238 - Navigating the Complex Landscape of Cyber Threats with Nisos' Ryan LaSalle

Welcome to Listening with Leaders. I'm Doug Noll, lawyer turned peacemaker. I teach executive leaders how to listen to emotions rather than words so that they can become the leaders everyone wants to follow. And I teach those same leaders how to be authentically present, available, and connected to their families despite being insanely busy. I have learned that we are 98% emotional and only 2% rational. Learning how to listen to emotions is, in my experience, the foundational skill of life. Stick around to the end of the show, and I'll reveal how you can be on our next guest in 15 to 20 minutes. So let's get started.

Ryan LaSalle, welcome to Listening with Leaders. You are the CEO of a company called Nissoz, which can be found at nissoz.com. And you guys are in what I think is one of the most fascinating spaces in the world, which is cybersecurity and intelligence around threats. So I think this is gonna be a pretty interesting conversation.

We usually, we usually get in some interesting chats. Yes. For sure.

I bet. So let's start with a little bit about your backstory. I think you told me you were a Princeton grad. I'm a Dartmouth grad. I won't hold it against you. And From there, what happened?

So after college, I went and joined a company then called Andersen Consulting that became Accenture. I was there for 26 years. So I was a serial entrepreneur at Accenture. I helped work first in an advanced R&D team that did the first thing that the company was doing, whatever it was, the first video streaming architecture, the first multi-state, multi-carrier e-commerce insurance website, the whatever the first thing was, the first social community for newsmakers, the, we, we were just on the cusp of whatever the, whatever our clients were trying for the first time. That was what my team did. And along the way, I found myself gravitating towards cybersecurity. It was pretty bustling in the late, in the 2007, 2008 timeframe. I ended up working in some really interesting places, including with some US national security entities as a consultant to them. And just found my passion there. So I helped create the first R&D center at Accenture for cybersecurity and parlayed that into helping grow the security practice through acquisitions and then eventually through leading the North America business for the last 5 years.

Wow.

And then I found my way to Nisus in 2023.

Tell us a little bit about what Nisus does.

Yeah, we're a fascinating company. We're a 9-year-old startup and our focus is what we call managed intelligence. So we help our clients, whether they are trying to solve trust and safety problems, like they're a big platform company, or whether they're trying to deal with legal issues like insider threat or IP theft. We help them figure out who is behind the digital threats that they face. Sometimes they're cyber, sometimes they're not. They all, but they're all digital. And so we help them figure out how to understand the motivations, the economics, and the identity of the people who are trying to do them harm.

And wow, that's amazing.

It's a fascinating business because our team is so committed to helping keep our clients safe and by extension our clients' customers. And when we're getting that, we do just the most amazing work.

And these threats are all over the world.

That's right. That's right. There's the foreign and domestic. Most of our clients are in North America. We have a few in Europe, but most of our clients are in North America, given kind of our reach and our, and our size and maturity. But for sure, the threats are all over the world and people who are trying to compete fairly or unfairly, the extremists who are trying to subvert the, the public square, all the things you read about every day on misinformation and disinformation, that's who we try to help our clients fight.

And part, one of the part, part you're trying to do is identify exactly who these people are.

Ideally, that's that on our, on our best day, that's what we're doing. We're helping them figure it out, figure out who it is and what they can do about it.

Wow.

And, and I, I can't even imagine how you would go about figuring out the res— that's something I would think the government would do, but yeah, private to pri— have a private company be able to do that too. That seems pretty amazing to me.

Essentially, we're digital investigators at our core, and what we specialize in is how to find, through open-source intelligence, all the different ways that connect different types of data to, to individuals. So it might be they might be using different online personas, they might have all kinds of different data about them, maybe they have a phone number, or they have a, or they have a social media handle and they're trying to figure out who's the person behind it. Not even, sometimes the social media companies don't even know who's behind it, but we can, looking through all the different data sets that we have access to, we can help connect the dots to find the right person.

And I guess when you're online, no matter who you are or where you are, you leave breadcrumbs. And so you just, you follow the breadcrumbs.

That's exactly right. And I think we've built a lot of technology to help our people be really efficient and really effective at how they, at how they connect. The dots. You'll notice that in my background I have no maps with red string tying things over. We're not conspiracy theorists. We are in fact just deep digitally native investigators.

Wow.

So what is it that would—

so what is it that gets you excited? You've been doing this for a long time. I think you said you were 26 years at Accenture and you've been with this company for a while. What gets you excited every day to go to work?

