. Do you think that the war on Ukraine or our most recent pandemic Do you think that's shined light on supply chain attacks?

Oh yeah, man. Hell yeah. That's it. Yeah, totally. I mean, global economy and specialization, I mean, it's all awesome when it works, right?

But you've got critical infrastructure and I think for such a long time, critical industry. When my father, I've got a weird family. My father was in World War II. I'm not, don't look like my dad would've been in World War II. He kind of had me much later, but I got to experience his perspective on America's time through that, that period of his life, plus the evolution of America to my time.

And one of the things at the time, it was like, okay, rail yards and shipping yards and electrical. And those were the things they were worried about being attacked. But that, that footprint is expanded dramatically. I mean, we've got telecom, we've got really critical industry, etc. And we have shifted away from making a lot of things that we really should be making here.

And I think you're seeing that over the last few years, or at least like, oh my God, we better start making this shit now. So we're a little bit behind, certainly. But the thing about America, which I really like, is we have a hard time getting it together, but when we do get it together, we move fast. And if you get everybody on the same page, there's really no one in front of us, in my opinion, on the global scale that can outmaneuver us or outwork us because of our innovation, because of our can-do attitude. Now, we don't have the amount of people, let's say, somebody in Southeast Asia may have, but we certainly have a willingness and ability to do so when we want.

So I think now all of a sudden we're looking at the supply chain as something that is critical for our nation state and our security and our livelihood. So yeah, absolutely. Oh, cool. Cool. Well, we're getting really serious here, so let's bring up the light and the mood.

But we are talking about fighting here. I heard something about you being in a brawl in Holland and then making friends with the police afterwards or something like that. Yeah, so, so I have family in Europe and I was gonna go see them and I, I'd never really ever met them. And so I took the trip and I had some friends who were stationed over there, so I was kind of bouncing around this tiny little country that's like the size of your fingernail on a train. And I went up north and saw a lot of people that I was related to and had a great time and had some drinks, etc.

And I get on the train and I see about 4 young guys just hassling these old people. And I really just didn't like it. It was something I was like, I don't— man, I'm not dealing well with this. So eventually I said something and one of the dudes mouthed off to me and I, I clipped— I kind of chirped back and he realized I was an American. He's like, you're an American?

I'm like, yeah, is that a problem? And he's like, nah, nah, he's cool. No, we're cool, we're cool. So it was kind of a moment where being an American bought me some cool points with the main guy that I was actually kind of concerned about that I was gonna have to deal with. He the big one.

So anyway, we all get on the train, they get on a different cart, the old people get on the cart with me. And like, man, I really got a feeling that these dudes are still effing around. So it was like a couple stops. I'm like, I'm gonna go check on this. So I walked down the train, the big guy's gone.

And there's a couple drunk little guys there. And they're just harassing these girls. So I'm kind of looking around, I'm like, I haven't really ever been arrested in Europe. And I don't think it's going to be that big of a deal. In Holland, right?

It's like, this isn't like Thailand. That, that goal was to get away? Yeah, it wasn't really a goal, but it was like, it was, it was a possibility that needed to be accounted for, right? Because I'm considering my options and what my path forward is, and it was pretty clear these guys weren't going to be talked out of being a problem. So I'm like, okay, what is the best case scenario in this situation?

What is the potential worst case scenario? Given the fact we're in Holland, there's not a lot of weapons, so I'm kind of like, all right, let's— I think I can press this. And I'm like, there's a possibility I'll end up in jail. That's fine, I'm American. They'll probably— I'll get yelled that.

I've been chewed out before. I'll get chewed out. We'll just call it good. So anyway, I sit down with these guys and they are just running their mouth and I'm like, okay, this is happening, right? So I kind of line everything up.

I'm like, we're gonna do this, we're gonna do this, kind of plan this whole thing out and just go to work, right? The first dude swings and I'm on it. So after about 5 minutes of me trouncing these 2 dudes, I get to my stop and everybody on the train's like, okay, okay, it's enough, it's enough. So I get off the train. And this old Dutch guy walks over to me and they're very kind of quiet, proper people, right?

Not quite like I am. And he kind of gives me this nod and pats me on the back. I'm like, okay, thanks. So I get off and these 2 guys follow me and I'm like, that's not a good idea. And the one dude grabs a bottle and breaks it and I'm like, now we got a real problem.

