HG - From Hacker to Serial Entreprenuer - Matt DeVost

Do you remember when we met?

I remember when we met for coffee.

So it was govcon.gov2o. This was 2009, and there was such an overflow to the conference that some of us had to go sit in another conference room. And I was tweeting, but I didn't have my picture on my Twitter profile. And there was someone else who was tweeting, and we both thought each other was doing some really good commenting about the conference. And we said. And this person said, you don't have your picture on your profile, so I don't know how to talk to you. And so I then automatically changed my profile, and he was sitting right next to me. So what's interesting, it's absolutely wonderful to network over Twitter, but you do have to actually meet people face to face, because in the end, the people that you work with, you're going to work with face to face. And as I've watched Matt's career, I was just totally blown away with all of the different ventures he's done, the entrepreneurial ventures he's done. And when we started Higher Ground, it was about doing a combo between people who wanted to start out on their own and people starting their careers. So I figured, as we go into our next stage of Higher Ground, that Matt would be the perfect one to kick it off. So, Matt, typical question to start us off. How would you summarize your career and what are some of the highlights and lowlights? I mean, everyone sees entrepreneurs with their really great cars, and they get to vacation in Hawaii and work for two hours, and it's always so easy. And, you know, that's what being an entrepreneur is all about, right?

No, it is not Highlights. I definitely think, you know, the nice thing about being an entrepreneur is that if you have a passion or vision that you see in the market space, you actually get to experiment and try and execute against that vision, right? To see whether that market exists to offer that service. The low light of that, you know, is the fact that you are actually putting yourself at great risk in the process. All of the companies that I've started individually as a founder were bootstrapped. So it was my own money. It was me paying myself out of my savings, paying other employees, putting myself at great risk to start those companies, to prove out a thesis that I had about an opportunity in the market space or that we could do something. So the highlights are definitely being successful in saying, I have an idea, I can execute against that and build value around that particular idea. The lowlights are you have to deal with the struggles of building a company. And it's not easy. Right. There's the ups and the downs and the, the. The nervousness of a spouse. You know, when I started my first company solo and I told my wife I was quitting my nice corporate job and was going to work out of the basement, we had just gotten pregnant and we're getting ready to have our first child. So not an easy.

You look good for being pregnant. You look good for being pregnant.

Yes.

So starting off as a young family now, I haven't been able to keep up. You've had three ven. Four ventures. What have your ventures been?

Yeah, I've had numerous over the years. The, the first that was kind of truly my company was a company called the Terrorism Research center, started in 1996. That was based on passion that I had around issues in, in terrorism and the linkage that we saw between terrorism related issues and infosec related issues. Right. The start of my career was at that intersection of national security and cybersecurity. And there really was no career path back then. I mean, I understand the struggles associated with finding a job in today's day and age and that last talk was very helpful. But if you can rewind to, you know, the early 90s, there were no jobs out there that said cybersecurity. There was, you know, not a lot of believers that this was a real issue. So the Terrorism Research center was kind of a combination of, you know, looking at the. We had a cybersecurity component, we had a conventional terrorism aspect to it and we built that up over the course of a decade and was an incredibly valuable experience. The second that was kind of truly my own company was a company called Fusion X that I started in 2010 and that was a red teaming entity where we wanted to kind of change the nature of how red teaming was being done in the market. Again, I had a thesis around a problem area that I saw and thought that I could deliver a solution that was better and built that out. Over the years I've been very involved. I was a founding member of the iDefense team, if you're familiar with iDefense or acquired by Verisign a few years after I left. And interestingly, when I was at Accenture a couple years ago, I actually acquired iDefense into Accenture. So that was like a full circle was there at the founding of the company 20 years before and then wound up acquiring a company that I had helped start. Was also early days at Eyesight Partners helping them out. And at A company called Security Design International, which not a lot of people remember, but we did some pretty kick ass stuff back in the like 1997, 98 timeframe.

So many folks in the room and watching offline are frustrated with their careers and want to go out on their own. What would you say to these folks about their current careers and their future as an entrepreneur? So do you just sort of say, I'm tired with my career and I'm just going to go off on my own? Or what should someone sort of look in the mirror and say to themselves before they do that?

Yeah, you have to find that balance that is right for you. Right. It can be very disruptive and hard to just say, I am going to quit and I'm going to go and find a completely new job. A very close friend of mine actually did that just a couple weeks ago. He got frustrated and said, I'm done, I quit. Hadn't updated his resume, hadn't looked for a new job yet, but just reached that point where wanted to branch out and he ended up going to work for a startup just this week actually. But then also balancing that with that you have a family to feed, that you need income coming in, that you don't know how long it would take to start your company or to get off the ground. So I'm also a big proponent of the side hustle piece. Is there an element of what you want to do that is not a conflict of interest with your current employer? When we started the Terrorism Research Center, I was a full time employee of saic, if you're familiar with saic, but they were not interested in that mission space. They were not interested in any of the ideas. I actually got a letter signed by Bob Beister, the CEO at the time that said I could work on this project nights and weekends as long as it didn't interfere with my SAIC work. And then that gave me an outlet for my passion to go and do research and collaborate. And we did a lot of cool things. And that laid the groundwork for when I decided to say, well, I think there's enough business here, enough momentum that I can make this my full time job. I was wrong. I couldn't make it my full time job. I ended up having to draw down on savings. We took a lot of risk, but it was the right decision at the time to kind of give it the full time focus.

