Latest / The Breakout CEO / 59 - What Happens When CEOs Ignore Cyber Risk in an AI-Driven World

Transcript

59 - What Happens When CEOs Ignore Cyber Risk in an AI-Driven World · The Breakout CEO

0:00
Small business owners are so focused on just getting to tomorrow.
0:03
We need to present a clear, more narrowly focused value proposition, focus on signal, right?
0:10
What are the one or two things that really, really matter?
0:14
Welcome back everybody to the breakout CEO podcast.
0:17
I'm your host, Jeff Holman, and I'm glad to be here today with Brian Kueb.
0:21
Brian, thank you so much for joining us.
0:24
Yeah, glad to have you.
0:25
uh We're going to talk about your business uh and we're going to talk about some of your breakout moments today, but it feels like maybe there's two layers to this for me because
0:37
you're in cybersecurity, your business or your organization is a nonprofit called Global Cyber Alliance.
0:44
And it just seems to me that building a company is chaotic enough, but when you do it within the landscape of what I believe is a really difficult, externally influenced, maybe
1:00
expensive landscape, that might make it even harder.
1:05
So you've got two layers at least of the chaos in the organization.
1:11
Is that anywhere close to correct?
1:13
ah It is.
1:15
Every company and every leader has their own particular set of challenges.
1:19
We're not different in that way.
1:20
I do think that cybersecurity in general is a particularly challenging uh environment and industry.
1:30
It's complex.
1:31
It's technical.
1:33
I think also for end users and what we do, what we focus on is on making the Internet's infrastructure more secure.
1:41
There are some
1:42
security flaws within the infrastructure.
1:45
And we collaborate with others to develop solutions.
1:49
We work with network operators, infrastructure providers, because if you fix a bug in the internet itself, every user is more safe by definition, right?
1:59
So that we try to achieve scale working in collaboration.
2:03
We also develop and offer free tools to micro and small businesses, NGOs.
2:11
We target
2:12
the organizations that are at risk and also under resourced, right?
2:15
They don't have enough money to buy commercial solutions or have a vendor do their cybersecurity for them like a large enterprise.
2:24
So we're by definition taking on really big complex challenges.
2:30
So I think in that way, yeah, you're painting a picture that's fairly accurate.
2:35
We're taking on some pretty big challenges and ah there's no easy way to...
2:41
to deliver those solutions.
2:43
Yeah.
2:44
So for those of us who are less educated in the space, you know, I'm going to come at it from a really naive perspective here.
2:51
And I think, you know, you go to the movies and every year or two, there's, there are movies about these cyber attacks or, you know, technology.
2:59
And, and I just assume because I see a lot of companies building technology of their own.
3:02
And I know that the technology I see is, is well ahead of whatever makes it in the movies, you know.
3:09
So when we see something in the movies, I assume that we're
3:12
that you're dealing with things that are, know, levels and levels beyond whatever has made it into the movies.
3:19
Unless maybe it's a sci-fi, I don't know.
3:20
Sci-fi might predate some of the chaos, but.
3:25
Yeah, I mean, the sci-fi, some of the sci-fi movies are presenting futuristic things like, well, like The Terminator and Skynet.
3:34
Remember that?
3:34
Right.
3:35
Right.
3:35
enough to remember that.
3:37
And that's what, 25, 30 years old now?
3:39
So the fun thing there is I made my daughters watch The Terminator.
3:44
They didn't really want to, but I said, you've got to see this movie.
3:47
Yeah.
3:47
And I saw it 25 years ago.
3:50
And I think the concept of Skynet
3:52
for us back then was like, wow, this is Skynet, what would that be?
3:57
The interesting thing was when my daughters watched the movie, they became more troubled by it than I did because the concept of Skynet to them is actually, well that exists,
4:07
right?
4:07
We've got satellites, we've got computers, it's sharing data, these terminators could actually come and take over the world.
4:13
And for them it was very real and present.
4:17
So, you know, that's just one example.
4:19
For us, the challenges that we face, I would say this.
4:22
um What you see in the movies tends to be fairly accurate.
4:27
um What's going on in reality, if the average person knew um the types of attacks, the capabilities of the bad guys, the risks that they face, it would uh unnerve them.
4:45
There's a lot of risk out there.
4:49
more challenging, Jeff, with AI, and I'm happy to elaborate more on that with AI, the threats are becoming more serious.
4:57
They're coming at us much faster, and they're becoming more effective ah in their aim in terms of cybercrime.
5:06
So we're really moving into an environment that's becoming very high risk, very challenging.
5:12
And so people being protected, right?
5:17
The internet being safer as we can make it safer working with infrastructure providers, but people being protected, knowing what their risks are and being protected is at a
5:25
premium.
5:27
I feel like we need to get into that, we might need to step in a little bit slower because there's probably so much.
5:33
Let's back up.
5:34
So you've been involved with uh Global Cyber Alliance for, is it 10 years now?
5:40
that's how long it's been around?
5:41
It's been around since 2015.
5:45
I've been here about four and a half years.
5:48
Okay.
