Risking it All in Cybersecurity - Christmas Special - Troy Fine, Jeff Scheiss & David Forman

Good morning, good afternoon, and good evening wherever you are. My name is Jake Bernardes. Welcome again to Risking It All. It is beginning to look a lot like Christmas on that background, and also you'll notice the semi-wrapped presents in the back corner. Um, I'm genuinely nervous today, so I've got 3 people on today, 3 wise men. We'll stay on the Christmas theme. We've got 12 questions for the 12 Days of Christmas and we'll split them into GRC present, GRC past, and GRC future. For the Dickens fans out there, you'll notice that kind of quick reference. Between them, they have far more knowledge on this sector than I do. I've got some questions which I think may offend some of them, but we'll see how that goes. And if you have any questions, thoughts, concerns, comments, disagreements, please post in the chat as we go. But we'll get going quickly so not to waste any time. So Simon, why don't we bring the three of them on? Hello to all three of you. I have two traditions on this podcast, an opening and a closing, which Jeff, who's been with me before, will know. The opening is you introduce yourself with what is your hobby, which may be obscure and weird, your hero— mine is Alexander Hamilton if you've never listened to this before— and what is the biggest risk that you ever took. I know, Troy, it's ironic for someone that's British, but Go figure. Um, so go ahead, if we go David, Troy, Jeff in the order of my screen. Um, hero, hobby, the biggest risk you ever took in life.

Dang, why do I have to go first? We weren't preemptive with these questions. All right, so hero, hobby, and what was the last one?

The biggest risk you've ever taken.

The biggest risk I ever took?

That's actually pretty easy.

Okay.

All right, I'll start with hobby because it flows here. Um, I love sushi. So a lot of guys have golf. Um, I could talk like for hours and hours about sushi. Um, and when we say sushi, I'm not talking about like American rolls here. I'm talking about sashimi, nigiri, like the good raw fish on a bed of rice. Um, so if you guys ever want to talk about that, and, uh, sushi tourism, it's a big thing too. Um, done a number of trips to Japan, fortunate there. Um, hero, I'm gonna keep the sushi theme here. Um, big fan of Nobu. Nobu, the founder of Nobu Restaurants. He's actually like a philanthropist as well. And I think he also was one of the early kind of Benihana-like successors here in the US that brought sushi to Americans too. So we're more cultured as a result of that. I don't know much about his personal life, so if he is like a terrible person, nobody like—

caveat now.

Yeah, I'm going to cut that out. I don't want to get canceled. And then Biggest risk, uh, 2024 is a big year for me personally. Moved on from very stable job into entrepreneurship. So, um, from a professional standpoint, uh, it's been a big risk but very rewarding as well.

And who's the company you work for? What's the company you own and run?

Yeah, formal company name, Mastermind Assurance. Um, you can find us at mastermindassurance.com. We go by Mastermind for short. Um, and we are a pure-play ISO certification body. So all we do all day, every day, ISO audits.

Perfect. Thank you very much, Troy. On to you, sir.

Uh-oh.

Uh, I do want to say, how come we didn't get any Hanukkah love in the intro there, Jake?

I mean, it's true, actually.

Jewish Hanukkah starts on Christmas this year.

Good point. As a thought on my part, especially with the amount of Israelis that I work with, I'll, um, I'll apologize now.

Nah, that's, um, just give me a hard time. That's what I do. That's what I do. A hobby?

Memes.

Memes is one of my hobbies.

I like to read. Yeah, read, uh, non-fiction, uh, a lot of non-fiction. Uh, for example, I'm reading, um, Ryan Holiday right now. So if you know who Ryan Holiday is, uh, Right Thing Right Now, his latest book, that's what I'm reading right now. So those are types of books I like to read. Um, what was the other one?

Um, your hero.

My hero. My hero is probably LeBron James since I'm a big Cleveland sports fan and he finally brought a championship, uh, for me. And if you are American and follow sports, you know that Cleveland is terrible at everything all the time. So he's my hero, and I think he's a really good person. He handles everything really well. In the spotlight. And, uh, yeah, he definitely since high school has been my hero.

I like it. The biggest risk you ever took?

Biggest risk was probably giving up a job as an auditor on partner track to go work for a startup. Okay, yeah, that was probably my biggest risk. Uh, yeah, that's my biggest risk.

Okay, thanks, mate. Um, who do you work for now?

What do you do?

I work at Gales Norton now, and I am the director of ISO and SOC assurance services.

Perfect. Thank you, Jeff, to you lastly.

Perfect. I will keep it short and sweet so we can get to the real good stuff. So hero, it is definitely gonna be all the servicemen and women that fight for, fight for the country, especially this time of the year for, you know, all the holidays when they're away from the family. So appreciate that sacrifice. Hobby, golf. I mean, got a lot of hobbies, but golf would be one of them. The goal 2025 is actually get good at it. We'll see if that happens. Um, and risk, I have been skydiving several times, and the last time I went, I, I'm trying to think the exact altitude, I think we did 19,000 feet, which is above the, I guess, kind of legal limit in California without oxygen. So, and we, we did it without oxygen, so it was It was a risk because it wasn't easy to breathe and it was a thrill. So that was the risk.

And what did you do, Jeff, for those who can't read your top?

So I'm a partner managing director at Shellman and Company, where we're one of the leading cybersecurity assessment firms.

Perfect. Thank you. For anyone who wants to reach out to these guys, if you look at the event or any of the invites or posts I've made about it, the reference for all of them and their companies are in there. So we will start with the state of GRC now. Um, and we'll start with a nice easy non-controversial question. Is GRC now completely broken, pointless, and merely there for sales enablement? Who wants to start with that one? Because I've seen 3 LinkedIn posts that recently said that exact words.

David, what do you think?

Yeah, I just think it's an interesting term, like it's broken. I think it's evolved for sure. Um, and maybe we're gonna get into a little bit of past here coming up, but so I won't dive too much in that. But, um, I do think it's taken like a different, um, flavor, I'll call it that. And what I mean by a different flavor really is just what people thought of a SOC 2 report 5 years ago has changed. Um, and I, I really think what it stands for today is very much more table stakes in terms of baseline requirements that are needed for a service organization, um, compared to 5 years ago it may have been viewed more as a differentiator. And, you know, if we think about like compliance as a differentiator It could be revenue enablement. I think it had more of, um, that kind of angle to it 5 years ago.