So obviously there are some hard lessons to learn being an entrepreneur. What are one or two hard lessons to learn being an entrepreneur?

Yeah, I think the hardest Lessons to learn are to make sure that you have the passion and that you are attracting the people that you want to work with. I'm a big proponent of recognizing that you don't work for companies, you work with people. So I've always made it about who are the types of people that I want to work with to go and try and accomplish this mission. I think too often people get emotionally invested in their brand. They get emotionally invested in just the startup for the startup sake and they forget about the fact that this is a people driven pursuit. Right. That you need folks to work with. So I think recognizing that early on is very, very important. I've seen a lot and I've done it myself where you get incredibly emotionally attached to the brand. It prevents you from making decisions that are in the best interest. It forces you to be overly competitive instead of collaborative. I think that's another approach that I see especially in the infosec industry. Like it's fun to be a little boisterous and think that your team is better than the next team. But these problems that we're facing are bigger than any one company is going to solve. They're bigger than any 10 companies are going to solve or 20 companies. We need to be collaborating and partnering and sharing within the community, which is why I love events like this. So those are two, you know, common things that I think I encounter where people get, they forget that it's a people centric aspect of it and then they feel like they need to be the best and it's this highly competitive when they should be much more collaborative in working with.

So you're talking about collaboration being a really important skill. What are some of the other important skills that an entrepreneur needs? Because you know, we talk about skills and skill sets when we talk about career tracking. And what are the skills that people need to learn? Are there skills that you can learn being an entrepreneur or are there some innate skills that you need to have as an entrepreneur?

You, you have to learn a whole set of skills. I like to joke in building the Terr Research center that I got the School of Hard Knocks mba. I got the School of Hard Knocks law degree because you know what, I had to review the contracts myself and research because at the time I couldn't afford to pay the legal fees associated with like a real legal review. Right. So there are skills that you pick up and some risks that you take. But I think the most important aspects are the passion is definitely if you're not waking up and feeling that this is it, right? Then it just becomes like any other job. Being genuine. Right. I think is not something that you learn. It is just something that you are. I think I've been successful in business because I approach everything that I do with a very genuine nature. I'm very honest. I tell people I had a conversation last night at the bar with a person who would probably consider themselves to have been a competitor of my old company. And I was just sharing all the secrets, all the lessons learned because I want other people to be successful. Right? I want to be able to share that experience. So coming at it with passion, being true to who you are, finding balance. I mean, I'll be honest, in the early days or in the startup perspective, I swung the pendulum way too far in the kind of work life balance, right? So I think recognizing that you need to find that balance in life and that it can't be 100% about work or even 95% about work, you have to have other things. You have to draw in other passions and family and things of that sort.

So you've gone from one venture to the next. And a lot of times when I've talked to entrepreneurs, they just have one idea and they run with it, and that's the rest of their career. But you've been very successful going from one entrepreneurial venture to the next. How do you sort of keep that momentum going? Do you always have ideas on the horizon? Are you collaborating with people? How do you keep the energy up to constantly go from one to the next?

Yeah, I'm high energy to begin with, you know, haven't had enough caffeine today, but I think just intellectually, always curious. I read a lot, I interact with peers a lot. I expose myself to a lot of new ideas. I don't formally journal, but I keep a very long list of things that I think are interesting ideas. And at times they are. And other times I revisit the list and think, oh, man, what was I thinking? And other times I revisit the list and somebody else got there first, which is okay, right? It kind of proves the market. So when I found myself in those situations where I'm transitioning out of one entity and looking for the next piece of it, what the next opportunity is, I revisit that list and I think about what am I passionate about? Where do I think I could put the most energy forward and feel really good about what I'm doing? And then the other piece of it is I also listen to the market. So when I was getting ready to start Fusion X, I Actually had a whiteboard in my home office, and I had three ideas on the whiteboard, and those were three companies that I wanted to start. And then my phone started ringing. And the phone was ringing from executives and companies that I'd worked with in the past, friends in the infosec community that all wanted help around one of the ideas that was on my whiteboard. So when I looked at it, I said, okay, I have a lot of passion. I think I can do this. And the market is also speaking to me like, this is a problem that exists, that people are clamoring for a solution. And so that was actually helped me in the selection process with regards to, you know, I've got three things that I want to pursue. Which one, where do I apply my energy? That I let the market speak to me in that instance as well.

So talking about reading, you put out a reading list frequently, don't you?