5:49
The original CEO Phil Reitinger, we just celebrated our 10th anniversary last September 2025.
5:58
And that was a big milestone for the organization.
6:02
And at the same time, our founding CEO Phil Reitinger stepped out from his post.
6:08
So
6:10
as a cybersecurity nonprofit, know, quite a, quite a, uh you know, quite a big milestone to reach 10 years and be vibrant and be delivering services and helping the public.
6:23
And then having your founding CEO step down, it's a big transition, right?
6:29
You know, familiar startups, right?
6:31
I mean, they are, the identity of the startup is the identity of the startup CEO.
6:35
Yeah.
6:36
Phil was a brilliant dynamic.
6:39
cybersecurity expert who was so creative and built GCA into what it is today.
6:48
And so for me, stepping into the role, A, very big shoes, B, a really rapidly and changing environment, and so C, now where do we go?
7:01
That's kind of what I'm trying to navigate.
7:03
Well, and it seems like if I were to think about it, maybe they're, don't know the exact milestones, but I think 2015, like that picture looked totally different.
7:11
I'm certain of it, right?
7:13
And so the reason that this was started and the objectives you were trying to achieve as an organization were probably maybe simpler back in 2015.
7:25
And then fast forward to when you took, when you became a part of the organization four and a half years ago, that would, you know, that would
7:33
probably be very different than 2015, but also very different than today.
7:39
How has the landscape changed or how have the objectives of the organization changed?
7:47
You know, what you're trying to achieve or the players that you're trying to collaborate with, how has that evolved since 2015?
7:57
Yeah, your instinct is spot on.
8:01
In 2015, so Global Cyber Alliance was established by in partnership with the Manhattan District Attorney's Office, the City of London Police, and the Center for Internet
8:12
Security.
8:13
It was those three organizations that birthed GCA.
8:16
And the original idea was it was really coming from the prosecutor's office, Manhattan District Attorney and City of London Police.
8:27
together at that point in time, and you're right, the cyber landscape was very different back then.
8:33
It has evolved so much.
8:35
But even back then, they were struggling with the concept of cybercrime and how to prosecute it, right?
8:43
How do you capture a digital evidence of a crime, right?
8:49
How do you secure it in the evidentiary chain?
8:52
How do you establish jurisdiction?
8:54
And we all know how cybercriminals can
8:57
tied behind different resources and not be visible within your geographic jurisdiction.
9:04
So they were wrestling with all those challenges about getting cyber criminals and putting them in jail.
9:12
And the simple idea was, wouldn't it make sense if there was a not-for-profit that was offering security tools to the public free of charge so we can prevent some cyber crime in
9:23
the first place?
9:24
That was the germ of the idea.
9:26
Let's create an organization that can get these tools into the public's hands so we can start preventing some cyber crime and lessen the load.
9:35
Had there been a specific incident like to have New York and London forces come together, was there something that was happening at the time or this was just kind of the
9:45
culmination of we've been dealing with this, we see it growing, we need to do something, let's be proactive?
9:51
Just a quick note about our guests.
9:54
I host the Breakout CEO podcast to share behind the scenes insights from scaling businesses.
10:00
As an attorney, I see the real challenges leaders face.
10:03
long before success becomes public.
10:06
But client stories have to stay confidential.
10:09
So we invite guest CEOs to share their own moments of struggle and success.
10:14
I'm so grateful to our guests and my team at Intellectual Strategies for making this show possible.
10:20
Now, let's get back to the show.
10:22
think it was a culmination of that.
10:24
And um I've worked in different capacities, kind of close to law enforcement in the past.
10:30
um Law enforcement collaborates, you know, regularly, certainly between certain countries and certain types of uh law enforcement agencies.
10:40
But they do collaborate, they do share information.
10:43
um And so I think it was a culmination of that recognition on both sides of the Atlantic that we need some help here, you know.
10:51
Did anything else like this exist or was this kind of a uh new thing like New York and London were kind of on the forefront of we got to devise a solution that doesn't yet
11:01
exist.
11:02
Because that's what a lot of other startup businesses do.
11:06
They're in the middle of all these problems and then all of sudden someone says, well, there's this niche here.
11:11
We should be the ones to proactively go out and create a solution for it.
11:15
Sounds like that might be what happened here.
11:17
I think it was kind of new.
11:19
And Will Pelgren, who is from Manhattan District Attorney's Office, and Cy Vance, who was the district attorney not so long ago, it really was their brainchild.
11:31
And I think it was new.
11:33
mean, I've been here in four and a half years.
11:36
I wasn't here in 2015, but I'm pretty confident that the GCA was maybe the first of its ilk.
11:43
There are many, many cybersecurity nonprofits now.
11:46
who offer a variety of different uh solutions or services or educational resources, some that are focused on different areas than us.
11:56
But I think it was a fairly new, a novel idea at the time.
12:00
Yeah.
12:00
So if we fast forward to four and a half years ago, what did the landscape look like when you joined?
12:06
Well, the internet has become a much uh richer platform in terms of services and apps and social media and how the youth are using the internet in ever evolving and creative ways.
12:24
um You know, I actually started my career working in the internet domain name system back in 2000.
