In this episode of the Full Throttle Leaders podcast, host Michael Falato interviews James Oliverio, founder of IdeaBox, a cybersecurity consultancy that focuses on quantifying the financial impact of data risk. Oliverio recounts his career trajectory from Wall Street CIO roles at Credit Suisse, UBS, and DLJ to founding and later selling a managed‑services firm, and eventually resurrecting IdeaBox after a Harvard program on risk mitigation. He highlights three core lessons from that program: (1) the critical need to separate the CIO and CISO functions, (2) the hidden danger of unstructured data (Word, Excel, PDF) as the primary breach vector, and (3) the importance of quantifying risk through a metric he calls Return on Mitigation (ROM). Oliverio explains how IdeaBox leverages the Actifile platform to provide file‑level encryption, real‑time logging, and chain‑of‑custody visibility, which they sell both as a tool and a managed service. Their ideal customers are mid‑size financial services and healthcare firms, often accessed via MSP partners or directly with internal IT teams. A vivid case study is shared where a healthcare client’s data appeared on the dark web; using Actifile’s logs, IdeaBox proved the breach originated from a third‑party vendor, not the client, demonstrating the value of visibility and liability quantification. Oliverio concludes with a call to action for organizations that cannot answer basic questions about their unstructured data exposure, directing listeners to contact IdeaBox via ideabox.com.
Chapters
All right, everybody, it's Michael Falato here from Full Throttle Leaders. We have another great guest today, James Olivero. Olivero.
Olivero. It's good. Close enough.
From Idea Box. I've known him for about 6 to 12 months. Great guy. I just wanted to say thank you for coming on. What What grabbed your attention to even want to do a podcast with Michael Falato today?
Look, just more outreach. I really appreciate, you know, putting this together, but more outreach and kind of, you know, spread the word to some of the companies out there that can maybe, maybe thinking or struggling with cybersecurity or the challenge of cybersecurity and AI around it. We just, we just approach it very differently and we're just trying to get our message out there. you know, to the community that we just, we approach it a little bit differently.
So tell me a little bit about your company, why you built it and what you actually did up to this point. Like, so what kind of got you to build this company?
Yeah, I mean, spent time on Wall Street as a tech jockey in my early career, and then that career blossomed and I was encouraged after becoming a CIO of an investment bank Banks merge. You know, things fall out. Those bankers say, hey, come with us over to this other firm, which I did back in the early 2000s. That was UBS. Went from Credit Suisse. It was DLJ was the original company. Donaldson, Luckin Jenrette was purchased by Credit Suisse. And about a year later, those bankers said, hey, a bunch of bankers said, come with us over to UBS and set up the IT structure there. I did about a year there and then they said, go start a business, which I had no clue what to do. But I started a company, an IT firm, which blossomed into a managed services company. I sold that in 2015 and I came out of the market for a little bit about 10 years ago, did some private equity, another MSP, we're, you know, building out and decided from a program I enrolled in in 2019 at Harvard University It was called Mitigating Risk in the Information Age. I decided to resurrect a company that I owned, the brand called IdeaBox, and bring a different focus around cybersecurity, things I took out of that program at Harvard, which we focus on. There were 3 things I learned, right? We took apart all the major breaches several years ago in that program, and it was 3 things we learned. The separation of duties was number 1. You can't be the CIO and the CISO. And I believe out of that program, fast forward to today, most organizations are, you know, well, we— is the audio OK?
Yeah, you said, you said the CIO and what?
CIO and CISO, Chief Information Officer and Security Officer, can't be the same.
Yeah. Okay, cool. I just want to make sure I heard the right—
Yeah. And secondly, was those firms like Sony, Target, Equifax, and the NSA, what did they learn, you know, postmortem on their breaches? It was the unstructured data that was stolen that created their greatest vulnerability and risk.
And when— And then understand structured data and unstructured, what is like the layman's— Yeah, for that.
So the unstructured data is Word documents, spreadsheets, PowerPoint. The structured data would be your databases, things that are secure, you think they're secure, but sit in repositories in an enclave and you know where to go to get it. But the unstructured stuff, attachments, has sensitive information like credit card and other, creates the greatest vulnerability.
Okay, thank you.
And then lastly was how do you quantify this stuff? And that's where I spent a good amount of my time in the last few years. ROM, what is ROM? Return on Mitigation, which is helping organizations essentially quantify that risk in a way that is meaningful. And that's what I've been up to.
You explained to me I think like in 90 seconds last time we spoke, like what you do is to break it down for our audience.
Yeah, I mean, really simple. We identify the invisible liability for companies, why data is the most mispriced asset, you know, on your balance sheet. No one's really focused on the question of If we were experiencing a breach, what data that's unstructured creates our greatest vulnerability? And no one's really gone through that mechanism of it. Security in general, right? You know, the perimeter, people think there's a false, you know, false thing that firms fall into. My perimeter is structured, pen testing, and the rest. Security is not the exposure to visibility, right? Moving from the perimeter defense to financial liability quantification is what we focus on. So, you know, when you, you know, when you look at the illusion of security, I passed my audit, you know, you know, but do you really know who has access to your data? You know, what, what AI tools that your employees are using? Are they perhaps maybe exposing some of the data that you're supposed to keep protected up to the large language models.
So what's, what's the thing that you learned in the last 6 months that either was a great or great idea, like, hey, this thing worked, I came up with a new idea for my client, for myself, or, or, or system or technology? Or secondly, what's something you figured out like, that was a really bad idea, and I learned from it, but that I don't want to do that again.
