Cybersecurity for Entrepreneurs - Simplifying Cyber

Welcome back, or welcome for first-time guests, to Simplifying Cyber. This is a new format for us, a little bit of a living room style in person. No more Zoom. We might, we might be online from time to time, but we are really big here about having in-person experiences and really leveraging other people's experience to learn and grow together. So we're Excited to have a couple really longtime friends and colleagues. We all worked together at Lilly, but I'll let Katie and then Laura introduce yourself and then we'll get into our topics of— we're going to cover starting new businesses and questions you guys have about cybersecurity in the early days. And we're going to tap into both of their experience to learn a little bit more about M&A deals and payer deals and cybersecurity related to the healthcare markets that you guys have supported for so long. So I'm excited for the conversation. And without further ado, Katie, if you want to give us your story.

Sure. Well, thank you guys for having me. It's really a pleasure to be here. And since starting my business, I've learned a lot from you three on cybersecurity and all things, right, technology related. Um, so I started BioVenture Advisors in January, uh, after 25 years at Lilly, the first 15 years on the commercial side of the organization.

You made it a quarter century. I was there 17, but that's a momentous achievement.

Thank you. It's a long time to be at one company. Yes. So yeah. And then the last 10 years I was in corporate business development doing transactions of all types with venture funds or biotechnology companies or other platforms that would be helpful in biopharmaceutical development, manufacturing, and then commercialization. So now at BioVenture Advisors, we provide advisory and negotiation services to biotech companies and venture funds who are interested in doing a deal with, you know, a collaboration partner, in-licensing, out-licensing, mergers and acquisitions, really any type of transaction.

If you want a deal, call Katie. And I'm going to put you on the spot with a personal question. What is one fun fact that people that know Katie might not know about you that, or people that don't know Katie can learn about you?

One fun fact. So my, I'll give you a couple. I'm a mother of two. I have two teenagers. I'm a black belt in taekwondo.

Don't mess around with Katie.

And I, in my free time, enjoy power paragliding. Wow.

I'm going to have to follow up with you offline on that one. That sounds pretty awesome. I did not know that. All right, Laura.

Hi, everybody. Laura Vyaches. Thanks so much for the invitation to be here today. I'm president and founder of Endeavor Pharma Solutions, a boutique pharmaceutical market access consulting firm. Like Katie, I spent over 2 decades at Eli Lilly and Company, the vast majority of that in their market access division. I have now transitioned into entrepreneurship and I work with a range of clients. I work with pharmaceutical clients that are anywhere on the development spectrum. So I have some clients that just have an idea and they're looking to get venture funding to get that idea into clinic. I have clients that have assets in Phase 3 of development, clients that are getting ready for launch, and clients that have products already on the market. The idea behind my business is, is when it comes to pharmaceutical market access strategy, it's never too early to start. Never too late to improve. And that's exactly what I do, is I help my clients with their strategy development, or I pressure test the ideas that are already in place, looking for opportunities to improve, and basically act as a technical thought partner, uh, in this very complicated world of pharmaceutical market access. I also work with companies that have complementary products and services to pharmaceuticals and help them with their market access challenges. And lastly, I work with venture capital private equity firms either to assist with the valuation of companies or, to the extent they already have investments in place, help them work with the management team to drive to profitability. A little bit, uh, about me outside of work: I'm married, I have two kids, I enjoy traveling the world. I've been to over 50 countries and added a few to the list this year, so that was really exciting. And I've just really enjoyed this transition from corporate America into entrepreneurship and the chance to meet new people, learn new things, and consider myself a lifetime learner. And when it comes to things like cybersecurity, I'm excited to learn more today. So again, thank you so much for the invite.

We're looking forward to— and I, you know, it's been 7 years of you guys watching me and us have so much fun, and you had the FOMO and had to join the entrepreneurial crowd. So speaking of that, let's start with the entrepreneurial jump and journey. And you start a business, there's so many things to focus on to get your first deal and infrastructure put in place and internet. Maybe Todd might have got a few calls on getting some things set up, right? But, um, but give us kind of that, that 30-60-90 view of kind of what you were focused on, nervous about, and then kind of if at all cyber was on your mind, even if it was for got to worry about that in the future.

