No Password Required Podcast Episode 63 — Jon Schipp

Welcome to No Password Required. I'm your host, Jack Klaby, a cybersecurity attorney at Carlton Fields, PA.

And with me as always, I am Kaley Melton, the Executive Director of Operations for the Cognitive Security Institute and the Bob Ross of InfoSec.

We just finished a great conversation with Jon Schipp. Uh, Jon leads inorganic growth strategy at Rapid7. Kaley, what stood out to you most from our conversation?

I think the thing I'm walking away with is the knowledge that being a metalhead, especially if you're in a metal or punk band, prepares you perfectly for the boardroom.

I think, too, it's— when Jon shares a story, our readers will see some beats maybe with their own and some beats maybe of their colleagues. But one thing that stood out to me was when you're good at something or if you like something, right, like working with computers, you know, you can follow that passion all the way down and find a way to make a living from it and thrive, right? Absolutely. And that's it. You don't have to force it, right? If, but if there's something you like, you can really make it happen. And Jon shares his story with us, which we hope will resonate, uh, with all of you. So you've heard a little bit about what we took away from the discussion, and now let's hear what Jon has to say. Welcome to No Password Required, a podcast dedicated to showcasing the top personalities in the world of cybersecurity. Welcome. Our guest is Jon Schipp. Jon, welcome to No Password Required.

Excited to be here.

All right, so if you've listened to this show before, you know that Kaley is the Bob Ross of InfoSec, but on your LinkedIn, you call yourself the Ric Flair of cybersecurity. That makes me feel, I guess, pretty lucky to be in the company of two fantastic cybersecurity celebrities. But tell us, is that alter ego, is that something that shows up in your day job at Rapid7, or is that like an after hours?

It definitely shows up in the day job. So just to be clear, I didn't coin it myself. That would make me cringe, just so we're clear. Like, I actually had our sales team— the sales team came up with it, and then led by a guy named Nick Rossi, one of our sales leaders at our company at Rapid7, and it kind of percolated from there. And I just said, hell, I'm just gonna lean into it, right? And so the reason it came up is that Ric Flair is in Tampa He has a boat down by the marina, by the Marriott Hotel. It says "woo" across it, right? And so when I get too excited, I like to go, "Woo!" I like to do it too. And then the other thing is that I also like robes. I'm kind of fancy in that way sometimes, like a niche. So I got a ton of robes over here. You can't see them, but I brought my favorite pink one. And that picture got circulated with me in this thing. From a friend. And then that was kind of the whole Ric Flair persona came to be. And there's a funny video of me at Black Hat where I do a lot of market evangelism too. So I kicked it off, had the microphone trying to get the floor's attention where there's like hundreds of vendors out there. And I'm like grabbing the microphone, what's up, Black Hat? I do that for like 60 seconds and then everybody starts to come in. So it was fun.

That's good. I think the robe is underrated, right? It had like a peak in maybe the 15th, 16th century, and then ever since then it's just dropped off. It's just wrestlers and people at staying— people staying at fancy hotels. Yeah, I'm glad to see, Jon, you're giving it a third use. Uh, can you guys— can you tell us what is it— what do you do at Rapid7? And then give us a little bit of a backstory of how you got there.

Yeah, so I'm kind of in an interesting spot. I like to say I have one of the coolest roles at the company, so Technically, I roll up into the product management organization. I'm a product strategist. I report in the chief product officer, but I have a specialty where I focused on mergers, acquisitions, and partnerships. So anytime there is an area of investigation that we need to do about bringing new capabilities in or partnering with an organization, we're going to market growth or whatever it is, I actually involved in a lot of those. I've led a few different acquisitions, number of different partnerships. Over the years. And I think I kind of got in this role a little bit too from my startup background. I've been on the other side of the table in the conference room, if you will. And then I also have another part of my job, which is kind of intriguing. It's a little unique, not common, but I do that, the product side, but I also do market evangelism. And then go back to the Rick Blair persona, it probably makes sense to you if you're listening to me, but I do lots of webinars, I do lots of public speaking. And just getting out there at conferences and stuff. I actually used to be on the conference track a lot. I used to be like giving 10 to 11 talks at hacker conferences for a number of years, but I did get burnt out a little bit. I haven't done that in a while, but I would like to get back in it. So that's kind of a little bit of the background, but I've been, where I joined the startup, which was called Command, it was a Boston-based company. I did that 9 to 10 years ago, and then Rapid7 acquired us. And we had a good, nice little exit. Uh, very happy with everything. Rapid7 has treated us very well, and now I am at Rapid7 and continue to be there, continue to grow, and get to try a lot of new different things. So it keeps me excited.

Can I ask, Jon, did you, uh, did you relocate to Tampa from Boston? Like, how did you come here?

Yeah, so, um, so I was mostly remote. So I worked at that startup called Command. I was remote in central Illinois, a little town called Bloomington. Met my wife there. But when I worked at Command, they still had me remote. And then eventually Rapid7 acquired us. We opened an office in downtown Tampa like 3 or 4 years ago now, and we kind of— they needed some new leaders to go help grow the office. And so I raised my hand and then they relocated us. So we've been there for over 3 years now.

Well, that's right. That's where I'm based, in Tampa. And we're really glad that you guys are here. So thanks for making that trip for Rapid7 opening up here and then also for you relocating to the, to the city.

I wouldn't want to be anywhere else. I love it. The city is great and it's always growing. It's just the cybersecurity community here is pretty strong too. Like, it's awesome.