So after that happens, train security comes and they're talking to the guys. I'm waiting my turn and all of a sudden they come over to me and they're like, what happened? They start speaking to me in Dutch and I answer in English and they're like, You an American? And I'm like, yeah. And they're like, huh, okay, so what happened?

I tell them the story. I'm like, you can ask anybody here. The old people come over, they speak to them. The young people come over. So then the guy, the guy looks at me, he goes, just a regular John Wayne, ain't you?

Just all you goddamn Americans, you just gotta— anywhere you go, you want to help, don't you? And I'm like, hey, my family's here. I mean, and the dude, all of a sudden he's like, oh. And I'm like, this isn't like I just travel with a gun trying to solve people's problems. So all of a sudden at that point, the dude, the drunk is just being irate.

The police end up getting called and they come over and they're like asking everybody the problem. And then all of a sudden I see the train security look over and he says, John Wayne. So the cop comes over and goes, are you John Wayne? I go, I guess today I am. And he goes, he goes, what happened?

So I tell him the story and he's like, all right, well, we're going to let you go. I go, I'm going to tell you right now, these 2 guys, they got a problem and they're gonna follow me and this ain't gonna go well. So he kind of— he looks at him, he's like, yeah, that's probably right. He goes, what do you want to do? I go, can we put him in jail for the night?

And there was a soccer game that night that was like the soccer game in Holland that I knew about. And as soon as I said it, these 2 guys just start crying, hysterically crying, because they're gonna miss the soccer game. He goes, how long you want me to keep them in jail? I go, 48 hours. That way there's no way they could get anywhere near the game.

So afterward, the guy goes, is there anything we can do for you? Can I buy you your ticket? I go, can I get a picture with you? So they're like, yeah. And I— so I get this picture with the cops, I get it with the security guys, and they let me go.

So I go back to my friends who are stationed in Holland, and I tell them the story because I'm late for dinner. It was this very hoity-toity dinner I'm supposed to be at. And I tell them this, and they're like, this is BS. None of this happened. None of this is true.

Like, cops don't take pictures here. So then I just pull open my phone, I start scrolling, and I'm like, these cops And these trained security guards, and this is my pass, and this is my, like, this is my, like, little get out of jail free card from the Dutch police if I ever need it again. So at that point, my friends who were there on work were like, you can spend the night for the rest of the time you're here. We have to report this up the chain. You're probably not gonna be able to spend the night with us again in Holland.

And I was like, totally cool. It's all good. I'm here with family. It's, it's that. So that was my, that was my John Wayne moment in Holland.

Okay. So wait a minute. So 2 things out of that. The first part, is that you're fighting with these guys and then you're trussling it up and then the stop comes and then you suddenly stopped and said, oh, well, let's stop fighting. No, a bunch of guys split us up.

They split us up and then they keep trying to come after me and I just keep putting them down. And then everybody's like, please God, stop. And I'm like, my stop's here. I'd like to get off. I can stay if we'd like.

And everybody's like, no, no, no, it's good. You get off, you get off. I'm like, fine, fine. We're here. All right, I think I just said the way it sounded, I was like, huh?

Yeah, no, it wasn't like I was like, hey, it's been lovely, I've really enjoyed our time together, my— but I have to go, my mom's here. Yeah, no, we're not there. And then what about you? So did you end up getting kicked out of Holland? Like, are you allowed in the country?

No, not at all, not at all. So my friends had to report it up. They contacted the, the police, and the police are like, actually, your friend was very polite. They were like very polite, like very nice. They're like, you probably shouldn't be doing that, but He's welcome here anytime.

They literally— and my, my friends were in complete shock because they thought, this is— he's gonna get thrown out, we're gonna have this problem. And the cops were like, such a polite man, so great. Like, we got it all from the, the people that were there, we're good. I was like, cool, we're set. I'll come back and holler anytime.

Okay, now from your fighting skills, what— I, I mean, you, you, you are apparently John Wayne. What kind of hobbies do you have though? So I, my friends and I really enjoyed hand-to-hand combat training, which is why I wasn't too worried at that moment about what I was engaged with. But at this point, I've got a 6-month-old, I've got a 2-year-old at home, and I got a 14-year-old stepson. So my hobbies include changing diapers, taking kids to basketball practice, and praying to God that me and my wife can get a full night's sleep without getting woken up by a cranky child.

