Episode 65: From Big Data to Personal Safety with Rachel Vrabec

Den:

Just before we get into today's episode, have you experienced interview fraud. So this is everything from fake profiles applying to proxy interviews where people are swapping themselves out mid-interview or AI fraud. But we hear a lot about it and that's why we launched 909 Shield. It's a platform that keeps you safe during that interview process. Learn more at 909shield.ai. So let's get on with today's episode. Hope you enjoy the show.

Narrator:

Welcome to 909 Exec, the executive leadership podcast from 909 Cyber where cybersecurity intersects with business strategy. Your host is Den Jones, founder and CEO of 909 Cyber. For more than three decades, Den has led enterprise security at Adobe, Cisco, SonicWall, and Banyan Security, helping executives navigate risk, trust, and transformation. Each episode goes beyond headlines and hype with conversations that matter to leaders shaping the world of technology. So please join us for 909 Exec, episode 65 with Den Jones and Rachel Vrabec.

Den:

Hey everybody. Welcome to another episode of 909 Exec. I am your host, Den Jones, and like every episode, we have managed to find some amazing guests. And today, Rachel Vrabec from, well, founder and CEO of Kanary. And Rachel, I already recognize I can't get your last name correct. So why don't you introduce yourself and not let me screw it up?

Rachel:

It's okay. I'm Rachel Vrabec. It's a Czech last name. And honestly, I find it's helpful if you get a little angry and say it. Vrabec?

Den:

Yeah, you could shout it almost.

I don't get angry too easily. Well, I don't get angry too easily now. I mean, I'm getting told for that nonsense. But hey, thank you. Listen, I really appreciate your time coming on the show. I know it took us a little bit to set it up because you are a busy lady. We're going to dig into the busyness shortly. But let's talk a little bit about. So yeah, so a check, but I'm guessing, let's talk about you when you were a kid. I mean, you're this high flying tech exec now, but when you were a kid, what did you want to be? Did you think this was your path?

Rachel:

Honestly, never thought about tech as a kid. I was not somebody building computers when they were seven years old, but I was someone building things when I was seven year old. I was just outside building things in nature. So I was lucky to grow up in Northern Wisconsin and have a lot of exposure to just being outside. And it was still the '90s, so you just kick your kids outside and say, "Go play." So yeah, always been a builder. I think when I was young, I had this idea of being an inventor in my head. I'd watch Disney movies and I remember watching Beauty and the Beast and wanting a whole movie on just the dad, the crazy inventor. So yeah, I don't know. I think it's funny how just different paths in lives take you, or just how life takes you down different paths.

But I've always liked building things. I've always been creative, so it makes sense where I'm

Den:

At. And when you were, I mean, I don't always try to go down the path of the females in tech angle, but I'm very, very, very well aware of the discrepancy or the percentages in our industry where there's not a lot of females. So when you were younger, so as a want to be builder, how accessible was tech and that side of it in school growing up or when you went to college or university? What was that like?

Rachel:

Yeah, it's a good question. Let me start out by saying I do think how school structures technical learning is oriented toward one type of thinker. And that thinker or social skill or social preference tends to show up more, I think, in how. I mean, it's like nature versus nurture, who knows? But it's more male dominated for sure. So I remember very distinctly, I kind of transferred school systems going into middle school. And there was a robotics club. And in sixth grade as a middle school girl, I was doing a lot of things. I was playing sports. I was interested in literature. I think I was an extra in the school play. But I remember walking past the room where this robotics club was happening and it just being the nerdiest of the nerdiest guys, no girls. And just wanting to go build. The idea of competing in, I

Den:

Think

Rachel:

It was one of the robotic battle bots competitions. The idea of competing in that and building a robot sounded so cool to me, but from a social perspective, I don't think I had the confidence at that age to be like, "I'm going to go do that versus be on the soccer team," if that makes sense.

Den:

Yeah. Yeah. Well, I was going to say in school, did you ever feel like it was encouraged because you were a female? Because I know it's funny, soccer in the US not being a dominant sport and all, it seems like women's soccer in the US has always been a thing really. I mean, I remember back watching movies in the 90s like Bend at Beckham, and it's almost like Santa Clara, women's soccer, men's soccer in the US, not so exciting or not so fun. Yeah, not still there. So yeah, but I can imagine you pick soccer because it's more accessible or feels like it's more inclusive. I mean, do you think that that exclusivity was, well, inclusivity was not there as much because you're a female and robotics tended to be a guy thing? I mean, that's kind of the sense I got.

