Jay Kaplan: Crowdsourcing Cybersecurity [Entire Talk]

Tina, thank you so much. It's great to be here. This is the last lecture I understand of the semester and usually save the best for last, so thank you for that honor. So I'm going to start off today. You're going to learn a lot. You're going to all be expert computer hackers by the end of this presentation. You are going to learn a little bit about cybersecurity, and you're obviously going to learn about our story and what SYNACK does and how our company evolved over the years. But before we get started, I want to tell you a little bit of a story of my own. Back in February 3, 2013, I was woken up in the middle of the night. It was about 2am and my boss gives me a call on the phone and she says, jay, you've got to get to the NSA now. Operation Unicorn is a go. What's Operation Unicorn? Well, she can't tell me over the phone because everything's classified, right? But I put on my clothes, I jump in my car, I go up 295North, about 25 minutes north of Washington, D.C. and go into the front gates of the NSA, run into the Research and Engineering building, which is the building I worked in at the time. I sit down at a computer station, start looking at the notes. I say, yeah, you're right. Operation Unicorn is a go. I pull up a chair. We have other operators working on the project. And I actually can't tell you anything else. Sorry, I might have to kill you. But what I can tell you is that, and I'm sure you're seeing this every single day, cybersecurity is a really big problem today. Company after company is getting compromised, getting breached. You hear about the target breach. You hear about the anthem breach. You hear about Sony, JPMorgan Chase. You're hearing lately about these hospitals who are getting hacked. And then hackers are basically locking down their systems and saying, unless you pay us this ransom, we're not going to unlock any of the systems. It's a big problem, and I think you guys are very aware of it now because it has gained such mainstream media adoption that it's something that we might have not thought about before, but everyone's thinking about it today, and the threats are really everywhere. The real problem here is that the actual cybersecurity talent is not. We have a huge shortage in this industry right now. There's over a million cybersecurity jobs that remain unfilled, and over 70% of the security professionals within the organizations trying to hire for these positions are saying that this shortage does direct, immeasurable damage to the organization itself. Frankly, guys, it's way too easy today to break into any organization's network application, whatever you're trying to break into, if you have the right resources, expertise and motivation. Definitely learned that in my time at the nsa, I was focused on the counterterrorism mission, basically tasked with targeting foreign terrorist communications and so forth. It was an incredible job, but it definitely opens your eyes and gives you a pretty unique perspective on this space today. It's like bringing a knife to a gunfight, right? The attackers are well resourced, they have a lot of motivation, they have a lot of money. Different states are ultimately funding this, right? So how does an organization that might even be smaller defend against these attacks? It's just not fair, right? Clearly there's a need and it's a need that we saw. So you're probably thinking to yourself, okay, yeah, this is a problem for big companies, right? Big enterprises. JP Morgan, Anthem, all these companies are huge. So who would want to attack a smaller company? Or who would want to attack maybe one of you guys? We did a little bit of an experiment. We said, why don't we put just a random box on the Internet, not attributed to anyone or anything? And we said, this is called a honey pot in the cybersecurity space. And we said, let's watch what happens to this box. Let's put down some tools, let's monitor the traffic, let's see what people are potentially doing from the outside world. We opened up Port 22, which is basically the port used to connect to that remote machine from the outside. And within five minutes, we started to see unauthorized login attempts. We actually registered almost 100,000 login attempts on that machine. What does that say? It means that there's automated attackers all over the world just looking for anything that's vulnerable on the open Internet. Right. You can kind of see here it's a little bit hard to see, but they're running through a dictionary attack. So basically going through the entire dictionary and trying to log in using just random usernames and passwords. So I think this is pretty interesting, right? But I'm going to back up a second. I'm going to tell you a little about my story and how we got into this. So I went to school in Washington, D.C. went to GW. It's one of NSA's centers of academic excellence. At the time, there were only a few. They funded me through school, and then ultimately I went to go work for them. So it's kind of like ROTC for cybersecurity geeks like myself. I left in 2009 after getting my master's and joined as a global Network exploitation vulnerability analyst. Kind of described what that was before. I didn't really know too much at the time what that job entailed or what it meant, but I went through quite a bit of training, obviously was exposed to unbelievable projects, unbelievable missions, and I can say without a doubt, I saved a lot of lives. The question at the end, in about February, March 2013, when I realized that there is such a huge problem in this world as it relates to cybersecurity, and I had a revelation that I think I could solve this problem. I think I could solve it. And I think I can pull out one of my. My really good friends at the agency at the time, and maybe we can start a company that addresses the big issue. And I'll tell you more about how we're going to do that. But I was also