So if, if I get some time at the gym, I'm super grateful. But right now my hobby is sleep, diapers, and walks with the family. Well, speaking for as a father myself, I'm gonna say a fat chance for sleeping through the night with you. Yeah, right. And it doesn't stop.

I mean, my kids are actually both in college these days and good night's sleep just doesn't exist, especially as a guy with 2 daughters. It doesn't exist. Yeah, I've got, I've got 2 daughters, so they're awesome and then they're terrifying all at the same time. Time. My stepson, I'm like, hey, here are the rules, these are the guidelines, don't fuck up, I won't punish you, here's where we are, right?

It's very, it's very easy, right? The girls, I'm a little concerned about. Yeah, my wife did accuse me at one point of saying, oh well, you give them— they were boys, you treat them completely different. I'm like, yeah, absolutely, 100%, no, no doubt, but these are, these are my princesses, so all right. So you've got 2 kids, you don't really get any sleep, sometimes make it to the gym, possibly.

Yeah, possibly. How did you get to this point in your life? I mean, from your, from a career standpoint, have you always been in security or? Yeah. So I was, I had the opportunity to attend a very challenging military school in high school.

Okay. You know, so from about 8th grade to my senior year, I was at a school in Virginia that at the time was going through a transition itself. So the scholastics and the kind of personnel that were there were very different than they are today. But I was able to get through that, and I was kind of zeroed in to go to, to VMI as an undergrad. But I got recruited to play sports at another small school in Virginia, so I ended up going there, who had a really good business department.

They had a great economics department. So I ended up kind of taking that path because my interest and my capability lent itself that way. And then I had an East Asian studies concentration because I was kind of very interested in what was going on in Southeast Asia. It kind of seemed to me it was pretty evident that this was going to be an important part of my lifetime. And then, and then from there I graduated undergrad and I was like, I'm going to join the Marine Corps, right?

I'm going to go. I'm gonna get a gun and I'm gonna travel the world and I'm gonna meet different people and I'm either gonna like them or kill them, right? That's what I'm gonna do and I'm good at it, right? That's what I'm gonna plan my life to be at. And an uncle of mine, a family friend really, he had— he was an aerospace engineer and he had gotten into IT.

And me and him had a long conversation about economics and kind of the future of what we see in a— that geopolitical idea. And we had some interesting talks and eventually he goes, Hey man, I wanna hire you. And I'm like, yeah, that's cool. I got, I'm, I'm joining the Marine Corps. And he is like, you can make a lot of money here.

And I'm like, yeah, that's cool. I'll do that after the Marine Corps. And he is like, like he called my dad and he goes, he goes, can you get this kid to just shut up and, and like do this for a second? So my dad calls me, he goes, hey, if you get fired or you want to quit, you can quit anytime. Marines will take you.

And I was like, yeah, that's true. He goes, this opportunity won't come by again. So you may want to just investigate this now, and then if it doesn't work, roll, right? And I was like, okay. And I certainly had some bills I needed to pay.

So enlisted Marine doesn't make a lot of money, and neither does an officer for that matter. So I was like, well, I could, I could try my hand at this and see if I'm decent at it. So my first year at this company, I was the first employee ever had. I basically got a stack of engineering textbooks, and he goes, go. And he He was a double E. He goes, read all these and if you have questions, come back.

So my first 2 years out of undergrad, basically I had a 2-year hyper-focused electronics engineering degree for IT and I would be in his office constantly just pinging him with questions and he would be answering it. And then I was hammering the phone talking to people and I kind of started figuring out where people's pain points were and how we may be able to help them. And that was my whole thing is I wanted to help people. That's what I like to do. Right?

I mean, I don't really like getting into bar brawls. It's not my shtick, but I do like helping people. And if one of those things leads to the other, then so be it. But I actually want to help. That's my, my philosophy is be a helper, right?

I may sound kind of cheesy and certainly sounds like Mr. Rogers, but that's how I just am. So anyway, I really enjoyed kind of helping people and I thought maybe I could do it this way. So We started doing quite well and we went from 2 people to about, I don't know, 20 people. And I started getting brought, I picked some pretty cool, interesting solutions that I thought were gonna be helpful. And I started getting some calls from some groups that had some problems that I was able to help.