I do, yeah, I do. A top 10 books of every year that tend to be business, technology, security books. Sometimes I'll throw in a. In a science fiction. I also put out a newsletter every Sunday. That was actually something I started over a decade ago as a way to provide feedback to my analysts and employees that were working with me. It was basically, what are the five to ten things that I think happened this week that are the most significant? And it might be like the indicator of a small trend line or it might be something big that broke, but it was kind of what do I think people should be paying attention to? And I made the commitment early on in that newsletter to include a book review. So every week I put out a book review of a book. And sometimes I cheat. Last week, you know, getting ready to come out here on Sunday, I put a review of a book that I read a couple years ago but hadn't reviewed yet. You know, kind of pushed that out to the audience. But I use that prior speaker talked about staying current and understanding the world around you. I use that as my level set to make sure that I'm paying attention to what's happening in the world. Because it becomes very easy to kind of ignore, get in the trend space. But committing to putting out a newsletter and identifying five to 10 stories means I need to be thinking about it all week. Every Sunday morning, I need to take the time to sit down and say of the things I've encountered that I've bookmarked, that I've added to my to do list, which are the ones that I really think are the most important, and then kind of push that out.

So when you look at the cybersecurity landscape, it's very interesting because we tend to see a lot of the big names. Why do you feel entrepreneurship is important to this community?

Entrepreneurs can innovate at a much rapid, much more rapid pace than a big company. And I've lived in both, so I've seen it firsthand.

Right?

Entrepreneurs can take risks that a lot of big companies can't take. From a risk perspective. They can have that kind of application of energy. You can funnel energy. If you hire 20 really smart, talented a players into your organization, you've got all of that energy that's channeled towards solving your particular problem that you've approached in the market. Big organizations. Not that there aren't a ton of smart people in big organizations, but you also carry a lot of dead weight, you carry a lot of bureaucracy, you carry a lot of overhead. So a startup is kind of unencumbered by that. So I see entrepreneurship as essential because it's a great way for new ideas to kind of manifest and accelerate in the market.

So when someone is considering a career, should they consider working? Excuse me, let me backtrack. When someone's considering going to become an entrepreneur, should they go and work at a startup first to see what it's like, or should they just go out on their own?

I think you could go either way. I mean, working in a startup I think is fun and gives you that kind of shared experience. You learn the things that you don't want to do as an entrepreneur. Before I branched out on my own, I worked in a startup and I saw the good, bad and the ugly. And the ugly was the stuff that I committed to myself that I would never do as an entrepreneur. Right. And I encountered those where another CEO was making those mistakes or doing those things that, you know, allowed me to see, okay, those, these are mistakes that I'm witnessing that I want to make sure that I never repeat and committed to doing that. Or you can go out and learn those mistakes as well. Right. Just on your own. So I think either pathway is valid. It's just if there's a startup that's aligned with your passion and there's an opportunity there, that's a great environment to learn a lot about how startups are built.

So cybersecurity demands on the now. Excuse me, I don't have my glasses on, so it's always interesting. Cybersecurity demands the now. How do you balance the need for urgently urgent projects when you have to have time to develop your projects? So we're talking about cybersecurity and everyone wants to do it now. But if you have the idea and you have to develop it and have it mature, how do you have that balance? That's really hard.

I am a big proponent of focus, right? I had a quote that my employees actually put on the wall, which is kind of a humbling experience, where I said, distractions are free, but they sure do cost a lot. I think too often in startups, and I've done this myself, you chase the next revenue stream, you agree to do something that is really kind of outside the area that you want to be working in because a customer is asked. So it's that power of focus, that power of saying no, that power of not distracting yourself, I think becomes critical, even if it creates a little bit more stress, right? You're not accepting the revenue stream, so you have to draw down on the bank account or you have to go another week without paying yourself or whatever it may be. But the benefits of not having the collateral damage to your focus and your momentum and what you're really trying to do are key.

So the demands on CISOs today have created an environment where they are integrating many tools and data sources into their operations. How do you recommend an entrepreneur approach, bringing an innovation forward when they may not have the resources to have all of the tools? How do you bring an idea forward again?

I think that's part of the focus, right? When you go and talk to people, you need to make sure that you are addressing demand that exists in the market. If you have something that is addressing a current problem that the CISOs are facing, even despite how hard it is to get their attention, you are going to establish some momentum using your network to identify early advocates, right? When we were starting Fusion X, I went to someone who I'd known from the work I'd done back in the Department of Defense, who was at a big bank, and I said, listen, I know that we're a startup, we've got no past performance, but can you take a risk? Will you be willing to have this be kind of a joint thesis? And he did. And it turned out that he loved us and became a retainer based client and was one of our biggest clients over the years. So just having the requisite to go and approach folks and say, I understand and you have to really understand the problem that they're facing. I understand the problem and here's the solution and I'm willing to work hard to demonstrate how our product or how our solution will satisfy that. Right? So there's also a kind of a courage element of it, I guess, which I also think is probably important from an entrepreneur perspective. I am primarily an introvert. I like events like this because it's kind of my tribe. And I've been coming to hacker conferences since 1995, so.

