208 - Navigating the Cybersecurity Landscape: Challenges, Opportunities, and Expert Insights with Sertainty's Amir Sternhell

Welcome to Listening with Leaders. I'm Doug Noll, lawyer turned peacemaker. I teach executive leaders how to listen to emotions rather than words so that they can become the leaders everyone wants to follow. And I teach those same leaders how to be authentically present, available, and connected to their families despite being insanely busy. I have learned that we are 98% emotional and only 2% rational. Learning how to listen to emotions is, in my experience, the foundational skill of life. Stick around to the end of the show and I'll reveal how you can be on our next guest in 15 to 20 minutes. So let's get started. Amir Sternhell, thank you for joining us on Listening with Leaders. Welcome to the show. You are the Chief Strategy Officer for a company called Certainty, which is certainty.com, which is a pioneer in data-layered cybersecurity. And you're the guy who kinda sets the vision for the company. You had an amazing career. I interviewed you on Authority Magazine. Really glad that you could take some time out of your busy day to join us. So let's start with a simple question. Tell us your backstory. You started out in—

My journey actually began in 1979. In military intelligence in Israel Defense Forces. And back then you had 3 types of intelligence. One was SIGINT, signal intelligence. The other one was ELINT, which is electric intelligence. And the third one was HUMINT, human intelligence. I actually belonged to the third bucket because when you needed to collect something, you physically had to go and see it. It wasn't that easy to use satellites back then. We didn't really have a satellite per se. We used to kind of piggyback on the Americans, and they were very much, I would say, on a need-to-know basis. So if you really wanted to collect and see something, you had to go there physically. That's how I kind of started. The unit that I was in was kind of deep inside the intelligence community. I was very, very fortunate to have a cell with some very, very interesting people who were part of that cell. I won't get too much into it, but some of them wrote books afterwards about their experiences and their so-called assignments. And I did have some very interesting assignments. I can tell you that.

I bet you did.

Yes, I did.

Eventually you got out of the military. How did you get into the whole— the word cybersecurity didn't even exist then, but how did you, how did you stay in the technology field?

Great. I pursued studies afterwards. I was very fortunate that the unit that I came out of enabled me to study almost any place I wanted. So I did this so-called undergrad at Tel Aviv University. I focused on political science and psychology, but I were really very much into game theory.

Ah.

I continued onwards at Columbia University, and there I focused on international affairs as well as international economics. And I had the privilege of being mentored by Dr. Zbigniew Brzezinski, who was a former national security advisor. So I still kind of kept in with anything and everything. Now, cyber really became prominent in 1993 when you had the cell of Schwedt, Gil Schwedt, and two others, Shlomo Kramer, coming out of 9200 or 8200, and they established the modern perimeter. That became Check Point. That was the first, I would say, company which totally focused on cybersecurity, and they ushered in the parameterization of how we secure networks and so forth. Then, as I, through the years, as I worked in IT, as well as in corporate learning, as well as dealing with Israeli high tech, I maintained touch, obviously, with the cybersecurity world. And the beauty of it is in around 2007, Israel and the US created the Olympic Games, which led to Stuxnet.

I remember.

That kind of defined the entire genre that we are today as far as cybersecurity, which means that you're trying to figure out how to best a player, and that player is trying to figure out how to best you. So that kind of created the so-called, the first so-called worm that actually attacked a physical valve or physical entity. With that, you had obviously a response which led to multiple viruses aimed at Saudi Arabia and their infrastructure and beyond. That kind of created a whole world of cybersecurity in which we're engulfed today. Back then, the damages were in the billions. Today, the damages are in the trillions. So I kept obviously involved with all of that, and that's After kind of when I left my old place in 2013, I was then a chief learning officer. I was also in charge of business intelligence, things along those lines. But I went to work for a company down in Florida that represented more than 300 high-tech companies, mostly from Israel. And what came out of Israel was mostly cybersecurity because it is the epicenter of cybersecurity. It is the epicenter of really understanding the whole world. Of how to attack as well as how to defend from perpetrators, in this instance, nation states. So I got obviously involved with a few. I met our friends at Certainty 2016, and I came because there was a family office that asked me to go and assess and evaluate what is this company about. And knowing my background, I saw 3 things that were in an instant. One is the company never published anything in any public domain, so it had no backdoors. You had to be very sensitive back then to all that was happening abroad in terms of the WikiLeaks, in terms of Snowden. Nobody wanted to have a US software or US so-called network provider because they came in with backdoors initiated by the NSA. So you can figure things a little bit differently. The other thing is, because I have a global so-called background in the sense that I worked in much of my time between Israel, US, and Latin America, I foresaw some opportunities to rescope certain standards. One of them is EDI. The other one is figuring out the mud bus and how to kind of create a digital footprint to, to a, to a physical, which we call digital twin. These things I kind of saw, plus the fact that Nashville was still under the radar. You could do a lot of things and you can create the iterations to make sure that you're scalable. And ultimately consumable. So I kind of saw these things and I actually liked the team there. I was very much into the mindset into we gonna actually shock the world. And the essence of it is we are in the process of shaking that part of the world, which deals with cybersecurity.