And I was getting brought in as a very young man in my 20s to some very, you know, interesting buildings that I didn't wanna know where they were afterward and having conversations in that regard. And I was helping. And I loved it. So then all of a sudden I kind of looked around and I go, I want to keep helping people. And this IT thing seems to kind of keep moving into this war element that I kind of have a passion for.

So I looked around at graduate school programs and there were only a few that I thought were good. Everybody was running out getting an MBA. I'm gonna get an MBA. I'm gonna make $250,000 a year. That's like everybody's thought back, what, like a decade or so ago.

So, and of course the school systems were happy to support this idea because they were making tons of money on it anyway. So I just kind of looked at it. I was like, I've been through business school. I don't want an MBA. So I, I found there was a program at Harvard.

Well, they, Harvard kind of had a quasi program with Tufts. Then there was a Tufts program, there was a Johns Hopkins program, there was a Georgetown program, and then there was like one other. Okay. And for my own reasons, I had kind of applied to Tufts. It seems like, it seemed to me like the best program to be a part of.

It had the broadest reach, it had the most international focus. It was connected to Harvard. It just felt like the program. And so I, I applied, and for whatever ignorant reason on their end, they accepted me. And, okay, and I was sitting there, and I, I'll never forget when I got the acceptance letter.

I was literally planning my trip to go see friends of mine in Europe, and I'm like, cool, I'm gonna take like a month off, I'm going to Europe. Like, this is going to be— I've done really well at work, you know, young guys like mid-20s or something. I'm like, I'm out of here. And I get this acceptance letter, and I remember just cursing audibly in a coffee shop that is not supposed to be there and trying to figure out like, oh my God, I have to do this. And not only do I have to do this, I have to pay for it, right?

So there's no time off. There's not like— I gotta make— I gotta, I gotta really hustle to pay the bill on this. Okay, so wait, so you, you had a lot of experience first, right? You had a lot of experience and then you decided to go to school. And now you're mad that you got accepted.

Is that kind of— yeah, totally. Well, yeah, because I didn't think they'd accept me. I mean, I was like, it's one of these things like, I'll try. They say no, I'll be in Europe. You mean like, hey, I'll try again later.

So they took me and I'm like, God damn it. What do I like? I gotta, I can't pass this up. It's the same thing with the IT gig. It's like, I can't pass this moment up.

So it's not a cheap program. So I ended up attending and there was like 2 other guys in there that were paying their own way. And then everybody else had some government agency or some sponsoring place and everything. And you could certainly tell the, the difference in the people who were there on their own dime versus the people who weren't. The people who were there on their own dime were like, I want every little bit of this as I can get, right?

I am here to rock. And the people who were there kind of funded by an agency or a group or whatever the story is, they were just kind of like, hey man, it's cool, I'm off work, I get to attend school, I'm traveling, like this is great. Meanwhile, I'm working And I'm going to school and this is like a full-time program that they're like, your, your, your company has to let you do this because you're not gonna be able to work. So I brought it up to my old company and I was like, hey, if I got into a graduate school program and one of the guys who was a partner in the company looks me dead in the eye and goes, if you think about applying to graduate school, I will triple your quota, cut your territory in a fifth. And I will work you like a slave till you quit.

Hmm. And I remember thinking, and I didn't like this guy, I didn't like, man, I remember thinking, so I should apply to graduate school. That's a free— I was like, oh, okay, got it. All right. So I'm dead at that point.

I was kind of still on the fence. I was like, man, I really got to do this. And when he said that to me, I was like, awesome. That's all the FU I needed to make this happen. So for a year I was in graduate school.

They had no idea. The company didn't know I was there and I was working and I was up every morning at 4 o'clock in the morning and I'd go to bed every night at 12. And that was Sunday to Sunday, Saturday and Sunday. I was reading hundreds of pages of documents just trying to catch up with the reading that everybody else was doing. I worked, I worked so hard.

Once I graduated, I like, I couldn't get out of bed. Oh, before 9 o'clock for like a month. I went to the doctor, they're like, you burn your adrenal system out completely. Like, here's your supplementation. You can't work out, you can't do anything.

Like, you're lucky you didn't stroke at 20. Like, this is what you got, right? So it, it was certainly a hard-earned victory and it was one I'm very proud of. But right after I, I graduated my Tufts program, I left my first company and I was like, all right, cool. I got everything I need.

