Latest / Noise2Signal / EP 3. The Face of New Media for Cybersecurity with Cole Grolmus, Founder Strategy Of Security
Transcript
- Speaker 2: You are an N of one founder and SEO of Strategy of Security. Speaker 1: It wasn't like I was gonna go be a poet. Right? This is this is probably my last job. I mean, one example, like when Nikesha Aurora chimes in, when you're out there on your own trying to cover the industry with a broad mandate, I realized what I didn't know. This is how complex our industry is. I want you to know that. Let me just give you a tool to help you navigate that complexity. Speaker 2: What do you know something has gone viral? You write with the same level of clarity as an outsider, with the brutality of like a grand chess master. Speaker 1: There's a fine line between being critical and being honest. The only way to be good at strategy is to be brutally honest. Speaker 2: I'm gonna talk about the state of the union for cybersecurity media. Speaker 1: Yeah. You know, I think in some ways it's never been better and never been worse. Speaker 2: My sense is a lot of it is pay for play. Do you think these hefty fees are sustainable in the age of AR? Speaker 1: I mean is their business gonna grow like wildfire? I don't think so. Speaker 2: You're not in this ⁓ ambulance chasing mode. Speaker 1: I have a pretty high bar for quality in general. Speaker 2: What class of companies will die because of AI? Speaker 1: I think if you just had a g then I think you're probably in trouble. Speaker 2: What's the next big thing that is dropping from Cold Goldmas? Ladies and gentlemen, please welcome Cole Gromus, founder and CEO of Strategy of Security. Cole Groomos, thank you for joining me on this interview series, Noise to Signal. You are an N of one. There is no one like you in cybersecurity media. You are a student of cybersecurity companies and the ecosystem. You study them, you research them, and you influence them through your writing. You are an army of one and a founder and CEO of strategy of security. And your work requires a lot of effort, but you make it seem like it's effortless. And my sense is it must have taken a lot of effort to get where you are today. So I'm curious what has been the journey like to get started with strategy of security? Speaker 1: Yeah, ⁓ thank you for having me. Honored to be here. ⁓ you know, I've been doing this for five years, but it's been twenty plus years in the making, right? I think I think there are parts of this journey that I could trace, you know, all the way back to when I started using computers at twelve and for sure when I started working, you know, and having a chance to work in the the industry like at a fairly young age. But, you know, I I think what ultimately came together was like the culmination of that journey over a really long period of time and a lot of really intentional thought around, you know, what is it that I'm good at? What is a unique point of view that I can bring to the industry and what feels very like natural to me. Speaker 2: And there is there is one thing I want to add. You have been doing this despite lack of sleep. You just had a second kid. So congratulations on that. ⁓ despite that you have been doing amazing work. Your writing is really amazing. And my sense is like this was this is not your first rodeo. You tried something else, you failed, and then you landed up on strategy of security. What was that like? Speaker 1: Yeah, I mean I I did a run, you know, after my time at P D B C like I spent, you know, a decade plus call it intern through ⁓ you know, directorate at P D D B C mostly in the cybersecurity advisory practice. And the the reason I left was not to do this, it was to start a proper startup. You know, there there was a a long period of time where I always thought that I wanted to be, you know, a proper founder like you and had to give it a go. You know, it was just one of those things that I could never never make it to the end of my life and feel like I hadn't attempted that. And so did that kind of, you know, the the short of that was like a couple year run, you know, really giving that a go. tried to build AI agents before we had nomenclature for that. And, you know, this was like, you know, more than five years ago. We just didn't really have the tooling. But you know, we were kind of at the stage of like, I got my OpenAI playground API key from Greg Brockman. personally. Like that's how that's how early we were ⁓ in attempting to do some of that. And it it just, you know, it was it kind of ended up being a little bit too early and kind of the ultimately like the wrong time of my life. But all this is to say that didn't work out or I kind of decided that I didn't want to do that anymore after a couple year run. But what that led to was like some really good reflection around what it was that I wanted to do next. And I think that that's kind of the important part that that got me to what I've been doing with strategy of security. Being a founder is really hard. I have a ton of respect for, you know, startup founders that are trying to build venture scale companies. I just kind of realized that I didn't want to do that. That's a hard realization and it took a lot of pain to get to that point. But I reached a point of acceptance where it was like, it's not really for me. It's not what I want to do. But that doesn't mean that I have to go get a job either. Like I was in a fortunate spot where I could take some time and figure out what I wanted to do next. And so I took The better part of a summer wrote sixty five thousand words, which for a point of reference is like half a book. Speaker 2: Were those words for yourself or was were you writing it for public consumption on like Speaker 1: No, that was totally for me. It was all it was it I mean, I I'm like s you gotta remember I'm like sitting on by far the biggest failure of my life, right? And I I just ripped it all down to the studs and I was like, What went wrong? What do I really like? What do I wanna do more of? What I wanna do less of? What am I good at? What am I bad at? All of the above. Right. And a as it turns out, like through very intentional exploration through all of that. I you I I kind of read something that was really close to this. I knew that it was directionally like I'm decent at writing. I have an MBA, I've been through formal strategy training. I've ten years of experience as a practitioner in like a hard knocks PhD enterprise environment like P D B C. Like there there are a lot of things that are commercially useful. Like it wasn't like I was gonna go be a poet. Right. So I wouldn't have been good at that. And so it was kind of just like, hey, there are enough things that came together that are that are actually