Rachel:

I mean, it's hard. It's a bit of self-selecting to protect your social status and then a bit of feeling like it's exclusive, only a guy thing. So I'm not going to say that at any point in my young life as I was exposed to technology and maybe didn't take a classically technical path, that there was a man barring me from the room.That never happened to me. I never had a math teacher be like, "Girls aren't supposed to be good at math." But yeah, I think it's just at that age, you're so impressionable and there are a lot of other things circling around your mind. And I think tech has also changed a lot. I think there's been a lot more done in the industry to make it more accessible across different interests. And at the time, again, this is the '90s, is still extremely, extremely an isolating thing to do. And so I think as somebody who's always been social, the last thing I wanted to do was just lock myself in a basement and build a computer. So yeah, I mean -

Narrator:

Build a robot with five nerds.

Rachel:

Well, I bet you I really would've enjoyed it because that's frankly what I'm doing now is just building robots with nerds. But I think I'm a lot more self-confident now as an adult to know I don't really care about being in a popular group. Again, it's funny to look back at your childhood and try to map what happened to where you ended up in as adult. I mean, were you in robotics? How did you find yourself in the technical path?

Den:

This kid? Oh God, no. I was a musician. I was like, I want to do music. I was in music, media, drama. I was doing sound and light for our drama theater. We had a 400-person theater in our high school. So I was pissing around with lights and speaker placement and nonsense like that or making videos and shit. And I had really no access to computers other than, I mean, they had them in school, but I wasn't really into it except for music. When we started getting into electronic music, dance music, then we had a computer in the Tari and I'm like, "Holy shit, this is kind of cool." But for me, I was always into technology. I was always like, even at Southern Irons and I was doing circuit board stuff when I was about 13. So I was always into tech and I liked the engineering side of it more than the software side of it.

So that really led me down that path. And also, I grew up in Scotland and it's funny, you're talking about the '90s. I'm like, shit, I released my first record on vinyl in 1994.

Rachel:

Yeah. 22

Den:

Years old. I'm playing nightclubs. And you're like, so the '90s to me, my memory of the '90s is entirely different. I'm like, oh, the '90s, I remember them. And you got vinyl on the wall because of the '90s. So yeah.

Rachel:

I mean, I mentioned being in the school play and through high school, got really involved in music as well. And so yeah, there are all these creative parts of my life that had technical underpinnings, but I think it's just you have to make a decision that you want to be claiming that as a core part of your identity. And for me, it just took some time to get there.

Den:

Yeah. Yeah. And I think that's really hard when you're a teenager is first of all, knowing what you want to be when you're older, when you're a teenager, I think is a bit of a stretch of the imagination. And then the other thing is there's a lot of peer pressure and you're not mature enough to handle peer pressure or sometimes to make decisions because maybe you want to be in with the cool kids. Maybe you're a bookworm and you don't care. You just want to be nerdy and read books. But you are very impressionable. As you were leaving school and then getting into your career journey, what was the first job and what was the trigger that got you in there?

Rachel:

Well, my first job was at IBM. So I joined as a strategy consultant in their young kind of feeder program. They had acquired a consulting firm a few years before I had joined because it was during the consulting boom. I think Marisa Mayer was the head of Yahoo at the time, and she just launched that program at Google and then moved over to Yahoo and done the same. And I think IBM was following suit. And so that was really my foot in the door from a professional standpoint and a technical standpoint is I had hacked on some ideas in college. Again, I studied political science, so I was doing statistical modeling and some statistical programming, but I didn't do serious systems design or engineering work in my undergrad. And Android studio and stuff had just gotten to the mainstream when I was in college. And so my friends and I would hack on ideas. Nothing ever really came out of it. But I knew when I was leaving school that technology was going to be super important.

And so that was one of the reasons that I chose to go to a technical company like IBM because I wanted to continue to grow that skillset obviously while still contributing everything I learned and all the skills I had built in a non-technical way, more the strategy stuff for my undergrad.