thinking maybe I should go to business school. Maybe I don't have the right experience, or maybe I need to learn more about how to run a company. Never really ran a company of this caliber before, or maybe I should just stay in the government. It was such a cool job. I was being exposed to so many interesting things. I was saving lives. I honestly think it's probably the coolest job you can possibly have in the federal government. As a computer nerd. I ended up starting synac. I left, joined an accelerator program out in Boston called techstars, very analogous to Y Combinator. Went through that for a few months, and then ultimately moved out to the Bay Area in the middle of 2013 after raising a seed round out here. So for us, how do we solve this problem? We look to a trend that many of you are very familiar with today. I'm sure every single one of you in this room has interfaced with one of these companies probably within the past week. And it makes a lot of sense, right? There are a lot of resources out there in the world that we can leverage to solve problems. But thinking about solving cybersecurity using crowdsourcing, that sounds crazy, right? Well, it sounded crazy to us, too. But we started to ask people, if we created a solution like this, would you actually use it? We asked real potential customers, we asked people back at the nsa, does this sound even feasible? And they said, you know, it does, but what you have to really think about are all the implications as it relates to crowdsourcing in the consumer space. And you have to address those implications for business, right? And so there were five things that we sought to address. One, trust, right? These are hackers we're talking about. How the hell do you trust a hacker, right? So we inserted a vetting process, you know, and Uber has struggles with this problem a lot, right? They say we do background checks on people and then, you know, I don't know, it's not very good. But we inserted a vetting process such that we do background checks, we do ID verification. We have to do this globally. We're in 40 different countries today. And so we had to enlist the help of a lot of third party companies to help us do that. We also vet our researchers from a skills perspective. We only want work with top people, right? And so we can't just say any Joe Schmo off the street, come work for us. We put them through a practical exam and a written exam to make sure they meet our minimum bar of skills scale. How do we scale this business? Ultimately, there is, like I mentioned, a shortage of talent in this space, right? And so for us, we recognize that in order to be a scalable company long term, we had to turn to technology. We couldn't just rely on people alone. And so we decided to create an automation platform in conjunction with the researchers that we would be utilizing in, in order to automate some of the low hanging fruit attacks that they're throwing at our customers. And that has turned out to be an amazing resource for us. And we've been putting a lot of engineering effort into that technology management. How do you manage hundreds, if not thousands of hackers around the world? And how do you enable customers to interface with them on an ongoing basis? Well, we created a platform, we created a whole online interface where researchers can submit vulnerability data that they find on customers. We created an interface for customers where they can see what's happening and all the high impact vulnerabilities coming from our customers or from our researchers rather. And all of that is contained in one easy to use online interface. We even have a function for our own internal team to leverage, interacting with both sides, engagement. How do you keep research, or how do we call them researchers, by the way? It's kind of, you know, it's a little less scary than hacker. But how do you keep researchers engaged? How do you keep them motivated to find these really hard issues? What if they're only looking for the really easy stuff to find? So what we inserted was actually a bounty driven approach for conducting vulnerability research. So we basically said if you're a Hacker and you go through our vetting process, you find a problem on one of our customers, we're only going to pay you if you exploit that customer, you find a vulnerability on that customer and we're going to pay you based on the impact to that organization. So it really aligns the economics in a fundamentally just better way. So we're not paying them time and materials. They don't get paid unless they're finding things. And they're getting paid when they find really serious stuff. A lot of money. We paid up to $25,000 for a single vulnerability so far. And then intelligence, right? How do we make sure we understand what the researchers are doing right? It's one thing to say, okay, we're getting lots of vulnerability intelligence coming from the researchers, but how do we actually know what they're doing on a day to day basis? And long term, if a customer is getting more secure, hopefully we're not finding anything anymore. So how do we actually prove to that customer that we're still doing work? Right. And so we have a whole analytics and intelligence platform that feeds real time data to our customers. So that's how we've addressed all the problems with crowdsourcing as it relates to the cybersecurity space and as it relates to hackers. So really, really interesting. Not easy to figure all this stuff out, by the way. Then comes the early days. We thought this all through, we had a solution for everything. But we then realized, shoot, there's a little bit of a chicken and egg problem here. How do you actually find customers when you don't have any hackers? And how do you recruit hackers if you have no customers or no work for them to work on? It's a typical marketplace problem. And the way we solved it is actually by hiring some hackers. We basically paid them on an hourly