I think the space that we operate in, in this kind of digital risk space is, is still pretty nascent. Companies don't always know even which executive owns the problem. It's not clear. It could be the chief security officer. It could be the chief information security officer. It could be the head of trust and safety. It could be the general counsel. And I think that's a little bit exciting to me because that uncertainty means they need someone to help create the right, the right certainty, the right clarity inside there. And that, that's where we can, we can really help them. Get to answers better. That's a lot of the way where cybersecurity was 15, 20 years ago. And so it does feel familiar to me in terms of the mission set and it's adjacent, but I also think it's really critical to the way our society operates. And so that combination of the uncertainty that requires energy, effort, and brainpower with the mission of trying to figure out how to make our public square better. Those two things come, like, really excite me every day.

And what strikes me as making your job even more challenging is the rapid evolution of technology. Now we're on the cusp of AI. God only knows what that's going to do.

For sure. It is an absolute accelerant, both the, the defenses and the weaponization of attacks against companies and people. It is a huge opportunity and a big risk, right? Anytime that happens, it's great because that It's great for our team because we get to help really refine and understand what's going on and help bring clarity. It's great for companies that are able to take advantage of it because there's so many new— we're about to publish some work in a couple of days around the effects of AI in elections in India.

Wow.

Well, and so the first thing you think about is, oh my gosh, this is probably— it's probably a nightmare. But there's a lot of downside risk, but there's a lot of opportunity in India. There's 22 different national languages that are recognized. And for the politicians who want to reach all those different people in all their native languages, they can give one speech in one language and AI can help translate it in their voice to reach all those different populations who wouldn't otherwise have access to understanding that candidate in their own native language.

And that is phenomenal.

It's phenomenal. It's unprecedented in terms of the ability to reach people. And the flip side is also true. It also gives an amplification of people who want to distort and change what those messages are. And so looking at the, looking at both sides of this really helps give companies and governments and people a better sense for what are those risks and what are those opportunities and how they make the right moves.

Wow. I, I'm used to complexity, but this complexity is almost, as I imagine it, is almost overwhelming. I guess that though you have your systems for breaking down the complexity into small pieces that you can figure out, And we're—

yeah, that's— so our tradecraft does help us, you know, as intelligence professionals, we have, we have a tradecraft we follow that helps us try to winnow down what's the core question we're trying to answer. And when you can winnow that down, it does help distill where to focus and not, and where not to get distracted.

Right.

But for sure, along the way, you were running into more complexity every day than previously. And so we always look for new ways to get more data to help us get through that, new ways to come up with new techniques or new technologies to help us navigate the things we're running into that make it a little trickier to do our job.

Are you— I'm just thinking of the technological embargo on China, and I'm wondering whether or not there's starting to be any kind of technical, technological differentiation between, say, the Western world and the other parts of the world where technology is accelerating. The physical technology and the software technology is accelerating faster in some areas other than others. And what effect is that having on all of this stuff?

I mean, that's a great question. I think the, the innovation, I'll call it an innovation arms race. I'm not sure if that's a really fair description, but I do think that there's a real national competitiveness, right? Between East and West on who's gonna, who's gonna create the first general intelligence, who's gonna go live first. How do you reduce dependence on each other so that you can build a more sustainable, innovative future without having to be relying on somebody who may not have your best interest at heart. I think both sides of that conversation see the other as adversarial in that way. They also see themselves as completely dependent on each other from an economic perspective. So it's, it is complex. But I think we, we have seen, again, I'll go back to my cybersecurity background, it, the West has talked about this for a while, that it, one of the largest transfers of wealth and intellectual property have been through the means of cyber theft for the last several years in intellectual property. Wow. When you look at some of the biggest technology platforms, whether they're aircraft carriers or stealth fighters or whatever, the similarities between East and West technology is eerily similar. And it's no coincidence that technology stolen by the East. Yeah, that's 100%. That has been a pattern of success. And for jumping ahead, applying what is really great scientific talent, but taking some shortcuts on R&D to be able to get there faster through more, more illicit means. And I think that's, that probably leads to a lot of the embargoes that you see and a lot of the concerns that, that US companies particularly aren't donating their hard-earned R&D to people who are trying to jump the line.

That's got to be, I mean, what a, what a complex problem. Amazing.

Right. We, we, we help, we help companies deal with that in two different ways today. We help companies who are looking at their IP to try to understand whether it's, there's evidence that the, their competitors are using their IP. So we help them more safely acquire and compare that IP in more of an escrow way so that they're not doing things that are unethical themselves to try to figure that out. And we can be an arbiter in that way, and we're helping them prepare. For when they do fight back, because when they fight back, they become a more visible target and they need to be ready for that kind of stuff. So they need to understand their threat, their threats and vulnerabilities of their executives, of their company. And we can help them think like an adversary does when they're trying to prepare their own defenses.