Like, I've helped you guys enough. And this guy, me, we don't like each other. Obviously, he's a prick. I'm out of here. So I got recruited by another company that does a lot of work with those types of agencies that were calling me and they're like, hey, we want you to help us grow the business.

So I ended up doing that and doing it very well. Company just sold for quite a bit of money to another massive IT company here in town. I was one of their, I think I was like number 2 employee and, you know, did a bunch of stuff for them. So I worked for those guys for about 6, 7 years, absolutely killed it. I opened up, I opened up their civilian team, their DOD team, their— I helped them with their IC team, their civilian commercial team.

And things were going well right up until the point where I knew the owners made a decision they were gonna sell. And right when they made the decision they were gonna sell, all this like innovative, cool, fun stuff we were doing that was on the edge, seeing the future, navigating the future, reading the tea leaves, looking at the tide, all that shit stopped. It was like, we're here to sell. And I knew it. It was just night and day, the difference of what I was allowed to do and what it wasn't.

And I was like, all right, man, it's cool. Like, I'm outta here. Like, I, I got it. So that's how Neri started. I was like, I'm, I'm here to rock the boat.

I'm here to make it cool. And I'm, I wanna do some fun stuff. Okay. So it took somebody though to basically say, F you, right? And in the face of adversity, you went ahead and decided, you know what, now I'm going to make this happen.

This is more motivation. Is that advice that you would give to the Colorado Equal Security teams, to people like that? Oh yeah. I mean, America is built on an F you. True.

I mean, 1776 was an F you, right? Slaves breaking free of their bonds was an F Right? Like America is flush with the F you. Every startup that shows up is built on the F you. Now it may be a polite F you.

It may be a, hey, I think I can do this better, or hey, I've got an idea, or hey, but you gotta have an F you to start your own company, to take that risk, to be like, okay, I'm gonna put it all on the table and see if I can make this thing go. Like, that's not a safe bet. You know, those guys in California, the guys who've successfully left and they can go out and they can get $100 million and start up with their widget idea. Like, is that an F you? Sure, it's a little bit of an F you, but it's a safe one.

I think for other people it's a bigger one. And the more that you have that kind of drive and I'm gonna make it no matter what is what, that's the passion and the fire that I think helps drive innovation in America. I stuff. I've always been a believer in that. Is there any techniques that you would recommend or give when, when someone comes up to you and says, fuck you, and you want to reach down deep inside of you?

What kind of advice could you give to somebody, to the crowd that's listening right now, to really try to make it, like, to, to really come out? You have to— what's good advice for that? Know that you will be afraid and be okay with being afraid. Okay, be okay, be okay being afraid. Like, be accepting of being uncomfortable.

Like, discomfort is where growth happens, and if you're not willing to suffer some discomfort in some way, then there will be no growth. If you've ever been to the gym, there is discomfort there, right? If you've ever played a sport and really put your effort into it, there's discomfort there. If you've ever worked in a Math Olympic Challenge, there's discomfort, there's suffering, there's work, there's effort. You've got to be willing to, no matter if it's physical, mental, emotional, it doesn't matter.

You have to be willing to be discomforted, to bear discomfort and learn to actually enjoy it and the unknown, right? Like you have to be willing to take the risk of the unknown. Now I'm not saying just throw it all on black down in Vegas and say, let's see what happens. That's ignorant. But there certainly needs to be a willingness to take risk and be in that space of discomfort.

Okay. Okay. Is that where you think you would be? I mean, you sound like a very passionate person. You, I've heard things like you love helping people.

You're okay with discomfort. Is that what you would be saying you would be the most passionate about? What I'm the most passionate about? Yeah.

Yeah, I'd say that. I'd say helping people. I'd say I'm the most passionate about actually helping people, right? Because there is, I don't know why, I couldn't tell you why. I don't know.

I don't have some kind of Zen philosophy behind that. I don't understand kind of why I'm built that way. I just know I am and it's something that I love doing. Okay. Well, I can fully understand that as a Marine, as someone that essentially is a Marine, I have a sense of honor and I like to help people.

I teach at universities and while I get paid at these universities, I really get my reward from watching a student succeed. So I think that, and I think this community in general, whether it's in cybersecurity, whether it's the Colorado Equal Security group, you'll always find helpful people in the Slack channels, at the meetings and everything else. Yeah, that, and I think that's like you said, it sounds kind of cheesy, but it's also like, you'd be surprised how warm of a feeling it gives you when you think about it. It's like, look for the helpers. I'll tell you kind of a heartwarming story.