commercially interesting as an independent business. And by the way, I picked up a lot of skills along the way that to help me fend for myself as a, you know, as a founder. And so there's just enough things that I that I'm good at in that area that are what you see today that I just I felt like it was something I had to do. And so that was the plan for me to come up with what is it that I could do for the next ten plus years. Like that was my objective starting out. I didn't I wasn't re ready to commit to forever yet, but it was What can I do for a while and give this a run? And and that was this. So I I would say now, this is this is probably my last job. Like after after having done this for five years and and enjoyed the process and gotten some validation, like I don't want to do anything else. This is what I want to do for the rest of my life. Speaker 2: There are two there are two follow-up questions I have. One is, you know, like the early days when you got the EPI key from from the Open AI founder, that was probably the worst time to be a founder because things were changing so fast. Every day, every week, there was a new paradigm on how to build stuff. First it was RAG, and then there was vector search, and then there was something else. And ⁓ now it is, you know, now I guess it is settling on the agentic AI wave. The second question I had for you was what were the lessons learned from that journey, you know, writing that sixty five thousand ⁓ novel, you know, like deep introspection. What were some of the lessons learned from your point of view in terms of getting to strategy of security? Speaker 1: Yeah, the the answer to those or at least my answer to those two things might be closer together than what you might think. We were probably even before some of the tooling that you were talking about, right? And this is like twenty eighteen, twenty nineteen, twenty twenty. So, know, so yes, it was a bad time. Little did we know when we left the firm, like we were heading into a pandemic, which, you know, what i I don't want to place blame there. I mean, that wasn't what caused this, it just didn't help. ⁓ you know, but but but I think we were in a time where like way pre Chat GPT, like LOM's barely worked at that point. I mean, you could go into the playground and you could get like sort of a response, but not really. I mean, so what we were trying to build never was really around that. You know, we were kind of back in the, you know, pandas and proper machine learning and a lot of a lot of things like that, trying to build an agent. So it it was pretty primitive. So I I guess I would say the timing of that definitely mattered. We didn't know the time that that that all this other tech was gonna come together, but I would say if I were trying to build this today, it would've it would look a lot more sand. it would it would be a lot easier to do and and and all that. So it it that definitely would have that definitely would have helped. But I think what I learned along the way though was like starting a startup or really any business, but especially a startup, is like incredibly hard. I mean the odds are just stacked against you from the beginning. Yep. Even if you have everything working in your favor, right? And I think at the time what I you know, what I what I had to admit, I didn't know going in or wasn't willing to admit going in, but what I had to acknowledge was there were too many parts of that job that I didn't have the skill set for. Like I I I mean, yes, I I went to business school and management information systems, but like I'm not really a good programmer. Like I know what I want build. I'm not really a good programmer, so it was you know, it was hard for me. ⁓ you know, could I write code? Did it look respectable? Sure. You know, but it definitely wasn't an advantage. It was sort of mitigating a disadvantage at the time. You know, and and there were I don't know, there were just kind of enough other parts about the founder journey that I wasn't really suited for. And so it didn't it didn't really were. And and we were building outside of cybersecurity. Like that's that's worth noting too. Like it was a little bit adjacent to what we had done at P D B C so it wasn't completely bananas, but like I was also it you know, so so a person who's not really that good at writing code working in a domain that is not my core domain. Like you can look at that in hindsight and be like, ⁓ well that probably wasn't a good idea, and you would be right. So, you know, I think it's a little bit different now. I mean, I can fend a lot better for myself with yeah, coding assistance and all the luxuries ⁓ that we have today. But ⁓ but I think like that was one of the big lessons on the way out for me was look, like it it's hard to do this anyway. You have to align everything you possibly can, like layers upon layers of strengths, and do what is like very natural to you in order to have a chance at being successful. Speaker 2: I agree. Yeah, I mean it's it's very hard. There are so many, you know, you don't realize how many functions you have to take on as a founder to scale the company. And every space is something that you've not worked on. A lot there are a lot of spaces that you've never had to touch upon. And then you are there are nobody else to help you out. You just have to do it yourself. The thing I want to touch upon is one of your greatest contributions is the mapping of the cybersecurity ecosystem. And you know and I say that because as founders you're always struggling to figure out which category we belong in. And there are there are new categories coming up every now and then, right? You know, a Gartner comes out with a category, Forester comes out with a category, and then you're trying to figure out which category we belong in, which categories don't belong in, and so on and so forth. And you went in and you did a deep dive in terms of mapping out the ecosystem so that even if you're not like very attuned to the market, you can figure out what is the lay of the land and figure out where you fit. So talk us through your journey through One of your most viral posts, I believe. I think it it draws more traffic to your website even today compared to all the other writings that you do. What were you thinking and in those days? Why did you write that piece? Speaker 1: So this is, you know, kind of early. I started strategy security like end of summer, fall twenty twenty one after my time off or my exploration time. What I quickly realized, again, with a heavy dose of humility, ⁓ walking into this project and you know, with with some confidence, but trying to rebuild my own confidence in many ways, if I were to admit that. I realized what I didn't know, right? Like even