12:31
So I remember the internet back in those days and the
12:36
The internet you come online today compared to 2015 or 10 years prior is vastly different in terms of services, uh interactive services, the types of tools and apps and gaming and
12:51
uh text and voice and video.
12:55
It's just a much richer environment.
12:57
And there it's also a richer, it's a target rich environment for cyber criminals, unfortunately, who...
13:05
Cyber criminals are always among the first adopters of technology, right?
13:10
And from four and a half years ago to today, I think the notable change is that scams have become the white hot center of cyber crime globally.
13:25
ah Fishing emails are right part of that, but that cyber crime has become organized crime.
13:33
It has become transnational organized crime.
13:37
There are scam centers that are the size of small cities in Southeast Asia that are spiking the attacks um in really concerning numbers.
13:46
that change, and that is being driven by AI.
13:51
They're leveraging AI as first adopters.
13:54
I'd say from four and a half years ago to today, that's the biggest change and things are accelerating and not in a great direction.
14:02
Yeah, you're making me think with all of this uh momentum maybe in the wrong direction.
14:10
What's the vision that GCA would like to accomplish?
14:16
you know what saying, how do you create a vision that's large enough to combat the other things happening, but not so large that it becomes overwhelmingly undoable?
14:30
That's great question.
14:33
We do it one way because we know in reality it's the only way.
14:38
We work in collaboration with others, right?
14:42
And we approach the problems that no single organization can solve alone.
14:49
If we're going to succeed in protecting the public at scale,
14:56
That is only going to happen through the collaboration of many, many organizations working together.
15:01
It's got to be some government.
15:02
It's got to be some industry players.
15:04
It has to be some not-for-profit civil society actors at the center, right?
15:10
Getting the necessary services and protections to the public at large.
15:17
That takes collaboration.
15:19
It sounds ambitious, but it takes global collaboration.
15:24
to meet the threat that's coming at us right now.
15:27
So we think about governments and industry and civil society coming together in global communities of action, right?
15:36
And partnering, working together in their own lane, but making a commitment and agreement that we need to deliver cyber protection at scale.
15:45
There's an example of that that's already working on data sharing, right?
15:51
The importance of
15:52
sharing data between law enforcement and industry players, data that can provide insights into what the cyber criminals are doing so that the people in position to stop them can
16:03
use that data to stop them.
16:05
There are examples of these types of, we call them communities of action.
16:11
The only way we get this done, is through coordination, collective action, agreement that it's in the public's interest to attack this problem in this way.
16:22
and get it done.
16:23
Yeah.
16:24
As you're explaining this, know, I'm picturing you walking into a room.
16:28
I'm sure if you walk into a room of a bunch of other, you know, people leading um these nonprofit organizations, like you probably feel pretty comfortable, pretty familiar with
16:40
the other people.
16:40
You understand where they're coming from.
16:42
If you walk into a room, you know, of a bunch of startup or scaling CEOs, do you feel like there's...
16:51
a common understanding as to what they're dealing with and what you're dealing with?
16:56
Or are you just in a different realm?
16:59
You know, I see it one way, but I'm really curious to hear your perspective.
17:04
It's a good question.
17:06
I think as a generalization, the startup or scaling up CEO is laser focused.
17:15
Yeah.
17:15
Right.
17:16
On growth and getting the next round.
17:20
Yeah, find customers, find investors or revenue.
17:24
One of the two, or if we don't do one of those, we don't have money, we don't continue to exist.
17:30
Exactly.
17:30
And so I think um I'm focused on advancing GCA's mission always and keeping my eye on that horizon.
17:42
And I think through the lens of collaboration, how do I influence these people to come on board?
17:48
How can I make a large corporation see that joining this type of initiative is, it aligns with their business model.
17:57
There's a business incentive for them.
18:00
to participate and support this type of work, right?
18:04
I think the startup and scaling CEO with that laser focus that can't be distracted from that.
18:12
They need to be laser focused.
18:15
There's an analogy to the small businesses that we try to get tools to so they can protect themselves.
18:25
Small business owners are so focused on just getting to tomorrow.
18:29
Right.
18:30
You know, making it through the day, getting the revenue, uh managing the team, the building, the service, the product, the widget.
18:39
um That what we find with them is that they don't tend to think about cybersecurity as a priority or risk to their company.
18:50
When we do a lot of engagement, we've done a lot of training around the world, working with partners to train micro and small businesses on what they need to know.
18:59
the steps they can take and the tools they need to use to protect themselves.
19:03
And it's a very common mentality.
19:07
I'm running a small business, Cyber security, yeah, but I've got to do this, this and this.
19:13
When I have time and money, I'll do it, but not today.
19:17
Exactly.
19:19
Or that, or the, but that's not going to happen to me.
19:22
That's an attitude that's out there too, which is a very, a very dangerous attitude because it's going to happen.
19:28
It's, know, whether it's one of your teammates or an employee clicking on the wrong link because they just didn't know it's going to happen at some point.
19:36
I think like a lot of attorneys, it's not broadcast because when a company does that, nobody's like, hey, everybody, guess what?