basis up front. We said, we'll still pay you on this bounty driven model if you find vulnerabilities. But at the end of the day, we were able to bring them on board and convince customers we had a stable enough of a community to be effective. When we start started testing their environments. That doesn't look anything like me anymore. I don't know. But getting over the you're crazy moment right when we first walked into some of our early customer prospects, they basically said, you guys are nuts. I mean, come on, who are you? What is this company? You're two random dudes from Washington D.C. and you're asking me to basically employ hackers and they're going to go hack My stuff and they're going to tell me what the problems are. How do I trust them? How do I trust you? Who are you? Well, it turns out actually coming from the nsa, it gives you a lot of credibility. And they start to listen. And what we found was really talking about our experience at the NSA and telling them that this actually aligns to a lot of NSA's methodologies. Right. NSA employs massive amounts of data. They use that data to largely drive a lot of their intelligence missions. They have really, really smart, motivated individuals. Those individuals are, they're not paid that well, but the mission is so exciting that they're willing to come in even at two in the morning and work on these projects. And so that analogy resonated with our early customers and they said, all right, maybe we'll give this a shot. Certainly we're not the first ones to say, trust us, we're from the nsa. Right? There are a lot of companies doing that. This was a Forbes article where they did a whole spread on ex NSA and ex Israeli intelligence folks that started companies. It was kind of cool. They put on a trench coat, by the way, I stood in front of a blue screen and then they photoshopped that together. So it's not as cool as it looks. But anyway, so, so we started to mature. We started to go from that's crazy to wow, this might actually work. Right. And the way we convinced customers to try it was say, we'll do a proof of concept or a proof of value with you just come in. We'll work for a seven day period. We'll launch our cadre of security experts at you, we'll tell you some of the problems over that seven day period and we'll show you there's massive gaps in what you're doing today and, and what we're able to do for you. The problem we didn't anticipate, and this happened with one of our very early customers, was that some of their environments are so bad that it actually scared them. So there is one pretty large company. We basically found over 100 vulnerabilities within seven hours. And that customer was like, holy crap, this is my job. It's not to protect this application. And clearly I'm doing a pretty crappy job. Right? And so for them, they actually went silent. We emailed them, we called them, they're like, they wouldn't answer our phone calls and we're like, what's going on? We thought we did a great thing here, but the reality is they were so scared that they refused to talk to us because they were scared of losing their job. At the end of the day, we figured out other people in the company to go to and everything was okay. We remediated the press, the problems, and we ended up taking more of a low and slow approach. We kind of scoped out the work so that we had do a small piece at a time and they're still a great customer of ours today. So it's a great success story. But it's a little bit scary, right? And we freaked out. We're like, oh my God, did we do something wrong? Are they going to sue us? A lot of crazy things happen in the early days of a company. Then came the F word of entrepreneurship, right? Fundraising. Who doesn't love fundraising? So fundraising for us actually turned out to be a pretty easy process. And I think a lot of entrepreneurs can't say that. But cyber security is just a space that is really hot right now. There's a huge need for new, innovative solutions. We are fortunate to align ourselves with phenomenal investors. We raised a $7.5 million round in April of 2014. And then later on in 2014, we raised our $25 million Series B. Google is an investor, Kleiner Perkins is an investor. And we have some other great investors as well. It's been a lot of fun to work with these folks. We definitely recognize that having a good investor syndicate is absolutely necessary to build a sustainable business. They help you a lot, right? Whether it's through customer introductions, whether it's through making introductions to executives, to join the company, other talent and to just give you a really good perspective on things because they've seen it before, right? And so we put a lot of value on aligning ourselves with top notch investors early on. We also recognize that early employees are super crucial, right? You have to hire the right talent early on and they have to really believe in the company's mission. It's one thing to say, okay, you're a hot Silicon Valley company, you have great investors, you're well funded. It's another for them to really believe in cybersecurity, for them to believe in our approach and to get behind the company in a big way. And so that was a big goal of ours early on. We wanted cultural fits, we wanted people who we wanted to sit down and have a beer with. Not everyone, but how engineers are sometimes, hey, I was an engineer, I can make fun of them. And then what we also realized is that early customers are just as important, right? These are the people that are not only going to serve as references as you continue to build the company. But they're actually providing you a lot of really valuable feedback. And so you actually have to choose your early customers wisely. Just because there's a huge bank willing to pay you a boatload of money doesn't necessarily mean they're the right customer for you. In the early days, you have to really think about who are the people within that