after doing cybersecurity very professionally at you know, at P D B C one of the top consulting firms in the world for over a decade. When you're out there on your own trying to cover the industry with a broad mandate, I realized what I didn't know. And so all the things you just described about the the challenges of navigating and mapping the cybersecurity industry were were like what I realized. And so I made that for myself. Like the the plan was always to publish it, right? But the time I had the time, I had the freedom to sit there and like actually put all this together and It was largely for my own ability to navigate the industry or at least like quickly orient myself to where wherever a certain company or wherever a certain topic was in the industry. But ended up publishing it and that was that was definitely one of my first probably fair to say my first big hit for sure. I mean I had written some other things, you know, that but at that point it was very early days, like hundreds of readers, ⁓ type of a thing. This has really turned into more of a project. Like it was a post, but I would say the the ecosystem itself has lived you know, far and wide beyond the original post. It's in some ways kind of like a canonical reference now in the Speaker 2: I'm curious, was this intended to do a very small subset of the industry you wanted to take on? Then as soon as you dive into that topic you realize it's way bigger than that or or did you always intend to make it like a mapping of the entire ecosystem? Speaker 1: It was c more of the latter. I knew enough for sure to realize how broad the industry was and I I think one of the core insights looking at it in retrospect that I was right about walking in is like I have always had the point of view dating early back early in my career that like you need a balance of business and technical things. Like there's that there's especially like cybersecurity is a very technical industry and like that tends to be valued. I have always been pretty evenly split, you know, between the two. ⁓ or at least having more of a business background than than what many folks in the industry do. I've just always been empathetic towards that side of it, right? And and one of the things that I knew walking into that was, hey, I think people are kind of looking at cybersecurity like this, like pure play cybersecurity, you know, but like in reality, there's this entire ecosystem around it, especially if you were to go to, you know, capital markets, venture capital, private equity, you know, all that, like, I mean even equity analysts who cover the industry or You know, within the industry you have all kinds of GTM people and and you know, other functions of people who work within the industry, but they may not call themselves like cybersecurity people per se. And I just felt like that needed some recognition because that like that's a major part of the industry. Like if you I I've never actually run the data behind that, but like if you were to look at the number of people sitting in each of those camps, like very technical, employed by s you know, cybersecurity professional would recognize themselves as such versus another discipline that happens to be working in cybersecurity. There's tons of those people. I just felt like that was a good like that all comprehensively needed to be accounted for. And so I was trying to go like both really wide and fairly deep. And that's why, you know, in some ways this thing is as gnarly and as overwhelming as it looks, is because that was on purpose. It was not to try to abstract away the the complexity. It was to it was to actually say, hey, like This is how complex our industry is. I want you to know that. Let me just give you a tool to help you navigate that complexity. Speaker 2: And it seems like you have this natural tendency or a natural pull towards a good strategy. Once you see a good strategy, you get naturally drawn to it. I I believe you wrote about ⁓ the one password blue ocean strategy. And ⁓ you know, I think that even that went viral. Right. And that you l you you study all these companies. G you know when you see a good strategy, you just latch onto it and you write really well about that strategy. So I'm curious, like how did that play out the blue ocean strategy from one password. That was I believe that was one of your vital posts as well. Speaker 1: Yeah, that was probably the that was probably the second really big hit. ⁓ you know, so that that that I that one I sat down and probably wrote over the course of, you know, I don't know, sixty hours over a couple of weeks in the frozen tundra of February in Minnesota in early twenty twenty two. It you know, it was I don't know, it was just it I I'm very much a student of strategy. I mean it you again, that was like one of my emphasis in MBA school, along with like the technology side of that and you know, kind of even back to undergrad. So You know, I've I've always I've always cared a lot about strategy. That's one of the main orientations of what I like to write about. I just think one password is a fascinating business, right? I mean, you know, again, this is this is like fresh off of their series C. You know, but but long story short, you've got a company that's been around at at the time for like fifteen plus years, you would hardly raise any capital and was at hundreds of millions of dollars of business. And you know, had a very unique brand, just a very unique story in the industry in general. And so I I felt like it was very undercovered. And you like I the funny thing is I find this all the time now. Like like there are a lot of great companies in cybersecurity, including some pretty big ones, that like just have not had people cover them at the level of depth that I think you know, that that I think they're worth. And and that was the first time I really did that. Like I would say that was my first really serious attempt at like taking one company and really going, you know, super deep on it. But, you know, they yeah, that article that article was huge. I mean I heard from all corners of the internet on that one, including people who I never would have expected to read my stuff. Speaker 2: And the and the funny thing is if things are going well for you as a founder, you don't really need all that recognition anyway, because you know, you have revenue, you have customers, you just scaling your go go to market and b you know and just scaling the revenue from there. And the other aspect that you write a lot about is the earnings transcripts. And one of the reasons I gravitate towards your writing is, you know, if some of the analysis that you write, especially in the space that I've worked in, If I wrote it, it would be, I mean, he's this guy's an