It's—

when I say table stakes, it does unlock certain revenue for especially smaller businesses, startups today. But for midsize and enterprise, it's viewed as the baseline. You have it automatically almost if you service the North American market. Um, if you don't have it, it's considered weird and possibly a detractor to business. And, um, if you do have it, it's more or less a neutral point, like it's an expectation. So from the standpoint of the report itself, I will say the perception of the report has evolved from the entire marketplace, which I'm sure we're going to get into that topic. Um, I do think there are elements of it that might be quote unquote broken, that maybe that risk hasn't been exposed yet, but I think we are on a very interesting path that will either lead to, um, kind of a newfound understanding for this marketplace or there'll be a correction at some point as well. So I'll leave it at that without getting into too many other topics, which I'm sure are on the agenda.

No, thanks, Troy. Jeff, anything to add?

Let me also— I think, I think David put it well. I mean, we can start off on agreeing for sure is that it's not— I don't think it's broken. I mean, I think it has evolved, it's changed. I think that the perception of it has changed, and I don't necessarily think that that part of it is a bad thing. I mean, I think that you know, compliance needs to evolve. I think that the way that folks and organizations, you know, build a compliance portfolio needs to evolve. There needs to be enhancements, there needs to be more technology used from a testing perspective. So I definitely don't think it's broken, but it's evolved. But I do think that there are aspects of it that need to be honed in and focused on and, and really appreciated again, which I think that's kind of where the market has been moving away from the core of the appreciation of the intent of a lot of the audits, but it's definitely not broken.

We'll come back to that. Appreciate the intent. Troy, anything more on that one, or should I fire question 2 at you?

I guess real quick, I would just say I agree. I mean, GRC is not broken per se. I mean, if just looking at from an internal perspective, right, there are a lot of companies have great GRC programs internally, right? I think when we're seeing broken it's focusing on, you know, external-facing audits potentially, right, and the low quality that that's— and that's what I think people are referring to. But I think what's broken is the mindset of GRC. Right now people want like a piece of paper, they want this goal, they want to show leadership, hey, we're compliant, we're certified, right? But that's not really what the intent of GRC is, is to manage your risk, right? I mean, that's the whole idea, and you always have risk. It's not really about getting a piece of paper. Compliance should be the byproduct of a good security program. Compliance shouldn't necessarily drive your security program. And so I think what's broken is that compliance is kind of driving a lot of security programs. And that's good for initial smaller companies that need to start somewhere. But as you mature and grow, compliance should be a byproduct. It shouldn't necessarily be the driver, in my opinion.

So—

No, I think that's right. And I'll stick with you because you kind of poked this kind of thread. One of the things that's happened is obviously it's becoming front and center and becoming accessible. We talk about the democratization, particularly of SOC 2, the fact that it's become available to anyone and everyone. And you'll find startups that are tiny, barely have like a product team, but yet they're SOC 2 attested, or they'll put certified very frequently. I know you love that, Troy. Um, but do you think this is a problem? Because I sometimes think now, does it— is there a meaningfulness to— if you look at like a SOC 2 state, a reality that the security, the compliance underpins it in a Fortune 500 versus a tiny startup who have the same attestation and the same claims, have we kind of devalued and kind of start— are we starting to chip away and decay at what those things actually mean because we've over-democratized the availability to anyone and everybody? To you first, Troy, since I was with you already.

Yeah, have we? Yes. Well, I think it's definitely— I know, I think David would probably agree with me on this, or disagree with me on this, but I think that the value of SOC 2 and ISO 27001, PCI, you name it. I think the value or the perception of the value has definitely been downgraded over the last, last 5 years. You know, I think the problem is, is that people, they don't— there's 2 problems. One is people who are getting their reports don't even understand what's going on in the audit or why they're getting it. They just— they're told to get it till they get a sale. And then two, the people who are relying on these reports at these companies don't understand what they're looking at either. So you get like this like mixture of like whatever, right? And that's the— that's kind of the state we're in. It's like, what do we do with these things? Why are we doing it? Oh, they wanted it and we got that sale because of it. Okay, that we should do it. This is good, right? And that's kind of what it's turned into. Um, so because of that, the value has become kind of what David said. Is that, you know, it's to generate sales. I don't think that's a bad thing necessarily. Like, I agree, David, that's not, it's not bad that that's what's driving it, but when that's the only driver, I think that becomes a very transactional thing, right? Like, we missed the point of what GRC is supposed to mean, and it just becomes, I need this report to win this work or to keep this client, so what do I have to do to do the baseline to spend the least amount of money to keep this going? And that's what's kind of happening.

Yeah, David, go ahead since you're going to disagree.

Yeah, um, I agree and disagree with Troy as always. Um, I do think the values change. I do agree on the transactional component. If you just tie your like driver for why you want to go get this certification or report, um, just to like sales enablement only, um, you're going to end up missing the mark in terms of intent and like actually building compliance like I'll say continuous compliance outside of like maybe what will be point in time for an auditor to look at. Where I disagree is I hope every organization worldwide that's a service organization seeks out something like SOC 2 or ISO 27001 in the short term. And the reason why is I view it more as a baseline. And if I articulate that a little bit differently, it's almost like a reporting standard, like the same way in the US where we have financial statements, And we're familiar with like GAAP reporting on how we are going to articulate what is net income. Um, I view that very similarly for security. It's like, what is, um, the minimum expectation if you are going to have customers who have end customers as a service organization in terms of what an acceptable use policy looks like, or what you need to do in terms of information backup or MFA or just end-to-end encryption if that's pertinent to you. And that's where I think there's a lot of value to those types of standards or compliance schemes. It gives an organization that might be starting from nothing, like, the generic, like, here's what you should be thinking about in terms of initial policy set. Now, I have other thoughts when it comes to how you implement that initially and whether or not you're using just like a policy library or something of the sort. But I will say, I think it's very good if you think of it like a reporting standard. It creates commonality, it creates comparables, it allows for you to assess a vendor, whether they are 5 people in terms of FTEs or 2 million people in terms of FTEs. In terms of determining whether or not like they have minimum security expected by whatever other standard regulation that exists out there in the marketplace.