Den:

And IBM by that point was quite an established old company, right? Right. So as being your first big step, what impression did you have when you were there? When you walk in the door and you suddenly realize the scale and gravity of what IBM actually is and means to the world, what were you thinking?

Rachel:

Oh man. Yeah. Scale and gravity is a really great way to frame what that company is. No, I'm really grateful for my time there. I was there just about two years, but I worked. The point of that consulting program was to rotate you through a lot of different groups. So again, really grateful for all of the mentors I still talk to from those days. Everything I learned about what I like and don't like about deploying technology to the world. I think across my time there, I worked in a design strategy group. I worked in an SAP implementation group. I worked on the first enterprise deployments of Apple Watch software. That was really interesting for financial services. I worked on an IOT group doing statistical modeling for safety at steel mills. I was on an international center of excellence and I got to travel to Seoul and Madrid and Tokyo.

And it was a really amazing experience while I was there for a first job out of college. And to your point, there's that analogy of the blind man figuring out what an elephant is. That's kind of what I felt like as a 20-something at a giant corporation

Like that is I would join a new team and then I would kind of figure out another piece of the elephant. Yeah. And it's funny, leaving there, I felt, I think I was at a point in my career where I just really wanted to have more ownership. And so that's why I ended up joining a startup out of IBM.

Den:

Yeah. And when we come back, we'll take a break for a second, but when we come back, I do want to dig into then, that's when your life of startups begun. So I'm really keen to hear about that. Hey folks, we'll be right back. Hey folks, just want to take a minute to say thanks for listening to the show, watching the show, however you engage with us. If you're liking the conversations, if you think we're adding some value, we'd love you to like, subscribe and share the show with your friends if you know of anyone else that would benefit. Ideally for us, that will help us be able to grow the show, invest more in the quality, get some more exciting guests and keep bringing you some executive goodness. Thanks everybody. Take it easy and enjoy the rest of the discussion.

Excellent. So Rachel, so let's dig into life and start. Going from IBM to startup was like me going from Adobe to Cisco, then to a 50-person company. So my life at Cisco had 300 people in the org, 60 million a year budget. And then I go to a startup where their series B raised was 30 million and there was like 50 full-time people in the company. So the company all hands was less people than my leaving call when I left Cisco, which was very bizarre. But the scale of IBM, and then you went to what, Civic Analytics? Was that the next place?

Rachel:

Yeah, it was the next place. Civic Analytics. It was a political data science firm, so worked with a lot of campaigns and some corporations around advertising strategy, campaign strategy, message testing, anything data science related around campaign work.

Den:

I was thinking, so first of all, was there any. There must have been. So what was the best lesson you learned at IBM that you could then apply in your little startup life?

Rachel:

Oh, that's a great question. The best lesson, I mean, honestly, and this is probably a bit tired, but the people matter so much. Again, going back to the people who impacted me at IBM and mentored me and gave me a bunch of opportunities there. I think I learned and applied that similarly to my time at Civis. So when I arrived, I wasn't necessarily a junior employee. I had a couple years under my belt. And so I was very focused in my time there on taking my knowledge and using it to be a resource for new employees at Civis as well. I mean, in a startup environment, there isn't as much structure or opportunity, especially a highly technical organization. So this organization was hiring physicists out of U Chicago. That was the standard of hiring for them. And so it wasn't necessarily the most warm and fuzzy environment.

It was a very intense environment. And not that I think good culture has to be warm and fuzzy, but especially as a woman in tech, you want to set up structures that anyone can use to excel based on their capability and not have people discounted for unfair reasons. So I worked with a lot of the women at that company to make sure we were supporting each other. We're supporting everyone across the team regardless of how junior or senior you were. And likewise, it was just catching up with someone who joined the team a couple years after me at Civis who kind of saw me as a coach and they just got a new job being the director of this amazing group at this startup. And again, it kind of goes back to, yes, all the technology is important, but it's equally as important to structure how you work with an organization with other people so that they can excel. And I just had some really good role models show me how to do that at IBM. And I took that to the other environment at Civis.