19:43
We just lost $40,000 or we just made a $1 million transfer, wire transfer we weren't supposed to.
19:49
Nobody comes out and says that.
19:51
I get access to, like you, I'm in some of those rooms when those things happen and they call me up and they're like, Jeff, what do do?
19:59
Where do we go now?
20:01
Can we get our money back?
20:02
Do we call the FBI?
20:05
or, you know, we've gotten a ransom uh email in, this real, is this fake?
20:09
uh So it's really different.
20:12
um But just going back for a moment, like, you need revenue, you need, you know, funding, whatever, but when you're going out to these other businesses or organizations, know, uh
20:26
the infrastructure you said before, when you're going out to these infrastructure players,
20:31
Like you're not just saying I need some money to keep my organization going.
20:35
You're saying, Hey, we might need money or whatever.
20:37
I don't know if you ask for money in those situations, but you're, but you're saying we need a partner.
20:42
Like we need to actually work together.
20:44
This is more like strategic partnerships all over the place rather than, you know, again, going back to that analogy with a startup and investor rather than an investor and saying,
20:54
Hey, I need a hundred thousand dollars.
20:56
need $2 million.
20:57
And they give you the money and they're there and they're on your board.
21:00
but you're running the show.
21:01
This is no, actually have, we have to work together because we, the problem is so large.
21:07
It impacts everyone in a dramatic way.
21:12
If we don't have the partnership, not just the money, but the partnership, we're all going to fail.
21:18
Absolutely.
21:18
There's two uh current partners, MasterCard and Amazon, that we both work with in different ways, but the initiatives and the outcomes are shared, right?
21:32
The end state that we want to create is shared.
21:35
uh MasterCard is heavily invested in small businesses around the world.
21:40
They sell financial services to them.
21:42
um They recognize as a company that it's
21:46
It's in their interest, right?
21:47
That small businesses start up, get on their feet, thrive, grow, purchase services.
21:55
um And they, as a company, have invested quite a bit of energy and resources themselves into making sure that uh micro and small businesses have resources available to them so
22:09
they can thrive as a business and be secure, right?
22:13
Amazon.
22:15
came to us a couple, a years ago, they uh have a very tight focus on their customers.
22:21
That's where Amazon begins every conversation is from the customer back.
22:25
uh And they were seeing data around scams.
22:30
again, I said scams have become the white hot center of cybercrime globally.
22:34
They are.
22:35
uh And they saw some interesting data with respect to young adults, 18 to 25.
22:43
You know, just one example of how we partner.
22:46
um It was very interesting.
22:49
We had not seen that data.
22:51
We are very good at developing or curating tools and packaging them up so the end user can have what they need, understand the risk.
22:59
What steps do I take?
23:00
What tool do I use to mitigate that?
23:04
But it was an interesting learning experience too, because when we first started talking with them a few years back, I'm speaking for myself, but like a lot of people,
23:13
I just assume like my 18 year old son and my 22 year old daughter were digital natives.
23:19
They were so much more skilled at the internet and social media than I, and that they are probably inherently savvier in terms of how to be safe.
23:30
less likely to be successfully targeted.
23:33
Yes.
23:34
Okay.
23:35
Data says the exact opposite.
23:38
Bureau and other, they're being targeted as much in volume by cyber criminals.
23:44
They've been losing money uh on average, on par with segments like senior citizens.
23:52
And when we started doing some work and collecting some data and surveying, know, attitudes, they're not as confident online as we assume they are.
24:03
So it was really a learning journey with a partner organization about, here's a specific problem that's not being addressed.
24:12
This is a community that needs awareness, that needs resources and understanding of risk and some tools.
24:19
And so we ended up developing uh a mobile forward solution that was social media uh friendly that engages.
24:28
And we brought young adults into design process.
24:30
of that product, which was the smartest thing we could have done.
24:33
But yes, it is partnership and it's partnership in understanding the dimension of the problem, being aligned in the desired outcome, having aligned incentives, obviously,
24:46
there's being commercial, ours being not for profit, but having a shared incentive.
24:50
ah That's critical to getting bigger things done.
24:54
Yeah, yeah.
24:54
I'm glad you said that because I think from, you know, I'm a small business owner.
24:58
I've been a small business owner for a long time.
25:00
I work with a lot of small business owners and I think small business owners and individuals and families look at a lot of these larger organizations and they say to
25:08
themselves, man, MasterCard or Visa or American Express or Amazon or whoever it is, you know, like I'm paying for the fact that they just let this stuff happen and all this is
25:19
going on and, and they're just charging me and
25:22
They probably don't like, like they make money either way.
25:25
And, and I'm, I'm certain that's not their attitude, right?
25:29
uh It's interesting to hear that they're collaborating with people like you to try to tackle this.
25:36
And I'm sure it's just as overwhelming for them, even with their resources as it is for the small business owner who, who doesn't know if they're going to be attacked or maybe
25:47
has been attacked and is trying to, trying to navigate that.
25:51
It's just a universal problem, it sounds like, and seems like from what I've seen.
25:57
It is.
25:58
That's not an understatement at all.
