In this interview, security leader Joe Payne discusses the most pressing threats facing end‑users, especially within B2B SaaS companies. He explains how insider data exfiltration is often the first sign of a breach and how transparent, limited‑scope monitoring (watching only transfers of company data to untrusted locations) can deter employees from taking data, while still respecting privacy. A real‑world anecdote illustrates accidental leakage when a new hire’s iCloud automatically synced confidential files from her former employer to her new laptop, highlighting the need for awareness of default cloud sync behaviors. Payne emphasizes the current ransomware surge, urging startups to maintain robust backup and ransomware response plans because paying ransom often leads to repeat attacks. He argues that security must be baked into the DevOps pipeline from day one, rather than added later, and points to misconfigured cloud servers as the most common breach cause. Drawing on his experience scaling a 500‑person company’s security team from a handful to over 20 engineers, he recommends leveraging best‑of‑breed public cloud security services (AWS, Azure, IBM) instead of building custom infrastructure, and advises startups to adopt such solutions early—ideally before scaling beyond a few team members or initial customers.
Chapters
Yeah, I mean, you have that generally in most agreements, right? You have a non-compete clause or a non, uh, you know, uh, yeah, non-compete, or they can't reuse any of the, the content or the email list, etc. But yeah, I mean, at that point, if you don't have something like this, it's, it's too late once you find out. We've seen that before as well, like people leaving and they take, you know, see them contacting old clients and whatnot. But at that point, you're being more kind of trying to put out the fire rather than, you know, being preventative and, you know, going to court and trying to do all that stuff. So I think this is, you know, this would be really nice to have something like this to avoid that situation.
Yeah, you know, we've seen— it's really interesting when we first put it in our own company Every single person who left, every single one took data that they shouldn't take in our own company, right? And then, yeah. And, and, but today, nobody does. What's the difference? They now know we're watching the store. Because before, and at most companies today, no one's watching the store. Like, if the store's wide open, and all the windows and doors are open, and everybody else is doing it, you know, then people take a lot of data. But in general, people are good. And so like, if you just show that you have some controls in place and that you don't expect them to do it, people just stop immediately. In fact, today at our company, almost every employee will email security saying, hey, I'm leaving, but I want you to know I'm taking these 3 files 'cause they have my personal information on 'em or something, you know, like they'll tell 'em in advance. And it's really, really interesting change and dynamic. And that's all about us being very transparent with the organization about what our secure— what our software does and what our security team expects. And then, and like I said, most people are good. Most people aren't that malicious hacker out there.
So, I mean, on one side I understand, right? Like you wanna have some sort of control, but on the employee side, you know, do you ever feel like they feel it's being invasive or kind of controlling over them? And, you know, that they're feeling that's being invasive of their space?
Yeah, some people ask that. Yeah, no, that's a good question. I'm glad you brought it up because some people asked it. Hey, wait a second, are you watching it? To be clear, we're only watching for data that employees move to untrusted sites. And so that's really it. So if employees are sharing data with our ad agency or they're sharing data with, you know, our keyword search agency or they're, you know, whatever they're doing, none of that gets flagged and there's no issues there. But if employees are sharing company data with themselves or with third parties or with somebody they shouldn't, you know, they should be okay with the company saying, hey, why are you doing that? You know, like, why? And questioning that and challenging that. And a lot of times, by the way, it's by accident. We had an interesting story happen a few weeks ago. We hired a new employee away from another security company. She joined us as a salesperson and she'd been with us about 10 days and all of a sudden she downloaded all of this new confidential material from her old company onto her laptop. And our software caught that and alerted on it and our security team met with her and said, hey, what's going on here? And she said, oh my God, I have no idea how that got there. And they said, well, let me ask you a question. Did you just sign into iCloud? And she's like, yeah, when I plug my phone into my computer, it made me put my iCloud account in. And what had happened is iCloud automatically copied all of her documents when she was at her old company to iCloud and then copied them down to her new laptop when she signed into iCloud on her new laptop. And she didn't even know that was happening. And, you know, that's one thing that Apple does that's really not a good practice. It turns iCloud on automatically. Um, with any, with any new machine. And so that's one of those examples where, you know, we, you know, we had her delete all that material. We notified the other company so they knew what had happened. They were embarrassed because they didn't see— they weren't using Code42 and they didn't see the data leave. They, they should have seen the data when she first copied it from their company, you know, um, but they, they didn't have the tech in place. So that's interesting because that's also a new, a new sales prospect for us because they realize, oh my gosh, we need to be able to see these kind of things. So a lot of times it can be accidental. But we, you know, and so we assume positive intent. We assume the employee is not doing this on purpose, but then we verify to make sure. So, you know, there's no camera. We don't have camera software that's looking at what the employee is doing. We're not looking at their keystrokes. We're not measuring their work productivity or anything like that. We're just watching, hey, this is really important company information, and are they removing it to someplace it shouldn't go? And if so, if the security team doesn't pay attention to that, they're really not doing their job.