Wow. Fascinating work. Amazing.

We can talk about this all day. I mean, it is fascinating and, and thinking through the kinds of ways companies value it, I think it's also early days there because they're, they're unclear how much, how much risk they're already taking. And they're unclear the different ways of engaging safely and thinking through what are the steps they need to take. It's a different, it's a different model of engagement, a different way of operating that they haven't thought of before.

And you've got plenty of people who are unconstrained by the rule of law who, right, which, and fighting back, you're, if you're living under the rule of law, there are many things you could do that you can't do.

That's right. I think that's one of the biggest things that's different about being in a competitive environment. In a competitive environment, you can look at, you can look to your right and left and see who's catching up to you or who's out ahead of you. You can understand what bets you're going to make and how you're going to move financially and through innovation to get there. When you've got somebody who is unconstrained by rules or loss or harm, and they're not just trying to compete with you, they're trying to hurt you. Those are different rules and, and there's a different, and different expectations are allowed to the teams that to, to be able to defend themselves. It, it just looks completely different. Wow.

Are there things that companies can do that are, I, I, I don't mean to mean extra legal, extra legal, not in an unlawful way, but beyond litigation?

Yeah, I think for sure there's a handful of different ways to engage in different with, against different kinds of digital threats. I think legal is, is one that people come to a lot. Sometimes people, the attackers live outside of jurisdictions though. You, you're not gonna be able to—

exactly.

Get to a, a person who's in an unfriendly country and, and hold them account to account. So there are other things you can do. You can engage through strategic communications yourself. You can work with the media to help on, to help illuminate the things you're seeing. You can work with government relations to help them understand the things you're experiencing and how it affects the overall national economy, whatever country you're running in. You can work with law enforcement and national security to see if there are things that as you learn more and enable them with what you're learning, they may have the reach to do some things. And we've seen that recently where the FBI took down a massive botnet, massive, that unprecedented in terms of size and scale in terms of, and As a result, reduced the risk to all companies around the world for what these, what these people were trying to do and do harm. And they got there because both of, both the government and the commercial sector collaborated to understand what they were facing, what, where the impact was, and what they were learning about the attackers themselves. So that kind, there's a bunch of different things you can do. And a lot of companies don't think about that connection back to law enforcement and national security as part of their feedback loop where they can get help. Yeah.

So what do you think it's unique about you that you bring to the table that's made NISO successful?

Me as a person?

Yeah, you as a person.

So, well, that's a good question. I think about that. I think about that a lot. I've only been here 6 months, so I don't think I, I don't think, I don't think we are on the, on the side where we can look back and be like, we did it. We're not ringing bells yet, but I do think there's a couple things that I've been able to provide in terms of leadership that has been helpful to the team. I think the first one was my team gets so tired of saying it's focus. We have spent a lot of time doing things we're good at, but in a lot of different places where without the focus of where can we actually apply energy and get consistent returns for growth. And so we spent time when I first got here trying to figure out what were the couple areas, the very small number of areas that we were going to focus on to be able to drive the right returns and get everybody aligned in the same direction. So we were putting our energy in an efficient way into the market. The second one I think has a lot to do with some of the things we talked about in the authority piece, but it was around listening and empathy because the team has been through a lot more than together than before I got here. They've been, the company's been around for 9 years. I've been around for 6 months. So having to listen and understand just the things that they felt along the way and where they had had success and where they had missteps. And how they were feeling and what they needed to be able to come together as a team and move ahead. I think it needed an outside perspective and it needed someone who was ready to listen to, to bring that team together effectively. And then I think the other one is the presence in the market. I don't think, I don't have the best, my, my, my biggest value is not my Rolodex, but my biggest, but I do work well with very senior clients. As well as pretty junior clients. And so being able to be adaptable into the, in, in the market to try to understand what problems the clients are facing and how we can bring the right level of clarity and understanding, but also teach them something along the way, I think has brought a different kind of conversation in the market for our team.

You, you rolled right into my wheelhouse with your comment on listening.

Obviously that was not unintentional.

So you come in, you come into a new company from a 26-year-old career at Accenture, and you emphasize the importance of listening. Tell me a little bit about how you developed that process because it's a mindset.