26:01
And I think, yeah, they're commercial organizations and they're for-profit and they're market driven.
26:08
And having worked with them both very closely, they really understand the dimension of the problem and the impact that it can have if it goes unaddressed, which is why they've
26:21
committed their time and resources, not just to protect their own customers, but in these broader
26:27
coalition, these broader community of actions that I've referenced earlier, they're active participants.
26:33
They support those broader community of action activities because they understand the dimension of the problem and what was required to address it.
26:43
Yeah.
26:44
Well, fascinating conversation.
26:47
We could go on for hours about the expansiveness of this issue, but I want to, I want to give our audience some insight into maybe your role and what you, know, how you've managed
26:59
within the organization.
27:01
Whether you're, you know, CEO of a nonprofit, CEO of a scaling company, like you go through a lot of the same issues, I think, even though the playing field might be a little
27:11
bit different.
27:12
And so I'm curious as you've been, as you've been in the company or in the, in the organization and even more recently as CEO, what kind of things do you run into where
27:24
you're like, this is new or need to solve this.
27:28
Like this is, this presents an issue, maybe not viability of the organization as a whole or maybe, but we got it like, like we got to figure this out to get to the next level.
27:39
What kind of things have you run into that?
27:41
fall into that type of category.
27:43
I think the most immediate and important thing was with uh the founding CEO stepping down and um some kind of seismic shifts in both technology with AI, but also in funding for
28:00
nonprofits, which is becoming an increasingly challenging environment in the last couple of years.
28:07
um There's a real question about what's the forward strategy now, right?
28:13
Phil has stepped down.
28:15
And m I think one of the things I recognized early and with some internal colleagues as well was um we definitely punched above our weight as a small organization of 25 or so
28:33
people with a very broad goal of cybersecurity at scale globally for the under-resourced and at risk.
28:42
organizations and working with the infrastructure providers.
28:47
Nevertheless, we really punched above our weight, We have done so many different initiatives, delivered so many important solutions and contributions that, you know, the
29:02
first recognition was we are too many things to too many people.
29:09
Right?
29:09
Like if we're going to...
29:11
saying that this is like one of the realizations during this leadership transition.
29:17
you're like, do you think that happens?
29:22
Because other companies go through leadership transitions.
29:24
And from the outside, it would seem like, whatever goals you set last week, let's just keep those and keep going.
29:30
What's the shift kind of the, I don't know, what's the word?
29:35
I'm thinking of the um tectonic plates, right, in the earth.
29:41
Why do those things shift when there's a leadership transition?
29:44
Well, think there's a natural, um there's a maturity cycle for organizations, right?
29:51
From startup to make it past startup, and then your young adult moving to mature, and then you get to the fully mature, and if you don't innovate, you then start the death cycle.
30:03
ah I think there's a general cycle here too.
30:06
mean, what I think for global cyber alliances, um it has been defined by,
30:13
um the identity of an incredibly brilliant, dynamic, creative CEO.
30:19
And that has gotten us to where we are.
30:21
I mean, a recognized player that does so many incredible things.
30:27
But it's also time, it's one of those times where you have to mature in a different direction.
30:33
mean, personally, I think we need to be more narrowly focused, right?
30:38
We need to present a clearer, more narrowly focused value proposition.
30:43
to our funders, we can't be perceived as doing eight different really great things, but that doesn't lend to a kind of a cohesive value proposition, right?
30:54
If you invest with us, you're gonna get these specific outcomes.
31:00
So the first recognition was too many things to too many people, what should our value proposition be going forward?
31:08
Narrowing the aperture of what we do.
31:11
and focusing on the thing that funders care about today.
31:15
So we could make an effective value proposition pitch to them.
31:19
So that's really the turn, kind of the pivot.
31:23
And we're working on that.
31:26
We developed a new strategy.
31:28
We've developed a new value proposition statement.
31:30
We're targeting potential funders with better intention and aligning with those who have an interest in art.
31:39
the direction we're going.
31:40
uh And I think moving through that and more clearly defining GCA in different ways, I also think it needs to become an organization.
31:51
It needs to become a more professional organization in terms of how we operate.
31:58
Well, I mean in terms of internal operations, the way the team works together.
32:05
Eight different amazing things.
32:07
You've got people focused in different directions.
32:10
A lot of great, dedicated, capable people doing things and having impact.
32:15
But sometimes team cohesion can suffer.
32:19
Everyone's got their own initiatives.
32:21
You know, you're describing this and I'm hearing, I'm hearing a lot of the same types of things that I hear from founders where they're like early, early on, we tried to be all
32:29
things to all people.
32:30
And then one day we're like, that's not going to work.
32:33
We'll be, we'll be everything to nobody.
32:35
If we keep it up, we got to, you know, refine our offering.
32:38
That's what I'm hearing.
32:40
have these different people who have different objectives and now you've got, you've got to get into, into alignment and you've got to say, Hey,
32:47
this, you know, if we're going to align on one offering, we all need to align our actions and behaviors and inputs toward that offering.
32:55
can't keep going towards different offerings.
32:56
So this is, it sounds like a parallel to what I see in for-profit businesses quite often.