Hmm. Okay, thanks. Jeff, a slightly appended question on that kind of topic for you. When you talk about the democratization of SOC 2, you've obviously got down to the point where now it can be— I've seen audits for like less than $10,000 in SOC 2, which just seems absolutely mad. And when you're trying to sell a service like you do or Gills Norton do or Mastermind do, which is aimed to be more of a premium— we'll get into premium versus budget assurance in a while— Is that making it much harder to actually try and pitch the intent, the meaning, the real outcome when people are just going, well, all I need is the certificate and that cost me 10 grand. So, Sheldon, I'm not giving you 50 grand.

Yes. I mean, no doubt. And it's a barrier to entry for sure. And I think that, you know, we go back 10+ years. I mean, Sheldon as a whole always been, you know, positioning ourselves as a premium provider in the market. But we had a lot of success with startups because we were able to show our expertise and we were able to, you know, have very informed discussions and work with them to understand, yeah, you might be paying more than some other providers, but you're going to get more in return. You're going to get our perspective on how to, you know, really build out a control set for scaling, you know, because we, we were— look at a, you know, every one of our clients that We're not going to look at it a one-term, one-year, you know, assessment. We're like, okay, where are you going to be years 2, 3, 4, 5? And I think now that that's part of the problem is that when we have those discussions and we show that value prop, the message isn't being received because there's so much noise in the marketplace. They're able to say, great, I appreciate what you're saying, like it makes sense, but you know, every dollar counts. We're going to maybe consider you, you when we get to years 3 and 4. So it's just, it's a big barrier to entry, and they're not able to actually, you know, take that value and apply it to their business now just because they have so much available. And there's so much— I mean, I'll just say marketing jargon out there that, that says, hey, look, you— it's lessening the value of the, the product to just say all you need to do is get something in hand. And I think David and Troy touched on earlier as well, is it's, it's a sales mechanism, and they're looking at it purely if they don't have it in hand by tomorrow or by, you know, a month from now, it's gonna not allow them to close deals. And, and we respect that any startup or any business, they need to— you're only doing this on behalf of the business, so you need to allow it to generate sales. But you have to look at in return that you need to give a quality product to give comfort to your customers. That's why you're doing it in the first place. So if you're giving them a bad product, you're kind of, you know, shooting yourself in the foot a bit. So anyways, long answer short, I mean, I think that it is a huge barrier to entry and it's something that, you know, we're trying to get creative and come up with solutions of like, you know, a tailored version of a SOC. ISO is more prescriptive that there's not much you can do to tailor it to an organization. I mean, they can reduce their scope, but yeah, I mean, then that's where it kind of gets back on us as a firm is, okay, take our experience over the last 22 years of operation and try to apply that to every size of business to come up with something. And that's ultimately what we're trying to do.

Yeah, let me, let me ask you a follow-up question too as well, and I'll go the opposite direction. But, um, so you talked about noise in the market in a very competitive space, and I think that I'm definitely having— I'm seeing that now. But I think the other side for me is like a crazily noisy regulatory landscape where like there's always something new, like, and they're always contradicting each other. If you look at like some of the stuff coming out of Europe in like NIS2 and the critical infrastructure is very different from the critical infrastructure regulations and discussions in the US. Look at the previous laws interstate in the US are different. AI is completely all up in the air in terms of who sees what as the right way to approach this. Is an increased amount of regulations good? And does that mean that we're driving a conversation to try and improve and mature the baseline as you talked about earlier, David, that kind of you've got this is the minimum acceptable limit. Or is this just causing chaos and confusion because there's so many things that all disagree with each other at the same time?

Yeah, I mean, I'll say it means a bit of both. I mean, I, I would say I'm not a fan of over-regulation for, for really anything. I mean, I think that that can kind of steer the ship sometimes in the wrong direction. Um, I, I, yeah, and I think that if there's uniformity across the regulation, it can be a good thing. But when you have competing understandings and perception and definitions That's where folks get confused. And ultimately, you, like anything, if it's overwhelming, you kind of say, okay, I'm going to push that aside and I'm going to focus on ultimately, you know, the one task at hand. And they don't look at the bigger picture. And that's what we work with a lot of enterprise organizations is to kind of maybe, you know, we don't help them build it, but we help them, you know, implement, or I guess assess it, is like a unified control framework. And that can lead to a lot of value for an organization that is trying to build a scalable environment to, you know, appease NIST and, you know, all these competing regulations that have slight variations. So you can see those variations a little bit easier from a tangible control perspective and not just from a legal jargon perspective.

Yeah, makes sense. Troy, David, who wants to go next on that one?

Yeah, you beat me up here because, um, this is why ISO 27001 is so great. Um, in all reality, um, it's a management system that's supposed to flex to additional controls that are applicable to your environment based on risk. And that risk could be a regulatory driver. I mean, if you look at some of these popular schemes internationally, the US, TISAX in Germany for automotive information security, if you go look at its control set, it's literally the same font as ISO 27001, the standard. They're literally building on top of it. Same thing with HDS for health data hosting out of France. So they're leveraging that management system approach, which is really just a fancy way of saying a governance program. And abiding by additional controls that have a different taxonomy risk, whether it be automotive information security or PHI. Um, so ultimately I'll say, um, as an auditor, yeah, it increases our total addressable market, no doubt about it. Every time we get a new GDPR, EU AI Act, NIS 2, DORA, like, great. Um, there's people that are now focusing on this that might be in a different buyer segment, like legal departments in a company, and they're going to say, all right, what are we doing to get ahead of this, be proactive? Um, from the standpoint of just like compliance and certification attestations, opinions, um, I'll say like regulation really doesn't do much because oftentimes there aren't certification mechanisms or equivalent. And if there are a certification mechanism, we just look at like the GDPR, for example. GDPR certification exists, but it's just for such a narrow processing activity. You can't go get like a management system-wide certification for GDPR. The closest thing you can get is one of these ISO standards, 27701. So I think it does create noise in potentially a negative way. And to Jeff's point, like a unified or a common controls framework, I mean, that's the entire value proposition. Let me implement one control set of 100, 200 controls depending on who I am, and then let me just show how these controls meet at an attribute level the underlying risk that we're trying to mitigate here. So I think that's a very mature mechanism for a service organization to implement. And it's very uncommon to see that type of foresight for a startup or small business who, again, is just viewing one of these reports as transactional at the moment because they're trying to unlock revenue and every dollar counts.

Yeah. Okay. Troy.

