Risking it All in Cybersecurity - David Forman

Good morning, good afternoon, good evening, depending where you are in the world. Welcome to another episode of Risking It All. This is a strange little shifty thing where I said a while ago we had Troy and David on and we talked a lot about SOC 2 and where we were and where we were going. And I said we need to continue this conversation, but it's taken me this many episodes to get back around to continuing that conversation. So we're on to my favorite rants of auditing, AI, ISO, And another question I have for another person of why the hell would you ever start a company in this day and age? But, um, let's get into it. So like I said, I think there's a fascinating topic we're going to start with on the Workday breach that many of you— all the way to class action— that many of you will have read about already and what that means for AI auditing and AI security. Um, but I'm not the most knowledgeable and this guy is far more knowledgeable. So without further ado, uh, the CEO and founder of Mastermind, uh, David Forman. Let's bring him on. How are you, my friend?

Jay, doing well. Um, you're always my favorite accent to do podcasts with.

Good, at least I've got one use in life, right? I always say I've been practicing it my entire life, it's taken me this long to perfect it. Um, anyone has any questions in the chat, by the way, fire away. I'm sure between me and David will say lots of things which are disagreeable, offensive, and controversial, so Um, let's dive straight into it. I, in fact, I'll give you, I'll give you one pitch first.

Sure.

Masterminder, actually our ISO watchers, anecdotes, um, and my team are massive fanboys, think that you are actually changing the industry and doing things in a much more serious, sincere, and authentic way. So kudos to you for that. That's the only pat on the back and pitch I'll give you. Um, but let's go straight into a question that's very relevant to you as Mr. ISO. We, before this started, we talked, um, very briefly about Workday. Um, for those who don't know, what was announced at Workday in the last couple of days, and why is that remotely relevant to you?

Yeah, so, um, there's been a lawsuit filed, um, and, you know, everyone is innocent until, uh, proven guilty, I guess, in the US courts. Um, with that being said, this lawsuit is, you know, it's— it almost feels like quintessential, like, AI bias problems. But Workday, obviously, a very large, um, HRIS platform, um, they do other stuff in related benefits and even some like financial modeling and accounting help as well. But their core platform is around this idea of like talent and people management. And, uh, there is a class action lawsuit that's been filed, um, I think in the last week now, um, around, uh, basically these like use of ATS tracking, uh, for candidates submitting resumes and, um, companies that utilize Workday for like job postings and job screenings and initial resume drops as well. And essentially, um, there's been determined that there's some probably some gray areas with the bias behind the AI systems evaluating candidate profiles. So, um, this will be interesting for the industry because I think there's a lot of negative sentiment around ATS scanners already, uh, for recruits like putting their resume drop into some system, getting an AI confidence score out of it, and then maybe they move on to the next stage with an actual human. But I mean, if we do tie this back to ISO or NIST IRMF, whatever, there's this underlying element of basically keeping human in the loop. And having human decision-making to help kind of curb what could be considered bias by some of these high-impact systems or similar. So, um, and then finally of note, and this is, this is nothing against our auditors or anything like that, but I'll speak to this, um, more from a peer-to-peer kind of standpoint. It's unfortunate though that Workday recently got 42,001 certified, of course, and they're in like this small group of about 30 organizations globally. So I think that certificate was issued literally last month. So, um, it's, uh, it's very timely.

I mean, that's a tricky one, right, as well though, because like we were just saying, I was saying before, I, I've had my times where I've argued about auditors not having technical competency sufficient to audit the stuff that they're talking about. But this one's like another level, right? If you are auditing on ISO 42001 to understand the reasonability of testing, of bias, of output, like, I mean, that takes technology levels that you simply won't find in the auditing profession.

Totally agree.

You don't find them in our profession.

Yeah, total agreement. And if you think about who can actually do like accuracy testing or like determine whether or not there is bias in AI system and whether or not that like level of bias, if it is discoverable, is acceptable or not, like you're getting way beyond the technical competency and chops that these, you know, 42,001 lead auditors have. I'll be first to admit that. I also like, you know, I think I've said this in a number of like customer conversations at this point too. If you see somebody that says like, you know, they are an AI expert and they're doing ISO audits like day in and day out, I would say they're learning. But, uh, it's— there's, there's a gap, um, in knowledge and competency and experience. I mean, in all reality, most of the world that does even information security type functions has been only exposed to like AI as we know it today, like as recently as ChatGPT like becoming general availability. So, um, I would say like we're all kind of learning it together, and you have to kind of hold certifications like 42,001 with a grain of salt because in all reality, like, there's still risk behind that system, uh, beyond like the governance that's essentially getting certified for conformity.