33:03
It's precisely what's happening.
33:04
So it's not a new uh challenge.
33:07
It's new for me.
33:08
I've not been in this position before.
33:10
I was a uh CEO for eight years of Public Interest Registry, which runs the .org address on the internet, um which is a very, very well-funded, not a typical not-for-profit in that
33:23
it has a funding machine by selling .org addresses to feed its programs.
33:29
It has great financial stability.
33:32
But GCA is a classic not-for-profit which has to approach philanthropies, approach corporate donors, work with government programs that provide funding and align with them
33:43
and get funding to do the things that we do and work together.
33:47
So it's a challenge.
33:48
The funding environment has changed significantly.
33:51
You saw the US government eliminate USAID, which is an economic development uh funding channel.
34:01
The good news for us is we were not dependent on that for our life's blood, but it's one source of funding that goes away.
34:09
um
34:11
And then everybody else who was dependent is now coming to the sources where maybe you've had less competition.
34:17
Absolutely.
34:19
Absolutely.
34:19
There's competition.
34:22
A lot of the corporate funders and even philanthropies for the last couple of years, the constant message has been, I have a finite pot of money.
34:32
You know, I'm funding a number of you all, not-for-profits.
34:36
We'd like to see more of you partnering together and proposing larger projects.
34:43
We'd like to see other funders at the table.
34:46
as well, not just us.
34:48
And this is coming from consistently, know, corporates and philanthropies.
34:53
So that's the environment we're in right now.
34:55
So that's the environment we need.
34:56
We need to create an offering and a value proposition that's clear, that cuts through, that's attractive to certain funders.
35:04
And yes, we're entertaining the idea of partnering with others and coming to the table with bigger projects.
35:10
That's where these community of action initiatives, a lot more sense.
35:15
Let's get more people to the table, more funders, more not-for-profits, more corporates, and actually agree to drive a common initiative.
35:24
That's where that ties in.
35:26
um So that environment's really challenging.
35:29
yeah.
35:30
So founding CEO steps down, that's a change.
35:34
um Too many things to too many people, refocusing, new strategy, navigating the funding environment, and then just to make it extra fun.
35:44
Here comes AI, which is putting cybercrime on steroids, right?
35:51
So that's the environment.
35:52
It's incredibly dynamic.
35:54
That's amazing.
35:55
How, how are, what have, what do you feel like you've been able to do and who have you turned to to help you do it, to start to navigate these types of things?
36:05
Is this all internal?
36:06
Do you bring in consultants?
36:07
you, you know, you spend your Sunday evenings ideating like, what do do next?
36:12
Like, like what's the, what's the solution to, to, to getting all of these things to come together as the external, you know,
36:23
chaos is just expanding.
36:25
So interesting question.
36:28
Most of it's come honestly internally, know, uh colleagues on staff um who've been in the fight for a long time and have been part of the team and understand the need for change.
36:42
um Our board, we have got a terrifically supportive board that's, and many of them have there from the beginning, um who are open.
36:52
um
36:54
You know, they push us where we need to be pushed.
36:56
They're supportive always.
36:59
They're throwing in, you know, in moments like this, you want your board to throw in as opposed to be kind of sitting back posture-wise.
37:06
ah And then the one initiative that we recognized we needed was a communication strategy.
37:11
Right?
37:13
We realized that we haven't been the strongest in communications, but particularly with respect to the funder audience, right?
37:22
and the value proposition.
37:24
So we did go engage an outside firm, we're just about done with that, to develop a new communication strategy that can help communicate the new narrowly defined mission, the
37:37
value proposition statement, and get ourselves in front of the right audiences.
37:41
So that was a piece that was missing that we did go outside to get help with.
37:47
Okay, and who is that audience in case any of our any of our audience is listening and they say, wait, I might be that or I can make an introduction.
37:55
Who is that audience that you're trying to get the communications to?
37:58
So I think primarily uh if we were to order them, uh communications firms, internet firms, uh any large corporates who are dependent on the internet for e-commerce, for service
38:12
delivery, uh know, MasterCard is a great example, Amazon's a great example, uh but companies of that ilk, their dependency on the internet, right, providing seamless
38:26
service.
38:28
is the lifeblood of their company.
38:30
And I may not be the thing that's top of mind every time they come into work in the morning, but it's a fact.
38:37
And that's what been trying
38:38
gateways that mean they're the gateways that everybody else uses to essentially transact on the internet and that's how they make their money which is fair.
38:47
Right.
38:49
But because they're the gateway they're probably some of the most impacted by the things that are happening right.
38:54
Right, we've seen, know, recent, in the last five years, so we've seen instances where parts of the internet go down, right?
39:02
Or there's this massive disruption because of someone's software that wasn't updated.
39:08
And we have examples of the macroeconomic impact that can happen.
39:14
So those types of companies have a stake in the game.
39:17
uh Philanthropies, absolutely.
39:20
There are some philanthropies out there.
39:23
Craig Newmark.
39:24
who created Craigslist is an absolute champion of the cybersecurity nonprofit community.