So how many defcons have you gone to?

I have been to over. You know, it's probably right around 20. There are a couple I missed when I had children, and my wife didn't want me to travel because the children were too young. But I've been coming religiously over the years for many, many years, going back into the 90s. But the courage aspect of it, I think if I look back at the lessons learned, where I had opportunities, where it was the courage to go ask somebody to take a risk with me, the courage to go ask somebody to listen to what I was saying, the courage to go and introduce myself to someone. The early, early stages of my career, when I was a graduate student studying this topic and no one in the world was interested in seemed like I actually had proposed to do my thesis on the topic of information security and the risks to national security, and it was denied. So I'm being told.

How many years ago was that?

This was 1993, so 25 years ago. I'm saying, this is an important issue. I want to do a graduate thesis on this. And the chair of the department says, no, it's not valid. Why don't you go look at the national security implications of NAFTA and free trade and stuff like that. But I continued to reach out. I reached out to a conference, Computers, Freedom and Privacy. I think it was CFP number two or three in Chicago, and asked to speak and send a copy of my paper. And they said, no, the agenda's full, but we'd like to. There was this new organization that had stood up, that had scholarships to attend that was actually the eff. So I'm a big advocate of the eff, not just for their work, but. So they paid for me to go to the conference. And there was a guy that was on stage, and he was a former CIA guy, had been in the CIA for 20 something years, got out, was now in the private security space. And he said something that at the time was very risque. He said, hackers are a national security resource. I had a paper I had written that had a chapter entitled Use Hackers as a National Resource. So I went up and introduced myself to this guy and gave him a business card and got his business card and Said, can I please send you a copy of this paper? Said, sure. Sent him a copy of the paper, didn't think anything of it. Went into my department, that was about six weeks later. And the receptionist says, what did you do? What did you do? What do you mean, what did I do? She's like, I got 300 phone calls for you yesterday. We can't get any business done. You did something like, well, what are they asking? They're asking for a copy of this paper that you wrote. Okay. Then the letters started coming in from the guy who was the CIO at the Department of Defense, best selling authors, et cetera. It turns out, unbeknownst to me, this CIA guy had a newsletter that was an actual Xerox newsletter that he printed and mailed to about 3,000 people. And he put a recommendation that people read my paper in that newsletter. So because I had the courage to go and say, I would love for you to read my paper, gave him the business card, followed up, sent the paper, he generated all this exposure for my ideas. And that actually was a catalyst for the chair of the department pulling me in and saying, what was it that you wanted to do your thesis on again? And I explained it to him and he apologized for being shortsighted and let me do my thesis on the topic. Right.

And we are very thankful that he did.

Yeah. So that one, you know, having the courage as a small Vermont, you know, small town Vermont boy, to go interact with that person had a huge impact on my career going forward.

So collaboration, courage. These are some of the things that you would highly recommend as an entrepreneur. Anything else? Any other big skills that you think, you know, risk. Risk taking, how?

Obviously, curiosity.

Curiosity, definitely.

You know, you have to be. If you're going to find solutions to bring to the market, you have to be curious about the world. You have to be curious around innovation that exists out there. Curiosity about how other innovators have achieved things in other domains outside cyber. I went on a kick a couple of years ago. I was going to read about all sorts of people that were innovators in their space that were non cybersecurity. I wasn't going to read any cybersecurity books because I wanted to see how did other folks overcome some of these barriers to innovation? How were they inspired? That was incredibly insightful for me. I drew a lot of lessons from kind of studying the experiences of these folks that had innovated in other domains that weren't cybersecurity related.

Do you ever read back to da Vinci or Any of the major innovators.

I haven't gone that far back now. I've been more curious about the last years, few 50 to 100 years.

So Tesla, maybe some Tesla stuff.

Now I can't remember the names, but, you know, I read the book about the guy who basically re envisioned marketing and the storefront windows and the famous architect that did the Chicago World's Fair. I mean, it just kind of a whole slew of books that I went through saying, you know, what can I study about other innovators that I can maybe bring back into this space?

So what I'm hearing is that as an entrepreneur, it's not just having a really great idea. It's and running out and doing it and having the courage to do it, but actually doing a little bit of the research to make sure that someone else hasn't already done it or how other people have gotten over that.

Yeah, or applying it to your own domain. I remember I was struggling for a way when I was running Accenture's cyber defense practice of kind of articulating the state of the practice, you know, which I had 15 or 16 different areas within there. Cloud security, mobile security, red teaming, purple teaming, blue teaming. It was kind of a hot mess of the services that lived in there. And I was reading a book, I think, about McKinsey Associates, the big consulting firm, and the formation there. And there was a matrix that they had, the founder had invented in the 1960s, I think. And I looked at that and I said, shit, this is exactly the problem that I'm trying to solve. So I put my information into that format and it actually gave us a great way to visualize what our capabilities were, where we were trying to get them. And it was an old technique. You know, here I was banging my head against the wall and somebody had already thought through these issues in a general business context that was very applicable to what I was trying to do.