When customers want something that Rapid7 doesn't offer, it's your job to kind of figure it out. Are we going to build it? Are we going to buy it, you know, or partner with somebody, right? Can you take us inside one of those decisions where maybe it's not clear and how you make decisions about how to which is the right path?

Yeah, it's a great question. And so I want to just clarify real quick, it's every product manager's job at Rapid7, any company, to do that. Rapid7 has about 60 product managers in our product org. So, but certain types of things bubble up to me from the specific lens that I have around M&A and partners. And so generally what happens is we'll do a lot of customer research, we'll listen to our sales team, our customer success team, our cybersecurity advisors, and talk to customers directly every single day across the hundreds of people that we have. And what we'll do is we'll kind of start to notice patterns in the requests. What's been, what features are missing? What's hard to use? Where do they think the market is going? Where is their budget being spent? When budget comes available for next year, where are they going to spend it? Like just common questions like that to get a pulse on the market, right? And then we also look at obviously attacker trends. What are the, like the Verizon report, the Mandate report, all that stuff, our own report. We see what's out there and say, hey, There's a crease in identity attacks. What are identity capabilities that we need to have, right? And so in general, those bubble up to the senior leaders at the company. And I'm a lower-level executive. I'm a senior director. And so I get to see across our portfolio, if you will. We have like 7 different products. We have a $400 million, almost $400 million MDR business, which is one of the largest in the world. Not a lot of people know that. They still know Rapid7 from its VM technology because we've been a VM player in the top 3 with Tenable and Qualys for the last 20 years. And so we branched out though. And so we have a lot of different technologies that we have to look at. We got to think about latest detection response capabilities, latest exposure management capabilities. And so what happens is you get enough requests come in, or you think there's going to be a strong business case that you can make, and you have to do a few things. You have to think about market validation. You got to think about the economics, the dollars and cents. Are we going to make money enough to pay for this or to grow as a company, right? What is our addressable market? If it's TAM or SAM or whatever it is, We gotta think about all these market dynamics. And then we gotta make sure the most important thing though is, does it meet the customer need? Is it gonna solve the security problems that they're having? And then what we do is we say, we ask ourselves some questions. Say we identify that we're gonna, something that we need, okay? Well, then what we're gonna do is we're gonna say, do we have the people internally that have the expertise and the number of staffing to actually build it ourselves? And there's a few decisions you gotta make around that. May not be a core competency. Maybe it's better to go outside. If you're going to do something a little adjacent to what Rapid7 does, like not core VM, not MDR, you're going to get into something else like patch management or compliance. Just making some stuff up. You're going to want, you're not going to want to probably build that yourself. You're going to want to partner with the company. And then you start doing that and you're like, okay, partner's an option. Let me go figure out all the landscape, all the vendors out there. Let's go through LinkedIn. Let's go through all the market reports. We're going to pull all those out.. And then we're going to see what are the sizes? Are they, you know, if we were to— what are their costs? Are they going to cost $10 million to buy, $20 million, or $100 million?

Yeah.

If it gets to a range that's not affordable and then the business case doesn't make sense, then you go from M&A back to partner. And so it's just this dance that you do. This usually takes about 3 to 4 months in most cases to go through this dance to figure out what the best viable option is. And then that's, uh, that's kind of how we do it.

Jon, I've got to ask, like, Were you a cyber guy who learned business or a business guy who learned cyber or something else?

That's a great question. I'm a cyber guy that learned business. Yeah, it's not the common approach. Yeah, I used to be an incident responder. I worked at the National Center for Supercomputing. That's where I learned security at scale. I was actually the head of security at a couple of small companies as well. And so I learned my chops early on and then I'm just a very natural, curious person. I like to learn a lot of things. And so I went into management, then into software engineering management. I ended up managing software engineering teams. At one point, I led a business, dude, that had 100 different people. So I had product managers, software engineers, designers, and ops. And that was a great way to see how everything works together. And then now I'm very much on the business side where I got to think a lot more about the economics and the finances and things like that.

All right, so I know part of your role, you're doing pitches. Can you give us an example of a recent pitch where it was really effective or you made someone's jaw drop?

Yeah, yeah, I can. So we launched a— before I get into that, so I'll give you a little backstory if that's okay. Yeah. So last year we launched Surface Command. It's one of Rapid7's fastest growing products, and it's the first product in the industry that brings in internal attack surface management and external. 'Cause today, if you have to go buy it, you have to buy from two different companies to buy a CASM and an external tax service management solution. We heard, I talked to 100 customers in 3 months, it was exhausting, but it was so worth it. And by the way, I love doing that. They told us like, hey, I can't afford a CASM or I can afford an ESM, but I can't afford both. And so we're like, okay, let's be a disruptor here. So this is an effort that I worked on. But anyways, so we brought that in, but the real big pitch around this capability is like, You talk to anyone, anyone on the vulnerability ops side, anybody even on the IT side or detection response side, whatever side your program, your cyber risk program you're talking about, there's a fundamental question that they need answered. And that is how many devices, assets, identities are you responsible for protecting? Yeah. And if you don't know that, that is a huge problem. It actually underscores and threatens your ability to have a mature cybersecurity offering or program, if you will. Imagine you have a detection response program, 80,000 assets in your environment, but you only know of 70,000 assets. That's 10,000 assets out there that an attacker could potentially cause an incident on and fly on the radar because there's no monitoring on those.

You don't know.

You wouldn't know. Yeah.