39:31
He's been a terrific supporter of many, not just us, uh but other philanthropies who have supported the work that cybersecurity nonprofits do.
39:41
Those types of philanthropies need to invest more with us.
39:46
And then lastly, but not last, uh governments.
39:51
uh There have been...
39:53
and still are government programs that provide funding to build digital skills, right?
40:00
In their students, in their workers, like workforce development on AI skills building is gonna become a huge, huge thing, right?
40:11
All governments see what AI is doing in its early stages.
40:15
Many are assuming there's gonna be job displacements.
40:18
You're gonna see funding for AI skills building.
40:21
Well, there needs to be funding for AI and cyber.
40:25
The risk piece of that skills building is going to be critical.
40:29
that's the type of message we're trying to get in front of governments is you need to also invest in the risk side of this technology and make sure that your, you know, your workers
40:38
know how to use it securely, how to mitigate.
40:42
There's hallucinations, there's inaccurate responses, there's poisoning, the exfiltrate PII.
40:50
That's a
40:51
a real, there's great opportunity with AI and there's also risk.
40:55
So getting governments to prioritize the risk side of skills development is something we think needs to happen as well.
41:02
That's really interesting, Brian, because like I'm thinking about here in Utah where I live, you know, we think of ourselves, we call ourselves Silicon slopes, you know, as
41:11
though as though we're maybe somewhere closely behind Silicon Valley.
41:15
But uh be it as it may, there's a lot of talk about all of the software and tech companies that are being built here, just like, you know, Arizona is talking about it and Colorado,
41:26
everyone's talking about that.
41:28
But I don't hear a whole lot about cybersecurity.
41:31
You know, they're not pushing for
41:32
They're not necessarily pushing the message around cybersecurity the way they are around job creation, job growth, growth, IPOs, whatever it might be.
41:43
So that's, seems like an area where um it's got to be just as important, if not maybe more important because without controlling cyber security, that whole technology base uh could
41:56
easily be impacted in a really significant way.
42:00
Increasingly important.
42:01
um And it's only going to get more important.
42:04
I'll give you an example.
42:07
I was at a MasterCard security team briefing for two days in Singapore last September.
42:14
And the attendees were largely Interpol and law enforcement agencies from the Southeast Asia region.
42:23
And I've referenced those scam centers, right, in Southeast Asia that have grown to be the size
42:29
of small cities.
42:31
They are being run by transnational organized crime.
42:35
Law enforcement in the UN Office of Drugs and Crime have been documenting and tracking them for years.
42:43
They are significant contributors to significant increases in phishing emails and scams, attacks that have happened globally in the last couple of years.
42:55
uh There was a Microsoft study that
42:58
showed that 40 % of phishing emails are now Gen.ai assisted.
43:05
what's compounding that, so AI number one lowers their cost structure of doing business.
43:11
Makes it easier for them to automate the delivery of attacks and they're doing it and the volume is showing.
43:19
Now add deep fake technology, right?
43:22
And we've seen it.
43:23
mean, today's deep fake is good enough.
43:27
to fool a lot of people.
43:29
Yeah, if you know a bit, you can look for like the extra finger or other indicators.
43:35
But right now they have, according to that Microsoft study, um click-through rates of 54 % in AI-assisted phishing emails.
43:48
54 % click-through rates.
43:50
That is a business driver, up from 12%.
43:55
Business driver for a business model, right?
43:58
That's just to today.
44:00
So I'm in that briefing and there's a lot of data being shared amongst law enforcement.
44:05
And somebody says that within two years time, we expect these scam centers to be operating fully AI agentic platforms.
44:14
So they're going to build agents upon agents to run these things.
44:19
24 hours a day, seven days a week, 365, using increasingly sophisticated deepfake technology.
44:29
So Jeff, you know enough, right?
44:31
I left that briefing.
44:32
sat on a, I'm not joking.
44:33
I sat on a park bench for about half an hour, just kind of let that process, knowing what I know.
44:40
There is a tsunami.
44:42
This is not an overstep.
44:43
is a tsunami.
44:45
Cams and fishing attacks that are going to come at all of us in the next two years.
44:49
more effective
44:50
Yeah, in my engineering, we studied the concept of harmonics at some point, right?
44:54
When you get harmonics out of balance, you know, harmonics are, you kind of keep in balance and they're going, but if they get out of balance, all of a sudden, there's no
45:03
end.
45:04
I mean, until there's destruction, there's no end to the growth of those harmonics.
45:09
uh That feels like, I hope it's not, but it feels like that's what you're describing.
45:18
It is, and I'm connecting back to cybersecurity, should be an increasingly important priority for everybody.
45:26
For sure, for sure.
45:28
Man, well, I want to ask you two more questions.
45:31
I want to ask you about what should some of our listeners who are building small companies or scaling companies be thinking of?
45:39
What are one or two things they should be thinking about?
45:41
But before we go to that question, I also want to ask you as you've taken the helm of this organization, what's an area where you feel like you've grown in an unexpected way?
45:56
I think it goes back to just, have my moments, right?
46:02
I have my moments where I'm animated or reacting to something that's happened.