Yeah, I mean, you're being commercially careful, which is fine. So like, I think to be more direct, because I think it's actually an interesting topic, so the auditor was Shellman, who I think are actually brilliant auditors. Like, we've used them before and I've used them in multiple places we have a relationship with them, and their AI team, who I know are fairly— are actually pretty technically advanced and pretty competent. So what it says to me is like a deeper challenge almost is assuming they have the technical competency to assess according to the standard, which I believe Shellman do. So I think that this is not a fault in their work. But then is it a question about 42,001 itself in its legitimacy? Like, if a good auditor doing a good standard of work can come out with an outcome which is then challenged in the criminal courts Does that mean that the whole thing is effectively flawed and doesn't mean anything? Like, I don't know.

Yes and no. And I'll do a parallel here. So first question is, is 42001 inherently flawed? I think it is. And this is one of the most prolific 42001 certification bodies I think on planet Earth right now. With 42001, there is a degree of accuracy testing that you are not finding in the standard. Like, you could probably map to it. But if you're telling me every 42001 auditor is going through and saying, let me like get keys to the kingdom access to your AI system and start running tests in here on the algo to actually figure out whether or not there's bias, there's accuracy, there's availability, those type of risk attributes that we're focusing on, then I, I think that's a flawed statement to say 42,001 is going to catch that. But let me give a parallel too. 42,001 is really new, it's in the crosshairs right now. Let's look at 27001. And I'll tell you, there are a number of organizations that have been breached over the years that are 27001 certified. One that I have a lot of personal because the breach happened in my backyard here in the greater Atlanta area here in the States, was Equifax back in 2017. July 2017, Apache Struts vulnerability was a zero-day and it went like undiscovered for several months. And then Equifax leadership found out about it and they still did like very little inaction. That's why we have new rules for publicly traded companies in the US and SEC reporting guidelines around cybersecurity breaches. But with that being said, that was a 27001 certified organization as well. And it's like, technically, like, were they out of conformance with the standard because they had a breach? No, the standard actually talks very highly about like, hey, you can have gaps in the system. Just are you addressing the gaps in a timely manner? Is there governance? Is there risk management around it? Do we have corrective action plans? Are we like basically monitoring steps to completion? Not is the system perfect 100% of the time. So I think that's a little bit of misinformation of what people think an ISO certification actually is. It's a conformity audit. It is not to say I'm 100% in compliance.

I mean, you, you used Equifax. Let's go to Equifax, right? I was involved in some degree at Equifax at the end, and that's a patching issue, right? They— it was— it wasn't just a zero-day that they got. It was unlucky. They got hit because they hadn't patched a patch for a long time, right? They were aware of it, they just hadn't done anything with it. Um, so that then does raise the question. You say it's not a non-conformity to the standard, but is it not if they have a patching policy and approach they document and should be following and a failure to follow that, and an auditor missing that because of a sample-based approach, does that not mean that both the standard is flawed and the approach is flawed?

So the standard at the time was 27001:2013. There was one control in 27001:2013 Annex A that addressed patch, and it was not— there was— it wasn't called patch management, it was called system change control procedures. That was the name of the control. And based on the name of the control, it was actually focused more on design than actual doing, operating effectiveness, it was procedures. And so, um, if the auditor was testing system change control procedures that year, one, the question is, was the procedure design flawed? Would that result in a nonconformity? Would that nonconformity be a minor or major in grade? And should Equifax, who had pre-existing certification prior to that year, um, be suspended or withdrawn that certification as a result of that nonconformity? Long story short, those elements are not ever gonna tie out to where you're going to end up with like a blocking certification, like reissuance decision from that. And that alone, that's if that was tested that year. As you're familiar with surveillance audits, at least on the prior standard, you could like sample across domains. So who knows if that domain was even sampled in that given surveillance audit as well. And I think they were in a surveillance period if I remember correctly.

Do you think that sampling's a problem? Like I've spoken a lot and it's very easy for me cause I'm not an auditor. But I say a lot that like, why on earth in 2025 are we still sampling? Like having full datasets has been around since big data, quote unquote, and we're talking like at least 10 to 15 years. So like, why the hell are we still sampling? Like, should we not move on from that?