Wow. So you're now the Chief Strategy Officer. What, what, as a Chief Strategy Officer for Certini, what are, tell me a little bit about the kinds of things you're thinking about.

Well, I oversee 3 buckets. One is the enterprise world, the other one is critical infrastructure, and a third, to a lesser degree, the Fed and the DOD. As far as the enterprise side, I'm looking for contracts that make sure that companies can actually effectuate compliance and governance. Our technology is very suited for it. In addition to that, by ourselves and part of our so-called partners, we can begin to figure out how to optimize an AI environment that is focused on making sure you enhance the large data models for AI training. And you can do that with, I would call, making sure you create domains, whether you want the data to be anonymized or you want the data to be in the clear. So we can actually work these constructs and make things much more appealing because the biggest challenge with use cases The data is locked in data lakes. It's locked into silos. You gotta figure out how to open sequences, how to get past the CIO and the CISO in telling them that now you have a chief data officer, you have a chief marketing officer. You have to rethink a little bit of how to make things much more consumable, but you need to populate that data. You wanna make sure that data is processed with efficacy, and obviously you wanna productize that AI output. Doug Noll.

So you've been doing this for a long time. What gets you up in the morning now and gets you excited to be at work?

Let me finish the other two buckets and I'll, and I'll tell you why, because this actually answers this directly. Critical infrastructure, that's a very big opportunity because in essence everything is mission critical. So if you want to know what, why I wake up in the morning, The reason is that most of our infrastructure is very, very vulnerable. And we gotta make sure that the electrical grids, we gotta make sure that our ports, things along those lines are safe. And you can figure out, obviously, how to put the right solution sets to enabling things to be safe. So one of them is how do you create out of a sensor, how do you make that into sensor data that you can consume for processing, meaning edge processing, or take it even to a centralized mode for big data processing? How do you enact digital twins to model things if you want to actually enhance or make anything grow? So you gotta really think a little bit along these lines of how do you actually enable the data to be a contributor into this convergence between an operational technology and an IT environment? Now, taking another step in terms of the federal DOD side, we gotta figure out, obviously, in times of any calamity, how do you generate continuity of operations? How do you make sure you use civilian broadcasting systems and creating a secret channel that could be broadcasted and for you to get to, and God forbid, in times of real, real, real trouble, or how to figure out interoperability to make sure that anything between different services gets to some sort of a point of a situational awareness that is concentric and you can move much, much, much faster in terms of action. So these are the things that I kind of scope in terms of where our technology fits in and how to make our country safer and effective. The mission of Certainty is to save American lives. And that's what keeps up us all day and night thinking and hopefully populating and operating with.

I get the sense that we're really, we've been in war for 2 decades, maybe 2 and a half decades. It's a war that nobody outside of people like you really know about, but it's constantly counterattack, defense, counterattack, defense. And, and the ramifications are pretty significant. Would, would that be a fair, fair summary?

Cybersecurity is very good business, specifically for the ones who are attacking us. The reason is We have to deploy between $500 to $1,000 to defend against $1 of any malware.

Wow.

And this is something that's not tenable. So we have to first of all understand that not only is it good business, it's organized business. It's nation states, their proxies, and criminal organizations. They're there to basically steal things, steal the so-called PII, which is your privacy, and sell this in the dark web. And just to give you a little bit of an understanding, your Social Security can fetch $150. Your so-called bio, I would say, records can fetch twice or three times that. And you can imagine one day your DNA gets into the dark web, who's gonna make use of it and for how much that's gonna fetch. So it's an ongoing business. What was one time, as I said, was some sort of a damage in the billions in the last decade, you're talking about over $10 trillion worth of damages. And I'll give you just a little bit of a portion. What's the third largest economy? The US is first, China is second, the third is actually the cyber criminals.

Wow.

So that's the essence of what's the third largest economy. It's all the piracy and theft that's being sifted out of our so-called labs, generally our IP. That's, that's very, very telling.

And we layer onto that the emergence of artificial intelligence and the complexity just becomes logarithmic, it seems like, or exponential.

It actually, this is why data doubles every 2 years. This is why the cyber breaches and cyber attacks will also continue on to treble and quadruple. Sad part of it is most of the AI programming landscape or environment is premised on open source. So it's very easy to kind of stick in some malware and have that kind of go into different labs that begin to populate itself or whether it wants to listen to. So a lot of things with these advanced persistent threats and AI only exacerbates this.