Well, hard to follow those two answers, but, uh, you don't have to if you have nothing to add.

Just—

yeah, I'm not a fan of overregulation either, but I'm also not a fan of underregulation. Like AI, right? I mean, like, what's gonna happen with AI, right? It can't be the Wild West, right? I mean, greed will take over and, and money will, will do things that, you know, people will do things for money that they shouldn't with AI if we don't regulate it. It's just human nature. So you can't have nothing, right? Like, especially when it comes to like AI. Um, I think CMMC will be an interesting experiment.

Yeah.

Uh, because that is kind of— they built and I— it's very confusing, and I can't even follow like all the regulations for CMMC and what's happening. But apparently something big happened like 2 days ago, but still it's not official yet. So this is, this is the problem with the regulation, right? It's been 5 years since this thing came out, and like 2 people on LinkedIn can tell you what's going on exactly, right? And people in the government can't even tell you, right? But once it is live and once it's fully going, which I think it'll be in the middle of 2025, Um, it'll be an interesting experiment. And do I think that contractor should be given national defense information without any regulation in place and do whatever they want? I would think most Americans would say no, that's bad, we should have something in place. So in that case, I think that's a good thing that they're doing that. Will it move the needle in terms of like lowering risk, or will it just become a checkbox thing that doesn't actually lower risk? That remains to be seen, but there's 80,000 contractors that need to be certified. So if the market's going to be the market, then there's going to be providers out there doing the same thing that's happening in SOC 2 and ISO 27001, unfortunately. But the regulation's good. It's better than having nothing in that case. So, okay, something is better than nothing, but too much is not better than something.

That's my— okay, I think then summarizing the current state We don't think GRC is broken. We think it's evolved in some ways good, in some ways bad. Um, we think that it has become as compliance the driver for security in some respect, and therefore potentially over-democratizing. As much as a startup SOC 2 might have a different meaning or different outcome to a Fortune 500 SOC 2, and there's a confusion around kind of what those really mean and what they represent. And that as we increase this regulatory landscape, we're seeing a hockey stick increase right now. It obviously drives better behavior but also drives a lot of confusion, and it's hard to work out which is the one that's valuable. And I agree, the point is if you find an underpinning management system and/or unified controls approach, then you have a better way to just say, I don't really care what happens, I'll just pivot what I have to whatever they will ask me next. Um, I'll stick with you, Troy. So going to the kind of the, the ghosts of GRC past, uh, how did we get here? You use a phrase that I use a lot on LinkedIn, sock in a box. Um, for those who are listening, What does it mean? How do we get here? And why is it a problem?

What does it mean? It means, uh, that— well, here's what it means to me. To me, it means that you sign up for software and they tell you what to do and you follow it and you get your green checkboxes and an auditor comes in and just looks at the green checkboxes and said you're good to go and you get your clean report. That's what SOC in a box means to me.

Agreed.

Which I think is being scaled, yes, but by the various startups. What was the other part of the question?

What's the problem? What does it mean?

What, what is the problem? What does it mean? Well, it kind of goes back to the first question about lowering the quality and, you know, commoditizing, commoditizing, whatever the word is, SOC 2. And making it more transactional, I think, and lowering the bar and just devaluing it. I think there is a market for people to use those types of tools, but the tools can't be shelfware. They can't just be set it and forget it and hope that your GRC program or security program is good. You need somebody to own it, and they're being sold as SOC in a box, you know, click here, do this, do this, and then you're good to go. You get your SOC 2 report. I mean, that's a great measure of success, I guess, but I don't— in the long term, I don't think that's really helping anybody. Short term, sure, you get your sale, you move on, and you can survive as a startup and win work. Um, but if that's the mentality and that continues, uh, then what is the— you know, what are you building with these tools, right? I mean, it just creates a false sense of security and compliance, I guess, also, which to me is a, a major thing that people might not realize is happening.

I guess to press the question further, what changed? You obviously used to work at Drada, went into the space. I was an early customer and adopter of Drada, so I like— I have no, no bad or negative to say here, but both of us initially thought this was a great movement and are now both thinking that it's not. So what's changed in that approach, either in the way the customer is dealing with it or the way it's been presented or the way the auditors or what's happened over time in the evolution that's made it go from being a good idea to a less good idea?

I think a couple things. One, I think VCs got greedy. So VC money got talking and marketing dollars went up and VC came in, right? That's one thing. VC is not bad. I don't want to say it's all bad, but, but that's what happened, right? They had to show return. They had to do whatever it takes to, to show return to investors. And two, you had audit firms popping up that were either associated with these providers, or they associate with 3 or 4 of them, and that's how they built their revenue base, right? So when that's your source of revenue, um, you have to audit a certain way, in my opinion. And you have to have a price that's a certain price, in my opinion. In order to meet that price, you have to do things to lower your internal costs. How do you lower your internal costs of professional services? You either do less work, spend less time, lower your labor costs, outsource the work. Um, I don't know, those are, those are the two big things that people do to lower their costs. Um, and that's a problem, right? So if you're outsourcing the lower quality people or you're spending less time on doing the audit because you feel you can rely on the technology, uh, that kind of leads to, to not, not good, right? I don't know what else to say.

No, no, I, I agree. For me personally, is my opinion is that the tools didn't have— didn't develop or evolve into a problem. What evolved as the issue was the relationship with the auditing firms. And all you obviously got is an auditing firm reliant on a certain company revenue. Your, your natural inclination is, if I keep failing people on this system, am I going to lose that source of revenue? And at that point, you're being controlled by the vendor and you've lost independence. At that point, it becomes a really complex issue. So I know I'll go to you, Jeff, and I'll come back to you, David, at the end with a slightly different phrase of the question. But where does that leave you if you are an auditor who's reliant on a revenue stream from a software vendor for whom will dictate what your prices are? They'll provide you with steady stream of work but dictate your prices, which effectively means you're kind of a little handcuffed into kind of having to say this is great and pass every check. What does that mean for you as an auditor for an assurance provider? Like, what does that result in?