Yeah, I think, and we took different approaches, so I think it's a great way to start. Uh, so I chose to go into a little bit of stealth mode for the first 2 months and build that back office infrastructure, which gave me time to at least start along the learning journey because I had to get a website in place, email, accounting, all those things behind the scenes. And so that was important to me to get that work done before I went out and actively started marketing my firm. I'm glad I did that because it was way more complicated than I expected. I did find some of the AI tools to be very helpful. I'm a big fan of Claude by Anthropic, and so that helped a lot because you really become the CIO immediately. There is no help desk to call. And so at the same time, it was a very rewarding learning journey too, because there were things that I just never fully appreciated the difficulty that now I know how to do. I know how to problem solve some of the tech challenges that I come into, but I'm glad I took the move that I did because it, it was a full work week to get those things in place. Before I went live with my business. But I know Katie, your business got off to a very quick start.

Well, let me guess, Katie, did you have 3 statements of work before you even had a domain name?

Yes, yes, I did.

Well, call it the virtual street cred. You know, you're like, it's like, do you have a website? Check. Email? Check.

A lot of the companies I'd worked with, once they heard I was leaving Lilly, they were interested in continuing to work with me because they needed to do—

they had experience—

deals. I was fortunate that Laura had a head start, so I relied very heavily on Laura and her learnings. If not for her, I don't know.

So you're just copying off her paper?

Well, she got the domain name first.

Work smarter, not harder.

Yes, agreed. But I find now that I'm playing catch-up, which is where you and your team have been invaluable as I have hit these challenges, having you as friends and collaborators. But I know a lot of small companies don't have the network.

We'll get into it with like IP protection later. But when you mentioned smarter, not harder, like, heard a quote like there's really very few new ideas. And I think I like to think about benchmarking, like there's a legitimate way to borrow things from others. And then as we get into the later conversation about intellectual property and pharma and there's, you know, the theft side of it, what's that balance for you guys? Like, especially maybe Katie from a deal standpoint, like, where is borrowing ideas from maybe something you've seen and where is the, hey, we have an NDA and we can't necessarily take that?

Yeah, well, I think, you know, in the biotech space, the research data and the intellectual property of these companies is their most valuable asset. So if I'm going to be receiving that information, I have to keep it in a secure manner and have the internal processes in place to document that I'm doing that. I am building that, right, on a case-by-case basis as we go, and every day it gets a little easier. But when I started, there's nowhere— you can't Google it, and there's no easy cheat sheet for how do you do it the right way, right? Smarter.

And you go into Google, it's going to give you a lot of products, a lot of things that don't necessarily make sense.

Yes, I think that's where having, you know, friends like you who can answer quick questions— and I don't need you to necessarily do all the work for me, but point me in the right direction. I think that's what was most helpful is at least starting down the right path. I went down a couple wrong paths initially. We won't name names of companies that were not easy to work with, but yeah, every day we get a little bit better.

Excellent.

That'd be a cheap move to name the name online.

Very cheap move, yes.

I am kind of curious, as you're starting to work with these companies, what are some of the questions are they starting to ask you? Are they starting to raise questions around, hey, how are you keeping my data secure? Or what are some of the examples that, that have been thrown at you from your partners and your customers?

I'd say if anything, I'm more surprised that that's not a question that they're asking, which raises a bit of a red flag for me. A lot of these individuals that I'm working with, I have known for a long time, and so they trust me personally, but there's rarely an audit done on my cybersecurity practices. And as these companies go to do larger transactions or, right, investors are going to put tens of millions of dollars into these companies, they're going to have to have some kind of process, right, in place and documentation to support it or they won't get the funding. So I think that's a huge area of opportunity. Again, if you start with the end in mind and build slowly, you can get—

get a few of the basics—

sizable infrastructure in place without a lot of capital invested when you don't have it.