insider. He knows about these companies, he's worked at these companies, no big deal. But you write with the same level of clarity as an outsider with the brutality of like a grand chess master. There is a level of honesty in there. When I read it, it rings true. Especially for the companies that I've been at, and I'm like, how does how does like Cole write so clearly about and that's why I trust other the other writings that you do, because I You know, if you do well in the space that I s ⁓ at least I claim to understand really well, ⁓ and you write really well on those topics, then it's a good proxy that it probably writes really well on the other topics that I don't understand really well as well. Speaker 1: Yeah. ⁓ so I you know, I definitely try to as far as like scope of coverage, I mean I I tend to focus mostly on like the later stage or the public you know, public cybersecurity companies like later stage well funded, you know, well funded companies that are pretty widely known. And then, you know, I do definitely spend some time covering startups, but it tends to be like markets of startups. So, you know, once in a while there'll be one that is really interesting that I just cover on its own, but like I the on average it's probably like a group of startups in, you know, an emerging ⁓ an emerging industry or one that I can definitely see a lot of activity around and try to draw the strategic themes from there. I think on the on the approach part, like on one hand I'm Midwestern, right? And so Midwestern people are pretty polite. I've grown up in the Midwest for the whole time, you know, my entire life, and so ⁓ Minnesota is the capital of passive aggression. There's probably some of that that I've channeled. ⁓ you know, so it's it's not I try not to be overly critical, right? So I don't I don't wanna go out and just Speaker 2: You're very honest in your writing. Speaker 1: Yeah, I think there's a difference between there's a fine line between being critical and being honest, right? And so like I don't want to be critical just for the sake of being critical. And you know, there are probably times where like privately I would criticize something, but like I'm just not gonna do that in public because I don't I don't wanna intentionally eviscerate a company just because I can. Right. But a at the same time, like I think there's the other end of the spectrum is like I can talk to you positively about something and make something look better than what it should. I'm probably guilty as charge of that, but I would much rather sit on that side than like being critical just for the sake of getting used. I think in the middle though, and what you're getting at is like there's this level of intellectual honesty in there where it and and I think I think if you were to just reflect more broadly on strategy, right? Like the only way to be good at strategy is to be brutally honest. Like even if you even if it doesn't even if the final product doesn't come out that way, like the thinking behind it needs to be brutally honest. Right. It's really hard to do strategy well if you're lying to yourself or your client. Right. And so that's kind of where that's where it's it has to be is just the recognition and the maturity to know like, hey, this is going really well. Here's why. Or hit that hey, this is not going very well. And here's why. And then I can kind of craft the message around that. Right. But but sometimes in analysis, like it has to be blunt. It has to just be like, look, I don't think this is working. Or I don't think this is going to work. And it's and and that's some of the responsibility that I have is like, People take what I say seriously, good and bad, and so I I cannot put lipstick on a pig, so to speak, when I should Speaker 2: Let's ⁓ let's switch gears. ⁓ I'm gonna talk about the State of the Union for cybersecurity, cybersecurity media. My sense is a lot of it is pay-for-play. So as a result of it, you never know what is true, what is not true. And someone like you shows up with a dose of honesty, it pulls the readers towards that kind of media in terms of ⁓ you know, trust, honesty. rigor in the research and so on. What do you think is you know, is good or bad with the current state of the union for cybersecurity media? Speaker 1: You know, I think in some ways it's never been better and never been worse. And I know that that that might be a that might be a contradiction. I you know, I I I think never been worse is probably along the lines of what it you're saying, right? Where I and and I think that that goes up and down, right? I mean I'm certainly not in the, you know, big analyst firm, you know, Gardner Force are gonna die camp. Like they'll they'll be around forever, they serve their purpose. They do what they do fairly well. I mean, the the stock price is what it is and I think they have challenges, but like they're they're resilient businesses. They've been around for a long time. They'll figure it out. So, you know, I think they have their role, right? And I just yeah, I mean, I can understand why people, you know, have distrust in the media and why ⁓ or the cybersecurity media and and like why some of the pay for play aspects of both large and small firms can be challenging to navigate. The the thing that I think is good though, and aga you know, again, this is just me kind of reflecting on my own five year journey as a independent person. I think five years ago when I was starting this, it was kind of just starting to become possible to do this as an independent discipline, right? Like there there really weren't you know, there were some people, I guess, I mean, you know, there you have the the the OG people like ⁓ Richard Steinon who have been out here doing this for a long time, but you know, for the rest of us mortals, it it was kind of a a new thing. And so That was kind of a small bet that I took at the beginning of this was like, Hey, I think I think through the combination of the the publishing platforms out there, little did I know like AI would come later, that would be a lot more helpful. ⁓ and I think more just the climate. I mean, I think my sense was just people were more receptive to listening to independent people than they ever really had been before. So, you know, I think that's been really good. It's been an amazing journey for me to be able to be independent since day one. You know, I've had the opportunity to write about a lot of things I really like. I have amazing clients. Like it all just works. And like there's a a small cohort of like my peer group, you know, Chris Hughes, Ross Halluke, Francis Sodom, James Rohti. Like you could name a a few other people who have all Mike for Bet, you know, who have all kind of started around the same time