I have a probably unique opinion on this. I do believe in 100% testing every year, and the 100% testing is not though necessarily design and operating effectiveness of a control. So if you think about just traditional risk management and doing these type of audits, you typically testing policy and then show me you actually do the policy like in your system. What I do believe you should do every year is 100% testing of design. So we should always be looking at those like patch management procedures, make sure you didn't lighten those up all of a sudden just because—

But does that work? Let me challenge that. Does that work? So how often do we see person got breached because of MFA issues, right? And the design process says we give everyone MFA, tick, great design. But if you gave it to 99 out of 100 employees and the 100th got breached, isn't that a process of operational effectiveness that you should be testing? You should be testing 100% of your operations.

I agree with what you're saying. Let me finish my kind of example though here, right? So 100% design, and then you do sampling of operating effectiveness, okay, on these areas. And I think one of the flaws that we got to call out in the standard and how certification bodies are told to audit as well is we always have a finite number of like audit days that we're sampling each year. So if I'm going to be working with, let's just use your company, Anecdote, for 4 days in the calendar year to do some sort of surveillance audit over 27001, I have 4 days to do that. Should I be spending my time sampling and going very deep into like only select control areas, but then missing others? Or should I do more of a broad sweep from design and then sample only those select areas that we see based on risk? And I'm more of a fan of the second approach. I think it gets to more conversation. I think we get beyond just like, show me 8.8.1 and show me your records for it. It becomes more conversational. This type of auditing is known as thematic auditing or key process auditing. Popular in other kind of realms outside of ISO, and it's also popular within other ISO standards that me and you don't work with all the time, but like ISO 9001, 22301, these ones that don't have a control set, it's just clauses as well. And I think that's a better auditing approach ultimately because you get more behind kind of spirit of control and like what is the actual underlying risk for that organization versus everything is just kind of templated if you treat every organization the same audit program.

I get that. Yeah, I can get on board with that. Let's get back to the conversation started, and this is maybe a tricky question for you, was quite a big 2001 certifying body, but If we're saying that people audit according to standard, but we can still have wild gap because of both how the technology's moving at speed, how people are implementing it in various different operational capacities, or just the fact that it's very hard to actually audit the technical requirements of a standard. Mm-hmm. Should we even bother? Like, should we do away with AI compliance until we can get to a point that we can do something measurable, effective, and like repeatable? Like, should, should it even be there?

It's a good question. Um, first of all, flawed question at the same time. You said compliance again. We have to separate these two conversations. One being compliance, one being conformity.

Okay.

And I think a lot of people mix ISO standards with like SOC 2, HITRUST, like FedRAMP, all this stuff, which is more compliance-based testing. Think, show me a population of all your users and we're gonna go sample a subset of those populations to get a representative sample and reasonable assurance. We do not do that in ISO. ISO is a conformity test. That could be, show me your total population and show me the design or the policy they're supposed to be following. I need a test of one. To get reasonable assurance for conformity testing. And I think that's a big kind of like wake-up call for a lot of people to understand the weight of what does that mean to be ISO 27001 certified or 42,001 certified compared to having alignment with something like the NIST AIRMF, that kind of thing.

Which do you think, which do you think is more meaningful?

AIRMF. It's more rigorous.

Yeah. Um, why are you certified to 42,001 and not to AIRMF?

There's no certification mechanism behind AIRMF, and I think that's like an issue there too. Like, you could do alignment but if there's not a third-party auditor and there's not oversight to those third-party auditors, then it's not accepted. So I think you, you run into like, where's their awareness, where's their kind of oversight as well to a third-party or independent or impartial audit, compared to like which framework actually is most rigorous and actually starts promoting this element of data protection or security truly. Um, and so I, I think that's why ISO standards have popularity, is that you can get an actual certificate deliverable if you go through a NIST or similar type of framework, you don't get that certification. And people want something that's like very easy, check the box, pass/fail, like I can show to procurement, I can show to like a vendor doing, uh, security due diligence, that kind of stuff. Here's my certification mechanism. And I think that's where the popularity for ISO standards comes from.

You think if aligning to more complex regulatory frameworks, or whatever you want to call them— let's take RMF as an example— is actually a better approach, that we're doing ourselves a disservice in industry by maintaining certifications and attestations to standards which are easier to get and actually divert from meaningful work?