So my, my father passed about a decade ago and he was a he was very old at that point. He was 83. He was kind of ready to go. He was like, I've seen it, right? And I, I remember trying to talk him into staying, right?

I was like, what? Like, I haven't had kids yet and all these things. He goes, Brandon, I grew up with a dirt floor. I remember when they ran the telephone line to my house, right? Like, we had horses.

And he starts going through all these things that he has lived through. Like, this is a diametric shift from what he grew up. He's like, my time is here, right? My time— it's not my time anymore. This is your time.

This is your world. You need to live in it. So you made the decision. He rolled. And it was— you were really good friends, me and my father.

And I remember sitting in his wake, and my, my uncle, a very lovely man who's still alive, funny enough, I think he's like 90-something, 95, I think. Okay. Um, yeah, yeah, talk about longevity, right? And he comes and he sits next to me and he goes, Brandon, there are still good people in this world and you need to remember that. Like, I know it looks bad and I know that there's bad people out there doing bad things, but there's still a lot of good people here.

And if you can remember that, it will help you every day. And that's just for me. I mean, not to— again, I kind of hope I don't sound corny on this thing because But like, I just want to be one of those dudes. And I, I think you do too. You joined the Marine Corps.

I think you look around, I think the vast majority of Americans are actually that kind of person, right? Irrespective of their political bend or whatever their thought process or what news station they're getting fed their lies to versus the other news station they're being fed their lies from. I think generally speaking, Americans actually are like that. They want to help. And I think it's, it's a pretty good— it's a, it's pretty good vibe to have and it's a lovely place to support, right?

So I think that's just kind of what I am passionate about and I think my company is too. I've never been prouder with a group of people that I've worked with and I've got some absolute killers on my team who are just studs in their respective field and they're just some of the most lovely, supportive, compassionate people you could be around. They're inspiring well past what I ever achieve. Well, I think that's true, uh, and I think that's great as being a leader of people. It's a lot of times you may not need this skill set, that you may not have the skill set that you need, but if you hire the right people, you treat them right, you have them passionate, they're going to take care of that business for you.

Yeah, they want to win, right? Passionate people want to win. People who care want to win. Like, help them understand, put the put the guidelines in place so they can succeed, challenge them and help them where they can. And people are really amazing.

I mean, truly. Cool. So you've worked in security for a little bit. What do you think though, that from a cybersecurity, what do you think is our greatest challenge? Not necessarily, we don't need to solve it, but what do you think is going to happen?

Like what, what, what are our threats or what are our issues? So I could talk— there's so many rabbit holes to go down, right? There's artificial intelligence and there's quantum computing and there's breaking ciphers and all this spooky stuff going on that's gonna happen, right? I mean, it may not be here today. Some of it actually is here today.

Some of it'll be here tomorrow. I hope it isn't here tomorrow, but it probably will be. I actually think kind of a broader sense of something that you're helping with is just educating people, right? It's people hear cyber and they think, ooh, spooky stuff. And that's a growing field.

And how excited— it's like, this impacts every goddamn person here, right? Every single person has an online identity. They interact with the utility company, they interact with their bank, they interact with their streaming organization, they interact with the Social Security office. Like, the government is going online for you to get your taxes. Like this is, this is ubiquitous as the water.

This is, is everywhere like electricity. And I think the biggest challenge and what's kind of scary is the ignorance of everybody to this topic, right? And I think a lot of people are like, oh, computers, I don't really— I'll work on it. I don't really want to know anything about it. It's like, I don't need you to be a programmer, but you do kind of need to understand some things here, like driving.

I don't need you to be an F1 driver. Right? But you probably want to understand some rules and you need to know that this is impactful to you. So I think that's, as, as a nation, I think our biggest challenge right now is just the general education of, of a lot of voting Americans that are important in our economy right now. That's an interesting point because one of the things that I always tell to my classes, and I know this is not a documentary, but there's a quote within Men in Black, right?

The original movie. And we all know, yeah, Classic. Where he talks though about what protects the public from the aliens and being feared of the aliens and things like that. It's because they don't know it. Do you think that could contrast into cybersecurity or do you think that's a detriment?

That they don't know what's going on? Yeah.