So, so early on, you're building your services, you've got a website, you've got customer relationships, you probably start to get some data and put it into whether Microsoft or, you know, a structured business repository. But what, what, what if anything keeps you up at night right now about ransomware or any kind of, you know, manipulate, you know, a fake deal that's not real, or like you think about hiring people and you're hearing about deepfake people that are actually North Korean individuals that are getting these jobs in the US. Like what, at your scale at this moment, what concerns you at this moment?

So, you know, I think one of the biggest challenges I've found is you're working with a lot of different software platforms because you're calling into clients. And so, you know, just start high-level examples. Some work with Zoom, some work with Google Meet, some work with Teams. So I find myself a lot of times you're getting onto a call and having concerns getting into the meeting, there's time pressure, et cetera. And so one of the best cybersecurity defenses I always thought was, does this look normal to me? Or does this, some person you haven't heard of saying, click this link, it's in my, that doesn't look normal. So, you know.

You're giving yourself the, like, Don't fall into the fear of the reaction.

Yeah. And so, but when you're working with a bunch of different companies, you're working with many different platforms, many different people, etc. And so that expands. And so that maybe, you know, I've forced myself to just have a heightened awareness of like, okay, does this make sense before I click this link, etc.? You know, that's been one of the early challenges is I've had just to acquaint myself with a lot of different platforms. Every email I get is an external email from the client because I am the only employee of my firm.

It's a big shift from coming from corporate, right?

And so that was probably one of the early challenges. And, you know, and with that comes connectivity issues as you're signing into different instances, going through Microsoft Authenticator with different emails. I mean, there's just a lot of new things very quickly. And again, my area of expertise is pharmaceutical market access. It's not IT. I've had to quickly educate myself and continue to do so every day to be prepared to do my job because those are the platforms on which I do my work.

So for new entrepreneurs, or if you're in a new venture, beyond calling Todd, which is— or phoning a friend, I was going to say phoning a friend, which means calling Todd, Katie. How else do you guys learn? Like online? Have you invested in any kind of training program? Like, how are you learning both the technology side of kind of not having a dedicated IT staff for the first time in 25 years, uh, and then just on the cyber front, some of the risks you talk about? Like, how are you educating yourselves?

It's a lot of work right now. I think I have 8 different email addresses because each client I work with, right, I have an email address for that client. They all have their own file server system where they store information. So You know, when I click send on an email, I have to make sure I select the right—

You're hopping, account hopping.

Yeah, but again, it's a lot of information to keep straight just to send basic day-to-day communication. So I've had to build, right, the discipline to stop and slow down and double-check these things. But as science moves fast and deals move fast, that's where I have concern is that people with all good intentions trying to move fast, it's really easy if you don't have your information appropriately stored, attaching the wrong file to the wrong email and it goes out. And if it's— that's right.

Is it, is it fair to assume, and I've seen and been part of examples like in an M&A deal, mergers and acquisition, you've got your data rooms, you've got your systems. My guess is that the most common breach of a deal is an inadvertent human mistake of copying the wrong person from the wrong client. Have you seen that in the industry where, you know, where it's a human mistake because they haven't built the, you know, the mechanics and the, you know, slowing down and it's just an accident? Is that the biggest risk that you see or is it—

I don't know that there's one biggest risk. I mean, last week was, you know, the BIO conference, the biggest partnering conference of the year. And there were two companies who were doing large M&A transactions and the data was leaked a couple of days before the transactions closed. And picked up by Financial Times. So it can be as easy as just a conversation someone overhears in the hallway, right? Or throughout the process of due diligence.

Were there any specific, like, was that an insider leak? Was that an inadvertent? Was there anything to the story there?

It's unknowable at this point right now.

So guess is the best.

I've been on certain routes on planes where, you know, a lot of deals are happening for certain industries. You get on the plane and you see the folks on a regular basis. And I've sat there and I've listened. I'm like, that's a deal that hasn't happened. I should not be hearing this conversation. But it's openly discussed.