In short, the answer is yes, those standards are better, or those control sets are better than what, uh, Annex A in 42001 offers for AI governance. Um, long answer on that is the standard is built to actually adopt those as well. So when you talk about a statement of applicability, the statement of applicability within these ISO standards, you don't have to use Annex A in 42001, you just have to map to it. If you want to show, hey, I have a more rigorous control that maps to this and I get it from this other third-party control set or my own control set, you're allowed to do that and certify to that as well. And I think that's the difference between, I'll say, first-time ISO clients to the ones that have been doing it for 8 years now, like, for a given standard, and they're in, like, cycle number 3, and they are, um, now adopting, like, kind of an internal controls framework to apply to all their different third-party audits in the at the same time.

Do you think there's a world in which these go away, in which we start to have instead you're attesting— not that your work goes away, because you've seen I'm an advocate for actually having independent auditors and kind of third-party eyes on things— but maybe we get away from attestations altogether and it becomes you auditing against two things that I always think of. One is like whatever I align myself to, so if that's NIST 800, whatever it might be, right? And then also to my risk register and how I deal with my controls aligned with the risk that I have as an organization. Do you think that starts to become the way we do things in the future? Do you think we'll always have a piece of paper?

I hope so, honestly. I think that's the future of security and future trust centers as a service too. I'm very bullish on what trust centers as a service are going to look like here in the future, like a form of continuous monitoring self-service. I can drill down into the exact tests that are happening as well at any given time. It'll be like the equivalent of like Down Detector we see today for like, is the website up, yes or no? To answer your question as well, I do think there will be a human in the loop always as well. Hopefully the competency of that human loop, aka the auditor, will improve over time. It'll get more specific to be able to test like whether or not these red light, green lights are correct. And then without getting too much on the side, like I have an issue with trust centers today. Trust centers today, if they do have those automated controls tests on there, there's a stage gate there to allow for an organization to not show the red light if they don't want to. and they get alerted before it may— is made public as well. So I think in order for there to be true integrity of using that mechanism, um, we need to kind of release the guardrails on some of that and show all the bad as well.

I, I mean, I'm with you. Like, I've been in this a long time and it's quite hard. Our customer base is predominantly enterprise, and like, that— the, the knee-jerk reaction when I say you should like uncover your entire dataset to like open public is just like Terror.

I also ask, like, how's it any different than, like, showing a sub-processor list at this point? Like, and you think about, like, how DPAs have evolved and SCCs, and like, we show now sub-processors. Basically, we're uncovering who are the tech stack vendors we're utilizing, like, because we have to think about it from a data transfer, data handling standpoint. I, I think that's just the next evolution, is making some of that more public as well.

Well, it's on technical sense too. I have the same argument when people talk about SBOMs. I'm like, you can have my SBOM, I put it publicly if I'm still out there. Like, Cause let's be honest, like 60, 70% of it is going to be the same as everyone else's. Cause we all use the same SCA composition in there to make the base layers of how something works.

They use Zapier, like awesome. You have workflow automation.

Like great.

So it's like, I don't think there's a way to hide that.

I see that. I'm all for the, the only problem I have and the reason that I think the trust centers are currently a bit flawed and what I'm not product pitching, but what I think that I want Anycodes to do is like. Completeness and accuracy of data is always a question for me. If you have a green light, I want to know how do I know what data I actually drew off of and how do I know that the answer it's giving is accurate? It's like I want the data. Like if we're going to do this, I think we've got to be all in. And like it's not just like showing how the test was run. I want the full results of every time that test was ever run. Like I want to be able to interrogate the whole—

going back to your MFA example, like, you know, don't just show me Okta's green light, show me Okta's connected to my full identity and access management provider. Provider as well, and 100% of employees are in there as well. It could just be showing green light across the Okta registered users as well. And I think that's why you kind of get this like feigned security mindset when you like look at one of those trust centers and just see green light everywhere. I've never seen a red light on a trust center. Have you?

No, I don't think I have.

I don't think I've ever—

I don't think I've ever actually seen one.

I don't know what it looks like.

Yeah, I don't think I have. But I mean, that— but that's a separate conversation.

People out there, like, tell me what a red light should looks like on a screenshot.

I mean, this is a separate conversation, which is like a little bit of a nerve for me because I have this argument a lot internally with not current CEO, previous ones and previous organizations, wherever it might be, right, where I advise and stuff. It's like pen test reports, only show them when they're fully remediated. Like, I get the context, right? Don't give people vulnerabilities away. But also, if I'm only showing them a clean report, it just doesn't make any sense. It's like the same as my ISO reports, my like SOC 2 like audit attestations. I'm like, If it's all clean, that makes me even more nervous. It's like, you know, like no one ever walked into a place where someone was handing cash to each other while having like drugs stacked on the shelf and went, I think that's a money laundering front. Like, it's the things that are too clean that make us think it's money laundering, right?