I mean, simply put, it's a conflict of interest. I mean, you know, being a CPA firm, you have to, you know, abide by a certain set of ethics that, uh, you know, allow you to make independent decisions where you're not connected to ultimately or paid for from the outcome. So I think that I know in reality that there are partnerships like that that exist, I don't— I'm not here for it. I don't support it. I mean, I think that we, we really— that is kind of the, the centerpiece of what is commoditizing SOC 2 and some other assessments, is that they're selling these GRC platforms as a package that, like, you, you buy the platform and you get an audit, and they really need to be two completely independent pieces. I mean, of course there can be partnerships I mean, Shellman has partnerships, everybody's got partnerships. I mean, that's business, but it's how you approach those partnerships is what is key. And I think, you know, you need to, you know, as the best interest of the, you know, the, our customers that, you know, that are going to be using the GRC platform, getting an audit, it's in their best interest to have those completely separated. Again, knowing that they're partnerships, of course, but they, yeah, there really should not be any interconnectivity because that's where, you know, where is, where do you draw the line and where do you see that line? And I think that that line evolves. I mean, it's— I think it's moved in the last year, year and a half. I mean, I think that it just continues to get tougher and tougher to have that independence. And, and, you know, I think a good audit firm, a respectable one that is out there trying to, you know, produce really strong, the core of what SOC 2 and ISO is, um, they're not making those partnerships. They're really wanting to have those informed discussions and say, great, you're using this tool, no problem at all, we respect that, but we want to approach it the way that we're comfortable, that our ethical boundaries stand. And when you try to sell as a bundle, you know, you— I think you lose that.

Yeah, thanks, Jeff. I agree. I want to come out of the any kind of vendor bias and come back from that. So David, slightly different phrase to question. You've also got two different models there in terms of the assurance and the provider themselves, from kind of what is a budget assurance provider will bring the cost down to make this sock-in-a-box kind of costing work, versus premium insurance says this is our price because this is what we're providing. I don't really care if they can do it for a quarter of the price. I suppose two parts of that question is one is what are you getting and what's the value of doing a more premium assurance offering? And the second part, we talked about how the certification, the attestation, attestation are the same, are the same, are the same. So how do buyers or customers get smarter in trying to understand where real assurance work and real insights been provided versus where boxes have just been ticked?

Yeah, that's a good question. And, um, it goes back to this conflict of interest that Jeff was talking about too. And, um, it— I think it can show itself in different forms. Um, it's not always just, do I have like a sketchy partnership with a compliance platform that's feeding me leads and maybe there's referral fees, kickbacks, commissions, or some other form of compensation that's under the covers there. It's not public to the buyer. But in what you're kind of describing, which is just differences in budgets for the same work stream, for presumably the same or equally weighted deliverable due to accreditation or just whatever the license looks like behind the deliverable, I think what it comes down to— and this is my opinion and my experience— but whenever I— and ISO, there's a concept called transfer audits. So essentially, when you have an incumbent organization that is certifying— certification— or sorry, Certified Organization A, and Certified Organization A wants to transfer that certificate to a new certification body, we get to see kind of under the covers of like, what was the prior audit report look like? What was the extent of the testing? It's not just the certificate deliverable we're looking at, it's part of that transfer review. And I'll tell you, it's depth of testing. It's amazing, really, kind of what some certification bodies can gain reasonable assurance over with the amount of testing they're documenting here. Now, that's a gray area within the ISO standards, for example, and I know it's a gray area with SOC reporting as well. It's like, at what point do you have this concept of reasonable assurance when you're testing a given criteria or control area? Um, and that is, um, always kind of comes down to what they call auditor judgment, which is just fancy terms for saying like, it depends. Um, it depends on what you're looking at, it depends on how comfortable that auditor can get over your environment. Maybe there's some continuity there, which has created that judgment. Or maybe there's like other sort of like reliance type testing going on where they are familiar with the system providing the data and they can get comfort over like, you know, a test of one versus a sample of a total population. With that being said, it all comes down to budget. Budget translates into level of effort because you're literally dividing that by number of hours you, or your bill rate to determine number of hours you have for an engagement. And I'll tell you what the trend was originally. Like, if we could just go back 5 years ago, it was how quickly can I like audit these controls? Then that turned into, okay, I'm going to do this quickly, but I'm now going to use a junior resource, meaning somebody whose bill rate hasn't escalated yet to like what you see for like a manager or partner level, and maybe even are like what we call university or campus hires. So 1 or 2 years of experience. Um, and then that shifted to offshoring. Now we said, all right, where can we go find the cheapest labor in the world to do this on a per hour basis. And now what we're seeing is like the use of AI agents to do this. So it's not even a human anymore, it's just automation here that's performing automatic tests. And so at some point you start losing that reasonable assurance element because you either don't have a human at all making decisions on this, or that human is what we would call incompetent. And that's not to be like a slur, like negative, but it's like you lack experience and skill. Um, and so I think that's where it comes down with these firms, like Yes, theoretically they can produce an equally weighted deliverable. For example, an accredited ISO 27001 certification, a SOC 2 examination report that has no exceptions listed on it, yet they are part of the AICPA peer review program, whatever that weight still has. Um, and, uh, it, it comes down to ultimately, will the end user, the reader of these reports, accept it? And if they accept it, then maybe there isn't any issue here. But the way that I was brought up in this industry, and I have the traditional Big Four background, um, you have to go through traditional reasonable assurance type tests. And that doesn't just mean look at the surface of the control and the evidence you're receiving, but also going behind and seeing what systems are populating that data. And, um, I just don't know how you can do it for, you know, doing ISO 27001 certification for $4,000. There's just too many hours you need there in order to test the 93 Annex A controls efficiently, even from the most broad sampling requirements that you could possibly apply to that.

Yeah, I agree. At one point you made about the non-exceptions is a bit of a bugbear of mine. I'm kind of an advocate of true transparency. I think we should show trust centers pen test reports, compliance reports, warts and all, and talk about how the fact no one is perfect. But it's hard when you have tiny startups who have exceptionalist SOC reports and perfect ISOs. And where a lot of people are like, well, why is yours not that? I'm like, because I let someone actually look at my reality. Like, have we talked about real things? Um, question to each of you is yes/no question. So I'm obviously part of a company that works in GRC automation anecdotes. There's Hyperproof, like us. Troy, you came from Draada. Draada and Vanta unarguably changed the game in terms of compliance automation by connecting applications through a technology stack to give real-time or near real-time attestation to whether a control was working or not in a technical logical sense. That's changed auditing and made all these conversations we're having today. Um, David first, then Troy, then Jeff. Is that positive? Has compliance automation made things better? Yes or no?