Den:

Yeah. I think when people go. The companies like IBM, Adobe was similar, Cisco was similar. You've got more mature organizations where they've made a lot of the mistakes or they've probably had a lot of the lawsuits from employees or previous employees. So then all of a sudden they're like, "Oh, we need to do something more about this so we don't get screwed again there." But that whole inclusion thing, and then let's go do our Myers-Briggs and all of these little things so I know what your personality type is and all that shit. "What do you like when you're really upset versus really happy? How do you behave? "And I can't remember how many of those I'd done, Rachel, but it's many of them. And then you go to a startup and none of that seems to be on their radar. None of that seems to apply. They're all like," Let's get moving. "So yeah, you going there from IBM, that must have been a whole night and day shift.

Rachel:

Yeah, they were just at maybe 90 people when I joined and they just raised, I think they just closed their series A. So yeah, it was early. It was highly technical. It was amazing to be in an environment where cutting edge AI research was being shared every day on Slack. But again, how do you open up those environments to teams so that the friction of getting people to join and share ideas is decreased? Yeah. Yeah.

Den:

And then the other thing, if I got the timing right, you're in an analytics company at the same time as the DNC hack and the Cambridge Analytica scandal hit. Am I right in the timing there?

Rachel:

Yeah. I sat next to our head of security who was actively fielding attempts from state-funded actors to access our predictive models and data records on the 2016 election. So it was very interesting to watch the media coverage of that incident versus behind the scenes what it looked like day-to-day to be operating at a company where we were absolutely targeted.

Den:

Yeah. And yeah, without getting ourselves into any legal recourse here, I think the thing is you see the media announcements about it and then you see the, I'll just say the social response to this kind of thing being out there. But if you're in security, then we've known for years that people were gathering this kind of information about other people and using it to benefit either politicians or all the way back to the '50s and the CIA and all these guys where they're doing newspaper articles and then gathering information. So there's always been this misinformation and use of information in a way that benefits, I'll just say organizations in a way that maybe matters to them. What were you getting as a sense of responsibility as you were in the role of that company? Because what I see here is this path now where you're in this situation as this fallout's happening.

And we're going to get into Kanary, right? Because the reality is you've went from this company where they're gathering data to now this company where you're protecting people about data being gathered. So when you were there, did you feel that sense of responsibility? What did you feel going through all that experience?

Rachel:

Yeah. I mean, I guess first I felt awe. Second, I did feel disappointment. And then third, I did feel a lot of hope. So I guess on the awe piece at the time, this was over or about 10 years ago now, these systems were just so powerful. And not just the data aggregation, but the prediction capability. It was really incredible to just be on the ground as the first versions of TensorFlow were being released and we were applying them. I think

One of the key parts of that organization was called the Applied Data Science Team. And they were some of the first people to use TensorFlow within an applied environment. It was really cool. So awe. I was just like, wow, based on what I saw at IBM from a technical perspective, I mean IBM was just packaging and repackaging SPSS, which is totally fine. They have every right to do that. But again, just that experience, the first thing I felt was just technical awe for what was coming down the pike instead of pipe in terms of AI capability.

And then I guess two, it's like, yeah, disappointment, fear. I just felt we were aggregating all this data and people had no idea. They had no understanding of how connected these systems were. And then truly how that impacted all of the attack vectors that, regardless of how sophisticated the attack was, it's just the fuel. Whether it was a domestic attack, someone getting stalked by an X or a state-based attack, these Russian attackers that were targeting our system. So that sort of disappointment and frustration was very, very apparent at the end, especially as these breaches hit the media because we were kind of operating until then from a, hey, tech's making everything better perspective. But then it turns out these systems were not well protected and there are big downsides.

Den:

Yeah. And I would say one thing as well, I'm mulling through this in my head at the same time, Rachel. I'm like, okay, for the audience, just so everybody's aware, we're not saying anything for or against Cambridge Analytica or your previous employer or IBM. I think it's stating the obvious that big companies have been using data for many years in a way to try and improve how they market to people, how they engage with people. And if you're not paying for this service, then you've got to assume that you are the commodity of that service.