Yeah, I'm amazed in marketing how many times I have to share with people what a SWOT analysis is. And I'm like, okay, strengths, weaknesses, opportunities and threats. You know, just sort of a basic thing. So let's sort of flip over. You know, we deal with a lot of conspiracies in our community. How, as an entrepreneur do you find people do work with that you trust? Can we, can we hold the conversations in the back of room down a little bit, please? Thank you.

So. So that's probably another mistake that you'll make as an entrepreneur, is that you're. You're going to get Burned. And I've been burned. There are people that I have trusted that I've taken kind of on their bona fides, that have taken on their promises. You learn to develop a natural instinct around that. I learned to focus on what motivates people. Right. That kind of speaks to intent. I've learned to use the network. Right. When I built Fusion X, we did it almost entirely within network. It was, you bring on board the first few people that I know and then it's who do they know? And then who do those people know? And kind of using that as a way to expand things, being honest around where you encounter situations where people violate that trust. Right. We tend to tend to silence the negative experiences that we have. Where I've always been very vocal. If somebody calls me and they say, what was your experience working with xyz? And they burned me, I'm going to give you the honest answer I'm always going to give. I'm not going to sugarcoat it. I'm not going to hope that it doesn't get back to me. I'm always going to be 100% honest and transparent. So I think if you, if you follow that and you are very genuine, you will find trusted people to work with. But you have to prepare for the fact that you are going to get burned. I've had my trust violated in very significant ways over the years. And you can't, I'm very stoic about it. You can't let it take you down. You just get to view it as something that you have to overcome and then file it away.

So you touched on this a little bit earlier, having sort of the side project. And I always find it interesting because people think that they can be an entrepreneur or they can be a full time employee or they can be one or the other. Can you sort of touch on the side project a little bit more? You were really great about going to your boss and asking permission. And I also think that, you know, entrepreneurial skills you can actually bring into a career if you're not willing or in a position to be able to take that risk. What are some of those entrepreneurial skills that you can use within your own career?

Yeah, I think, I mean, the side hustle piece I think is appealing because it lets you go out and kind of pursue that passion or experiment in the market, finding the time, finding a way to do that, even if it's just writing. I'll often encourage folks, go out and write about things that you're interested in, go and make risky predictions. Right. If there's something that you believe or an issue that you feel passionately about, be transparent and talk and write and be out in the community demonstrating that passion or demonstrating that thesis, I think that becomes incredibly important as well. Being transparent, you know, that you talked about with saic. I went and talked with them and actually got permission. It worked out in their benefit because when I left and went and started, you know, working full time at the Terrorism Research center and then we eventually grew over time, I actually by way of kind of catch 22 ended up subcontracting probably like $10 million worth of business back to SAIC and my old team and my old partners. So them allowing me to be entrepreneurial and pursuing that passion on the side and then transitioning to it actually worked out for the company. And I always was very proud of the fact that Bob Beister, when he wrote his book about employee owned entities that he listed the Terrorism Research center and Fusion X as examples of, you know, people that learned the lessons of that SAIC experience and went on to become entrepreneurs.

So you can, I mean, I think that what's interesting is that a lot of people think that they need to be, when they go out to be an entrepreneur, they need to go out on their own and that they, it doesn't have to be. And it's also what's interesting is that they feel that they need to hold this back from their current employer. And as Matt just shared, being able to be transparent and actually talk to your current employer about hey, what, you know, I want to do this, how can you support me through it? Now you will probably get some nos and that's fine because after every no's there are going to be some yeses that come through. But being able to sort of create your own incubator within your current employment situation can help you sort of, you know, not have to take that big of a risk. And a lot of us don't go to business school, don't go to law school. You know, that's what Matt was saying earlier is that he had to learn the school of hard knocks. He had to be his own business person, he had his own lawyer. But if you have the resources of a large corporation and they have accountants and they have finance people and they have HR people and they have lawyers, they may be, they may, I'm not going to say they are, but they may be willing to sort of say, hey, let's sort of give you some advice. And you know, that is advice that's paid for on another Dime rather than your own. Would you agree with any of that?

Yeah, don't be afraid to ask. I mean, that's the one thing, and I think that's one thing that's great about this community is that there's a. There's a lot of community karma, right? With regards to taking the time to talk to people, to answer questions, to give advice, you know, whatever it may be. I taught at Georgetown for 14 years, the most popular cybersecurity class. I cycled about 600 students through. I will always take the time to go have lunch with a former student to give advice, to write a letter recommendation to review a resume. Same with, with folks in the hacker community, right? Get them to reach out to me, ask for advice, run an idea by you. Right. Sometimes you just need a sounding board. And I've done that with my friends as well, where it's like, hey, I have an idea. I've done that for other friends. I mean, I was around the table. If anybody knows the company, Carbon Black, I was around the table because they were buddies of mine when they said, hey, we have this idea. What do you think? And I gave my advice. Or when Nick Lanta was trying to spin Net Witness out of mantech, right? To be able to provide that advice just for free and put it, put it in the. The karma bank. I mean, one thing I also big piece of advice that I give to folks is don't be overly transactional in your relationships with others. Don't always expect that you're going to get something in return if you give something of yourself. Right. The natural order of things is that will kind of balance out, you know, on its own. But there is a lot of asymmetry. You might provide advice to somebody and you never get anything out of that other than knowing that you provided advice and you helped move somebody's career forward. Too often I see a lot of quid pro quo where it's like, well, I'll help you with this if you help me with that. Like, go into it where you are, you know, offering help or providing advice or taking the time to meet with somebody without any expectation that there's anything in it for you in the future.