and have all been able to do, you know, their part of it. And so I think that's cool where like it the the punchline is like it can all coexist. I like I think it's really neat where Like none of us are sitting here trying to take down Gartner. Like that's just that's not that that's not what this is. It's like there's just more room in the industry for more voices and I think, you know, people like to hear from that. I think that that's been a fun thing. Speaker 2: Follow up to that is I have is do you think these hefty fees are sustainable in the age of AI? If this high quality work gets done by independent media, you're one of the people leading the charge on that. Do you think these hefty fees are sustainable? Given the amount of research AI agents can do, AI analysts can do for you, or does it not matter? Speaker 1: I think the people who I I think it's kind of Gartner's kind of like an annuity, right? And if by hefty fees we're referencing like the original old school analyst firms, i I think it's gonna continue to exist. I mean, is their business gonna grow like Wildfire? I don't think so. I mean it might, you know, even slowly decay, but I think it's always gonna be around. I think no matter which size of firm you're looking at, as a person who's spent a lot of time doing all kinds of research, including AI research. you know, from for my own work, the one thing that's always gonna matter, or at least will matter for a while, that I think may always be durable is human judgment. Right. I'm still pretty surprised by how often even, you know, frontier AI and or you know agent tooling gives me back something that's wrong. Like, like, and for a person who has a really high quality bar, at least enough enough intuition to know like, hey, this isn't quite right. ⁓ I'm surprised at how often it's wrong. What like nothing will teach you nothing will be more eye-opening about how wrong these things can be when they go out and find my own research that I did on something and they'll reference like a strategy security post. And it'll recruit like like this happens with public companies all the time. That's like oddly, I I mean I've written about it. I've become sort of like a a semi-go-to person in aspects of that. Like I'll be doing public company research and it will return my own result back to me, not knowing that I wrote it, and I'll be like, ⁓ this was wrong. Or this is this is like outdated. It has changed. And I could really go back and I should really go back and clean that up. Or like, ⁓ it would have been nice to add this as well. You know, so it's it's stuff like that that makes you realize pretty quickly that like, yeah, these things are really good and they're fun and I love them and and I would use them all day long. But like you gotta have a human with some judgment on the other side of that or you're gonna go sideways pretty quick. Speaker 2: Have the new tools changed the way you work? Has it resulted in creating more work or has it resulted in doing much more impactful work for you? Speaker 1: I'm still working harder than ever. Like they definitely save time on a lot of things, but they, you know, don't save time on other things. I think the way that I would put it is like, you know, there were probably aspects of manual research gathering that I was doing at the beginning of this that like aren't really valuable for me to do. Like like like my unique judgment is not around gathering research. It's it's probably like steps after that. In some ways they've probably improved that, or like they can take a broader swipe faster and like I have also learned how to direct, you know, deep research to be able to to find things or or filter things that better than what I could have, you know, they would undirected. You know, so I think in that sense it's been really good. Or or that's that's taken away some work. But I I think the flip side of it is is is it's also opened up some possibilities that were never there before. Like there are some things that I would code or things that I would analyze or pieces that I would write now. A good example just to put a practical thing behind this is I did this piece at like when Doge was kind of kicking in and there were l a lot of concerns in the industry around, you know, funding cuts and what's gonna happen, you know, what's what like what's the trickle effect of that gonna be in cybersecurity. I realized that nobody had really unpacked like that entire funding tree and like how things flow down. And you look into that a little bit and it's like, ⁓ this is pretty complicated. And and it's it it actually like takes a little bit of thought to figure out what might happen there. And so I didn't really know a lot about this. I mean, I've worked like in the public sector a little bit. I would never consider myself to be an expert. I mean, certainly not at all like a Chris Hughes or somebody like that would be. You know, but I just realized, you know, hey, I think I could actually probably figure this out. It's just sort of a blood, sweat and tears thing where if I just, you know, pound on deep research for a couple of weeks, it'll probably give me back something pretty sensical. And you know, and it did. And so I did this entire like, you know, mapping of like where a lot of funding is coming from from different parts of the the federal government and you know, put out a fairly well regarded research product like, you know, but when Brian Krebs was chiming in on it, I was like, Okay, we did something here that you know that that that people thought was good. Speaker 2: So ⁓ so how do you know something has gone viral? Speaker 1: I mean, one example, like when Nikesharura chimes in on something that I've written, which has happened four or five times now. So it's you know, he's not afraid to engage with with anybody, including the independent people. I I will say I think I've got a pretty good batting average on that so far. I'm probably three for four or four for five on him chiming in and thanking me instead of him chiming in and trying to rip me apart. ⁓ but but that's what that's when you know, is when you've got, you know, when you've got like well known figures in the industry chiming. Speaker 2: And the one thing I like about one thing I like about your writing is you're not in this ⁓ ambulance chasing mode. There are there are two modes, at least from my the the way you break into my feed is one is one is you write about areas that you're you have competency in. So something in a way an area that you r know really well about and you are very methodical in choosing about writing about them. And second, the pieces that that come through my in my feed at least are when you don't know anything about it and you do a deep research. you