organization, and are they willing to give you both the positive as well as the negative feedback? And those early customers really drove our product roadmap. They drove our vision, they helped us prioritize a lot of the feature sets, and we found that to be super crucial. Now, we all hear disruption today, right? It's like the big buzzword, and it's kind of annoying. You hear it all the time. But the reality is, unless you're actually doing disruptive, unless you're actually doing something really different, people just don't care to listen. And certainly crowdsourcing security, that was disruptive. It was very different. People had not heard of that before. We placed on CNBC's Top 50 Most Disruptive Companies list. Now, for the second year in a row, we're now the number 20 most disruptive company, says CNBC. I wish everyone put us on some list in the top 50, but it was exciting to be on that list nonetheless. And I think it really highlights the fact that doing something disruptive gets people to pay attention, and that's how we got our customers to pay attention. So who's actually trusting Synack today? Well, we're very focused on large enterprises, so we're working across the Fortune 500. We're now working with a lot of international customers in a variety of different countries. We're touching government. We have a lot of financial services customers. It's one of our heaviest industry bases. Technology, consumer goods, retail. You've seen a lot of retail breaches out there. It makes a lot of sense that they're engaged with us and then healthcare organizations. I think what you'll notice about these type of industries is that they're actually ultra conservative. And so regardless of the fact that we're doing something pretty progressively leaning, we're finding that these organizations are opening their arms to this idea and embracing the idea of crowdsourcing and recognizing the only way they can get ahead of this cybersecurity issue is, is by using things that are innovative and using things that are outside the box, because, frankly, the old stuff is just not working. Just recently, we announced two large contracts with two federal customers. One The Internal Revenue Service. We've all seen the news of the IRS being breached. So it's great to see them taking more of this progressively leaning view on things as well as the Department of Defense, arguably one of the most conservative organizations in the world, saying, we're getting attacked too much. The attackers are winning. The only way we can defend against this stuff is by employing or adopting a solution that mimics those same attackers that are attacking us. This is something we didn't expect and I think it's really cool. And when we started the company, it was all about, we're going to try to bring as much revenue into the company, we're going to try to sell to as many customers as we possibly can. But what we didn't realize is that the people that we are leveraging all over the world, in countries like Bangladesh and India and Russia and Eastern Europe, they're actually starving people out there that are really good at this work. They have computers, maybe they go to an Internet cafe. They love just breaking things. They have the hacker mentality, the hacker mindset. And we started putting food on their tables at home. And I think that's really exciting. We never thought that would be possible. We thought hackers that we would be employing would all be experts. They already were making a lot of money and we didn't really have to. We weren't going to provide them much more benefit than making them richer, I guess. But I absolutely love this quote from one of our SRT stands for Synack Red Team. And that's what we call our community of hackers. So one of our SRT members wrote in and told us what we're doing for him. So I want to end with just some learnings, my key entrepreneurial learnings. Tina asked me to throw together some things that maybe you can learn from. A lot of this I kind of already talked about, but I think starting off, don't just ride a trend, build a lasting company. It's one thing to say I'm going to do cybersecurity in a crowd sourced way, right? It's another to actually build a company that addresses all the problems associated with selling to businesses, selling to conservative enterprises in cybersecurity and crowdsourcing at the same time. So that was definitely something that we learned was really important. Surround yourself with the right people. We talked about that. Hiring really top notch talent, bringing on great investors, advisors, mentors, super crucial. They have really propelled our business forward and got us to where we are today. Conviction, you got to stay the course. Even if people Call you crazy, they will call you crazy. If they're not calling you crazy, your idea probably is just boring. So do something that's exciting. People should call you crazy. And then you should figure out how to prove them wrong. Be passionate, but patient about the grand vision. It takes time. It takes time to build a business. I'd say the last year, I've been at this for about three and a half years. The last year or so, we've really hit our stride with respect to bringing on new customers at large contract values. I mean, our federal customers are new. We've been going after them for some time. Enterprise sales takes a really long time. You have to not only convince customers, but you have to get through their procurement process. That's really hard. They're very conservative with dealing with smaller companies, but they're starting to embrace it more and more. And then execution, it's one thing to start a company, it's another to actually execute. And sorry, this is so small, by the way. See some of you squinting, but really, at the end of the day, it's all about execution and executing on that early idea that you had to make it a reality. So with that, I'll take questions, Go to the last slide.