And what are some other, like, general, you know, say, main threats you're seeing to the end user? And maybe say specifically for B2B SaaS solutions, um, are you seeing anything on, like, you know, hackers, a lot of hacking, a lot more hacking going involved, nation-states? You mentioned insider threats, or maybe you can share some other common threats you usually encounter.
Yeah, well, so there's, there's You know, the security industry is always evolving and the bad folks are almost always one step ahead because there's such incentive to be bad. Right now we're seeing a huge amount of ransomware out there. So what I would say to all you entrepreneurs out there, you should have a backup strategy and a ransomware strategy, meaning you don't want to be in a position of paying ransom. Because if you're stuck having to pay ransom, not only are you losing out on all that money, you're also— 2/3 of people that pay the ransom get hacked again within the first year by the same group.
Wow.
Because it turns out thieves aren't necessarily— there's no honor among thieves is an old expression, and there is no honor among thieves. You know, they'll tell you that they've, you know, rid your system of their software, but they haven't. They've left backdoors. So ransomware is a big deal right now. You need to have backups of all your, you know, all your, uh, all your cloud information, but also stuff on your endpoints as well. Um, I, I think that the most important thing, if you're— is if I'm talking to SaaS entrepreneurs and CEOs, is you've got to build security in from the beginning today. You need a whole-stack DevOps approach where security is part of DevOps. It's, it's not, it's not separated. Security is not something we do after the fact. It's not something hey, we gotta build our product first and then we'll worry about how to secure it. You've lost if you do that. Security's gotta be baked in. I am a 500-person company and I have more than 20 people in security. And so like, that is a different, you know, when I was running my last company, I think we had 3 or 4 people in security with a 500-person company. It's changed. You need to have a real focus on security and security needs to be part of product development and it needs to be something you think about from the get-go. So, you know, getting your— the most hacks also that we see today are misconfigured cloud servers, or just seeing an incredible amount of misconfiguration, which results in data spillage and data leakage, and it's all avoidable. So if you have the right people on the team who understand security and how to secure your application, that will pay dividends in spades. Because it just takes one, especially as a young company. If you have one breach, you're done. I mean, you're— if you're trying to win in the enterprise space, you can't afford one breach in your early days.
You lose it all. Yeah. I mean, like, so you mentioned, you know, the level of sophistication is growing, evolving in the cybersecurity space. You have 20 people on your team, you know, kind of working on that. What else are you kind of doing to kind of, you know, stay ahead of that, right? I mean, you have things, you know, even blockchain, blockchain technology, all these things where people are trying to be more confidential, they're trying to hide, they're trying to be smarter than your engineers. There's always a smarter engineer out there. So how are you guys staying on top of that?
I mean, I think it's just a constant investment in security. And we have sent people to school, we've trained people, we've put in new methodologies, but we also leverage, some really good cloud technology. We use both Azure and AWS as part of our product, and we leverage the capabilities that they have because they're some of the best in the world at security also. And never thought I would say that about Microsoft, but they are. And so, you know, learning how to leverage— don't roll your own. I mean, so many founders, you know, want to roll their own infrastructure, they want to roll their own applications to run their business and blah, blah, blah. Don't do that. Invest in best-of-breed technologies to help you grow your business. And certainly invest in— if you're going to build something cloud native, I wouldn't do it on Jim's cloud, Jim's discount cloud service. If I were you, I would really leverage AWS or Azure, uh, or IBM and any of the public clouds, um, have strong security.
Makes sense. Um, so obviously, you know, we're talking to SaaS here. Data is, you know, probably the most valuable asset, and, and, you know, all things considered, um, is, is there a right time for when a startup should start looking for this solution? Is it after, you know, first client, 10 clients, 100 clients, or 1 team member, 5 team members? You said you have 500, so, you know, I can imagine more to manage. Is there a right time to look at it and invest?
Well, you should appreciate that your, your first client expects you to protect their data, you know. So I, I think, yeah, I think it's from day one that you need to be worried about data security and what could happen to your data and who has access to your data. And are you building, are you building controls in, um, both internally and externally? Are you building controls in for your customers so that only certain people on, you know, role-based access control is critical for your customers so that only certain people in their organization can access the data through your product. And so all those best practices in software engineering are critically important and they're expected today. And I think all of your clients, even when you're in your first 10 clients, you can't say to them, well, you're only one of my first 10, so I didn't really have time to protect your data. That's not acceptable. They're not gonna— you're not gonna get to your next 10 if that's the approach you take. So I think you have to, you know, You know, you have to think about it from the get-go. And if you're listening to this right now and you're like, we haven't really given data security much thought, like, you need to stop and give it some real thought.