I would definitely echo that. And it's interesting because my day job is very transactional and I'll have lots of people who will reach out to me and they'll say, can, you know, thank you for connecting with me on Twitter or LinkedIn, and by the way, can you review my resume and get me a job right now?

This is A perfect example, because I had no need to interact with somebody like Kathleen professionally. Right. But I liked her as a person. And so we met and we had coffee, and one of the things that we talked about when we had coffee was that there are a lot of job opportunities, especially in the US Government, for infosec professionals that weren't being filled. And we had all of these veterans of our military service that were transitioning out that might be good candidates for those jobs, but had no exposure to the community whatsoever. And she actually challenged me and said, you're on the Black Hat board. Like, what can you do about that? Let's get these people integrated in the community. Let's create opportunities. So myself and a couple other Black Hat board members, they give us free passes every year. We just coughed up our free passes and we posted on Twitter and Kathleen amplified it and said, if you're a veteran that wants to transition into the infosec space, let us know. And that first year, we brought two out. If you remember, the picture just popped up on my Facebook feed. We brought two out. One of them was a weatherman. He had been in the Air Force for a decade, was a weatherman, but it turned out that being a weatherman, he was maintaining hundreds of Linux systems. And in doing that, he was learning how to secure them, how to attack them, was teaching himself stuff at night. So we brought him out with another guy. They are both gainfully employed in the cybersecurity community now. The next year, we brought four people out. They are all gainfully employed in the cyber community. The next year, we brought one out who actually started a company who's very successful now. Black Hat actually supports it as an official program, and we bring 10 transitioning veterans to Black Hat for free every year. That was because we had coffee, right? We met at this government 2.0 conference, and we took the time to go and get to know each other and created this thing that, you know, from a pay it forward perspective is very valuable in the community. It also brought her into events like this, right? And rooms like this that wouldn't exist if not for the volunteers that are spending two days inside this room doing this work. So that's a great example of meeting with people and not being transactional and just looking for opportunities to collaborate. And I made her cry.

Yeah, you made me cry. Thanks, Matt. No, that's. It's. It's a passion of mine. And Garland, you want to raise your hand? So Garland is the first B sides Las Vegas transitioning veteran who's part of the program that Matt and I talked about over coffee several years ago. So we're. We're now doing that here at Bsides Las Vegas. But yeah, I can only echo that, that it's karma. It is the golden rule within this community. It may seem like it's extremely transactional. If you're helping someone because you expect to get something back right away, don't do it because you will carry that chip on your shoulder for a long time until that person pays you back. I can tell you I've been burned several times in this community. I've been burned several times by people that I thought would not ever burn me. And you'll be shocked. And that, to me, is a great segue to a question, because I need to fix my makeup over here. How do you stay positive in a pessimistic industry? This is a Bobby Stempley question.

Yeah, I mentioned the stoicism. I mean, I have a very positive outlook just in general. Right. That I feel like you can find solutions, especially if you're collaborating, especially if you're being focused on them operating in the counterterrorism space. I can tell you for a while it was difficult to be positive because we were confronted every day. We had a 24 by 7 global intelligence team, and it was every day people being killed and the things that were happening and the folks seeking to do harm, but just recognizing that there is a pathway for making things better. Right. And in reading books. Has anybody read the book Factfulness?

Who's it by?

It's Hans, and I can't remember his last name, but he just recently passed away. But it's just a book called Factfulness. I would recommend that especially on kind of maintaining the positive outlook because it goes and shows that the world is actually getting better. Right. Our news media focuses on the negative. We have a broader reach. We have social media. So we get exposed to a lot of things that are happening that we didn't get exposed to. But from a general trend perspective, education, eradication of disease, poverty. The world is becoming a better place. Right. So recognizing that you have the power to go do your little part in that, and it might be solving for a particular cybersecurity issue, it could be something that's at a much grander scale. My latest career transition was about me seeing the skill sets that I had acquired over the past 20 years. And you've seen me talk about this, you know, where I decided to walk the walk, where I said, I think that the principles that we employ in the hacker and Infosec community have broader application. And shame on us if we don't find some ways or some of us don't go out and figure out how to apply those same principles. The intellectual curiosity, the taking things apart, the making things better around other problem sets that exist out in the world. And last November, I decided to transition and start doing that. I mean, I'm looking at much broader global problem sets still as an entrepreneur, but not solely focused on cybersecurity, because I felt like there was great value to that mindset, that approach that could be applied to lots of other issues that exist out there. So see challenges as opportunities. That's kind of the basic of stoicism. Do your part to be positive in it. Be around positive people. One thing that I've had a very low tolerance for is just the negative energy around you, whether it's in the organization or who you're collaborating with. I mean, find people who share that positive outlook and excitement and use that as your network that you're interacting with.