And then what is more, companies today, every organization is paying a lot of money for a lot of different cybersecurity tools. They're paying for cloud security, they're paying for endpoint security, they're paying for compliance, they're paying for vulnerability management, patching, so on and so on. If you log into every single one of those tools today, they will all tell you a different number of assets and identities in your environment because they are focused on what their perspective— a VM program is only going to see its perspective, an EDR program is only going to see its perspective. And so you're paying a lot of money for tools that just disagree with each other. Foundational problem. And so guess what? You need to know what you're protecting. And so you need a way to actually aggregate all this information, get to a truer picture of your attack surface. Nice.

So how did that, how did that sell? Do people like that?

Oh no, it's, it's now one of our fastest growing products, and it makes sense. Like, I wish I had this whenever I was a practitioner. By the way, I used to use spreadsheets like a lot of our customers do in smaller organizations. You go in and log, log into one tool, your VM scanner, it's going to see what it scans. You grab the list of assets, you put in a spreadsheet in the column, then you go log on the next tool, you grab the list of assets, put the next spreadsheet and you figure out which ones don't match, which one has the VM scan agent, which one does not have EDR, as an example, right? It's out of date the next day. So it's a pain in the ass.

So I was both reacting to what you said, and also we've been joined by a friend in Kaley's screen here. There's either a small tiger or a large cat.

It's just—

what's your cat's name?

Yeah, this is Little Baby.

Little Baby.

All right.

Hey, Little Baby. And how old is he?

He's very little. Um, he is 7.

Oh, I'm allergic to cats unfortunately, but I do think they're really cute.

Yeah, I am definitely, uh, a cat lady.

My wife likes cats too. She's very sad that we can't have one in the house because of my allergies. Oh man.

So I'd like to take it back all the way back to middle school. I hear that you were into some things that kids today might call sketch. You were running things like Slackware and pirating games on IRC. And I know I absolutely certainly can't relate to that at all. So can you tell us a little bit about what your early setup was like? And do you have a favorite piece of sketchy software or tool that you used back then?

Oh yeah, so first, I was an angsty kid, angsty teenager, right? I was trying to find an outlet for myself like many of us do, right?

Yeah.

And it ended up being computers. Uh, no one could really tell me what to do outside of like what hours I could be on the computer. Can't be on at 3 AM if I have school the next morning, right? Which ended up being a lot of battles with my parents because I got, I got addicted, if you will. Uh, but yeah, piracy. Like, also, like any kid, I was too young to be eligible for employment, and so how the hell am I gonna get World of Warcraft or Warcraft 3 or whatever, Diablo 2, whatever game was out at the time? And so I had to figure that shit out on my own. And so I went to piracy websites, all the wares, if you will, got lots of viruses, had to reinstall Windows 1,000 times. Um, but eventually I found IRC. And I found a community of people that pirated software as well as some hackers in there. And we hooked up, we talked, we shared software with bots. At the time, they were like XDC and DCC bots. You could transmit all these files without— well, this is dial-up times, okay? And so I always had an issue from HTTP downloads where if the internet connection went out, which it did a lot, I have to restart the whole download. It took me 14 days to download Warcraft III, and I had to do it in a way because my dad was getting really pissed because the phone was— I would download during school. So this is IRC, by the way. You could actually resume transfers through XDCC. And so I'd start it during school and then have it run all night when I came home. And dad's like, why has nobody called me in the last 5 days? Like, the phone just stopped working. It's like I was blocking the line. And then I get this spiel about like, "Grandma, what if Grandma had a heart attack and she can't get through, Jon?" Like, you know, which is a fair point looking back now. At the time, I don't think I was too worried about it. But I eventually got smart. Once I could resume transfers, then I would do it while we're sleeping. My parents were sleeping, then I'd turn it off when I got up for school in the morning and then resume the transfer in the AM again. Grandma still couldn't get through if she had a midnight heart attack, but everything was good.

Grandma lived through that. Oh my goodness.

So anyways, that was the start. Then, you know, a lot of people journey out and get to the Anarchist Cookbook. They start trading illicit materials that's just interesting to children like me. At that time, I was probably like 12 or something. And then I got into programming. I went to Barnes Noble, got Visual Basic 6, started to learn some Visual Basic.

I like the idea of learning a programming language from a book. That's cool.

Yeah, yeah, yeah. That's how we do it most of the time back then. Yeah. And then just got into the hacker community. I was too broke to go to conferences. I met a bunch of people at IRC and forums. And to get around, again, I was a kid. At this point, I was probably 16, 17, early on my driver's license, so I could drive there. But I was too broke to have money to— I started at a grocery store though, but it wasn't much, part-time, to actually go to these, pay the conference fee, travel, pay, eat, you know, board and room, eating and all that. So I actually started sleeping on the floor of hackers. Like, I would talk to them and message on the forums, and then I would just drive out to wherever they are. Or if someone was within a 2-hour radius of me, I would drive to their house or park and then jump in with them. And then so I can get all these conferences. I met a lot of people that way. So that was really cool.

That's really cool.