No, it's, it's funny. My grandfather was a butcher. He had his own grocery store in Chicago. And when I first came outta college, he's, look, if they want you to sweep the floor, you sweep the floor and you don't know anything. So if you, you've got two ears and one mouth, you should listen twice as much as you talk. And I like, it's not his, it's not his quote, right? But it's a famous one, but, but I'd never heard it before at 22 years old and it, I took it to heart. And, and I think that a little bit of that ethic, I informed from my very early days. I didn't know many people when I came outta college. I didn't know many people who worked at corporations before, let alone in technology. So I was a little bit outta my depth and I felt in order to belong, I, I better learn how to be there pretty quickly. In every new role I've taken on through my career, I always get comfortably overwhelmed and then try to figure things through to figure out where, where can I contribute and where can I have the best impact with my talents, but also my insights and what do I bring to help make that work. So when I came to Nisso, I had a set of opinions because I knew them in the market. I'd seen their work. I knew what they were proud of because they had an amazing reputation. I talked to their investors, I talked to their board, I talked to their, to the founders, and I knew some of the folks who worked at Nisos because I'd worked with them before. And so I had a little bit of, of, I'll say, preconceived notions. But I also realized when I got here that if that was what it was going to lead us, that I would miss something big. And so I needed to hear from the team what they were feeling, what success looked like from that for them, what they needed from me. And what they needed from each other. Because if we could just get there a little quicker, that then we could be off and running. And so I think that was the, a little bit of how I arrived at it was I think role by role, I've seen what it looks like when you are a good listener. And I've also had some people who've come in over the top as bosses in the past who were not good listeners. And so I've seen what good, I've seen what good and bad looks like. And I think I've tried to learn along the way on both of those.

How did, so you're the new guy, the new CEO. Everybody's wondering who's this new CEO coming in and what's got, so everybody's wondering, a little fearful, a little anxious and nervous. They don't know you from Adam and you're coming in. How did they take the fact that you were more willing to listen than to talk? Was that surprising?

First of all, I think as intelligence professionals, they knew a lot about me when I got there.

Okay. They done their homework.

They did a good, yeah, I would expect nothing less, but I mean, I think that it actually stood out. We just did a little bit of a kind of a 360 on me, um, for my team a few weeks ago. And it actually came out a lot in the feedback was that it is that they actually noticed that I was asking questions and I was seeking out people's opinions throughout the organization. And I think I can always do better at that, but It definitely was. It definitely came out as one of the things that they noticed felt different and was needed.

I'm curious how you went about, as you look back on your career over the last 26, 30 years or so, how did you develop your ability to listen?

It's not— it's a skill that is not—

I teach it, but it's not a skill that's generally taught. In fact, as children, we're ordered to listen. We're never taught how to listen.

That's good point.

And so how do you think you develop— how did you develop the ability to listen?

I grew up in a consulting firm, first of all. That helps. So a part of our job is to ask hard questions and integrate the answers and help them arrive through all the different input we take into something that they can act on. So that, I think, is core to the developmental environment I grew up in professionally. I don't think that's all of it though, because, but I do think that because you can do that with clients and not do it with teams.

Right.

So there's a skill you have to apply in, in, in different ways to sell and deliver versus to lead. I think I had some really amazing mentors along the way who role modeled that really well for me. The man who's now the CEO of Pearson Publishing was a boss of mine for a little while. And, and the thing that stuck to me the most about his personality was his insatiable curiosity. He loved to hear your stories. He had, he'd share his, but he loved to hear yours. And the way it made me feel to be heard, there you go, was really important to me. And it's something I anchored off of, and this was probably maybe 2016, 20, that's probably when I, that's probably when I think most uniquely identified that was something that great leaders do.

I call it listening others into existence.

Yep. Yep. And it's, I, I, I can feel that for sure.

It's a skill that can be learned and it doesn't take long to master it. That's the amazing thing. I can teach most people in 6 to 8 weeks how to do it. You just touched on something that I think is a core part of leadership that is missed, and that is people have a deep need to be validated and heard. And when you can meet that need, they'll follow you anywhere.

I think that's 100% right, Doug. I think if they're heard, but you don't act on what they tell you, or they don't have the agency themselves with the autonomy to operate within that, then it also cuts them off at the knees. It's not, it's not sincere. So listening has to come with action, right? And otherwise you sort of, you're almost there.

There does, that requires authenticity and transparency. And it also, I think, requires leaders to say, here's, here are the decision-making boundaries. This is the authority or agency that you have.

Yeah.

Anything above that, it's gotta get escalated. It's gotta be handled in this way. So people know exactly what they can and cannot do within the, of their particular position.