How often do you see a press release from like the recent Y Combinator grad and they're like, we just achieved our SOC 2 Type 2, and it's a perfectly clean report? Like, they like put it on like 30 days. Yeah, and they did it. Yeah, we did it in record time. Well, congratulations to the two people involved.

Do you think then it— I mean, that raises the question, right? I work for compliance automation vendor, so I won't take offense. Say what you want. Do you think that we've made more damage than good because we've made it to the point that everyone can point and click and be compliant in 30 days with a green light, and the whole thing now negates the whole purpose of having people look at it?

Yeah, so I watched that GRC engineering like roundtable with all the—

oh, with the U. Yeah, it was interesting.

Um, I definitely saw your participation, Jake. You were a little spicy. But, um, uh, one of the comments I liked was actually, uh, it was Jeremy Epling. He said on there, a similar question got posted to the group, um, even though it was a little bit filtered. Um, I think Jeremy Epling made a good point that I agreed with. Um, he said there were so many companies prior to this entire sector spawning that were doing nothing. And he says, now we have a lot that are doing something at least. Um, I'm paraphrasing for him. So I think very low end of the market, it's been a net positive. Now when you start downplaying or reducing what you're doing in terms of governance at maybe a mid-market or enterprise level, and you're trying to get more of a check the box, make something a little bit more transactional just to get the certificate in hand, I think that's where it's had negative impacts. So I would say it's a little bit of both. I think on the startup and maybe low end of the SMB, it's been a net positive because there are more companies doing something today, if anything, than that were doing nothing prior to this sector. Whereas I think for mid-market and I think for enterprise, there are a handful of cases I think have dumbed down their programs to meet kind of the least common denominator as a result of—

I think to, to flavor on some of the plugs that you gave there, the, the podcast is GLC Engineering with Ayub Fandi. If anyone wants to watch me get ganged up on by multiple other CISOs and CEOs, that one's fun. And he's referencing Jeremy Epling, who's the VP of product at Vanta, who gave some quite insightful comments around kind of it's better that everyone does something than a lot of people do.

It's 2 hours long, so make sure to like hit like—

it's long. Yeah, you want to put it into double time or you want to like make some breaks for it. There's some interesting stuff. I said everyone just disagrees with me constantly, so it's worth watching if you just take entertainment.

It gets spicy around the 1-hour mark.

Yeah, yeah, definitely. So let me go off at that point a bit more then. So we've talked last time about this sock in a box syndrome, right? And that everyone's now this— I've put enough infographics up of literal socks in boxes. Um, it feels a bit to me like that's dying off. Like, it feels a bit to me, maybe it's in the circles I walk and the people I talk with, that we're starting to say, well, maybe this isn't right. Like, maybe we do want like more meaningful assurance. Like, it feels like that it was going one way and it feels like it's now coming back. I don't know if that's how you see it because you're on the other side having to have these conversations commercially, so maybe I'm wrong.

I see it both ways actually. Um, I think it's died off in the ICP that you target. You're more mid-market enterprise, in my opinion. This is how I view Anecdotes. Um, and there, there's maybe one or two other vendors I think have a similar ICP as you, but then the ones that we're talking about, like, uh, Vantage Data, like the Sprinto, SecureFrames of the world, in my opinion, um, again, like, they may have something different publicly stated here, but it's just like kind of the customers I see them actually have. Yeah, I, I feel like there's basically a division being created among the sector. There are some that are going after the mid-market enterprise, therefore that's a completely different value proposition. It's not help me get certified, it's help me manage the compliance program across 50 frameworks that I have worldwide and I have to work with disparate departments. There's some corporate or entity-level controls, that kind of thing. And that's where I put anecdotes. And then I have this other group which is very transactional. Get me from point A to point B as many weeks that I can do it, like a very low amount of weeks in order to get certified and give me the most transactional auditor you can find. Scour the earth for the lowest, like, per day rate you can find and just get me the checkbox. So I think, um, what you're seeing actually, Jake, is your type of platform is attracting one type of ICP, and that ICP is no longer interested in the check-the-box stuff and SOC 2 in a box. Um, I do still think the SOC 2 in a box industry totally exists. Yeah, and I'll give you some validation behind that. Companies like Eden Data, WorkStreet, Cognizant, um, there's others I'm missing as well. I don't work with these companies closely, but those type of advisory shops that purposely help people like implement Avanta, implement a Drata, I see them growing and they are adding headcount. And that ICP is very much this kind of more startup-y that you're not working with every day.