I think they should know what's going on. I don't need them to know that the Chinese planted a logic bomb on the PG&E electric grid in California a month ago and that we we unwired it, right? Like, I don't need them knowing that, but they should know like, hey, there's a misinformation campaign getting sponsored by Russia about this thing, right? Or hey, there is a Zelle attack going on with these 3 major banks and you need to know it. Or hey, there is foreign nationals are working at this very interesting production plant and they stole a bunch of information.

Right? Because that way, all of a sudden, it becomes awareness, right? And you here on the Metro, if you go to DC, if you see something, say something. So we don't want to make a citizen of paranoia, right? We're not turning into Russia any, anytime soon.

But just, my God, just be a little educated about the fact that if so, if something weird is happening, maybe like look into it and just don't kind of write it off because you're part of this. Okay, well, that, I mean, that, that's interesting that you mentioned that because I think one of the new things at DEF CON this year was there was a misinformation village. Right? Right. Think about— I mean, that was kind of new because we're trying to be informed, but now we're being— that could be a vector of attack.

Yeah. Oh, it is, man. It couldn't be. It is. And the thing about that is, well, it's interesting, is those who are on the western border with Russia, right?

Finland, Estonia, these countries, they have had to arm themselves and their population with understanding what kind of misinformation campaigns they're going to experience and what to look for. So by virtue of that, they're on the look for that. It doesn't mean that they're clutching their pearls and worrying about something immediately in this moment, although if you're in Ukraine, obviously you should have been, and, and most definitely did, to be fair to them. But I think in America, we've been so isolated physically and geographically speaking that we haven't really had that educational process instilled in us. And I think it's being weaponized against us, right?

And we have to be careful not to get too far into the political weeds, but that goes for nation states and for special interest groups, for moneyed special interest information groups. So now you've got a misinformation campaign that is being provided to you via the mechanisms of IT that most people are just completely susceptible for, and they're not, they're not fully aware of what they're dealing with. Now, something to be said to that is what I do like about the younger generation, my stepson's age, and I could rave for hours about what I don't like about them, but what I do like about it is they're digital natives. So they're much faster on picking up anything that's out of line with what they're seeing, and they're quick on the response. Whereas my mom's generation, for example, Like whatever is said to them by their favorite channel is just the God's honest truth, right?

That is set in stone. Doesn't matter how you're— how ridiculous it sounds, it's, it's got to be the truth. So what, what do you think? I mean, what with your stepson being able to recognize, I guess, what, misinformation? Yeah.

How would you— what advice would you give to the, to the crowd right now, to the podcast about what they can do with their own kids? Because I'm betting that most of the people listening right now have kids that are in that digital age. What would you say to them right now? I'd actually tell them to listen more than teach. And the reason for that— and trust me, man, I'm hard on my stepson and I love him to death, but I, I keep his rear end in check because he needs it.

So it isn't like I'm just I'm like, teach me, Obi-Wan. You're my little Yoda. But I, I do when it comes in and I'm in IT, right? And then probably everybody on your side is in IT too. So I listen to what he has to say because these kids are smart, right?

They did grow up in IT. I mean, they, when you and I were growing up, like, dude, the dial-up was like, oh wow, like this is happening. Like these kids, man, they've had streaming media their whole life. Now there's a lot of bad to that. And certainly we could spend days on that, but they're also intimately familiar with it.

So they see and pick up things that I think even our generation, just one or two before them, miss because they're so natively attuned to that. So I would, I wouldn't tell them to teach them anything. I would just say, talk to your kids and see what they tell you right now. Again, they're not your little Yoda, but they're going to be pretty clever and quick on the draw on stuff that you may not be. Be paying attention to.

Yeah, I mean, I do. I have found that amazing. My oldest daughter is trying to get into marketing and the things that she knows at a very young age is incredible about how to market herself, how to put things out there, how to put out a new magazine. It's absolutely incredible how the algorithms work. And it's like, it's almost this like intuitive understanding of, oh, of course it's like this.

And like, oh well, they changed it and they changed it a year ago and now it's like this. And it's almost like this, well, of course you got to change a tire. Like, my stepson, it's going to be a mind-blowing experience for him to learn how to change a tire. It just is, right? And he's gonna learn, and he's gonna learn how to change oil.