And some of those people helped me later in my career. They gave me the advice. They liked me, thought I was a bright enough kid anyway. And helped me get connections and things like that that landed my first couple jobs and all that. So that was a really good experience. But anyways, I'm off track. To answer your question, favorite tools. One of my favorite ones was DSniff Suite by Doug Song and team. ARP spoof specifically was the tool that I used a lot. I may have used it on a lot of businesses that I shouldn't have. I didn't have permission to spoof back in the day. I used to go war driving in my old Pontiac Bonneville. When I got my driver's license, I mapped out the city of Huntingburg, Indiana, so I knew all the Wi-Fi spots and then which ones were unencrypted and I could actually just go connect and actually go probe the internet. I also, there's a cool tool called iWAR written by, he goes by Dabiv. I can't remember his first and last name, but a great guy. I talked to him a lot back then, but I would just war dial also for modems that I can connect to to see what was out there. We had a lot of manufacturing in that area. So there was a lot of modems online. It was a big manufacturing area. Furniture. I remember dialing into one, uh, that was not local, uh, but my dad got a $200 phone bill. I dialed into a modem of an adult content network, and I was like 16. Uh, I didn't, I didn't want— I didn't— I just dialed into it and kept the connection, but it was racking up these $200 charges. And then I got banned from the computer for a week, uh, which is unfortunate. Um, but so, and this is my other favorite tools, the last 3. Nmap, excellent tool, great way to learn about networking. And then I'd say TCPdump was also a great tool. I spent a lot of time with TCPdump. I actually started to specialize in network security monitoring at one point. I ran OpenNSM at the University of Illinois, Open Network Security Monitoring Group, for a number of years. Unfortunately, I didn't have time for it anymore, had to quit. And then I think for the last one, probably some scanner like Nikto to do web scanning, to find web exposures. Probably the other one. So those are the tools I used a lot back in the day.

It's awesome. This is making me a little nostalgic. So I would say that there are more than a couple of nefarious actors out there with very similar origin stories to yours. But what do you think made you pursue knowledge outside of something more ego or material-based like money.

Yeah, I think it's just, you know, personality. Grew up in a pretty strict Catholic household, so I had some morals instilled into me at the time. Um, but in general, I'm just fascinated by the tech. I just— I'm a naturally curious person. If I were to, like, you know, I have, uh, my own mission statement or about myself about, uh, how I'm just— I'm just really naturally curious. I just love opportunities and learning about anything., and I have a strong conviction about things when I get into them. I get very passionate. And so that carries me through a lot. And so the reason I mention all that is it was always about the learning. You've seen people, I used to read FRACK Magazine back in the day. It's a very underground magazine. And there is a lot of black hat hackers on there that, you know, it's got a little black hat vibe, cybercrime people they interview. Very cool stuff, always so interesting, but I just never was interested in that path. I mean, I was never a good hacker to be, you know, to be clear. Like, I'm not like very good. I just like to tinker here a lot. And so, um, the natural curiosity kind of kept me going. And then I learned through my dad too, was very business focused, is like, hey, you can make a career out of this computer thing. Um, we just hope you get through high school. Let's start with that first. As, as the first goal, again, I was an angsty teenager playing in punk rock and metal bands for a long time. They didn't know if I was going to graduate. But once I had that outlet, I, after high school, I really excelled and I was able to kind of make it to where I am today, which everybody's like, "Jon, grandma prayed for you every single day. We're so happy you made it this far." So, it's pretty funny, but that's kind of the curiosity is what drives me.

Yeah, I think that a lot of the hacker community can relate to that sort of thing.

Yeah, it's like—

Hackers are really just curiosity first.

Exactly. Many people have this story. This is probably not unique at all, so. But it's a standard path, if you will. Got to start with gaming, video gaming when you're 12 years old. You start there and then you don't know if you're going to be a black hat hacker in 10 years. You just don't know.

Exactly.

No, but it is a lot like wrestling. Like if someone's coming up in wrestling, no, they're going to local promotions, they're trying to get involved, they're sleeping on the floor, right? It is kind of similar. And some of the people don't make it into professional wrestling go on to break legs for the mob, right? I mean, it is a similar origin story.

That's good. Yeah. Yeah. And I learned a lot of that stuff through the band too. Like we sleeping on floors. Like we didn't know if we're going to make, have enough gas money to get to our next gig sometime because of theft or a promoter that wouldn't pay us or the show went really poorly. Like that's, those are all things that happened. So you gotta learn to be very uncomfortable.

Tell us a little bit about that. Like tell us a little bit about your time in metal and punk bands. What got you interested in that and what was that like?

Yeah, so when I was in— I'm trying to think. So I listened to a lot of boring music with my parents, right? Because again, they were a very strict Catholic family. So the most that they would get to is like '70s rock. And that's not even that fun. Like, I like some '70s bands, but like, I wanted more being this angsty kid. And so I eventually found metal. MTV Total Request Live, you see bands like Slipknot and things, you know, on there. Mudvayne, whatever. And so I was like, oh, this is cool. Dun dun dun. Like I was just, I was digging it. It was a good outlet too. And then I just kind of really got into it. And then I got a guitar, asked for a guitar for my birthday because some of my friends in high school were playing instruments. I was like, I want to do that too. And then with the computers, I could learn everything I wanted about music, guitars, all kinds of things. And it kind of started networking with people in the area with chat. I think it was Yahoo Messenger, AOL Messenger, one of those back in the day.

Yeah.

Met local musicians and played in my parents' garage because I was still living at home because I was a kid still. I was barely 17 or 18 and found some people and then we made some music. People turned out they liked it and we decided to be official. We released 2 EPs, never got a full album because we fought a lot and eventually broke up, unfortunately. The night we broke up, we were actually on tour. And this is really a shitty situation. I feel bad about it today, but we bought a tour van. Went out there across the Midwest, and I think it was like night number 6, our vocalist was like, Jon, man, I don't think I can do it anymore. I'm so stressed with all these nights. And by the way, he didn't plan any of the tour. He's a great guy, by the way. We're all kids. We're all kids back then. He didn't really do a lot of the planning, so I did a lot of planning with my other guitar player Dustin. And so we were livid because we planned this thing for like 6 months. And I would have done this. Dustin's a bit of a hothead. Great guy, they were friends. He does bluegrass music now. He's a totally different person. Uh, but, um, we just left Matt somewhere on the road in Kentucky and drove away. So, and, you know, wow.