That's interesting. It leads me into a different question. I had, um, Simon, who runs the show and Stitch, Steve Hindley, you might well know, on not long ago. And my main questions to them about why on earth they started a company, because being a founder to me just seems like the world's worst idea. Um, so you decided to found a company in the middle of effectively an internal revolution where everyone's driving to much lower price points, much faster work, like completely changed the industry on its head, and then took a different stance and said, actually, we're going to go back to the way it was before everyone tried to do this, which seems a little bit like lunacy, if you forgive me the statement, but like Talk to me about that. Why did you do it? Like, is it working? If you went back, would you do it again?

Um, oh, I would do it earlier if I did it again. And yes, I would do it again. Uh, it's been an incredible ride. So, uh, Mastermind's just over, um, 12 months old now. Um, and, uh, we've, we've had a, just an awesome path to, um, just I'll say market acceptance and adoption. Um, and then you kind of plugged our training earlier. Um, we have a lead auditor training course out there. It's It's totally free of charge, and it's playing on kind of these early innings of like what we want to do in terms of spreading awareness. So Mastermind, name of the company, it's, it's not David Forman is a mastermind. It's make masterminds of our customers, our partners, and like just other users of the standards. And like one of the taglines we have is we don't dabble in ISO standards. It's all we do. Like the only offering we have at Mastermind is accredited certification audits. That is it. The training, yes, we have, but we're not making money off that. It's free. In fact, we're losing money on it. It's $5 every time a credibly batch gets issued. So with that being said, Um, why we did it was, um, I think twofold. I think a lot of people, especially in the US market where we're based, don't understand really what ISO certification means. And I, I think it's, it's helpful to bring a little bit more awareness, like what is conformity auditing, what does it mean to have a management system, or AKA governance program, compared to these like popular control sets we see in the market for like stuff like SOC 2, which criteria you build controls on. Um, secondly, I think there is kind of a regression to specialization. And I think me and you work with very similar ICPs. Mid-market enterprise typically want to see like a lot of value come from their governance programs they're spending time on. And so what I mean by that is not only do we educate throughout the assessment audit process on like, hey, giving them feedback and benchmarking improvement opportunities, etc., like trying to improve systems through feedback and findings, but also we try to help amplify like what does it mean to be certified too. So You'll see Mastermind be very loud in the market when we certify somebody. Um, obviously we let them lead from the front there, but if a company certifies and say, hey, we want to do PR on this, like we say, let us help you amplify that message, okay? Because I think it means something of what you just went through. We don't want to just toss like a certificate over the fence. And I think what we've seen unfortunately in this like kind of audit space is a lot of auditors are, um, I keep saying transactional, but what I mean by that is we finish the audit we send the report over email, we say see you next year. And it's like, how do you like become a little bit more sticky to that customer and help them actually improve a program between those audits as well? And, um, I think that's where we've been pushing customers. So I've enjoyed it so far, to answer your question. I would totally do it again.

Do you think auditing as a service is the future, where like we talk about continuous control monitoring, full data auditing? Like, is that— do you think that's where you could differentiate? You say actually like forget the once-a-year audit. We're going to come and like audit on a monthly basis in tiny small fragments, and when we get to the year, but there's not a real full audit to do because we've already done it.

Without naming customers, there are, um, very large enterprises out there and maintain ISO certifications, and they are onboarding products or microservices constantly to their certificate, almost on a quarterly basis. So that type of theme is already out there, um, to do like basic quarterly onboarding audits is what it'd be called, um, and keep updating that certificate throughout the year, not just waiting for the annual audit to come around. But, um, to answer your question, I don't think this space of what I'm doing today at Mastermind is going to be— I mean, I'll say I don't think it's going to be around in 10 years. Um, I think it's going to get totally transformed. And that's not just like the AI revolution. I think, um, the types of conversations me and you are having around like legitimacy of like, what does it mean to be certified? What does it mean to say I align to a control set? Something like that. I think it's going to get flipped on its head here really quickly, and people are going to be looking for more of that trust centers of service we've been talking about, where it's like true real-time control testing, not one time a year, like show me a pass/fail.