go in like the doge thing. You you didn't know a lot about, but then you take the time, the blood, sweat and tears, and then you you go deep into that topic, write about, you know, and you add your spin to it, your analysis to it, your research to it, and then it then the end product really shines through. Speaker 1: Yeah, I have a pretty high bar for quality in general. I mean, that's something that I I've always held in high regard even Speaker 2: I mean, as an independent ⁓ writer you have to have a very high bar Speaker 1: bar. You don't have to. I mean a lot of what you see, I mean that's probably one of the things that, you know, if you were back to your criticism of like things have never been worse, right? Like anybody can write things on the internet now, Record and and they and they do sometimes. And so, you know, I think that that's strategically and and just personally, I mean again, this is this is a personality trait, not necessarily a strategy. It just triggered it translated into that. But like, you know, I think when you've been through the the PwC the P D B C boot camp, so to speak, you just you have a different appreciation for what like an extremely high level of quality is. And then I think I'm also, you know, my my mom would say that I'm a perfectionist. And so I think you put those two things together and like that's what I've always tried to do. And so that that that's probably a feature and a bug. I would say like what I write, you know, sometimes I get it wrong. I mean and I've been called on that before it happens. But like what I write, I try to produce at like a pretty high level of quality. But like The flip side of that is there's probably things that I should or could write about that I just don't either because I don't feel like I know enough about it just yet or you know, I just haven't had the time yet to put in the the research to be able to hit a point where I feel like I should write about it. That's what I'm trying to work on now is like, you know, can can AI, can experience, can like combination of several factors like get me to the place where I can increase the volume or increase increase the bread for like just a little bit, that I think that would be a good place. Speaker 2: Do you strive for a unique perspective? Like, you know, something like I don't know if you have read about the glass swing thing or the my thirst, you know, everyone has opinions. Everyone has like a lot of opinions when I when you see something like that blowing up, do you strive for a unique perspective? And if you have one, you come and write about it, or you just like leave it at that? If there is nothing new you can add to the conversation, you just leave it. Did does that play into your thinking as you're thinking to write about some of this? Speaker 1: That's what's something I debate every day with whether I whether I cover, you know, the news or whether I cover something that's a little bit more evergreen and durable. You know, I I mean the glasswing thing's a pretty good example, right? Like I that one I did decide that I was gonna chime in on. Sometimes I just will keep the bat on my shoulder or, you know, sit it out. But ⁓ you I don't want I don't wanna sit everything out either, right? I mean I don't think it's I I think there's times where I feel like I should chime in and people are expecting me to and they want my perspective and so I do feel some obligation to do that. But like There are other cases where it's like, hey, you know, there there are other people who are better off covering this one than me. You know, the the the Glasswing one is probably an example where it didn't work out very well. Like I I debated whether I should chime in at all. You know, I kind of convinced myself to do it. I ended up writing by my standard would be like a fairly mid analysis of it, or I think I took a little bit like the wrong approach of the marketing partnership aspect of it and and when you know, the the vibe of the industry was clearly against the marketing aspect of it and I should have known better and stuff. I didn't really get blasted, but it wasn't really a good post either from a performance standpoint. So, you know, I don't know. It it you just you gotta pick and choose and it's okay. Speaker 2: Again. One of the reasons you started strategy of security is to cover the commercial side of cybersecurity. You wanted to marry the commercial to the business and the tech side to bring in that complete analysis in strategy of security. So I want to switch gears into talking about the commercial realities of cybersecurity. My my question is like, what is some of the b biggest mistakes like early stage founders make when they're trying to navigate the cybersecurity ecosystem from your point of view? Speaker 1: Yeah, this is like somewhat drawing back to things I alluded to in the earlier part of the discussion around, you know, the ecosystem and like my own journey as a as a solopreneur, as an entrepreneur, like I see a lot of companies, right? I mean, my job is to sit here. Although I focus on some of the later stage, like I see a lot of companies, and especially in some of my client work, especially for MA, I look at a lot of companies. And so what worries me all the time is when I start to see a lot of companies in one space, just because it just because that seems to be like a space that either there was a reasonably successful exit and then people will say, ⁓ well, there can be another successful exit, or they take that as signal and, you know, then they want to do it. Or, you know, maybe worse yet is, hey, I'm not really a cybersecurity person, but cybersecurity seems like a really hot industry. I'm gonna go do a cybersecurity startup. ⁓ you know, I I think that's really hard. I mean, again, I think it's so hard to start a startup anyway. And I think that walking into it with things working against you, like, ⁓ I don't have that much domain knowledge, or hey, I worked in cybersecurity, but it was really like this one, you know, maybe I was an identity person, but I'm gonna go start a vulnerability management startup. Like you probably shouldn't. I mean, I'm sure there's cases where it's worked out that way. And it's not to say that you have to be an absolute insider to be able to to do this. But ⁓ I do think if it's just hey, I want to start a startup and then I'm gonna figure that out later, that's probably a tough way to Speaker 2: Do you do you see like an unhealthy pattern? You know, you you talked about this this the VCs backing the same types of companies in a category. Do you see that there is an unhealthy pattern where the the well funded VCs are jumping into the market, spending two dollars to gain one dollar? How does that how does that impact