Yeah.

And I look back, I feel terrible. I feel— and we've apologized because, again, we were just bad kids. Um, but We're all good friends to this day, but that's when we actually broke up. We couldn't recover from that one. So we had to call his dad to come get him, drive 4 hours wherever he was to go pick him up in Kentucky. But yeah. Oh my goodness.

All right. So, Jon, you've navigated the cyber world at a really interesting time, right? Some of what you're telling us about this, but you've touched everything from startups to academia. What's the best interview or strange experience you had during the kind of freewheeling era of cyber conferences and work you did?

Yeah, so I got this really good one, a story I always tell to people. And it was back when I was interviewing at Command. So I got this email from Jen Andre, the CEO of Command. She's looking to do the startup. I think they had like 2 employees at the time. I kicked myself, by the way, not getting back. I let that email lag and not respond for like 6 months. I could have made a killing. Who knows? But good thing she was persistent and she followed up again a number of times a year or a month later and eventually answered and then got on a call and she gave me the pitch of the company. I was like, okay, this is a really smart, intelligent person. She already was a founder of an existing startup that had a nice exit. It was called Critical Stack. She was executive over there and she's starting something new. I'm at the National Center of Supercomputing. I've learned cybersecurity at scale. I can learn more here too, but I think I'm ready for something new. And so this startup thing sounds really interesting to me and decided to fly out the next day. Talked to my wife, hey, off the call, can I fly out to Boston in the morning? She was like, good. We booked the flight, went there. I landed the— we landed the plane, coming out of the terminal, I get a text message. I'm expecting to go to my hotel and relax because I was super nervous. This is really early in my career, by the way, where I wasn't all that social yet. And I really didn't have that. I didn't build those levels of skills for business and things that you would need where I am today. And so I was very nervous and they pinged me and they're like, hey, Jon, come out to this Algonquin Club. It's a private club. They have them all over the US. The idea is it's like a club that was started, I think, in the 18th century for self-made men. Think about like oil and gas and whaling and all that stuff. Those guys, they put money together to build this club. And it's on to this day. So I was like, okay, I'm going to go to the club. I don't know anything about it. So I show up. They wouldn't let me in the door because I was underdressed. I had shorts and t-shirt on because I didn't know. I wasn't expecting to go here. So I was like, I have my luggage. And I'm like, hey, is there a bathroom I can go in and change so I can get in my— I'm going in here for an interview. And they're like, yeah. So I get escorted to the bathroom, change, put my suit on. I couldn't fit in the stalls. They're too small because I was a pretty big— I'm afraid to tell on the camera, but I'm pretty hefty. I'm like 270 pounds. I'm 6'3". And so I used to do powerlifting. But anyways, I start changing, dropping my drawers and all that. And a guy walks in this— oh, this immaculate blue suit. And he's got this great blond head of hair. And I'm like, God, that looks so familiar. I thought Leonardo DiCaprio was in the stall next to me while I'm unchanging. So I turn around embarrassed. And I don't know if it was— it looked a lot like him. I was like, holy shit, this place is cool. So then I changed, he leaves. I didn't see him the rest of the night in the club. I was looking out for him. But then what I did was I got in, 'cause I got this suit now, I passed the dress code, right? And I go up into this room where the bar is and I meet some of the venture capitalists that were funding the company. They were there and Jen Andre and some of the team. We're having a good time, we're chatting. And then one of the VCs, an angel investor in the Boston area, He, pretty honorary guy, pretty fun guy. He challenged me to a pushup contest. And the terms were, I was not expecting this by the way. The terms were if I win, outbeat him in the number of pushups completed in the given timeframe, which was 60 seconds, 1 minute.

Okay.

That if the CEO wanted to hire me after I do the full interview, which is the following day, that I would have to take the job. If I won. If I had lost, the terms were— I'm sorry, um, if I lost— I said it backwards— if I lost, I had to take the job. If I won, he was going to pay me out of his own pocket an additional salary, uh, he's got— he's got buku lots of bucks for me just because— just for the fact of winning the competition. Now if you look at the guy, he's pretty jacked. He's an older guy. He's probably just sick. He was probably his late 50s at the time. He's late— he's probably his late 60s now, but he looked like he could do some push-ups. And so I just started strength training like 8 months, 8 weeks ago, 8 weeks ago, because I was on the computer all the time. I got to get out of the house, actually need to start doing something. So I got into strength training and so I just started the Starting Strength program, was starting to squat and bench press and all this. I was just getting it. I was just starting to get progressively stronger, but nowhere where I needed to be. But I was feeling pretty confident. Like, yeah, let's do this. I'm going to get this extra salary. Um, so I go first. I knock out 27 push-ups in about, uh, 30 seconds. My arms gave out. I was done. He comes in, he knocks out 20, the next one up, 27. If I did 26 and he did like, no, it was like, okay, he could have gone to 50, he could have gone to 75. There's no way. But anyways, he won the competition. And thankfully, oh man, as a man that likes to keep my word I'm very big on that. I was going to take the job anyway, but thankfully it turned out awesome. The interview went well. The team was great. There was great chemistry, culture, and mission. And I signed the following day.

That is awesome. That is awesome.

Pretty good story.

That's like he got to pick. He got to pick the weapons, you know, he probably— Yeah, I love it. It's like a drinking contest with Thor.