I mean, it's a difficult one because part of me is always going to want some kind of auditor involved because I like the subjective, the nuance, the human opinion. But yeah, look, I've been very strong in saying I think we should get to a point where SBOMs are completely publicly available, where your full data set that supports every control is completely publicly available, where like everything is there effectively, like queryable via Slack or whatever, that like It's no longer a point if you send a questionnaire or even just ask for a document package. I'm going to— here's my 10 controls I want, and here's the evidence that supports those 10 controls.

I mean, I'll be the first to say, like, I should be out of a job in 10 years if we're still doing the same type of ISO. It's like, that'd be ridiculous. And it'd be, um, I think, really bad acceptance just by the general market if that's what we consider compliance at that point. Um, I think there will be a human element to, like, evaluating governance programs here in the future. And I think governance actually is going to have a little bit of a surge coming up because I'll tell you, especially with 42001, this element of just like, do we have the right ethos at the company? Like, that has become such a bigger part of the conversation of evaluating a management system than it did previously because you need like the company and the engineers to understand their full product development cycle, product management cycle. And you got to understand like, hey, like basically are we doing things for the right intended use? Do our end data subjects, our end users who are affected by this AI system that we're implementing, or this AI feature that we're randomly going to turn on with like very little fanfare, like, is that going to be received positively? And do they understand why we're turning it on to improve the product, not just to get training data that we're going to use against them essentially to raise prices later? So that kind of thing I think is an important conversation coming up.

I mean, maybe, maybe there's a way in which it blends, right? And like there's people like us and other vendors, and there's more, lots of vendors out there, right, provide trust sensor service in the future. Maybe there is then the auditing overlap, right, where there is an aligned person who's effectively validating the completeness and accuracy of those controls on a basis of being, I don't know, every 30 days or every 6 or every 90 days, whatever, right? So there is a combined approach where you've got full transparency, visibility. You also have external eyes on to say, yes, it's complete, yes, it's accurate, yes, it's the full scope or whatever it might be, right?

I mean, like, liken it to pen test reports right now, how those transformed in the last 10 years. Like, it used to be all manual, like, human pen tests. Now we, we have basically glorified vuln scans being passed off as pen tests now.

Yeah, I'm glad— I'm telling you what, I'm glad I got out of that industry when I did, because what I used to do is now, like, I was a social engineering specialist and that's now entirely gone.

So I think the competency and just general talent pool for like red teamers these days is very like small. So, um, and we accept pen test reports now that are pretty much application scans or website scans when— and like back in the day it used to be all human developed like penetration testing and reporting.

Um, someone did send me a pen test the other day which I returned around and said that's a Burp Suite Pro like report output. Like, that is not a pen test. Like, I can run that against your website.

It's not a pen test. There you go.

Yeah, I mean, and that's where I'm at. Like, I think that's the other thing we talk— I mean, this is a whole other conversation, another half an hour. But like, with the same way that I'm saying I want auditing to be based on risk and based on specific controls that are relevant to me or whoever's looking at me, the same is true in pen tests. Now, I don't need a methodological pen test across all these vectors and areas because they're just not real anymore. Like, I want A test specifically against the things that would worry me because they're the points that my customers and/or attackers are going to attack and the things which are compromisable in my world, which are completely irrelevant to everyone else, right? I'm not a retailer. I don't have huge volumes of like customer data and credit card data that you want to get hold of. So it doesn't really matter to me. But you dox me and you bring down compliance programs for some of like the Fortune 50, like that's career ending for us.

What I think you're talking about is like what I call like revenue or reputation pen test versus a compliance pen test. Like, I think what has happened in our market, everyone thinks about pentest as a means to meet some sort of compliance requirement, whether it be like FedRAMP or PCI or HITRUST. No one is thinking anymore about like, try to breach me because I want to see if like you can damage my reputation under a simulation, or can you like block us out of like, you know, certain like revenue opportunities.

But that's not called a red team. That used to be a pentest. That's not a red team.

Yes, it's not these compliance-based ones that are like, you know, it should be my FedRAMP environment's fine. Like it's the revenue side and reputational hits. Like that's the interesting penetration testing. Yeah. Yeah.

And I need customers to stop asking for the crap ones. Customers keep asking for like the methodology. Like did I follow Crest in the pen? I don't give a damn if I followed Crest. Like I like, it was a, it was an unscoped red team where they tried to break me. Like that's what you should care about. Like, yeah, yeah. The problem is, I think the problem is that a lot, I mean this could be a place where we wrap, right? The problem is that most of compliance is driven by procurement, not by security.