Yep.

100%. 100%.

Once that's well defined and people feel heard, they, I, I think that's the foundation for collaboration and cooperation in a workplace or on any team.. And I think that's overlooked a lot by people.

Yeah, I agree. I agree with that.

Where do you, where do you see NetSells going over the next 10 years?

That is the million, the billion dollar question.

I'll take a check.

Exactly. So I think, I think the market we're in is changing a lot, but I just, I'll tell you for, there are a couple areas I'm really excited about in terms of the way we help solve problems. The, the online platforms. The big social media platforms, the, and it actually, it, it extends down to dating platforms and AI platforms. And anybody who is offering sort of a place where people and technology come together have, have this continuous need to stay out ahead of those who want to abuse it. And we see that in the testimony on, on the Hill where people, the platforms are being called to talk about child harm. We see it with disinformation and misinformation that propagations not just around elections, but also around brands and people and harassment and propaganda. So all these different places, like, no, no platform, I don't think, wants to be a place where people feel unsafe, right? And we provide a really valuable service to many of those companies where we can help understand the new techniques that are coming out, the new ways that different adversaries want to target their customers, their clients, their users, and their tech to get to take advantage. They spend so much time using technology and engineering to scale the safety, but they need people to continuously inform what that looks like. And I think that, uh, for our best clients, we are in a virtuous cycle with them. Of innovation and scale, insight and informing. And, and then when, when that works, that's working like gas on a fire. It's, it's so great. I, I think with the AI platform specifically, there's a, the threats and harms are new and the peo— the actors are just starting to use their imagination now. And so again, it's, it's the right time and we're, and we're doing some amazing work in that space. I think that's gonna continue to, grow as well. But then I think the, the other place that we see a lot of growth for us is in this, uh, convergence of digital and physical risk where digital bad actors are threatening physical real-world harm.

Because they, they can get into control systems and cause damage?

Well, a little less around secure, around cyber and a little bit more around physical threats of violence.

Okay.

So activists, the, just the hatred that's, that is, is happening, the polarization. Is inciting an othering of anybody across the political spectrum or any kind of cause. And as a result, we see a lot of, we see a lot of organizations trying to figure out how to protect their, their, their employees against, against people who are just unhinged. And because that's the digital separation, they would do things they would never do if you ever, if you had to interact with people every single day. And your ability to de-escalate anger and conflict, the digital realm just inflames it. And so our ability to go and help figure out how to diffuse it and where to diffuse it and where to apply the right responses, I think is another area that organizations increasingly need because the, their, that online experience is continuously fraught for them and turning into physical risk. So we, we see those as being pretty big areas for growth for us. But I, I think over time we are gonna continuously have to innovate as well. We have to get more rapid in the way we work with our clients, more iterative in the way we work with our clients. And I think we have to, I think what we'll find is this digital risk space is gonna continue to evolve and we need to stay out ahead of it to help make sure our clients are getting the best insights and advice on where that goes. We're very technology able today. I think we'll continue to be more technology-enabled in the future. And that's, I think we're on that path forward to making sure that we have an amazing reputation for excellent work where our clients are getting really actionable advice that helps them keep their users and employees safe, but that it becomes faster at a broader scale with, through technology.

I don't think you're ever going to have a boring day ahead of you.

No, we don't have, we don't have any boring days. We don't have many boring days.

I didn't think so.

Well, Ryan, thank you so much for taking time out of your busy day to chat with me and my audience. This was really insightful. So thanks a lot. Really appreciate it.

Sure, Doug. Thanks for giving me the chance to talk about Nisus and meat, my favorite topic. So that's great. Absolutely.

Thank you.

Thank you.

Doug Noll here. Thank you so much for listening to Listening with Leaders. If you are a successful executive leader who would like to be on this program, please visit podcast.dougnull.com/podcast. If you got something out of this interview, would you please share this episode on social media? Just do a quick screenshot with your phone and text it to a friend or post it on the socials. If you know someone that would be a great guest, tag them on the social media to let them know about the show and include the hashtag #ListeningWithLeaders. I love seeing your posts and guest suggestions. We are regularly putting out new episodes and content. To make sure you don't miss any episodes, go ahead and subscribe. Your thumbs up ratings and reviews go a long way to help promote the show and mean a lot to me and my team. Want to know more? Go to my website, DougNoll.com, or follow me on LinkedIn, Facebook, and Instagram. That's @DouglasEnoll. Thanks for listening, and we'll see you on the next show.