Rachel:

Even if you are paying for the service. Yeah,

Den:

Even if you are sometimes, yeah. But I think as a technologist goes, and I know this is one of your angles too, as a technologist goes, it's hard not to be impressed with the way that these companies were building systems, aggregating data, bringing things together and delivering answers. So if I was a CFO at Cisco or Adobe or IBM or whatever, whatever, if I had the data that I could answer what are Q3 results is with one question, I'd be super delighted. And the fact that these companies are building these systems so well to bring data together and get answers so quickly that is really high fidelity answers, I think is technically just so impressive. Whether we like with the models of it or not, that's not what we're digging into here.

Rachel:

Yeah. And I would say on the, again, the first piece was awe. My goals with all of what I've been doing and what I learned from my experience at IBM and at Civis was never to try to revert the intelligence. It was to how do we apply this to make people safer? Because that's that third piece of there's a lot of. What I felt looking at what we had built and what was available to us was a lot of why isn't anyone applying this for people yet? And I think in the last few years we've now seen it that the wave is happening, which is great. But 2017, 2018, no one was really talking about that.

Den:

The one thing I was thinking about as well, so in Civis, you mentioned a little bit about data science and stuff, and I think people don't really think of AI as being something that in 2016 was a thing. But the reality is AI has been around a long time. So back when you were there, were you guys talking about data science and AI or was AI even a conversation?

Rachel:

Well, we were talking about machine learning and then we were talking about neural nets and neural networks are the fundamental technical structure behind what you see now in LLMs, which are large language models. And so yeah, we were talking about at the time, it just no one had rebranded it as AI yet because frankly, again, going back to the '90s, people have been researching general artificial intelligence for a long time. And there was this whole kind of discounting of the field in the '90s because a ton of money had been invested and then really good option.

Den:

Yeah, no real good result at that point.

Rachel:

At the time it was big data, machine learning. Yeah.

Den:

Yeah, I was going to say, was Watson not around in the '90s? Did IBM not have Watson try and beat a chess player or something like that? There you go.

Rachel:

Exactly. Yeah. Yeah.

Den:

It's brilliant. I mean, after spending $2 billion, you probably want them to play chess. That's probably the outcome. So let's dig into Kanary. So this kind of fascinates me a little bit in the sense of you're working in a company which gathers information about people, and then somehow you shifted to a vision to start a company that helps protect people from people who gather data or something. So let's dig in. What made you think about starting this business? What got you down this path?

Rachel:

Yeah. I mean, I think I, at the time had gone a little jaded with just businesses building software for businesses, building software for businesses, building software for businesses. And I was like, "Who is this helping? Who is this actually helping?" And I think at the time I'd spent a couple years at IBM, giant corporation, very hard to keep the plot as you're working on these small components of this very big machine. And then Civis was also kind of a B2B SaaS model. And I think at the time there was a lot of frustration around these data systems, social media, big tech. And again, going back to what I said, I learned, there's all this awe around this technical capability and then inspiration to be like, "All right, these systems are actually really capable of not just collecting data as a way to monetize it, but collecting data as a way to give people early warnings of risk and then ideally mitigate some of that problem." So it's funny you say collecting data to protect data.

I mean, at Kanary, we collect a ton of data. That's why people pay us. People pay us to scrape the web for their information. We find all their information and we say, "Hey, okay, here's the picture."

So I think my background there really was helpful in order to be able to frame the problem to people in a way that was visceral and visual. And then yeah, for the last six years as we've been building the company, it's been just iteration after iteration, researching how to mitigate and what UX gets people engaged when it comes to caring about their personal security and how you connect that to organizational risk. Because at the end of the day, a lot of companies care about the risk that they incur when their employees aren't protected or their executives aren't protected. So honestly, I think it's like that background that we had as an early team was a launching pad for us to be able to do this work. Yeah.

Den:

And so when you think of your ideal customer, is this a B2C thing or a B2B thing? What's the ideal customer profile?

Rachel:

Yeah, I think we always care about the individual. So this is about personal risk. And so we're building threat models to say, "Hey, how at risk are you of doxing, impersonation, account takeover?" And then we're building the automated mitigation. So it's like, "All right, what can you do to reduce the likelihood that you're doxxed or reduce the likelihood that you're impersonated?" And those can be deployed for you as an individual. And so yeah, we learn about the problem space, the implementation of the technology, how useful the technology is by having a product that anyone can come and purchase. But we are really excited by our partnership with a lot of organizations who use us to inform, like I said, how their security teams handle personal security risk. So we work with the federal DOJ, we work with other leaders in tech, the National Network of Abortion Funds. We work with a lot of really targeted organizations to help those organizations protect their staff.