Yeah. And like revenue unlocking, which is procurement as well. But yeah, that's how I do it as well.

Well, I still have control. What shouldn't I have asked you that— what should I have asked you that I didn't ask you, David? Here's your chance.

Oh, this is an interesting one. Yeah, I mean, on the topic of ISO certifications, I think I always have to do this anyways, but like, who shouldn't be certified right now but has a certificate? And I'm not sure I'm going to answer this live, but I'll tell you, like, I was pretty public about this a couple of weeks ago. I saw it on LinkedIn, but there was an advisory company that was saying, hey, we've done dozens of ISO 42001 audits for our customers. And I think referring to like internal audits, and I was like, BS. Like, there are— at the point in time when they put that out, there was 25 global certificates registered through the IAF CertSearch. So if you're not familiar with the International Accreditation Forum, they have a global database where any accredited certification body within 30 days of issuing an accredited certificate has to upload it to the database. So it's pretty accurate information. Uh, today we're at 30 certificates for ISO 42001 per IAF CertSearch. And so this was a couple of weeks ago, we had this advisory firm saying, hey, we've done a dozen ISO 42001 internal audits or audits just generically. And I'm like, BS. Like, I know how many mastermind I've done. I have public information on a few others in terms of like their kind of key landmark clients they've done PR around. But in all reality, I think there's a lot of fakes out there that are claiming a lot of 42001 experience. Not to say that that's not growing in terms of their exposure. But ultimately speaking, I think a lot of people are trying to ride the hype train right now without actually having the experience.

I mean, that would be shocking, right? By the way, here's a QR code if you want to learn more about David and Mastermind. There's a way to go. I always close, you know, with a random question. This one actually bizarrely comes from my son. So Sheffield United lost in the playoff final the other day in a heartbreaking soccer match, which we'll leave behind us. But he said it was one of those painful things.

Soccer or football?

Well, football to me, soccer to you. He says the most painful things he's been through. So here's my question, and it's a weird one but a deep one. What's the most— outside of the obvious things of losing a loved one like that— what is the most painful thing you've been through in your life?

Painful thing, personally or professionally?

Personally or professionally, you choose. I don't mind.

Um, yeah, I'll tie it kind of both personal and professional. So I'm very open about this, but, um, I was married originally at 24 and, uh, divorced, um, what was it, like 14 months later. And the divorce, it was messy. But essentially where it came from though, I wasn't present early on in my marriage. I was doing ISO audits. So I've been doing— I'm now happily remarried. My wife is awesome, Tori, and very, very happy with all the trials and tribulations of my early career. But essentially when I was in my first job, Ernst Young, EY, I was on the road 200 nights a year. Doing on-site ISO 27001 audits. Um, I ended up going to— I think my count when I left EY to go over to CoalFire, I think I was at 42 countries at the time. And I did the majority of that from the time I graduated university to the time I went over to CoalFire, which was about 3-year span. So in about 3 years, I did probably about 40 countries and 200 nights a year on the road. I was at one point— they had stats on this at EY— I was in like the, like, top 100 globally for EY in terms of number of travel nights and like airline miles. Um, they like track that, and, um, EY has 200,000+ practitioners.

So that's the top 100 you want to make, right?

Yeah, but, um, I'm very open about like, you know, my, my personal life in that regard. But it was a huge learning experience, but also it teaches you what to value too. Um, I, I definitely made some mistakes early on in my career, and now I have a much better work-life I mean, that's, that's life, right?

It's, you learn from the things that you break and the things that you fall over and the times that you bump your knee, not from the times that you win, although this one gave you a medal, right?

You just come up with that just now, Jake? That was pretty wise.

I did. Yeah, I might have said that before at some point, but yeah, you know, like, I'm a, I'm an advocate of that. Like, I spent my entire life in startups at this point, so it's, it's learned by breaking things, usually yourself in the process. Um, I just did a trip to Tel Aviv where my flights were rebooked several times, end up in an air raid site and an air raid shelter, one like twice in the middle of the night. So I'm more than aware of the trials and tribulations of traveling. Uh, David, thank you very much for joining me. It is always an absolute pleasure having you around and your knowledge and base. Oh, Simon's even popped up an anecdotes thing as well. If you want to know more anecdotes, feel free to, uh, but feel no obligation to either. Um, appreciate your time. I appreciate your wisdom. I'm sure we'll cross paths again soon, but for the meantime, thank you for joining me.

Talk soon. See you, Jake.

Thank you all for listening.