Can I ask the first question?

Maybe. Okay. May I? Thank you.

I would like you to explain a little bit about the hacker mentality, the black hats versus the white hats. You know, what motivates people to break things and break things for good versus break things for evil.

That's a great question. So the question was, talk about the hacker mentality. What makes a hacker a black hat versus a white hat? Black hat being someone that's hacking for bad purposes. White hat are the type of people that we employ. Right. And I guess what ultimately makes them want to hack in the first place. Right. You know, it's a great question. We have people in our community that come from a variety of different backgrounds. They're developers, they're people working for big tech companies, they're people working back in the government space. Some of them are trained. Some of them are just really good at this. And they've learned to. They figure it out at an early age. That's kind of how I learned just trying to break things and take computers apart and figure out how to bypass authentication and do all kinds of interesting stuff. So, I mean, what makes a hacker a black hat versus a white hat? Well, I think some people are certainly attracted to the money on the black hat side. There's actually a thriving market as it relates to selling exploits on the black market as it relates to hacking banks, for example, and trying to steal money. But the reality is, before, there was not really a legal mechanism for them to operate, especially if they were just sitting at home. And so our hope and our goal is to actually turn these black hats, or people who are thinking about going more the black hat route and telling them, hey, you can actually make money doing this legally. Right. You can still sit at home, sit on your computer, but we're going to make you money hacking our customers. Obviously going to make you sign a lot of agreements saying, you're never going to talk about this outside. If you find something, we're going to need to monitor your traffic and so forth, and we need to make sure we can trust them. But I think the reality is you're starting to see a big shift and there's not a. I would say the black hat market isn't as massive as you would expect. There's a lot of people doing this for good. And so it's people we're ultimately going after. But I think you're going to see a shift. There's always going to be money on the other side, but that's definitely starting to shift the other direction. Yes. What do you do to develop your community of hackers? How do you make sure that community is growing? So the question was, what do we do to build our community of hackers? So we early on recruited a lot of people that we knew in our network. We were pretty well connected. We pulled a lot of people out from government, we went to a lot of security conferences, and we would basically set up a booth and we'd say, come join our community. There's some very large hacker conferences in Las Vegas. One's called Black Hat, another is called defcon. So those were prime examples. And sooner or later, hackers started hearing about this and they realized, wow, there's this company I could just work for on the side. I can still keep my day job, but I can do this work nights and weekends. And we started to get a lot of inbound interest. And so we created a whole application process around that. We now get quite a few applications. Most of our researchers come inbound at this point. We then put them through our assessment process and vetting process and then ultimately pass them through. But we continue to recruit at events. We continue to put out incentives for people to refer their friends, though it's a little bit harder than you would think, because by referring their friends, they're actually creating competition for themselves. We have a whole leaderboard System. We have a whole system where our hackers are the first to find an issue is actually the one to get paid. So by bringing additional people in, you're creating competition. And so referrals doesn't work quite as well as you would think. But there's a lot of different areas that we're recruiting in and obviously a lot of that's inbound at this point. Yes. Do you, when you're working with potential clients, do you like a test run to see if they are vulnerable? And if not, have you ever signed with a client and had to say, sorry, we couldn't find any vulnerabilities. So the question was, do you ever test a client ahead of time to see if they're actually vulnerable, then tell them to pay us and then not actually find anything and just say sorry. So it's never happened before where we haven't found a vulnerability. Never happened from the entire time we started the business. It's never happened. With that said, you certainly get to a point because our customers sign on subscriptions, so they're constantly engaged with us, and there becomes a point where they're getting pretty robust from a security posture perspective and we're not finding as many issues as we used to. And the way we prove value to those customers over time, because we want them to stay on as a customer in year two, year three, year four, is by showing them activity and actually showing them we're still trying and showing them your applications are changing, so we need to keep looking because you could be introducing a security issue at any point in time. Your infrastructure's changing all the time, we need to keep looking as well. And so we prove value in two ways. One is obviously finding vulnerabilities and helping them fix them. But the other, of course, is showing that we're trying and we're not successful. And that's a great metric for anyone that's a security executive because they're all trying to prove that they are getting better and they're doing a good job. And so we're able to help them at least quantify the fact that things are getting better over time. Yes.