How do you, how do you balance? This seems to me the great challenge of all of this. How do you— you've got to balance accessibility versus defense. I mean, the obvious thing is keep everything off the internet. Don't let anyone— I mean, you know, don't let anybody have any kind of access whatsoever. But then that— but at the same time, it's the internet and its accessibility through Wi-Fi or through electronics, electronic signals, whatever, that— and the interconnectedness that creates the efficiency and the productivity. How do you even begin to balance all of that?

It's a very good point. The internet itself was constructed to be an open communication medium. So you cannot really atone for at least the opportunities to steal certain things. We can think a little bit about hardening the internet, doing Internet 3.0, which is more regulated. It's much more reinforced. It begins to sift the bad actors out and things on those lines. That's where it may actually end up. But until then, it's very, very vulnerable. And the essence of quantum computing, that's going to impact the public key infrastructure just because you're dealing with encryption that is 50-plus years old. And it's— if you follow Shor's law of large numbers, there is that. There is that. So you got to really think how to either retrofit what we have with much better algorithms redo the internet entirely just because it was one time it was established as means to communicate and it became open means to communicate. So these are things that one has to weigh. And as I said, it's good business for the cyber people, but we gotta, as a country, really figure out things. And with that, you know, it's, there's a, I have a moniker, it's the West of the rest. We really gotta make sure that our values are saved. Just because when you think a little bit of how the Chinese have infiltrated every level, every server, every infrastructure, every node, their thing is they are populating garbage when it comes to the West. They're telling their side, make sure that you really come on top in terms of your math, really come on top in terms of your class. They indoctrinate their people to be like machine-oriented while they're, kind of making sure they can manipulate all the garbage for us to consume. So we'll waste a lot of energy and time and we not put our efforts into making ourselves better. There are certain things that we have to really be, not only we should understand, but we should be very judicious how we actually parcel the different players the ability to go in and do create an entire infrastructure like, like 5G.

I would, I would suspect that as many bad actors as there are out there, that Western governments also have their people out on the front lines doing stuff the other way. Would that be a fair assessment?

The only three countries which are doing what I call forward defense, and that's the US, Israel, and the UK.

Really?

Germany. Yes. Germany is more or less neutral because of— it's a conscientious on their part. They're very, very conscientious in terms of how they apply their capabilities. But it's the US, Israel, and the UK which are there to making sure that the other side understands that what goes around comes around. It's also an appendage to generally a nuclear doctrine, which means mutual destruction. If you really go after our critical infrastructure, you will expect a kinetic response from our side, not just cyber. So these are the things which are out there. The rest are not as much, they're not as sophisticated. The Chinese do have the base, the Russians for sure, as well as the Iranians. They're the ones that we should make sure that they understand that what goes around truly comes around. Right.

What about North Korea?

North Korea is still a pariah state. I would say they do have a relationship with China. But in that regard, the Chinese are there to kind of keep them at bay, but not, you know, from not creating more havoc as they do. But they have a relationship with Iran, and that's also, the Iranians have a very strong engineering base and quite creative. So the North Koreans are able obviously to at least get some input from Iran. And I'll tell you another thing, on October 7th, around 5 AM local time in Israel when the massacre, just before the massacre, you had Iran and their 15 proxies as well as Russia hit Israel in every way, shape, or form from, from with a cyber attack, every way, shape, or form. And the response time wasn't that good on Israel's part. You can imagine Even Israel was caught off guard. And at any given time, any nation state could hit another nation state. In this instance, it's 15 proxies and 2 nation states which hit Israel. And to a certain extent, it kind of delayed certain things. I'm not going to conjecture what the Russians can do in space, but they've been known to take out satellites. No one is going to speak about this in the public. Nobody's going to talk about these things, but It's a reality, right?

So, I mean, how does— what is the— what is the US government's attitude towards all of this? I mean, I'm sure they've got unstated dark policies that probably we don't know about, but it seems to me that, you know, a good defense is based on a good offense.

The US is at the forefront of this. They keep everything at bay. They make sure that Russia understands, China understands, Iran understands.. And the NSA at any given time can go in and go on the offensive. And remember that they're the one with Israel that promulgated the Olympic Games, which led to Stuxnet. So they have the most experience out of anybody in terms of how to hit, where to hit, and so forth. It also because of the, the two Persian Wars that you had a lot of experience in hitting terrestrial command and control systems. That the US had. And back then, I think they were able to hit Siemens because Siemens was supplying and some French vendors were supplying. Same thing goes with Iraq. They do have these vendors there that they utilize. So as I said, we should know the environment that the enemy has, and we should know better than the enemy where to hit this, where to hit them. We have that experience.