So the cost for learning of a deal is $300 to $500 on Southwest from Tuesday at—

Yep.

And they're wearing shirts saying, I'm making a deal. Don't talk to me.

Cone of silence.

Let it go.

But I think a lot, you know, a lot of the concerns I hear from biotechs as they're working with, you know, big pharmaceutical companies, it's that the company will take their information and use it inappropriately. By having a data room where you can track who downloads information, who looked at it for how long, you have a record of who's seen your confidential information, right? And then having that data can be really helpful if a couple years down the road the company you're working with just happens to coincidentally launch a product that looks very similar to yours without having those kind of records, it's really hard to demonstrate that there's been anything done wrong, especially, right? Intellectual property protection is evolving on the tech side. It's pretty clear on the product side for pharmaceuticals, but on the technology side, there's still a lot that needs to be sorted out.

So when you're working with clients too, I'm sure this comes up at some point, but like When typically do you see them raise a flag like, I need to have more focus here? Because I'm sure part of it's just we got to survive, right? We have things we got to survive and get off the ground. But usually when did they start? When do you see in the deal and they're saying like, we should revisit this, we should figure out our strategy for this?

Usually when that is necessary for them to take the next step. It is rarely a thought about in advance of being needed. Yeah.

So incident-driven or customer or client-driven or diligence-driven.

Okay.

That's very, it feels very reactive, I guess.

No, there's a handful of companies I work with who have COOs who are very experienced and have done this before, and you can tell a marked difference in how they've set up their internal systems. You can tell really quickly if they have any experience at all or, you know, little to no experience.

Well, and on that, like an experienced COO that it's not their first rodeo, that they know that this is going to bite them at the wrong side, like from some of our clients that are kind of emerging companies or high-growth companies, the ones that are the toughest to manage. I mean, they're high-dollar for us, so I don't hate the opportunity, but they've waited to the very last minute and they either have a breach that's put some extra pressure or more likely one of their customers is like, we are not going to move forward with this deal or we're going to pull the deal. If you don't have a SOC 2 or ISO or one of the certifications. And the worst thing that a company can do, the most expensive way to do it is by bringing a team like ours or whoever in to throw a Hail Mary, you know, 90 yards.

In the final hour.

In the final hour.

Well, and that's not something you want to be negotiating. If you've built it the right way all along, you have the infrastructure in place. If you're doing it under duress on a really short timeline.

And it's not sustainable, right? Like, so the companies we've done this, it's like we're back the next year trying to replumb it back together.

Which isn't bad for your business. Business.

But again, it's not bad, but I would rather have a relationship where we're building it over 3 years than like everything at once in a big bang, and then we're fixing it because there's a lot of churn, there's a lot of pain for both the organization. And then at that point, cyber is seen as an impediment because you got to do it all at once. So like stepwise approach, like I would advocate for that if founders and growth company leaders can kind You know, start early and make easy bets that don't have to be something bigger than they need. I have a hunch it's 10x the cost to do it at the last minute.

It's probably more than that, right? Because then you're responding to their request to build something. And if you're working with a really large company, they're going to have really high standards. And if you're a 20-person biotech burning through your Series A funding, you don't have the capital for an enterprise-wide cybersecurity program, and if you're responding to a request and you have to meet, right, clear the bar that they give you, it's better to have some foundation to say we're close and have the dialogue there around, well, help us understand what minor incremental changes might need to be made to a stable foundation versus start from scratch and build it in 2 weeks so you can close the deal.

Because it's so hard because you think about it a lot of times, like, writing a policy or process, not a high hill to climb or to overcome. Operationalizing that within a company is where, so to your point of like the Hail Mary, yeah, you can churn out 10, 15 processes to satisfy compliance framework and then yes, but then to get that operationalized and now I have this small company trying to do all these processes in parallel with my, yeah, it's such a tough thing. And I have a lot of friends in the NDVC market and a lot of their, some of their seed companies that are like build, build, build and the culture's very laid back and they want to grow and then they get their first deal even before diligence, they'll get through signing and then Later on, they're looking and say, well, hold on, we just attested we need to have this certification, something like, what does this mean? And they go back to the board or to the well and say, oh man, we got to figure out how to get this compliance with. Now we are obligated contractually to have this attestation certification.