So my final question before we'll open it up to the audience. You have some amazing family members. You are just so very much a great parent and a great spouse. How do you be that and an entrepreneur at the same time?

It's that finding balance, you know, Definitely piece of it. My wife has been a great partner over the years where she calls bullshit on me a lot.

Where I will say, I guess I'll make my husband get an entrepreneur so I can call bullshit on him all the time.

On maintaining that balance. Right? Just saying, like, no, you can't go on this trip because we have something else, right? Or, you know, you talk about opportunity. I was a hockey player. I didn't get a hockey player out of my.

Caps.

We're in Vegas, so you gotta be careful.

Sorry.

The second child wasn't interested in hockey. Third was interested in hockey. I ended up leaving Georgetown. It was very bizarre circumstances that you can read about online with, like, unionization of adjuncts and just all sorts of craziness. But I ended up leaving and it was Monday nights where, like, a. Like, it was very hard for me. I saw it as, like, oh, my gosh, I'm no longer teaching. And it just happened that my son's practices were on Monday nights and I was able to become a hockey coach, right? So, like, the world found something for me to do with that excess time that I had. I think the other piece of it is letting your children be true to themselves. I've never tried to force them down any one Path. They've never tried to say you're the hacker child or you're this or you're that. I've just kind of let their personalities develop. I did get one hacker out of the group as well. So my middle child does. Will be at Roots Asylum. He does. Thank you. Shout out. I don't see any of them in the room, but shout out to the B sides. Nova back in Virginia that run a middle school. These are volunteers that every Sunday show up at 9:30am with Bagels and they teach a hacking class. Feed the Kids Pizza until 2:30 in the afternoon. And they put together their own capture the flag. Right? So something like that. These are people in the community that said, I want to pay back, I want to do something. They didn't need to go and have a side hustle or be an entrepreneur. They created this program that's incredibly valuable. I mean, they graduated like 15 or 16 kids through it. So letting them kind of pursue their own passions and find their own balance, I think is also key.

So I'm going to put a little plug for another presentation that's happening tomorrow. At the end of the day, if you're thinking of being an entrepreneur but you don't quite know if you can go out on your own or work with. With people that you don't quite know, do consider volunteering at a con. Volunteer as you know, hey, am I going to be able to get venture funding? Well, go and volunteer at a conference and get the sponsorship. You know, what is it like to go out and get money? Are you a person that can manage a lot of different people? Well, volunteer management, it's really great when you're working with staff that have to show up when you can pay them. But volunteers, you know, and they didn't want to show up that day or, you know, are you really good at the subject matter that you think you are? Being able to volunteer for the proposal review process or the cfp, being able to read other proposals from the community, you might find out that that idea you had might not be as good. So Matt is here for a few more minutes. Do we have any questions from the audience? Please don't be shy. Come on. Courage, courage. Okay, you're gonna have to stand up and yell over these people. I'm gonna repeat the question and you're gonna let me. Thumbs down, thumbs up if I did it. So every entrepreneur has certain strengths, but an entrepreneur also needs to know what their weaknesses are. And do you actively go and find people that are strong in those weak Parts. Is that it? Okay.

I would say yes. You have to understand your weaknesses. Right. And for me, I think overcoming that, I was a red teamer. So I wanted to view everything in the world from that red team perspective, which is a very skeptical perspective, you know, by nature. So learning to balance and say I'm engaging the red team side of my brain because I'm red teaming right now, but as it relates to how I'm interacting with people or how I'm viewing this opportunity, it's okay to introduce some of that skepticism. But you can't let that be the guide for your decision making solely. Right. Recognizing the need to learn from others. I think especially when you're young in your career, when I talked about being humble, you have this perspective that you know it all right. Or I had some great mentors that were not cyber folks, you know, on the red teaming side I got to work with General Van Riper is a famous military red team or conventional red teamer and kind of learned the lessons there. And recognizing that and then recognizing your weaknesses and finding that team, I can tell you when I, when I put Fusion X together, I had to confront myself that I was no longer a real highly technical red team team guy because I had been doing management, I'd been consulting, I was still deploying with my teams. You know, it started once a month and once a quarter I was on the black hat review board, which I still am. Right. So this, you know, technical prominence teaching at Georgetown. And I had to confront the fact that I am no longer an A team hacker. Right. That was a, from a technical perspective, that was a huge barrier to overcome, you know, from ego. So when I started Fusion X, I had to go find that a team hacker that I trusted that could fill that gap. And that was critical. I couldn't have built Fusion X without Tom Parker, who was that. A team hacker, still had the technical skills and was a good balance. I understood what he was doing, but I recognized that me going out and saying that I was that guy would not be honest in the market because I wasn't that person anymore. So also recognizing and accepting that your careers are going to transition over time. I have friends who have been incredibly highly technical and still are, you know, now in their 40s. I have friends that have transitioned to management, running large teams, becoming entrepreneurs. Right. There's a, there's a natural progression. You need to pursue what makes you happy. If it's always the technical piece, I'm learning stuff now from my 13 year old, right. That if you'd asked Matt DeVoe 15 years ago, I'd have said, there's no way I'll ever learn anything from a 13 year old. So that you do have to recognize that you have to be true about yourself and your capabilities and be okay with the fact that. That things change and that you do transition and age out maybe is a good way to say it. Professional sports is maybe a good analogy. You're not going to be the star quarterback for the entirety of your life. And recognizing that you can go be the coach or go be the GM and bring in those folks and still be part of a really great team and accomplish great things.