So I'm curious, what is it about you that's unique that you bring to the table that makes Certainty as a company and you personally successful at all of this?

Well, first of all, I have been very fortunate that the unit that I came out of had some of the who's who. So from day one, I had to stretch and I had to swim upwards because it's not— the people that I was with are some of the best.

Right.

And that permeated throughout my, my so-called, my professional life that I always had to swim upwards. I never took anything for granted and I always lived every day as if it was my last. So I was able through my years to accumulate 3,500 books. I was able to really kind of factor things globally. During my 20-year working for the largest IT company in Latin America and a pioneer, I held two responsibilities. One was to, as far as business intelligence at the right time. So you have to be very, very smart in terms of really understanding how to slice and dice data, what are the variables that go into data and how to come with some sort of a snapshot that goes beyond human intuition. Second piece, I was the Chief Learning Officer representing Harvard Business School, Harvard Business School Publishing, Harvard University throughout Latin America. And I had commutatively between Mexico, Brazil, Argentina, and Chile, I had more than 300 clients and I was kind of the go-to on everything. So you can imagine how much I learned during that time in terms of business cases, not use cases, but they permeate also to use cases at the end. You can factor what I learned in terms of really understanding the C-suite at every level and the business models that came with it. And so forth. So I was the number one guy in the world. I was their number one distributor in the world. I was 3 times the most valuable partner and nobody knew their content as good as I did, even their professors. So I began to be kind of an online facilitator and I used to kind of work with most of the C-suite and the Mexican 100 because they were looking obviously to go and evolve beyond either being a manufacturing base or being commodity-based. So you had to really figure out how to turn the pyramid upside down. And I was very successful in short as far as that. So that gave me the longevity, that gave me the income, that gave me the opportunity to factor what's next. And what's next became cyber. And that's the essence of it.

That's amazing. Huh. So where do you see yourself going from now? I, you sound like you, from what I can tell, you have a real passion for what you're doing, and you're just fascinated by all of this stuff. It's just keeping you intellectually engaged. I don't see you retiring anytime soon, but what do you, what do you think the next 5 to 10 years are gonna hold for you?

It's been focusing on critical infrastructure. It's focusing on providing the solution sets that enable convergence between an operational environment and an IT environment, making sure that the maritime and logistics are secured because most of the intel that's being kind of stolen is basically stolen by the Chinese, and they have the manufacturing base and a cost base to take competitors out. So that's something that needs to be protected. We need to redo EDI. If I can have a just a small part in that in terms of safeguarding, in terms of redoing a standard, that I think is interesting because you have to go through— if you want to do, do, do a standard there's more to it. It's a 5 to 10-year process in any case. But if I can kind of jumpstart that, I think I'll be very, very happy.

Good for you. One more question, then I'll let you go. This has really been fascinating. What's one thing about yourself, Amir, that we wouldn't know about unless you revealed it to us?

I would say that I'm passionate about everything I do. You just saw, I can tell. Ex-basketball player, team player. Everybody kind of has already figured that. I collect, I collect books, I collect art, I collect watches. I'm somebody who has kind of been very impressionable when, when it, when, when he was young. It was also good to have an Ivy League, I would say, erudition. But as one says, I'm always committed to others and I always put others in front of me. Because I learned long, long ago that truly what goes around comes around. And if you're good to others, others will be good to you.

Absolutely. Well, thank you so much for this wonderful conversation. Really fascinating and scary.

Thank you so much, Doug. I didn't mean to scare, but the essence of it is we are in very, very interesting times according to the Chinese.

That's right. Yeah. Maybe you be cursed by living in interesting times. It is a, it's an incredible— it's an incredible world we live in right now, and God only knows what's going to happen over the next 10 years. It'll be crazy. Thanks a lot, great talking with you.

God bless. Thank you very much, Doug. Thank you for your time as well. Thank you. You're welcome.

Doug Noll here. Thank you so much for listening to Listening with Leaders. If you are a successful executive leader who would like to be on this program, please visit podcast.dougnull.com/podcast. If you got something out of this interview, would you please share this episode on social media? Just do a quick screenshot with your phone and text it to a friend or post it on the socials. If you know someone that would be a great guest, tag them on the social media to let them know about the show and include the hashtag #ListeningWithLeaders. I love seeing your posts and guest suggestions. We are regularly putting out new episodes and content. To make sure you don't miss any episodes, go ahead and subscribe. Your thumbs up ratings and reviews go a long way to help promote the show and mean a lot to me and my team.

Want to know more?

Go to my website, DougNoll.com, or follow me on LinkedIn, Facebook, and Instagram. That's @DouglasEnoll. Thanks for listening, and we'll see you on the next show.