So let's transition the conversation. We've asked a lot of questions of you of kind of your first, you know, 30, 60, 90 and some of the M&A stuff. We'll get back into that in a bit. But let's turn the tables and let you guys ask us questions. You are where you are now. How can we be of— how can we take 60 years of cyber experience and help you and some of the listeners that might have businesses or they're part of companies that are in similar stages?

So yeah, I'll go ahead and start. So one of the questions I have is what are some of those ideas that are low investment but high impact that small business owners can do in terms of cybersecurity? So things like SharePoint sites, etc. But I'm particularly interested in now that AI has become so prevalent in daily work, how should small business entrepreneurs think about how they use AI in terms of cybersecurity and keeping their own intellectual property safe, along with their clients' intellectual property safe?

So I'll start with a fun/scary story of what not to do. And then, Todd, I think you've got some examples that I know you're already cooking up.

Oh, this doesn't sound good.

So I was at a founders event. It was like a breakfast event and there were about 20 founders there and we were having kind of casual conversations outside of the main event. And one of the CEOs was, we were talking about AI. He's like, I was the only cyber founder I think that was in the discussion. So we were having a little bit of a cyber conversation. He's like, Aaron, you're gonna be impressed with me. AI has been transformational. I get a lot of requests from my bigger clients that are Fortune 1000, Fortune 500 about my cyber program. I clearly don't have one. So what I've found to do is I insert a prompt into ChatGPT and ask it to fill out the questionnaire that the company has given me with answers that are reasonable enough to pass, but not overstating what we would have. My face kind of went white and I'm like, that's not a strategy, right? Like, it's probably fraud. Like, it is fraud. And it only takes one audit or a follow-up question or whatnot. So to me, the thing not to do is let's have AI generate the answers to the test that are right without doing the homework and taking the course. And there's things like, back to the what can you do in small increments, they shouldn't be representing their, they've arrived in a 3-year mature program. They should be saying to your point, like, you're not looking for perfect when you're evaluating these deals or customers. You're looking for, hey, they're small, they're doing, they're taking some good steps. We don't expect them to be, you know, an Eli Lilly-sized cybersecurity program. So that's what not to do. But Todd, you've probably got some examples of the kind of the starting blocks. Of what to do.

So a lot of the tools and the things that are out there for security have been catered to large companies that have large budgets out there. I will say AI is starting to shrink that. I wouldn't say they're down to the one-person level, but they're usually— if you call them, they'll usually give you access to some of these, just endpoint monitoring. And the companies you're working with, they really— they care about their data. Where's it going? Can you tell me where is it going? And is anybody watching what's going on behind the scenes? Those two questions, if you can answer those, I think start to move the needle forward. If you do get questions, you can answer it and they'll probably move along because they know you're a small consulting org and they're not going to dig in and say, hey, I need a SOC 2 or I need to see your ISO certification.

They'll probably ask you.

They might ask.

But having an expert that can help you navigate that, like I guarantee that both of you from a customer will have a request. Do you have a SOC 2 or an ISO? And the right answer isn't always, because Cody, you've helped some firms spend $500,000 put in for a 30-person company to put in a SOC 2. And while that may be the answer for a specific business, there's probably a more minimum viable product way to show that you have that support and right-size it. Because SOC 2 was really invented for cloud and software companies to attest that they're solution is solid. It's not a ubiquitous one-size-fits-all to validate a boutique consulting company.

But tell me about some of the best practices, you know. So for example, I prefer to set up a SharePoint site with clients that's on their, you know, their instance that I can access, and when I'm done working with that firm, they can remove my access. I never download the material. Things like that, things like double-checking your emails before you send them, kind of the ounce of prevention is worth a pound of cure. You know, tell me also about AI. So for example, I never put any client information into AI, even if I'm like trying to develop a contract. I might say things like my client or my company without using names, etc. Tell me other things you've seen, because these are things that like cost nothing but are high impact.