Den:

Yeah. And then I did see from your site, politicians as well. So I mean, you've had great experience in that world. So yeah, I can imagine celebrities and politicians. And I also think - That's what's

Rachel:

Frustrating about security. You can't really name a lot of your clients.

Den:

Yeah, yeah. Yeah, you don't want the endorsements page to list off the who's who, right? Yeah. And so where do you see the world with AI going? I mean, how do you guys respond to this evolution of AI where I think more data is going to be accessible at a lower bar of entry? So it's going to be easier to get information about people, but then it's also easier to get wrong information about people.Because there's been a bundle of lawsuits in the last five years where AI companies, you go search someone and they give absolutely bullshit information about somebody else, and it's really hard to get that pulled down. So where do you guys sit in the whole AI evolution front?

Rachel:

I mean, I think it's accelerating the need for what we're doing. AI can pull highly accurate information and then it also can get it wrong. And we saw this with social media. There wasn't a fast enough response from people to get companies to take the security and safety of their users seriously. And I know a lot of the safety, security people working very hard at Anthropic and OpenAI, amazing researchers, amazing teams. But we see our role as just like we have with other types of data, essentially being your personal pen tester, making sure that when we pass the most popular prompts to ChatGPT, we get what we expect. A, accurate information if you want it. So on Uden, we would say, all right, is the 909 information coming back? Is the podcast information coming back? Cool, that's what we want. If there's your home address and your mother's social security number, that would be a risk we flag.

And then we have a researcher and a beta implementation of what it takes to remove something from one of these large language models. And there are two approaches we've found so far. One is you get them to patch a security vulnerability because the data leaks are impacting everyone. It's essentially an exploit. And then the other is these models are releasing new versions every few weeks. They're retraining the data all the time. And so

One thing I like to say with people is, hey, I know the internet is forever, but these models are not. They're retrained on data sets all the time and data moves in and out of those sets. And so just like we would expect someone to take down defamation or take down breach data or take down child pornography, we can have those take down flows for these models as well and they can be retrained.

Den:

Yeah. No, that's pretty cool. And I think the other thing is that from a roadmap perspective, if I read it right, I mean you guys focus a lot on text and that side of it, but then what about videos and images and things of that? I think you've got that in the future. Is that right?

Rachel:

Yeah. Yeah, absolutely. I mean, just like these models have become multimodal, we need to become multimodal. We do take downs around video and images now, especially anything that's non-consensual image sharing. Oftentimes images are tagged with PII in a text format. But yeah, becoming multimodal is a big milestone for us.

Den:

Yeah. Yeah. Well, I can see the crazy thing is, I mean, I was just thinking of this, I'm at an event and somebody tags me. Well, they don't tag me, they take a picture and I'm in the background of the picture. Nobody's tagged me, but I can see in the future. So whether I'm at a concert, a sporting event or somebody's birthday party or whatever, I can then see in the future that with AI, they'll know it's me straight away because they'll have that image and there's little recourse. It's easy for a bad actor to know that I was at that event because they'll find that information out very easily. It's very hard for me to get that office gated door removed.

Rachel:

Yeah. Well, and I think that's why, again, we aren't just a removal company. Removal's not the answer, frankly. You need to have a much broader set of mitigation strategies, and you need to partner with the people who can get you physical security in the way you need it. So we partner with a lot of physical security teams who need the digital signals about information like that, because at the end of the day, when Coldplay does the kiss cam, you're not removing that video.

Den:

Well, that's why I've not hired a head of HR yet, to be fair. Just because that's one problem solved right there.

Rachel:

Exactly. Exactly. So the data feeds and the threat modeling themselves are very valuable to inform how you deploy other mitigations, whether that's physical security, physical hardware, masking, proxying, confidentiality audit programs. We have a bunch of these mitigation tactics that we've instrumented across our team. And so removal is one tactic, but it's just a small piece of the playbook.