He had leverage.

So Aside from the push-up contest, was there anything else about that that made that in particular stand out as an experience? And what, what sort of advice would you give to someone who is at that point in their career and they're torn between diving into a startup or sticking with something more stable and known?

Yeah, I think the biggest learning for me at the time was how important great teams are. And there are certain ingredients you need to make a great team. I think you need mission. I think you need really strong leadership. I think you need culture. I think you need skill sets and expertise, among other things. And I've been on a lot of teams that had skills, but they may not have great leaders, or I may have been on other teams that have leaders but not a great mission. And I think for me, we had all of the ingredients for this effort. And it was just like, it just changed the game for me. It was like a, it was like an epiphany, uh, because I, I learned like, oh, teams can really— like, where they're, they're just hashing out things and no one's getting like jealous of ideas, or, or no one's— they're actually focused on what's right, what the best answer is versus who came up with the answer and things like that. Because everybody's been in environments like that. If you had a big corporate job, it could be like that. And so the culture was just awesome. We all were very good friends, and it motivated us to all work for each other, not just the company, because we all respected each other at such a high level. It's— I don't want to let anyone else down. And that led us to, I think, Over a year and a half, we built and launched an on-premise SaaS product and got acquired not too much later. It was a very quick exit. It was just an excellent time. So, I think those are some of the things. I think, to the second part of your question, you have to think about your risk appetite and your risk tolerance. And you got to think about your level of income that you need to live the life that you want to, or if you want to even adjust your life, you can decide, I want to take in the lower salary, but you might need to downgrade to a smaller apartment, right?, right? You need to think about the amount of time that you have with your friends and family, your pets, all these things. And you got to be able to think about like, hey, am I really willing to give it my all? I'm talking— again, not every startup is like this, but I was working 14 and 16-hour days for over a year. You have to be able to commit to that. Now, for me, I loved it. Like, that wasn't work to me. I was excited to work to 2 AM. I was excited to get up at 6 AM. Like, That's not for everybody. And you have to find a company that really matches with you and aligns. But for me, it wasn't work. It was, it was, it was just, it was just passion. And so those are the things that I would think about if you're going to do a startup again.

Well, thanks, Jon. I think it's a good time to take a quick break. And when we return, Jon will go through our lifestyle polygraph. So please stay with us. You're listening to the No Password Required podcast. We cover cybersecurity and a lot of other stuff.

Welcome back. As many of you know, the lifestyle polygraph is a test used by the federal government to determine if a person is worthy of learning some of our nation's most important secrets. Here though, we use this technique for slightly lower stakes to determine whether our guests can join our fantasy Cybersecurity Squad. Jon, are you ready for the lifestyle polygraph?

Oh, I am ready. Let's do this.

All right, question 1: If you had to build a cyber team from TV or movie characters only, who's your SOC lead, who's your red team lead, and who's your HR partner?

This is a really tough one. Um, okay, so I'm going to start with the HR partner. I'm going to pick Leslie Knope from Parks and Rec. Is off the charts. She does all these team building exercises. She's great. I think she could, she could channel her energy to more performance-related things. She'd kill it. So that's, that's who I'd pick for the HR one. Okay, sock lead. Um, so I'm starting to watch the show called The Wire. It's an old show on HBO. Have you guys seen that? Yeah. Okay, so I'm not too far into it, so I don't know if there's a bad character arc for about who I'm gonna say. But Detective Jim McNulty. So I just finished the first season. I feel like his persistence on the investigative side is pretty good. The insubordination sometimes can— we can figure out how to focus him too, maybe. I think he could be a great Sock Lee, right? And then I guess an alternative one I could say if Jim McNulty is not a good fit— actually, this is not a good fit either. Dexter. Dexter is great at all the investigative details. I don't need him killing hackers or the offenders, but if we could also channel his energy into a healthy outlet, I think he would do excellent. Then— That's awesome. I'd say for the— the other one was the— I'm sorry, the red team leader, right?

Yes.

So, okay. So the movie Now You See Me, it could probably be any number of those magicians. Whether outside the box thinking, which is absolutely critical for penetration testing, because nothing ever goes the way that you want. You find things that you didn't know were there. So, I'd say, like, maybe Woody Harrelson's character, actually don't remember their name, but maybe his character in that, I think they could be someone to kind of get in and just figure out at all costs. So, that's my tiger team right there.

There's an episode of Parks and Rec where Leslie Knope, for whatever reason, is sidelined, like she's sick or something, or she's trying to take the day off, and there's an event they're planning, and she She leaves them really detailed notes on what to do and it all goes wrong. And she shows up in the last minute and she looks at it and she's like, "Did you forget to bring the keg of beer and give it to the Teamsters?" And that was it because they hadn't given the beer to the Teamsters. Everything else fell apart. No matter, they had done all the other stuff right, which is a great lesson on navigating bureaucracy, right? Like sometimes you just gotta remember, give a bottle of water to the flight attendant. You know, there's something you gotta do to be a human at the end of this thing, right? You can't just be— That is such a powerful message, that episode, that everybody working in bureaucracies has to watch it.

Oh yeah, 100%. And that's something, by the way, you know, as the teenager in myself, I didn't know all the dynamics of personalities and how to build trust and confident relationship with people. I had to learn that much later. So anybody that's watching this that's younger or earlier in their career, those are the things that are going to probably carry you the most far depending on where you want to go. Right? If you're gonna be a black hat hacker, you probably don't— it probably doesn't matter. But if you want to get in the corporate side of things, then it matters a great deal.