So you talked about scaling by adding technology. Can you talk about that? What kind of things are you doing to essentially put these hackers out of business?

Yeah. So the question was, can you talk more about the technology side, how that helps us scale. Us scale the business. So the reality is we're never going to be able to cut the hackers out entirely. There's an entire class of vulnerabilities that you simply cannot replicate using technology you can't automate. If you think about an online banking application, for example, a piece of technology or automation sees a bunch of form fields on a website, it doesn't have any clue what those form fields are, but it's going to send a bunch of data to those form fields. It's going to hit the submit button, it's going to see what it comes back and it's going to see it doesn't match any signatures that are built into the automation a real person sees. Okay, there's one account here, there's another account here, then there's a transfer button. If I'm able to transfer money from one account to another and I'm not the owner of that originating account, that's actually a really bad thing. And it's those business logic abuse cases. That's one example of why you can't cut out the hackers entirely. But there are also a slew of vulnerabilities that you can automate. Right. You can actually build technology that finds this stuff more programmatically. And so for that low hanging fruit, we're definitely going to be concentrating on building the technology, but we're going to try to level up the game for the hackers on the other side. So they're focused on the issues that we want them to focus on, which are the things that we can't actually automate. And that's how we're going to scale the business long term. We hope the automation becomes more and more robust to the point where we aren't as heavily reliant on the researcher community as we are today. And we're definitely moving in that direction. Yes.

What measures do you have in place to make sure that your researchers do not play the system? Meaning that either they themselves or their friends create a problem first and then they get paid by you to fix it.

Okay, so the question was, what stops researchers from gaming the system? So I guess potentially paying, I don't know, a developer to put a bug in so that they could find it and then ultimately report it and get paid. I think there's a lot of ethics that are tied to our business model. It's part of that trust process when we put researchers through vetting to just get a sense as to what kind of people they are. Certainly if they're working for an organization that we're doing business with, they're not allowed to participate on those projects. So at least gets rid of that scenario. But I think a business unit owner will start to ask Questions. If they start seeing the same developer bringing the same vulnerabilities into a code base over and over again, that will definitely raise questions. And at the same time, it's an interesting question. We've never seen it before. I guess theoretically it's possible, but I think it's pretty unlikely. Yes.

So you were talking about leaderboards. Have you implemented any other stuff towards gamification? I could guess that your hackers are triggered by some form of gamification.

Yep. So the question was around gamification and leaderboards. Right. I mentioned that we built leaderboards and as a result, obviously we've gamified some of the platform. Yes. Gamification is really important with this community. Hackers are not necessarily only working because they want to make money. They actually really like the notoriety. They really like to be seen as a top notch hacker in the community. We've created those leaderboards for that purpose. They're welcome to advertise that wherever they want. Some of them put it on their LinkedIn, some of them, you know, put it on their business cards. We've seen cases where they advertise that all over the place. And it actually is pretty meaningful to be part of our researcher community to begin with. We only accept about 10% of the folks that come on or apply. And so it's pretty rigorous from that perspective. But even further, I mean, being a top ranked researcher with SYNACK is pretty meaningful. And so that's what we have today. From just a gamification perspective. We do utilize points on leaderboards for prizes as well. So we basically will send hackers to conferences, send them different swag and all kinds of stuff depending on where they rank. So there are a bunch of things that we do with that, but I think it's the notoriety that plays the biggest role in keeping them motivated. Yeah, full of questions.

I am always very curious. So you talked about gamification, which is super interesting. I'm fascinated with the culture more broadly of the company. What kind of culture is there in the business and what kind of levers do you use to, to influence it?