Den:

Yeah, it does seem that the source of the problem is usually the better thing quite often. How do you change the system so that the information. I don't care about people necessarily taking my picture, but I would care if it was then able to be used against me. So the reality is how do you get into the system so that it doesn't have that negative impact? Which it's not a problem I've thought about actually until we met. So in that way, oh shit, maybe I need to wear a big - Well, when your podcast is hitting 20 million listeners, we can talk.

Yeah. Yeah, exactly. I mean, I think that's the one thing. I'm like, my business enterprises are not at that stage yet, so I'm pretty fortunate. Maybe that's my plan. I don't want to be too successful in business, so I don't need to worry about it. I think that'd be a shitty plan though.

Rachel:

What's your security strategy? Just don't be successful.

Den:

Yeah. Yeah. I mean, it's really funny. I remember at Adobe, we talk about security strategies, and one of the strategies that we discussed was about being politically just on the fence. Making sure as an organization, you don't take a bold firm stance on any specific topic. Because if you do, then that is given someone means to attack you. And you see that a lot more now where companies will be boycotted or they will be attacked, whether that's a bad actor or whether that's some other form of attack, or their CEOs will be attacked or whatever, whatever. So the reality is I think it's just important to understand the landscape we're living in. And then what are the risks and how do you mitigate risks? And I think one thing you mentioned as well, you guys work with physical security and I'm sure agencies and things of that nature as well.

Because to your point, if you're going to protect an executive, one piece of the puzzle is the digital piece, and then the other pieces are physical or others. So I think it's not a one tool in the toolkit. You need a whole toolkit.

Rachel:

Yeah, we don't see ourselves as being the one-stop shop for executives. We're not going to send you a bottle of wine on your birthday. Sorry. But we do see ourselves as the best tool for security teams needing to run a privacy program for their celebrity clients or executive clients.

Narrator:

Yeah.

Rachel:

Yeah.

Narrator:

Yeah. And I think that's pretty cool. Yeah, and that's the whole thing. You can go ask people to delete your shit on the internet, but that doesn't last very long in my opinion.

Rachel:

Yeah, I Agree. We have to do that. You can't do that

Den:

Every six weeks. Yeah. Every six weeks, please delete my shit from your database. And I think I could probably have my AI agent send out those please delete every single day and still not win the war.

Rachel:

Well, and there's some viral Instagram stories that I've been sent recently from friends where people are doing that. They're asking their quad agent to just map the data brokers, find the emails, send the emails. Great. Yeah, that's so easy. And that's frankly what some folks have built in the space and that's fine. It's not very effective. You could do that if you want. But again, going back to this idea of mitigation strategy, it's highly complex. And to do a good job at it, it takes a lot of work. So definitely not at a point yet where Claude can just do our job, but we'll see.

Den:

Yeah. Yeah. Well, I think this is the thing is there's more to it than that. That's one piece of the puzzle. And to do the job right, which I see what you guys are laying out here. I mean, to do the job right, then you need to be thinking more than just that one piece of the puzzle. So yeah, this is awesome. Rachel, so in the show notes, we'll include all the links so people can learn more about Kanary. I'd love you to end on, if you could do one thing all over again, starting your own business, what would that be?

Rachel:

Man, that's a hard-hitting question, Den.

Den:

I thought we'd end on the easy one.

Rachel:

What's your biggest regret, Rachel?

Den:

Well, I think of it like, so in business as entrepreneurs, I never look at anything like a regret or a failure because hindsight is brilliant and nobody started off being a perfect tennis player. You had to start off being a shit tennis player. So the reality is in our journey, the lesson I think you've learned that you could share with others is probably something that now serves you really well. So yeah, what did you fuck up?

Rachel:

What did I fuck up? It's funny because we're still a startup, we're still figuring things out. We're building really fast, iterating a lot, relaunching products, launching new products. I would say the thing that has been a step order change for us is getting the right people in the right seats. When I started the company, I think I was still building a network and security. And so it took me a couple swings to find the people where all of the pieces aligned. And so I think on one hand, narratives around startups is like, "Hey, you should be figuring this out overnight." And then the VC pressure to have growth be 30% month over month on month two. Is insane. Yeah, it's insane. It happens for some people. I get it, but I would just encourage younger entrepreneurs to very carefully evaluate those cases because frankly, behind the scenes, what's often happened is it's this entrepreneur's third attempt.