He's gonna do all these things he doesn't really want to do, and I don't care, right? But he intimately understands how TikTok or Instagram or any of these viral social media campaigns Just intuitively. And it's, it's just so interesting because I look at it and I'm like, dude, I'm, I'm like my dad at this point. I'm antiquated, right? Like, am I going to be put out to pasture in the next few years?

Because I, I don't understand it. So that's, that's what I would say to that. Okay. And so that we— there are things that we can learn from our kids these days. So, oh my God, more than you suspect.

Okay. Well, I do want to go back. I'm looking through my notes. I do want to go back to something. That you said earlier in the podcast.

Did you do some, and I don't even know if you can actually answer these. Did you do some work with some clandestine organizations, or you mentioned that word? And I definitely. I just did some education for them. That's it.

Okay. That's it. I just educated like so nothing like you trust me. I would love to be Jason Bourne. I am absolutely not.

Although I tried to be him on my vacations, which has almost got me arrested more times than I can. Account. But really, I just— I didn't do anything cool, I swear to God. Really, all I did was like, hey, we've got a malware problem. And they're like, hey, we need to talk about this because guess what?

They're hitting GE the same way they're hitting this group. Like, it works, right? So why not use it? So it was more of just an education element of like, hey, this is what— this is what things look like out there in the wild, and you should be mindful, and this is how to defend against it, and this is our best technologies that we have. That are open source, or this is what we have that's coming out of Silicon Valley, that's a startup, and this is what we would recommend, that kind of thing.

Okay, so you didn't rappel off the building? No, God, I wish. No, no, no, no, no. I mean, I got friends who do, you know. All right, you know, yeah, I got, I got none of that.

Again, diapers. Okay, you're within itself. Yeah, totally, dude. If, if I was doing that work, I wouldn't be doing this podcast. I'd be in Ukraine right now, right?

Like, I'd be there, right? Instead, I'm diapers and walks and strollers And, and why can't we just come up with a standard format for a stroller? Like, why does it have to be an engineering effort every time you need to break one of these, these goddamn things down, right? It's like, oh, a new way to do it. Awesome, cool.

Love doing that parking lot while it's raining and my kids are screaming. This is great. Love you. I, I, I know the feeling, especially because I don't know how it happened, but we ended up leaving a stroller at one of the malls we went at, and Thank God we had the baby with us. Yeah, we— but we, we literally left the stroller in the parking lot, and I have no idea.

I mean, we, we had no idea about it. So I'll tell you, no one who's ever had a kid, and it like would be like, oh, it's— anybody who's, who's childless, that's just ridiculous. You must, you must not be paying attention. Every person who's ever had a child go, oh yeah, I completely understand. Yeah, no problem.

Yeah. You can tell a parent because there's so much patience for you as another parent. You're just like, it's cool, man, I get it, it's good. You want me to— you need a hug? You want me to buy you a beer?

You all right? Totally different. Both of those I think are acceptable too. Yeah, yeah, usually both. Yeah, totally.

I'm gonna hug you and buy you a beer. No, you know, yeah, cool. We don't need to be friends. I just need you to know you're not alone. It's cool.

Awesome. Well, we are coming up on the end of the podcast, or at least the end of this interview portion. Any final thoughts? Any final words that you want to give the crowd? I don't know.

Not really. I mean, you know, I just, I'm excited to be here and I'm excited to be in Colorado. I love this state and growing our company here and we're, we're pushing the envelope wherever we can be. So I think I, I'm, I'm guessing you're, you're gonna have a lot of listeners who are doing the same thing. So I salute them and I wish them the best on their journey.

Awesome. Well, again, thank you, Brandon. He is the CEO of Nearest Systems, located right here in Denver, Colorado. And again, want to thank you for the time. My name is Frank.

I think most of the people here know me in the crowd. If not, one of the things I do is I run the, or at least help run the Denver OWASP chapter. Please keep in mind that we are helping out. We work together with the Colorado Equal Security Crowd. Please check out our OWASP chapters at meetup.com/denver-owasp.

And I hope to see Brandon and everybody else in this podcast at one of my meetings soon. Again, thank you for your time. I appreciate it. And we'll talk to you. We'll talk to the crowd later.

Thanks, guys.

Learn more about the Colorado security scene at colorado-security.org. Where you can see information about local security groups, a calendar of upcoming security events, and learn more about Colorado Equals Security. Reach out to Alex and Robb by emailing info@colorado-security.com.

Until next time, remember, Colorado equals security.