So the question was about culture in the actual business and what do we use to influence the culture? You know, we wanted to, when we started the company, I said I want to create a culture that's a complete 180 from the federal government. Look, we're working on really cool projects. It's exciting, saving lives, but at the end of the day there's a lot of bureaucracy. Right. And it's hard to get things done if you Have a really brilliant idea. It has to go up many levels of chains and management. Sometimes you have to really beg for money and you would think, wow, but you're working like intelligence. It's like counterterrorism. Why are people giving you a hard time? It's not as hard as you or not as easy as you'd think. In the government you also have to basically pay for every little thing. If you want a candy bar, you got to put it in the jar. People can't give you free stuff. We wanted to cut all that nonsense out and we really created the typical Silicon Valley culture out here, but for people that are interested in cybersecurity. And we actually have pulled a lot of people out of the government and they're like, wow, this is amazing. And so we have a very non bureaucratic system at synack. If you come up with a great idea, we empower you to work on it. We never want people to be bothered or burdened with paying for a candy bar. We give them as many snacks and drinks as they want. I'm sure you guys have seen the startups in the Valley and what it's like, but we almost used the government as a guide of what not to do and then went with the opposite. Not everything's so bad, especially where we worked. I mean it's a pretty laid back organization. You wear, you wear jeans and a T shirt and people are pretty geeky and nerdy at the nsa. It's not like that in a lot of other agencies. I worked for another couple DoD agencies and it's very different there, suit and tie kind of thing. But yeah, we sought to create a very different culture than where we were before. Yes. So you mentioned that you really enjoyed your job at the nsa, so why did you decide to leave? So the question was, since I really enjoyed my job at the nsa, why did I leave? And it's a great question. It's one that I grappled with for a while. I thought about, I really love what I'm doing. Counterterrorism, such an exciting mission. But at the end of the day, I was entrepreneur at heart. I really wanted to build something. I wanted to start a company. Actually backing up. I started a company when I was like 13 years old. I built a web hosting and development company in the days before Amazon AWS and Microsoft Azure and Google Cloud. And it was basically a shared web hosting business. Put a bunch of servers online, rented space out, built it to over 1000 clients and then I ended up selling it. So I really Enjoyed that. That was a lot of fun for me. It was obviously nothing like the business that I'm building right now. But the reality was I did not see myself being a career government guy. And I knew I wanted to start something. I just didn't know when, timing wise, when I'd be able to. But I decided to dive right in and just make it happen. People think the government's losing all this talent. There's such a talent problem. The way I look at it is they're able to get really great talent, even for four or five years. And it's not necessarily a bad thing. You're pulling people out of college, you have these great scholarship programs like the one that I went through, and being able to leverage them on even just a shorter term basis, it's not terrible, Right? And so I encourage anyone who's thinking about entering federal service. It's not necessarily a lifelong project, right? You can go in, you can learn a lot, you get exposed to really interesting things, really interesting people, and obviously the stakes are really high. And then you can earn that credibility to go do whatever you want to do.

So is there a place for entrepreneurship in the government?

Is there a place for entrepreneurship in the government? There is. And I think the government's. They're being a little better about it today, more than they ever have. There's a lot of new organizations that are spinning up that are trying to bring Silicon Valley companies into the federal government. You're seeing the DoD recently launched something called Diux. It's the Defense something experimental unit. And the whole point of it is to basically take innovation from outside and bring it in. And generally it's more of the entrepreneurial thought leaders within the federal government that are spearheading those initiatives. And so I think there's a lot of opportunity in the federal government to innovate, to be entrepreneurial, to build things that are exciting. I mean, even my job. I think while I complained that there was a lot of bureaucracy, we did have a lot of freedom and we were able to think really creatively because the projects that we were focused on were how do we gain this intelligence from a potential terrorist, right? And we had to take all of this data, we had to talk to analysts from all different buildings and bring it all together. And it was a huge group effort. And I would say a lot of the same things that you would do building a company you can do in the government. It just looks different. Your end product is not necessarily a company or a product or a piece of software. It ends up looking more like I just stopped a terrorist attack, which I think is just as exciting.

Well, thank you for your service, first of all, and congratulations on all your success. Please join me in welcoming Jay.

Thank you. Thanks so much, guys.