Without any justification? Yes.

No justification. Okay, Troy.

Made it Mm, that's an interesting question. Has it made it better? Um, no, I'm gonna say no.

Okay, interesting.

Jeff, I was— yeah, this tough is to say yes or no. I mean, if I was going to say yes, it was going to have a massive asterisk next to it. So I'm gonna double down with Troy and say no.

Interesting. All right, I like it. I'm gonna give no context whatsoever. I want to just leave out there and see what people thought. We've had large parts of this movement. Um, summarizing, I suppose, the how did we get here, I think we're fairly agreed that we've got to a place of what we call SOC in a box. For those who want to understand, that is basically ticking boxes to get your SOC report through vendors. Um, that software— and I agree, Troy, always fantastic intentions that create startups, and then VCs start to drive them into places that usually mean they have to do things that they didn't necessarily want to do ideologically. And you get to a point where you've got these auditors who are controlled by and/or compensated by software vendors and therefore have a bias, and there's conflict of interest, Jeff, as you pointed out, which I entirely agree with. You get this difficult— then, David, I like your point of if no one really cares, is there a difference between premium and budget? It's a good question because I teach a lot of people who say no, there isn't a difference, I just need the cert, right? And that shows this kind of sales-focused view of compliance versus this security focus, which you said, Troy, right? That compliance is a byproduct of security, not the opposite way around. Which people often see all around. So I guess the future of GRC is the last point, the ghost of the future. So I've seen this a few times, and you're all auditors, so I'm curious to see how aggressive you respond. But, um, David, you point out the use of AI, and we also talked about automation of controls in terms of multiple vendors who do this. Are we looking at a future where there's no auditors? Are we looking at a future where we connect straight from tech stack to platform to certifying body and your effective role right now doesn't exist in its current form? Is that a fair or ridiculous statement, David?

That's ridiculous. All right, I'm not gonna write it in there, but no, there's always going to be human decision-making elements that are required, and that's like a core tenet of AI governance. And so if AI is that future and we're saying automation is going to be increased in its utilization, then it's going to be more competent humans that are needed in order to validate those systems and the output of those systems. Um, but, uh, you asked the second question there. Am I okay to answer the future of GRC, or are we waiting on that?

No, go ahead. Okay.

Um, I, I think you almost kind of touched on it, but I, I think it's these very public, like, trust centers. Um, and trust centers need to evolve too. Um, the current trust centers, like, 9 times out of 10, it's a red light, green light situation. And like, let me show you my, you know, certificate deliverable or equivalent. Yeah, um, that's fine. That's, um, definitely the starting place for, um, where I think trust centers needed to be. But, um, in all reality, you should be able to self-service the actual test that's going on.

Oh, David, you're preaching to the choir. I've literally been trying to convince our product team that we should do this, but none of our customers think it's a good idea. I'm like, let's have every control live in the trust center so they can actually see what's happening now and real time and ask questions.

You should be able to, and you should be able to do it through continuous monitoring as well, which, um, there's elements of Kanban continuous monitoring that you'll find in other schemes today. But continuous monitoring is very, very early in terms of adoption. You know, we talk about Type 2 periods, which there's an element of that that's applicable to ISO. It's really more of a point-in-time assessment though. But for SOC reporting, SOC 2 Type 2, everyone's familiar with typically a 12-month period. And that's saying, you know, I'm going to go test once a year that the controls were in place and working for that period of time. We should be able to run that same test as, you know, self-service end users of the service organization in real time as well. Now, there's obviously an element of privacy and confidentiality that will need to be embedded into this type of future state. But I do think trust centers have a long way to go in terms of truly providing trust at, you know, a landing page. So I'm excited to see that happen because I think that's going to create a lot more transparency and authenticity. Behind what is actually being provided as part of that third-party assurance.

Troy, I'm going to ask you a question based on what David said and continue down my slightly antagonistic theme. He just basically described a live Trust Center where you can query controls yourself and effectively run the test as and when you want to. Doesn't that mean at that point I don't need you guys to provide reasonable assurance because I can get it myself from the Trust Center?

Yes.

So is that the death of auditing?

Well, I don't think that— I don't think— what I think the death of auditing will be is that the market loses trust in the audit ecosystem more than anything else.

Oh, is that happening now because of the budget assurance, stock-in-a-box type stuff we talked about? Do you think that's already happening?

Uh, I do see— I, I think there have— no, because there's no viable alternative right now. Okay, like, like maybe what you're saying, like being able to self-service and do yourself. Could be the future, and we're probably a long way from that, but that could be a viable alternative. Um, but I think that I, I don't think people haven't lost trust because they can't, if that makes sense. Like, like, they're, uh, they have nothing else to rely on. And so, like, you have to rely on a SOC 2 report or an ISO or a questionnaire or whatever other due diligence you're performing. So, so right now, no. But, but in 5 years, if the big players decide we don't even want your SOC 2 report, we're going to do our own thing and have our own agent on your systems that tests the controls we want to see. Forget about this SOC 2 and ISO and everything else. We have our own assurance. And if you want to work with us, you need this agent installed. And we're going to monitor and get alerted if something's out of, out of compliance. And we're going to be like, what's going on here? Hey, why is this control failing? I think the bigger players are starting to think of that, to be honest. So if that starts happening, then yeah, why do I need a SOC 2 report if I can do my own assurance on my suppliers?

It's an interesting concept if everyone starts installing agents on all of your endpoints and your cloud infrastructure, what also the compute headache would be there and how that would actually form a commercial domain. There's an interesting whole different line down there. Um, Jeff, slightly twisted, different question. I guess one thing that I'm always conscious of is that passing an audit is a bit of a dance. Like, people come, you're kind of pre-prepared, you know what they're going to ask you, you kind of know what the control is going to be, you've kind of phrased and kind of created that moment in time. One thing I've been talking a lot recently at dinner events about is the idea of compliance red teaming, that like audits shouldn't be pre-planned or pre-discussed, that like you shouldn't even know they're happening. They're almost at David's point that someone can access either remotely or whatever it is to kind of test your controls and assess your position based on the on you not being able to prepare and know what's going to happen. What do you think? Am I on to something? Is this a marketable idea or is this an awful thought?