Sometimes I put up sticky notes that just says, ask how they're doing. Because I get on a call, I just want to get right into it. And it's like, whoa, hey, let this— you got to ask people how they're doing, check in. You can't just get right into the meat of it. You got to give it a second.

Yeah, treat us like humans. Exactly.

Yep.

Yeah.

All right, question number 2. You're the ultimate heavy metal producer with unlimited budget, time machine access, everything. So every ego in the room trusts your vision. Now it's time for you to build the greatest metal track ever made, the alternate universe anthem that would have melted faces across dimensions. Who is in the band? And what is the song?

I love, by the way, the dramatic metal language in here too, because metal is just so catchy, but that's what I love about it. It's just so absurd.

So same.

So I got a few vinyl— I collect vinyl here. So the first one, this is a very hard question to answer, but the first one is— this is probably one of the heaviest records ever to be produced. It's Marauders, Master Killer. So it came out in the '90s. It's not what you think about like modern metal, but if you think about metal in terms of entire essence, like add blue-collar-ness, right, to it. Add the lyrics, the, the, the, the focal points of all the, the just the heavy-hitting instruments, but not to the point where it's like doom doom or just drones on, because you actually have to have rest in music. You have to have rest and breaks to give access to things, which most metal bands do that today. It's just, it's just an onslaught and it's not that enjoyable if you ask me. But this is, this record is like a true representation of what metal is in my mind, from like a blue-collar metal perspective. And I'm just like, cool, I'm grinding my teeth every time I hear, like, yeah, I want to get up in, like, it's good. So the second one would be Metallica's 1984 classic Ride the Lightning, right? This is more— this is their second album, a lot more thrashy, uh, than what they've produced since then. I love it. We got a classic Florida death metal band called Death Uh, they basically created a death metal in Florida. Uh, this album's called Symbolic. I'm sorry, I got, uh, I'll do two more. No Warning, this is a hardcore record, and so it's, it's, uh, it's adjacent to metal. Think about punk played more aggressively. The lighting is not helping, but the album is Ill Blood. Um, there's two tracks on here, Behind These Walls and No Time for You. They're just absolute, like, jump in the air jams. So when I lift weights, I'm always playing like an Ill Blood. And then I'll do something a little different. There was a branch out of metal called metalcore back when I was in high school. This is kind of the stuff that I played. So this is a record called Every Time I Die. The album is Hot Damn. And it's what really got me into metalcore, which is like kind of a hybrid of death— or no, it's not death, but just general metal and hardcore. It's more fast, a lot more chuggier and faster riffs. Uh, with some melodicism in there sometimes too. But those are my— those are the 5. If I had— if I was a producer, those are the records I would want to produce. And I'd probably want to make a new band from some of those band members as like a supergroup.

So, Jon, can you— like, because of your appreciation of music, you know, as a listener, as someone who can play it, uh, and also understanding the history, when you're working, can you play music in the background, or do you get too distracted and you've got to really focus on it, like a headphone?

Great question. No, I get too distracted. I usually don't play music. Unless it's a low stress day. I don't get too many of those. So if it's one of those, then I'll put something in the background that doesn't have a whole lot of lyrics, but otherwise, yeah, I get too distracted.

Yeah. Yeah. I wish I could enjoy it without, just in the background, but I'm the same way. I can't. I just have to be engaged on it.

Yep.

That's what I'm thinking.

Yeah. All right. Third question. In Wayne's world, Wayne can't get enough of the '64 Fender Stratocaster in classic white. So if we were shadowing you during your peak metal era, what guitar would you be obsessing over and what song would you play to try it out? No Stairway to Heaven.

Oh, that's great. Um, okay, so I have a little personal, uh, on this one, or a little personal theme on this one. So we're back when I was playing in a band, uh, we played club in Evansville. It's no longer around. It's called 1123. And we played with a number of bands that toured from out of state. And, uh, I just got this new guitar. It was an LTD H300. They don't make them anymore. And, um, I spent most of my grocery money for the last 6 months to buy that guitar, um, back when I was working at the grocery store. I should be clear on that. That was one of my— I was part-time at a grocery store during high And, um, we went to that show, we played, you know, got on stage, we played. And then after we put all our gear away, the next band comes up, or you tear down real quick, the next band comes up on stage. Then we go mingle with the fans, watch some of the bands. I come back toward the end of the show, I cannot find my guitar. It— we talked to everybody, all the other bands, the house, everything, and it was gone. Uh, and so someone stole it. Uh, I don't know who— so someone stole the guitar. It was— it's actually a fairly rare guitar. Um, and it's a bummer, but to answer the question, that's what I would love to play again. It's not like that guitar was like phenomenal, but I just have an attachment. I have a love for it because of that, and I spent a lot of time making the money to pay for that. And by the way, I have a Google alert. It's been set out for 10 years. And so if anyone matches that guitar name on a forum that for sale, it'll send me an email. I've only gotten one match and it was over 10 years. That's how rare it is. So if anybody has an H300, if your listeners have an H300 or know someone that has one, please, I will buy it on the spot. Uh, I want that guitar back.

My, my partner works at a music store and is a certified luthier, so Okay, please, please ask him if he's come across that.

Yeah, LPD H300. So, oh, that's cool. All right, that's part of it. It's part of it. So it's just the lifestyle there.

Yeah, yeah.