46:07
But I think on the whole, just um being steady, um getting, not overreacting or underreacting too much in either direction, staying steady, know, let things come at you.
46:23
They're going to come at you.
46:24
um
46:25
Trust the people around you.
46:27
ah Lately, what I've been saying is signal to noise, Focus on signal, right?
46:34
What are the one or two things that really, really matter and keep your eye fixed there?
46:40
The rest of it is noise, right?
46:41
Don't get distracted.
46:43
I think I'm doing better.
46:45
And that comes with practice, think, knowing how to find the signal and knowing how to tune out the noise.
46:52
two different tactics that are complimentary, but very different from each other.
46:56
Yeah, I love that.
46:59
I love that.
47:00
Okay, so onto our audience.
47:03
if we've got people listening, they're hearing this and they're saying, I didn't think I had time before I started listening to this episode to really put towards cybersecurity.
47:15
Like we're just trying to make money or trying to pay employees.
47:18
We're trying to get the next product version out.
47:22
That's a lot of time, a lot of energy.
47:25
But what are the one or two things they really should be thinking about or even doing uh in parallel to building their businesses?
47:34
Well, I think everyone should be leveraging AI for its opportunity and promise, right?
47:42
Use AI, right?
47:43
It can enhance your business.
47:46
can save enormous amounts of time.
47:49
ah But if you're going to use it well, two things.
47:56
Understand your processes, right?
47:58
Because it can improve your processes, but that means you need to really have your processes well documented.
48:03
understand your processes and then see if you can use AI to leverage that to improve your business, um your intelligence, your decision making, your speed, ah not to replace people
48:17
necessarily, but to improve those things.
48:20
And if you've heard anything I said today, if you're going to use AI, you must, must, must address the risk aspects of this technology.
48:31
Otherwise, you could be putting commercially sensitive data on a server that goes, shares data with God knows whom, right?
48:38
ah Are you getting accurate responses from the technology?
48:43
Are you getting what you need from it?
48:45
uh What is it doing with PII?
48:48
If you use AI blindly, are, you're, you know, you're driving with the back door open and God knows what's going to happen, right?
48:57
So I say use it and use it.
49:00
intelligently and address the risk at risk aspect as well.
49:05
Okay, I've got to dig one step one level deeper on that because you've got me really curious as an attorney, right?
49:11
I'm very sensitive to not putting uh client information identifiers, people, confidential trade secrets, any of that stuff into AI anywhere.
49:20
I use AI a lot.
49:21
I use it for my own business quite a bit, but I'm a lot more reluctant to use it for client issues, right?
49:30
Because of that reason as an attorney and
49:32
Maybe it's not even the cyber issues as much as it is discoverability and legal ethics.
49:37
But for somebody who's not in my seat, you know, what are the risks that you, that you would say, Hey, or, or what are the protocols where you might say, if it's me, I wouldn't
49:50
do X, Y, or Z.
49:52
Well, and by the way, I'm a former attorney myself, um
49:58
We call you a reformed attorney then, because you're no longer practicing, right?
50:02
Recovering.
50:03
uh I really appreciate the responsibilities that you have with respect to your clients and your clients' data.
50:10
So I hear you loud and clear.
50:12
Again, I think it's really about understanding um your data, right?
50:18
um Your customers' data, how you manage it, um how you store it.
50:24
um know, little simple things like um sometimes creating
50:30
backup data sets.
50:31
um The first question we're being asked is, what about GDPR?
50:35
Is this exposing any uh data to GDPR violations?
50:43
the world going forward is going to be about data, data, data.
50:46
answer to that question is probably yes.
50:50
If Brussels has anything to say about it, Jeff, it's yes.
50:53
um Yes.
50:55
So understand your data, understand ah your requirements, and just know that AI as a tool, uh there's a number of, let's call them trap doors, right?
51:08
If you're not aware, there are a number of trap doors that can open up and suddenly your data is exposed in ways you don't want it to be, whether it's...
51:17
your commercial secrets, whether it's your customer's data, whether it's something else, um there's trap doors.
51:24
So be aware and mitigate and manage those risks with open eyes.
51:28
And I imagine as soon as you start creating and connecting agents into your own infrastructure, you've just opened those trap doors pretty widely.
51:40
So, wow, Brian, you've given me so much to think about here.
51:45
um This went way beyond the scope of even what I was hoping to talk about.
51:50
So I really appreciate you coming in and enlightening me and sharing some insights with the audience.
51:56
Thanks for having me, Jeff.
51:57
Absolute pleasure, really.
51:58
It's been great for me too.
52:00
So thanks again.
52:01
And for the audience who joined us, thanks for joining us on another episode of The Breakout CEO.
52:07
Be sure to follow or subscribe on your favorite podcast platform.
52:11
And if you enjoy the show, a rating or a review goes a long way.
52:16
Our mission is to promote the stories of breakout CEOs in scaling SaaS, e-commerce, and tech companies to equip peer CEOs with valuable perspectives and confidence.
52:29
Thanks again for joining us on this episode of The Breakout CEO.
52:34
I'm Jeff Holman and I'll see you next time.