And I would just echo about one. That's a really great question, because I think a lot of us think that we're good at everything. And I think that's one of the biggest pitfalls that we have, not only in our career, but also as an entrepreneur is that we believe that we're a good accountant and we're a good finance person. And, you know, I'm a really great idea person, but as everyone on my team knows, I am horrible at implementation. I can think of the great idea, but me getting it down on the floor, forgot about it. Now, when I started in my career, I had to do that all. Now I can at least be and say, okay, I can pass this off to everyone and, and everyone's much happier when we do that. We have time for one more question.

Come on, somebody's got a question.

There's. There's got to be a burning question out there. Okay, well, can, can we give this guy. Can we give this guy in front of you instead, since you got to ask a question. Thank you.

Hello. Is this working? Yeah, yeah. Sorry, I came in a wee bit late, so I might have missed if you've already covered this, but I was wondering, when did you know it was the right time to transition from permanent employment to doing what you're doing now? You know, branching out. You know, a lot of people I know who have done what you're doing, there was a strong negative motivator pushing them out of their current job. Like they just didn't want to do it. So they're like, all right, I'm going to go freelance contracting. But sometimes, you know, you can be quite happy at your current company, but you're wondering, well, what if I could do this? You know, like, it sounds like a good adventure. Yeah. I would say the key piece is intuition. Right. It's that kind of trusting that, that gut instinct that the timing is Right. That was the case with starting the Terrorism Research Center. That was the case with Fusion X, as well as a few other things that I've done over the years. Even with my career transition back in November, I was not looking to leave. I had built this team. We had been through the acquisition. I was running this global portfolio, hadn't updated a resume or talked to recruiters. But I got exposed to an opportunity and my gut intuition told me, hey, if I don't go do this, I'm going to regret it. And B, I think the timing is right. I think that the, you know, the time to test this thesis was appropriate. Sometimes you're too early. I mean, Terrorism Research Center. I mean, in all honesty, 1996, starting an entity called the Terrorism Research Center. I have a stack of denied proposals, you know, that I submitted to the US Government that would astonish you. I have rejection letters from people that have very senior executive positions in the Department of Homeland Security today that literally said, terrorism is not a domestic United States problem. Right? So we worked hard and built value and did things, but it was very small. And then September 11th happens. Right? And that was obviously a catalyst for our thesis around the problem, you know, that we were focused on was correct. But it took multiple years to manifest itself and a lot of hard work. Had we not put that hard work in, though, I would have just looked like an opportunistic, you know, person who is saying, oh, something bad happened. I'm going to go see if I can make money off it. As a result of having been working for so many years, advancing these issues, having all of these ideas, you know, working with a lot of local law enforcement and first responders, we had the credibility to be a very viable partner in looking at a lot of those issues moving forward. So it's intuition. It's, you know, that sense of the market having a problem that you're trying to solve for, feeling that the pieces are coming together. But I will say that if you have to overly deliberate on it, then it's probably not the right time. Or you need to teach yourself some sort of coping mechanism to not talk yourself into transition, remorse or buyer's remorse, whatever it may be, before it happens. I've always liked the adage, the samurai adage is any decision worth making should be done in seven breaths. So if you're taking a week or two weeks or a month and you and you're agonizing over it, it's probably not the right time. If you feel it and it's there, it's like with my transition in November, it's like I knew the minute that I talked to the person about forming this company, I knew. I was like, this is it. Like, this is the time it's been inkling in the back of my mind around the opportunity space. I'll regret it if I don't do it. So it's time to make that change and transition. So it's a little wishy washy, but you have to trust yourself, trust your gut, and you have to feel it strongly, right? In order to be able to move forward with the passion that you need.

Matt, thank you for sharing sharing your business card with me in 2009 and having coffee with me in 2015. And let's thank Matt DeVoe for coming over to his first B sides and sharing entrepreneurism.

Thanks everybody.