So let's start with kind of, and I'll let Cody and Todd, their expertise is, you know, grew up in the infrastructure and SharePoint and Microsoft and all that, but Let's start before we jump to AI of like foundational basics. And I'll start with like, Laura, the fact that you're coming up with a strategy, even if it's not written down on paper, to say my go-to is to work in the client environment. I'm not going to do data transfer. I'm not going to do data storage. I won't have to worry about it. That is the cleanest and safest way to start. But that doesn't mean that they're not going to email you something and all that. Kind of from a setup standpoint, the basics. Let's, let's start there.

I was going to say, like, you know, assess yourself before you wreck yourself. And I think, like, really, it's 3 questions I always say, like, what are your critical assets, where are they located, and who has access to them? Those are 3, like, non-technical questions that you can kind of thought there. And then, and then from there, it's like, go the critical assets. You can't do it all. So to your point about, like, okay, client data, top of the tier, most important. So I can either take on the responsibility of owning myself or not my choice right now, I'd rather use a client environment. So I think that again is like how you handle the sensitive, what data is the most protected and then start there. And then that, 'cause then you kind of follow the money and then from there kind of branch out to the nice to haves. But a lot of it's education, how you handle things. And it's that piece of just saying, okay, this is where I gotta focus. I can be a little more lax on this stuff 'cause it's not as important, but you can't be the max 10 focus on everything. It's just, it's not possible. And especially if you do, it's like you have like cement shoes on, you can't move fast. And to your point earlier, It's a very fast-paced thing. Speed is key.

Yeah.

No, and you hit a couple points. I mean, AI can come into pieces of these, but keep the data in the client environment, right? You've got that covered. You talked about Authenticator. You've already jumped through that hoop of turning on the MFA.

What if you can't keep it in the client environment?

So I think that next question is, where are you going to keep it? My answer is try to put it in some sort of cloud repository. Because if you end up with, I've got a lot of client information on a laptop, This happens all the time. We've dealt with this. Laptops get lost, they get stolen, they break, and you're stuck, and now you're trying to get somebody to recover data. That is very expensive. Best you can, make that laptop disposable so you can work anywhere, anytime, and your information is in some— whether it's Box, SharePoint, doesn't really matter. That simplifies the process.

So a lot of businesses start with— maybe they have a personal Microsoft License, tenant license, even if you don't even know what a tenant is, environment. And then a lot of times, let's keep it cheap. So like the business essentials, a lot of companies early on, they've bought something through GoDaddy and they resell Microsoft licenses. So both of you guys, Cody, CTO at an MSP in a prior life, and Todd setting up a lot of kind of startup type businesses within a larger company. Knowing that sometimes you start in these lower tiers, and this is not a Microsoft commercial, like how do they navigate? Like they're probably not jumping all the way to the top tier enterprise version, but like how do you make those choices to understand what kind of SharePoint controls you might put in place if you can't stay in the client environment all the time, which is never possible?

Yeah, we just spent some time with somebody else doing this, that default, the low tier one is great for storing the information, but it has no effective monitoring of what's happening. You're blind. So if something does happen, you don't have a place to go back and look. There is a tier up in the Microsoft side that's pretty easy to go up. I think it's somewhere in the $20, $21 a month. It gives you some basic monitoring. It'll start to alert you if there's issues, and it'll start to close things down behind the scenes, wrapping around your identity. That's a really easy one to step up to without having to go shopping for a whole lot of tools. You turn that on, it's got some AI behind the scenes that's just doing it. I mean, we love, it's easy to make fun of Microsoft and grumble about all their tools and things like that, but they've got a pretty nice offering where it just almost becomes a checkbox, turn a few features on, it's protecting the phishing links that are coming in, it's watching for those things.