I mean, if you're, if you're playing like punk and metal shows, yeah, like the worst, you're trying to get to your next gig and, uh, you're running out of gas and you gotta drive 3 to 4 hours the next gig. And we've had it where the promoter just leaves before the show ends, where they pay you at the end, where they start to divvy up all the proceeds. And so we had one time we had had other— because we actually were the far— the band that traveled the farthest. We, we played— we traveled 9 hours for this show. And, um, the other bands were so nice to us because the promoter left, and they actually chipped in their own personal money so that we could get to the next gig. Uh, and so, man, Yeah, there's also one— there's a couple wild stories. I don't get too far into it because some of them are pretty bad, pretty wild. Now, one time, one time we had— I was playing with this band, Grindcore Band. These guys were big, uh, with tattoos everywhere, huge gauges, pretty intimidating looking people. And, uh, the promoter was getting ready to also leave on them. One of the vocalists, huge dude, really tall, probably 6'5", brandishes a like 8-inch blade. And he's, he's in, uh, he goes into the office, beats down the door. The guy's actually in there, he locked his door so no one would come in there, and he's threatening him with it. Like, yeah, and see, they got paid, but I mean, you know, it's a little bit of a lawless land. You kind of had to do some stuff like that, unfortunately, if you wanted to. It was pretty rough, like And you just never— in the special, that may look, you know, it's a lot of blue-collar, right, listeners and stuff. So you see all— you see people doing heroin in the bathroom, you see, you know, vandal— it's just wild. It's just different, you know, different, completely different types of people.

So yeah. All right, so we get one full day.

I apologize.

No, no, no, that's why, Jon, that's why you can handle a 14 16-hour day in a startup, right?

That's right. That's right.

Been able to get through it. Yeah, you should be okay with some conference room lifestyle.

Yeah, I actually attribute a lot of my, uh, success to just being in that band, as we had to do so much of the do-it-yourself. You do in a startup, you wear many hats, as you know. So we had to do our own flyers, our own CD pressings, our own bookings. We were on MySpace every single day messaging promoters and venue owners. And nowadays I'm just on LinkedIn every single day messaging founders. It's like, it's like the same thing. Yeah.

It's true. Okay, final, uh, final polygraph question. You get one full day with peak 1980s Ric Flair, no rules, no limits, and access to any era. How are you making the most of that day?

Oh man.

And are you wearing your robe?

Uh, I am absolutely wearing my robe, or one of my robes, and I have to— and Ric Flair has to wear one of his most extravagant robes as well. And what we would probably do is we would have a photo shoot and we're walking down Ybor City in Tampa, the Cuban cigar district, and we're just going to have the robes dragging on the filthy ground walking down the street. And we're just going to be yelling woo on the nightlife while the events are going on at all the clubs down there. And then we'll do a photo op and then we'll go on the Ric Flair Woo Boat. So again, he's got a boat down at the Marriott Hotel. It says, woo, down the side. And so I want to take a boat ride with him. Um, and that'll probably be it. Honestly, Ric Flair is not my idol, to be clear. It is a funny persona, and so that's why we keep it. But I definitely want to have a light interaction, uh, with Ric Flair. So that would be something like that. And probably smoke a cigar.

I think that's a solid choice.

Definitely smoke a cigar with Ric Flair as well. You got to do that. It's Tampa.

Yeah. Yeah, absolutely.

I think you gotta hit the highlights. That's it. You've gotta hit the things he's known for. Check them off. It's a check the box exercise, but for a reason, because the highlights are very, very good.

That's right. So what do you think, Jack? Does Jon have what it takes to join our fantasy cybersecurity squad?

Yeah, absolutely. I think, you know, it's a great, Jon, to be able to know where you came from and where the adventures that you had contribute to what you're doing now and how you're helping all your customers and helping your colleagues. So, it's really cool that you shared your story with us. We really, really appreciate you being on the show.

I'm really thankful to be here. I do appreciate it.

Jon, if some of our listeners want to connect with you, what's the best place to do that?

Yeah. So, probably LinkedIn. Just add me on LinkedIn. Look for Jon Schipp, J-O-N-S-C-H-I-P-P. I'm on LinkedIn almost every single day. It's a big part of my job. So, I do a lot of outreach there. And so, it's a great way to get in touch with me. If you're local or go to conferences, reach out to me on there as well. I'm always up for drinks or cigars or dinner just to meet people. Again, social guy. We'll talk about anything. Doesn't even have to be cybersecurity. And then, jon@jonschipp.com is my email for this. Also have a Rapid7 address with the rest of the Rapid7 products. jschipp@rapid7.com. The last thing I'd say is I also do board advisory. And mentorship. So I have a few people in cybersecurity and software engineering that I mentor. They recently graduated college, as an example, help them prepare for their first job. In addition, that's pro bono. Uh, in addition, I do board advisory as well. So if you're a founder or startup and want help with your go-to-market, you want help with your product strategy and things like that, and just connections in the, in the industry, pitching, all that, just come to me. I do that as well. And just love meeting people. So hopefully that helps and hopefully get to talk to some people after this and hope this makes for a great show with you guys.

All right. Well, thanks so much, Jon. Well, that brings us to the end of the show. Thanks, everyone, for listening. For the entire No Password Required team, I'm Jack Klaby, and we'll talk again soon.

Woo!

Thanks for listening to the No Password Required podcast. Join us next time for more with your favorite cybersecurity personalities. In the meantime, consider liking, subscribing, and sharing this episode. You can find us on social media @nopasswordpod. The show is produced by Cyber Florida, and a special thanks goes out to our friends at Carlton Fields and Reality Shift. For more information, visit our website at cyberflorida.org/pod.

God.