Well, I guess our messaging, you know, leading with tools and showing, you know, cybersecurity is just a broad universe and honing down to focusing, saying, listen, we focus on the liability that most firms really, you know, go undetected and focus more of our messaging around return on mitigation, which is quantifying the financial return of reducing measurable exposure. Right? What investment, you know, in order to figure that out, what data do I think creates the greatest risk? Do I know where it is? Can I track it and monitor it? And then put some metrics around that. That's a better strategy than, gee, we got breached. We know it was stolen and everything's questionable. You know, that's how most firms deal with breaches. You know, it's in the rearview mirror and that's unfortunate. And it's fixable.
It's reactive versus being like proactive.
Yeah. What—
who's your ideal customer profile for, for your company?
It's, it's mid, mid-sized to, you know, small to medium to mid-sized companies, financial services, healthcare companies that want to keep data sacred. I mean, it's just, I think there's just not, you know, the ones that were because regulation drives it, healthcare for sure. You know, they've got a requirement to keep certain data protected. But I think this goes, this is very broad. We're approaching it very different than anybody else out there, literally. Not that I just try to focus on what makes us different. You know, I'm not really enamored with that. There's a lot of business out there in the cybersecurity sector. We just approach it a little bit pragmatically. From a perspective of how do I speak to the C-suite? What could you measure and quantify and give them data, their data, if you will? What do you want to do with this? Do you want to discard it, get rid of it, protect it? And the remediation pieces, we do file level protection encryption. This brand here that I carry on the sheet, this, this shirt is called Actifile. It's a company I partnered with to help devise and develop the whole ROM concept. And the, the back dashboard you see here is quantifying someone's data risk almost near real time and give them decision— give them opportunities to make decisions on what they want to keep protected. No end user involvement.
And who, who do you likely deal with inside these light enterprise companies?
We deal with sometimes with the compliance people, but we ultimately end up with the IT people, either they're MSP, insert inside IT people, because our tool, that's part of our messaging and our value proposition requires that we sit on the desktop or workstation or server. So it's an agent we need to deploy that keeps this thing, if you will, in balance to look at the data that's coming in and out. So we do end up with the IT people, you know, working with IT people.
MSP, you're working with them to deploy, you sell to them and they sell to their clients?
Pretty much, yeah, I do both. MSP wants to own the relationship or manage, allow us to manage the platform for them on their behalf, and focus on the conversation of return on mitigation. So we give them a whole— we become an extension of the MSP. I work with several MSPs as their security arm. Because they don't want to develop that skill set, hence giving them some separation of duties, right? And there's others that I just go direct. If they have their inside, you know, inside IT person, we'll show them this new metric that they can use and leverage that turns maybe an expense into a strategic opportunity.
So if you can quantify or almost give like a, hey, this is kind of a case study, which you don't have to mention someone's name, but like, I like looking at Challenger customer type things like you had a $600,000 problem I solved for $60,000 because you employed what I suggested. I helped you decide what exactly you needed to protect yourself from. Do you have any type of like—
Oh yeah, I've got, I've got several. I've got several. The one I like to use the most is last year this time The client received a phone call from the FBI. And this is the way it went down. Hi, this is the FBI. We, during a healthcare breach, came across data we believe belongs to your organization. So they put us in contact with the FBI. We trust but verify it was them. They gave us this link. Right. And we were looking at these files on the dark web, file names going to the client site, matching file name by file name, spreadsheet, Word document, you know, holy crap. Looks like this, this client got breached. But here's the difference. As the files were going to the dark web, opening up with Excel, opening up with Word, full text, reading it, and it was really confidential, sensitive data. Internal systems are showing that the data is protected and encrypted. So we looked at the logs of the files. At some point, those same files were decrypted and sent to a third party. So we matched all those files, matched each— it was the third party's network that got breached, not our client. So we were able to legally show the chain of custody, the third party or the access care organization in the healthcare sector breached their confidentiality agreement. And that's— that was a simple example that we were able to show the proof of concept. The other—
they thought, they thought you weren't protecting them, and then you said, no, that we did, we did.
And it was your— it was, it was your vendor who you work with that's copies of your files.
And they were like, you look at their whole path of data and go, we gotta fix—
we had a lot. Yeah, this tool actually shows logs of chain of custody where files were decrypted, went to the third party via email.
How do you stop that happening? That's what my question is.
What's that?
How do you stop that from happening if they have all these other partners? Do you have to work with their partners to make sure their data is—
they actually keep this Well, that's part of it, but they know as a third party they're supposed to keep that data protected. They didn't. Yeah. So that's the way it usually happens, unfortunately. You know, we keep data dynamically protected with the Actifile tool, but you know, that's where I think we, 6 months ago, where we got stuck in tool land educating people what the tool does as opposed to Bigger picture is this is the invisible liability the firms are experiencing. We detect it and quantify it. That's a different conversation.
Are you selling more of a service?
And with, with, with the Actifile, it's called Actifile, is a, is a, is a tool and a solution, but we sell it as a service as well.
So you, you advise implement, onboard, and, and be almost like a fractional, um, CISO. Yeah. Yep. Cool.
Yeah.
Um, how do people get a hold of you, and when or why should they get a hold of you?
Well, if they think that, um, they can't answer this fundamental question which says, do you know what's— what data that's unstructured, which is Word documents, Word PDF documents that might be regulated or unregulated sensitive data. If you don't know, if you can't quantify that, show where it is, where it resides, who's using it. And if that were to be stolen from your environment, what would that liability look like? If you can't answer that, give us a call. Reach out to James at ideabox.com. You know, and we could certainly help them out and point them in a direction. And work with them on that.
And what's the, what's the, what's the website? And is there any—
www.ideabox.com. Be easy just to reach us.
Okay, well, thanks for being part of this great podcast. And guess who the sponsor is? Full Throttle Flat Elite. So I'll show a little bit.