And a good example would probably be like if you've had some of those basic controls put in place, a passport number or a credit card if it's in a Word doc, you might have seen if this is on in your environment, you might see an alert like that. It either stops it or alerts you like, hey, this just went out. So some of that's called data loss prevention. It's a basic version of that around privacy data. But those are the types of things, especially Katie, in your business, probably everyone here's business of like the inadvertent things that you might not be able to prevent yourself from that one day when you're in a rush making a quick mistake. Most of those mistakes are recoverable and, you know, good humans working with each other to rectify. But yeah, I think there's some basics that can be explored.

I think also too, looking at like those foundational processes, the first part is define success because the tools I think are like almost like an airplane cockpit. There's 1,000 buttons you can turn on. And to your point, how do I know which ones are relevant to me right now? Like they all look kind of cool. And then if you kind of walk in without like a success criteria, then you start like turn things on because it sounds great, and then next thing you know, it's like I just lost a lot of time and may have locked myself out of my own environment. So I think like process, when you're a smaller company and there's less people, then your automation enforcement is easier because there's 5 people. If you're dispersed and you've got, you know, 20, 40, 50 now in different states, that's when you want to lean more on the technology because you need to have that extra like automation enforcement behind the scenes. So define like the process first. Hey, if we handle this data, We use these tools. This is how we're going to do it. We're going to recommend to do, or require MFA. As you get larger, you can't just shout that to the person next to you or text that person. Now you look at the tech, okay, what can the tool enforce when I'm not around? And that's kind of how I kind of back into it is like, what is my man hours going into enforcing this process? But the first thing is to find that control or process of what our company policy is and then look at like, okay, these tools can either enable that or speed it up. I always say you walk into the tool first without like a success criteria, it's like going to the grocery store hungry. If I go to Costco without an idea, I'm walking out a broke man. But if I have like, okay, I'm getting 40 ounces of peanut butter, which is not right, I hate peanut butter, but then I walk in and no one—

Dose of tomatoes on top of it. Absolutely. Then you're gonna wreck yourself. Speaking of assessing yourself before you wreck yourself, Cody, you kind of mentioned understanding what's most sensitive and focusing on that. So kind of early on in your business, you're obviously adding a lot of different client types. Would you each be— and we don't have to rattle through the answers here, but would you each be able to say like, what are the top 5 information types that would be most sensitive, either within the customers you're working with or the IP that you're developing within your company, your secret sauce, your strategies? You know, could you write that down in less than 2 minutes, or has that been something you've given thought? Okay, good. Good. And you guys came from a company that did that. So I— yeah, awesome.

Yeah. And a lot of credit there too. I mean, we got great training in cybersecurity and, you know, different exercises to keep those skills sharp. And, you know, I appreciate that. It's important, you know, whatever environment you're in, whether you're a consumer with your own data or whether you're a company. I appreciate that training.

And I think it's the founders that haven't worked in a large multinational corporation just don't know. They don't know what they don't know if they haven't been in that environment and seen what good looks like.

This is none of our first rodeos, right? Like, we're not the skateboard, you know, hover around riding through the hallway type startups here, right? Like, we've seen what can go wrong and how to do it from a solid standpoint.

One other piece that has kept me up at night, and it's around the angle of AI is a lot of these programs now are keeping meeting minutes and records of things that were talked about that historically weren't documented, and those documents are discoverable, and you don't want those documents to be stored longer than by law, right? Perhaps you want them. So I guess is there, there's the problem of when your data is leaked, How would you advise small businesses to, right?

Yeah.

Don't keep your receipts that are 25 years old, maybe. What's that right balance of how do I know how long to keep things and where do I store them? And then how do I systematically purge the information I don't want to retain?