the cybersecurity market from the way you see it? Speaker 1: Yeah, I mean I definitely think there I don't even know what the term is. I mean there probably is a term and I'm probably not using the right one, but like blitz scaling for cybersecurity, right? Where it's just, you know, we're gonna I mean not to point fingers at Wiz, but like to to follow kind of a whiz like model or, you know, models from like other other parts of the tech ecosystem where it's you know, hey, there's there's this market that is gonna be really hot and like we're gonna just pour a ton of money into it and we're gonna go, you know, buy customers or, you know, even jump into like shady aspects of customer acquisition where, you know, I'm gonna buy them vacations or whatever it takes to be able to get a customer. I it's you know, can you win that way? Probably. You know, is it are you playing with fire? Yeah. I mean it I don't know. It just doesn't match my definition of like what a good, durable business is. And I I think that anytime that happens, it's definitely concerning. I mean again like you can probably get away with it, but is that healthy? I don't think so. I'm much more of a fan and I try to cover like companies that are very durable, like the One Passwords of the World that or companies like that who have, you know, gone through this very long journey, you know, to get to where they are. And that not that growing fast is the problem. I mean, there are companies that, you know, that just find fit right away and they do really well, right? But like I just think when you're trying to artificially do that by throwing money at the problem and like crossing boundaries, I think that's not good. Speaker 2: There are two ways to look at it. One is there is an influx of new companies trying to gain a market share, ride the AI wave and so on. And the second way to look at this is, and there is a lot of fear around this, there is a lot of fud around this. Well, all these I cybersecurity companies are going to die. Was the one narrative is the future is so good, you don't have to work anymore. ⁓ Elon Musk is you know, the work will be optional. Like work will be optional. And ⁓ and the second narrative is all these companies are going to die. you know, give the money back to the shareholders, you know, shut them down. Where do you land on these on on these two diverging ⁓ points of views? Speaker 1: Yeah, I mean I'm probably in this interesting position where like I've been doing this for long enough to, you know, not be a curmudgeon, but at least like remember what it was like or seen enough things to be skeptical. But then I'm also young enough where I'm like using all this stuff and like really optimistic about the future. And so it's an interesting existence. It's an interesting time to be alive for sure. ⁓ I'm definitely not I'm not in the camp at all of like AI is gonna kill these cybersecurity companies. I mean, like come on. Speaker 2: I not even crowd spike. Speaker 1: CrowdStrike's amazing business. Palo Alto Networks is an amazing business. You know, I I don't know. I mean there you know, there's life cycles of companies. I mean, the names may change, but like no, cybersecurity is the industry is not going away. I I mean, I think there are things that are gonna change. Like our businesses certainly have to adapt. You can even see on CrowdStrike. Like there were there were endpoint security companies before CrowdStrike, but CrowdStrike brought cybersecurity to the cloud, and that was kind of their, you know, core innovation or or you know, but like George Curse knew what he doing. Like that was very intentional. And he had been sitting there waiting for that opportunity for a while and built the company that he wanted to build. And you know, and it worked out. But like, you know, no AI is not gonna kill all these cybersecurity companies. Like, if you if you tie this back to a much, much broader trend, very long discussion short. Any era of technology that has happened, like you can follow Mary Meeker's pattern all the way through. You know, she's kind of the famous PC that characterizes these. these technology eras like and even even before what she would have covered, like, you you just see that security was always an afterthought. Right. And and sometimes it took decades for security to enter Speaker 2: I think AI security is an afterthought. Now everyone is thinking talking about GRC for AI, visibility into AI, what are these agents doing? Every aspect of that. I don't think security has been thought through and now everyone is thinking about security for AI as well. Speaker 1: Yeah, I mean I think they're I think the the cycle is getting tighter. Like you could probably make the argument a little bit more recently that like mobile kind of got addressed right away. There were really never like a huge exit in mobile that came out of that because they were it was a little bit tighter. You know, is is AI perfect in security? I mean, you know, no, like like Anthropic just had two self inflicted problems last week. You know, so there's there's definitely work to be done there and their incentives are still aligned towards Competing and building Frontier A and all of that. You know, so I would say they're a little bit more mindful of security than they ever have been, but like the the the surface area of that is also way wider too. I mean, there's just so there's so much more it and it's a much bigger shift of a paradigm that I think there's gonna be plenty. And and I think the l the last point on this too is like even if they do get good at security, right? Like you can kind of trace this back to even like cloud security or endpoint security or whatever, like Guess what? Microsoft eventually got into the endpoint security market and has a multi-billion dollar business there. Like all of the major cloud providers have cloud security businesses. Like by them getting in that market, did they just wipe out everybody else in, you know, that was like a pure play cybersecurity company in that space? No. Like they're gonna get their pound of flesh, but they're not gonna wipe everybody. Speaker 2: What class of companies will die because of AI? Wha what categories in in the sense like what would be the form of those companies that fail to innovate will, you know, die in the age of AI? Speaker 1: I'll give like a very like paradigm based answer on that, I think is the best the best prescriptive answer I can give there. Like I think if you just had a good SaaS company and then you just say, We're gonna leave it at that, right? Like we're not gonna we're not gonna really bake AI into the product, or if we do, it's gonna be pretty mid AI, like, yeah, our chatbot is super innovative. ⁓ you know, our co pilot