Definitely not an awful thought. I think that the tricky piece with that is, I mean, really how practical it is. I mean, and what the end goal is. I mean, we're just looking at the core. I mean, most of the time we've been talking about SOC and ISO, and I think David and Troy both touched on this part of it, is that it's a reasonable assurance assessment. I mean, the goal isn't to get absolute assurance. So the red teaming approach, I mean, that just, you know, adds another layer of complexity, formalization that you're gearing towards absolute assurance there. And then it's ultimately where does that risk, you know, lie? So I think that there could be something there. And I think red teaming is very valuable. You know, obviously it's very specific right now, like, you know, federal type assessments, whether you're FedRAMP or, you know, StateRAMP, et cetera. But in just general pen testing and in best security practices. But when you come to organization, it's just, I don't find that to be scalable or appropriate for all organizations out there. We still have to look at and respect that there's going to be, you know, versions A, B, and C of every company, a different stage of their growth. And I think that they— maybe there could be some formalization around what types and size of companies need to go through what version of a SOC or ISO. I mean, just throwing that out there, never really thought that much through it, but I mean, if you're going to add some complexity to it, maybe breaking it down from that perspective, because I don't think that you could or should do that type of approach for all organizations. Um, but yeah, I mean, I think, you know, one thing I did want to touch on, it just because it's kind of in the same vein of the question before, but one, I mean, there just needs to be simply more attention to who's auditing your systems and who's producing the report. And there needs to be more transparency on— you know, I know there is the AICPA, there's a peer review process, and people are supposed to publicly, you know, display the results. Not all do, but I do think that some bit of a format of like a FedRAMP marketplace could be really valuable where, you know, assessors can show who they're assessing and some high-level results. So it's kind of a hybrid mode of some bit of a trust center from an audit, you know, an auditor, you know, the company perspective, as well as that kind of a marketplace point of view where there could be some— not grading or, you know, whatnot, but there could just be more transparency from, from that perspective. I think could, you know, add a little bit more trust to the external marketplace of, you know, who's performing the assessment.

There's two things in there I really like. One is this idea of like a tiered SOC 2, so you could actually have some differentiation between the one that a startup gets versus the one that a fortune gets, what the difference actually is inside of that. Maybe it's deeper or more granular testing or whatever else it might be. And the second is the idea of compare and contrast between auditors, almost like a shop approach, which I like. I think I've told this story to people before, but I moved off of Shell once and went to a very much cheaper provider, who gave me an outsourced Russian auditor who spoke questionable English, and who I spent, while I was on vacation in the Maldives on a beach, I spent about an hour arguing about the requirement for time sync protocol in AWS and whether that was really a thing in 2024. And then about key rotation, everything else it could possibly be, 'cause he was going, as David, as you will know, word for word through the ISO standards. And regardless of whether I explained this wasn't relevant, he was insistent that it was. So another kind of sing-off, kind of quickfire question with no justification. We talked about what we use as a control framework to underpin all this change regulations. If you're going to pick one, what would it be? Um, David, we'll go to you first.

Oh geez, wonder what I'm going to say. Geez, it's got to be a management system standard, so anyone who doesn't say that's going to be wrong. ISO 27001. There you go.

Okay, Troy, what was the question exactly?

What's the question?

One control framework or standard to kind of Rule them all. You've got to pick one to base off of what you're going to pick. That was a meme, right?

Yeah, because if I was running a GRC program and I was trying to build one at a company, I think I would probably start with NIST CSF.

Yeah, it's fair. Jeff?

Yeah, I mean, I, I, if Troy, he kind of stole that answer, um, because I help oversee our NIST CSF practice at Shellman, and I think that that is now, especially with 2.0, a very— well, you said not to expand on the answer, just to give it, but I'll just to support that, I will say that it is now that all verticals, different, you know, industries, size, it applies. So I think that that's a perfect one to, you know, start from for a foundation. But I think David is, I support that one as well. Definitely. I think a management standard is very appropriate.

Okay.

The best is probably using this CSF with your ISO 27001 certification, right, David?

Hey, look at that.

They do match nicely now.

No, um, to summarize, in the future we do not think that auditing is gonna die. And unless David maybe talked himself out of his own role by suggesting a trust center which you could attest and assess yourself. Um, but I, I, I think that trying to get to a point where assurance is more available, um, to external parties in a way that's more consumable than it currently is. And I always think that like we should also have to package compliance into some kind of like SBOM type thing. For those who don't know who's listening, then SBOM is a software bill of materials and it shows how your code is built. but we should be able to find this kind of compliance version of that that shows how it was right now, be able to ship that to someone who can ingest and do something with it. And I think we're starting to get there in some regulatory talk about how we could get to that point in the future. I'm conscious of time. I've got many more questions. Go on.

I would just say, I don't think auditing will die. It's just who or what is doing the auditing will change. Like, yeah, the concept of auditing will never go away because, I mean, that trust center as a service, like, there's still, it's still a front end.

Like, someone's got to audit, like, whether or not what those tests are saying and presenting to the end users. That's what I was going to add in.

There's There's still got to be some element of trust from independent third-party validation that that is even working. So you can never remove the human element, at least not in our lifetime, I hope.

I'm glad you've reassured yourself of your validity in the future. Always good to hear.

I want to remove some of the humans from it. I think we'll go, we'll leave it at that.

One last traditional, anything else that any of you want to add before I close with my final traditional on the podcast?

Uh, we started touching on this, and I always think it's a spicy topic, but it's just like talking about these relationships with auditors, with GRC platforms. Um, and, uh, I'll tell you, they have gotten very, uh, smart in terms of how they, um, compensate each other. Um, you will not find referral fees, kickbacks, commissions at this point. Like, everyone knows that's a no-no. So what you're seeing now in turn is like How do I get featured in your auditor directory and can I pay a marketing fee for that? There are other ways to show that there are conflicts of interest here. So I've seen similar types of panels, um, where we bring, you know, X, you know, VP of partner or whatever over one of these platforms. And they talk very, um, very passionately about like, you know, how they like want to combat this conflict of interest issue that's happening here. But there are pressures that are there. The VC money is definitely part of that, but I'd even say, um, we started getting into this topic as well, but who controls the customer top of funnel? Um, if you are a startup and you're looking for ISO or SOC for the first time, you're going to go Google search it. And when you Google search it, the first thing that's going to pop up through paid AdWords is one of these platforms who are spending— we've done analysis on this— over $1 million a month US just on AdWords and AdWords spend, because they are going to get that first touch point with that prospect and be able to tell them exactly how this entire process is going to happen all the way down to the finish line. And I think that is the noise in the marketplace that is not good for the industry. I said overall compliance automations are good, and you didn't let me justify that. I'll still hold that for later. But, um, in all reality, um, if the top of funnel is being controlled by these salespeople working for these platforms with a very clear incentive, and they do not have to abide by standards, conflict of interest, or impartiality requirements in the case of certification bodies, then they are going to shape what is considered normal. And that is where our root issue lies, is the top of funnel sales process at the moment.