It's a timely, timely, timely thing. This is a very common thing we see now. Like the big, the big buzzword is like records information management is like what the enterprise thing. And that's to your point, it's like, how long do I keep data? What's our policy? And then to your other point of like, what's my requirement? Because once I don't need it, purge it because you're subpoenaed or things are right to defend. And there's a mixed bag there. Sometimes you're required by certain frameworks on what data you have. You have to hold certain things. And then again, I go back to the process. What do you have to do first with the process? Operations is that process. And at some point technology can help to enable that. But again, it kind of goes back to like what I have to do first and where that balance is. We always say like, that's not, legal advice. That's something we can't advise on. We can help to enforce or help, you know, build an efficient policy for how big you are that's realistic. But it's a very common thing. People think, I want to keep everything forever. Could be great in some industries, other industries, if you're like in manufacturing or especially in like the IP and bio side, keeping things isn't necessarily always the best idea. But how do I kind of go through and purge?

And it's, I would encourage if you're concerned about it, it's okay. I've been in a lot of meetings where those AI agents pop up and like, hey, I, I think this is a fairly confidential meeting. Can we turn that off? And usually, more often than not, what I've gotten is, yeah, I've been struggling to turn that thing on. It keeps popping up, it keeps popping in. Can— let me, let me turn that off.

Here's the scary thing, that, that technology has been so consumerized. You can find it on apps, you can find it on, you know, little wrist strap devices that you can wear and record in live meetings. The world has changed in how easy and accessible that is and how quickly it can summarize a lot of information into meaningful, usable elements, which is super helpful.

That's the good use.

We use it and we have a defined policy of how to, how and when we will use it so we don't accidentally abuse that trust of a client or a prospect or whatnot. But my most concerning thing is there's so many of them out there and some are good and safe and have controls and some, who knows where the data is hosted in some cloud in another country and they're just on the App Store because they passed Apple's test of basic security, app security, not their data practices on the backend. So I think using a trusted, if you're in Microsoft, pay for Microsoft Copilot. If you're in a Google environment, like there's some good other third-party or app tools, but like you need to vet those. And if you don't know how to vet them, like obviously leverage an expert that kind of maybe, yeah, call Todd.

I will say this is a number of years ago, but it wasn't that long. One of the larger communications firms that did a lot of the telepresence stuff, I was on the phone, I was trying to vet their product, and it's like, hey, you allow people to share information like upload documents during chat and during these meeting sessions. You know, where does that go? Can you share that securely? And their CISO was on the phone. He's like, actually, I wouldn't share anything confidential. He goes, the video, the audio, we've got that secure, but we're a year away from where the storage where those attachments go is secure. I would not use that, at least for not another year.

That's good to know.

And that, so just asking that question, they were very transparent going, yeah, I wouldn't do that just yet.

That goes back to our policy of like, what's your company procedure and policy? Sometimes small firms will say, hey, I see the recording's on here. Can you please turn it off? We know we're not, because I'm not sure what will be discussed, or you can err on the side, or maybe to your point about the confidentiality, hey, See, this is confidential. For our set process and policy, this is where we're going. And this data room, we're going to store it here, or SharePoint. So that begins with knowing that process first and that procedure, and then technology can turn those things on. But—

and I think we're at time now. So I think—

yeah, maybe one wrap-up question just to roll it. Advice for your fellow entrepreneurs, what is one thing walking out of here that you'd recommend to the audience of simplifying cyber and taking some initial steps to get better from where they're at?

So I would say, you know, if you're a small business entrepreneur, you are the CIO and you are the CISO. And it's your responsibility to learn about the tools out there, learn about the risks out there, take it seriously just as you would any other aspect of your business, like marketing, sales, accounting, et cetera. Because if you understand it, it's a great opportunity and a source of competitive differentiation. If you don't understand it, you're at risk.

Great point.

Yeah, and I'd say along those lines, if you don't want to build the technical capabilities to do the day-to-day administration, you can call people like Todd who will, right, help you set up the system so that you can't break it. But I agree, if you don't understand it and set those guidelines for your organization, you're going to find yourself in a really tough position.

1-900-GET-TODD. Oh, that works.

I feel like we're going to put Todd's phone number in the show notes.

Thanks everyone for coming. This was a fun conversation.

Thank you. Appreciate it.