is very innovative. Like Then I think you're probably in trouble, right? I think if you just kind of sit on what you did, ⁓ you know, or I don't know, maybe this will happen with some of the PE back companies that are trying to cut costs. But like I think if you don't really take AI seriously, if you don't have the imagination to think like what would be different about my product and what and how would my customers use it if I had, you know, a very advanced AI. This is kinda along Jason Lemkin like SASR thinking in this category that I thought I've always thought is really good of just, you know, you're probably better off trying to build You're f you're better off trying to build the best agent in your space within your existing company, within your existing customer base. Like that is a huge advantage versus like trying to start that from scratch. Of course, there will be companies who will be started from scratch. I hope yours is one of them that, you know, felt like it was better to be outside of the space that they were in and and the companies that are established there, like you've just got to be on the outside and rebuild from scratch. But I think that a lot of the companies in cybersecurity that do well are gonna like have a very serious reinvention and come out way better on Speaker 2: And then, you know, we talked about we talked about in a companies dying in AI. I'm also seeing a lot of careers dying in AI. So what do you think is the future what do you think is the future of cybersecurity professional in the age of AI? Speaker 1: I think it it it it it leads you to be a little bit more of a generalist, I think. I mean not that there's no room for specialists, but you know, I I'm sort of self reflecting here and answering my own, you know, career evol evolution in some ways. Like, you know, I've just always been a generalist. I'm just I'm just I I d I I I'm interested in a lot of things in cybersecurity. I have some domain expertise, you know, but I also I'm interested in things outside of that or at least like broader tech and business and strategy and so you know, feel like I've never been better. Like I've never had more fun doing what I'm doing. Like I just thoroughly enjoy this. And I've probably never done better work. And I hope that it continues to get better because of AI, right? But it's it's been like a very serious reinvention, you know, even dating back to like when I, you know, when I started this and reflecting and then, you know, and then what AI has allowed me to do since then. Like y you just get you kind of have to keep reinventing yourself. I mean, I I don't mean to sound like trite about that, but I think that it's if you just kind of accept the reality of like this this this frontier AI is gonna keep getting better and like the tools are gonna change week by week and I'm just gonna have to continuously reinvent who I am and what I do as a professional, like you're gonna do great. Like like you're getting you get more leverage by the week. Like like like everything just keeps getting better. Like what you can do more is better. What you don't like you can get rid of. Like it's just it's an easy existence. But I think if U un unfortunately from my point of view anyway, like we do have this camp in the industry of like AI is terrible and I d it should go away and it needs to be regulated and I'm not gonna use it and like it's completely useless. And like I I don't know about that either. Like there's you know, there's been some I there's been enough tech trends that I've lived through that like, okay, yeah, this was a nothing burger and they really were pretty useless, or at least they didn't match the hype. Like if you use if you use Frontier AI and agents for like twenty four hours And you don't see how this makes the world meaningfully different. I don't know what you're doing. It's so much fun. It changed it's like my work is different since January twenty twenty sixth. I've completely reinvented the way that I work. And and and I probably reinvented it like before that, right? Speaker 2: How what changed in January twenty twenty six? Speaker 1: I don't do anything without an agent anymore. Like almost nothing. What Speaker 2: Your what's your go to agent? Speaker 1: It's i I kind of like have open claw plus at this point. Like you could look at that as like an aggregator of several different tools underneath that, you know, so that being like coding agents and, you know, perplexity computer turns out to be really cool. Like that does some good research and just you know, it you kind of have to insulate yourself against that, right? Like on one hand, some of the you know, some like clawed code has been my go to for a long time. Like I really like that as a as a tool and it's a really good one. But like There's always new stuff that comes out too. And so you you know, without having to like reinvent your stack all the time, it was nice to be able to have this like aggregation layer that at least allows me some level of consistency, but then, you know, be able to try and like swamp different parts underneath it as well. Speaker 2: Super interesting. Cole, this has been an amazing, amazing interview. You're way too generous with your time. Your insights are fascinating. What's ⁓ what's next for Cole? What's the next big thing that is dropping from Cole Grohlmas? Speaker 1: sleep. ⁓ defin definitely the the next big thing will be much more thought out because I will have slept much better because the baby is closer to making it through the the night. But no, I mean I'm sorta serious about that. That definitely that definitely would help my cause. But you know, I I mean I think it's again I think it I think it's like an amazing time to be alive like I've been gushing about here. Like I have never had more fun at work and I've been doing tech for fun since I was like twelve or younger. You know, I just I think never been a better time to be doing this, albeit in like a terrifying era. I think we're also in an era that we're all gonna reflect very fondly on and be like, Wow, this was like a really amazing time to be to be working in and I try to appreciate that. Like again, I've done this long enough that I think I remember what it was like before then. My kids are just gonna take this for granted and they're never gonna realize the era that you know that that we grew up in. You know, so I'm trying to enjoy it and I'm trying to but I'm also hopeful like that I have a long time to be able to continue. Speaker 2: Awesome, awesome. Cole, thank you for joining me on the series. This was an amazing interview. Let's check back in in a year from now and see how much you've progressed with your EI agents. Speaker 1: Yeah. Well, thank you. Speaker 2: Thank you.