No, I agree with you. I, I've got to a point where I, I obviously am an advocate of automation and compliance because what my job is, but I think we should be arming auditors with a better way to do their work rather than trying to get in bed with the auditors per se and dominate and control that space. It should be a completely separate relationship. At which point you might refer and say, these auditors are great. I get asked all the time who are good auditors, and I refer the ones I think are good. And I'm sure the reverse happens with people ask auditors and say, what's a good platform for me to use? And I hope that they give multiple options because there isn't a contractual commercial relationship in place, right? So I totally agree, David. I think it is a hot topic. We can definitely handle it on a future podcast. I think it can take an hour in itself on kind of where we've got to in that space. So yeah, happy to hold that one in the future, see what happens. Troy, Jeff, any final thoughts you want to throw in before I ask you one question?

Final thought is I think there is a mindset from some of the automation platforms that there are certain auditors out there that don't like the disruption and don't like using technology and feel threatened by it. I don't think that's necessarily the case at all. There are a lot of us who are in SOC too, obviously love technology, we audit technology companies, so We're definitely not against technology. We just want it done the right way, and we just want more transparency. That's really what we're asking for. And we want to be able to audit without undue influence from third parties. And so if we have questions, it doesn't mean we're against technology. It just means we're trying to do our job, um, and we want to use technology to make our lives easier. So I'll leave it at that.

No, I agree. The conflict, like I say, comes back to the bias and the conflict of interest and being able to make your opinions decisions as you want to and as you should be able to, that they're not influenced by the vendor who is providing you that data or technology that allows you to kind of get the report built, but that you can then still say, but this doesn't make sense, I don't like this, in fear of the fact that might affect your revenue stream. Totally agree. Jeff?

Yeah, I mean, I agree. I mean, just to clarify with the automation side of that, I mean, I think that that was well said. I mean, there are a lot of audit firms, Shellman certainly towards the top, that We, you know, have limited, you know, I guess, exposure and partnerships with the GRC firms, but we don't have any negative bias against it. It's just we want to make sure that when we are— a client is using that tool, that it's a, you know, a collective collaborative discussion of how it's going to be used, how you're still going to get to that endpoint and get a quality report without skipping anything from point A to Z. So I think that that's, that's what's key. It's, it's the— and then ultimately, to Troy's point, a lot of auditors get a bad rap. This is like, we're not willing to use the tool, we're not able to use the tool, and that's not it at all. It's just that there needs to be a plan, and it can't be reactive. It's got to, it's got to be a very proactive, uh, plan, not a reactive plan. But the last thing, kind of on the automation side, is, I mean, myself, Shellman, you know, all quality auditors, they're not going to shy away from automation. Automation and building efficiencies is a great thing. I mean, I think that there are a lot of ways to make audits more efficient, and it doesn't need to impact and lessen the quality. It's just looking at that from a holistic view of how can you make things more efficient and effective while, you know, increasing quality, or at least maintaining quality. It's possible. So I think that that needs to be the continued focus.

Yeah, definitely. I think technology should obviously enable you to do your jobs better and not inhibit it. And I think a lot of it also relies on us, and I can't stop counting ourselves as part of that, as the vendors, to actually educate auditors on how to leverage the platform technology we do, how that will enhance your experience versus actually inhibit it. I think often we sell to the customer and forget that actually the auditor is part of that customer chain, and then we don't facilitate, enable them to understand why this is beneficial to them, then we're kind of missing that step. And then we actually create this kind of conflict, or you see where it's like us versus them, which is nonsense because in the end our entire business model is built on enabling people in the insurance world to do their work more effectively and not the opposite. I always close with a question from the previous guest. That's a thing I stole off of Diary of a CEO podcast. If you haven't watched that, Stephen Bartlett, always great, interesting guests. And the former guest I had gave me this question, very topical for Christmas. What is the one thing you wanted as a child as a present that did not appear under the tree? So for me, I once wanted a Micro Machines city, desperately wanted one. If anyone's old enough to also remember Micro Machines, and it did not appear or manifest itself under my tree, and I was heartbroken. I think it's probably the year that I started to question everything about my beliefs. David, you were nodding, so I'm going to put you straight on the spot straight away.

I wanted a motorized or like electric scooter. Those were really popular back in the day. and I got the manual one and, uh, ended up, uh, having an accident actually when I was like 10 or 12 years old. And, um, I have two fake front teeth now because I like fell into a concrete sewer drain and busted my front teeth out on that manual scooter.

Maybe the manual one saved the rest of your face though. Had it been electric, you might have been faster and done even further damage.

It's possible.

You're very right. Troy, what about you?

Uh, well, I didn't have a tree, remember?

Of course, I've ruined— what was one present you wanted that you didn't get?

Uh, I don't even know. Wow, you're putting me on the spot. I, I don't honestly— I don't, I don't remember. Um, I got everything I wanted, so thank you, Mom and Dad.

What a privileged life you've led, Jeff.

Wow, this is gonna take me back. Uh, some of my sore spots back in the day, what trauma did I have for gifts that I didn't get? I would say there was a very specific BMX bike that I wanted that was completely unreasonable and unrealistic for a kid to get, but I really wanted it. And my parents said, well, now you need to get a job and you'll get it. So I didn't get it under the tree. I had to work for it.

Well, that's the lesson that you got under the tree. That was a gift.

That was a gift that keeps on giving.

Look where it's got you. Listen, thank you, gentlemen. It's been an absolute pleasure. If the community wants to hear more from any of these people, let me know and we'll have them back on individually and discuss some more pertinent and some confrontational topics. But I appreciate the time you've given to us. Happy Christmas holidays and Hanukkah to all of you and to all those listening as well. So thank you very much. And we'll call it a wrap there. So it's bye from me and bye from everybody else. Thanks everyone.