They have a network. They were able to hire in all the right people for the right roles that perfectly aligned with the strategy. And they then had all the right tailwinds at the right time. And for us, again, this is my first real company I've started. We've had a great run. And especially recently with our growth with our enterprise business, it's really come from finding the right people to lead that initiative and push us in that direction.

And it just takes time. You got to learn who's good for your business at what point in time. And it's not that certain people who don't end up fitting aren't great for another startup or another company or another role. It's just there's this five-dimensional chess game you have to play with finding the right people to do the jobs at early stage startups when frankly, the jobs could be changing every month. So I think I beat myself up on that a while back because I wanted it to move faster. I wanted it to make sense sooner. It takes time. It's hard.

Den:

Yeah. And I speak to a lot of founders. I mean, actually on the show, we try and bring in a bundle of founders quite often because I think the reality is everyone's got a lesson learned, everyone's got the story. And I kind of synthesize all this back down to as we're trying to make, especially first-time founders, you and I are both first-time founders. Every decision you make, you always have the ability to look back and then analyze it. And I stepped back at one point and just thought, well, what does it matter? You're not going to do anything perfect. And if you're going to move really, really, really fast or as fast as you can, you've also got to remember that your prospects, your clients, the people you're trying to convince your shit doesn't stink and it's this magic wizardry thing that you've just done.

Nobody will all see it the same way as us. So I kind of peaced out a little bit because that just adds more stress. And at the end of it, I've got enough stress from other things that beating myself up on decisions that I may or may not have made perfectly, that can't be the bags. And I tell people all the time, imagine you're just carrying bags through life and everything you regret, every bad decision, every argument, everything you screwed up, you're just putting it in the bags and it's just more baggage you're carrying. Well, if you keep doing that, you're going to stop. You can't walk forward. You end up standing still and just mulling over shit. So I tell people this all the time, it's release the stuff, especially if you're the only one worrying about it. If you wronged someone or somebody else wronged you, maybe that's more the analogy, and you're beating yourself up over that relationship, that conversation, that fuck up, you're the only one beating yourself up.

They're not beating themselves up. And even other people in your team, you'll beat yourself up on things that you wish could have went better. They might not even notice. So it's like you can't do it all the time. So yeah, Rachel, this is a pleasure. The one thing I realized recording time is 50 minutes and I'm always like, "Oh, we'll be done in 30 minutes." And then I realized there's probably about 10 questions I never even got to. So I'd love to have you back. Yeah, because I think there's so many avenues on this one. And this for me is a huge thing in our ecosystem. I think our data is only, as you mentioned, it's only going to get out there more. It's only going to be bigger as AI grows and the kind of work you guys are doing is fascinating. I think the path to how people can partner with you I think is amazing because you've got so many avenues for partners.

So we'll put the link in and people can connect with you guys offline. You and I said we'll both be, I think, in Vegas for Hacker Summer Camp, Black Hat and all that business. So love to catch up in person there. That'd be brilliant. And I guess the show will probably air around about that time too. So that'd be great. Yeah.

Rachel:

Speaking of partners, we're sharing a suite with a partner of ours and doing hands-on demos with folks. So doxing indexes, threat modeling. So it'll be really interesting. It'll be an interesting week. A lot of work, but hopefully some really good stuff. So yeah, thanks so much, Den. It was great to talk to you.

Thanks, Rachel. Yeah, and we'll see each other again soon. This has been excellent. And everybody, Rachel, co-founder, CEO, founder. Founder, right? Did I screw that one up already?

No, no,

Den:

That's all good. Very learn from you. So Rachel, thank you. Kanary, everybody, we're going to put the link in the website, in the show notes, all that stuff. And yeah, it's been great to see you.

Narrator:

That wraps up this episode of 909 Exec. If you found value here, subscribe and leave a rating to help others discover the show. To learn more about 909 Cyber, our advisory services, and how we help organizations secure growth, visit 909cyber.com. Thanks for listening. And until next time, lead with clarity, build trust, and stay secure.

‍