Decoding Digital Security: Michelle Zatlyn on Protecting the Web

Go find a meaningful problem. Find a meaningful problem where you're actually solving a problem for somebody and ask yourself, is there more than one person in the world that has the problem? And if the answer is yes, a lot of people do and it is meaningful, then I think you should go full force and do it.

This is Decoding Digital and I'm your host, Daniel Sacks. Every episode we hear from someone who is working to build something new in the digital economy. Each guest has has a unique perspective to share and together we work to understand or decode a trend that is shaping our digital world.

Every founder's journey is different, but for Michelle Zatlin, it involved a U haul, a cross country drive with her co founder's mom at the wheel, and a secret called Project Honeypot. After arriving in Silicon Valley, Michelle and her team would turn that code name to Cloudflare, a billion dollar unicorn company with a successful IPO in 2019. From day one, Cloudflare has been recognized as one of the world's most inventive technology companies and has received numerous honors including being named to CNBC's Disruptor 50 list, Wall Street Journal's Most Innovative Internet Technology Companies list two years in a row, and being selected as a technology pioneer by the World Economic Forum. By any measure, Michelle is a tech industry veteran and has a wealth of experience and insights to share. And today, Michelle will be joining us to decode digital security. Let's decode.

Michelle, we're so excited to have you on the show today. So let's jump in. I know that you shared that you wanted to be a doctor when you were younger and clearly you're on somewhat of a different path. Can you tell me about how that evolved?

Yes, I did want to be a doctor when I was in high school and even just the first part of college or university, that's, that's really what I was all geared, kind of set all my sights on that and at some point I kind of had aha. Like I assumed I want to be a doctor, but I'd never really tried anything else. And so instead of going straight to medical school after college, I said hey, I'm going to go work for a couple of years. And what ended up happening was the reasons why I wanted to be a doctor was because I wanted to help people and, and really felt like I could play a role in doing that. I ended up finding in the, in the world of technology and feeling like you can work with a really group of smart, passionate people, solve problems, but instead of one at a Time you really solve problems for people around the world. And so I ended up finding the same characteristics of what I saw in medicine, in the world of business and technology. And next thing I knew, I was, I was full on pursuing my business career and eventually going to look to round out my education by adding an mba.

And then how did you come to founding Cloudflare?

Sure. Well, so I, it was due my MBA and I happened to go to Harvard Business School and I was on a school trip in Silicon Valley and it was a week long professor led trip and it was this amazing experience where there was a group of us, 40 of us who came out to the Bay Area. And during that week, it was January of 2009, so it was right after the financial crisis of 08, and we were here for the week and we got to meet all these entrepreneurs at small companies, at large companies. We met these investors, like really prominent investors. It was just this amazing week long experience. And it was Wednesday of that week and we were at a startup accelerator down in Sunnyvale called Plug and Play, listening to a lot of early stage founders pitch their idea. At this point, we'd been here for three days, and I remember I walked out of that last startup pitch into the hallway and I said to a classmate who was on the trip to me and I said, wow, if that guy can start a company, so could I. And to my friend's credit he said, or my colleague's credit, he said, of course you could. And I just was this kind of moment where it demystified this idea of the Silicon Valley and what it meant to build a technology company or a tech giant or be a success story as a tech founder. And I just had kind of demystified being like, these people are no different than me. You know, you're passionate, you're smart, you want to pursue something, you can. And so that's what we were in the hallway discussing. And basically my classmate had always talked about, his name was Matthew Prince. And Matthew Prince always was really proud of something he had started for the last six years prior to business school called Project Honeypot. And Project Honeypot was an open source project that tracks web spammers online. And in that hallway conversation we started to banter back and forth. And basically out of that conversation we decided, hey, let's start a school project to see there was a business idea here. And that business idea literally turned into Cloudflare. And I guess the rest is history. They say, incredible.

So tell everyone about Cloudflare.

Sure. So Cloudflare is a Service that helps protect any Internet property, whether your website, an app, small or large, from cyber attacks online. We help make sure that every Internet property is fast around the world, and we help provide reliability services to those interproperties. So you think about cloudflare as we run a global network that makes Internet faster, safer, and more reliable for any business, cloud, large or small. And since that hallway conversation, we've moved out to the Bay Area to give it a go. And today we have over 1300 people at Cloudflare working on this on behalf of our customers. We have 2.7 million customers around the world and 2.27 million Internet properties that we help make fast, safe, and reliable on a daily basis. So it's been pretty amazing to see this idea come to life over the.

Last 10 years, and it's incredible to see how things have evolved. And one of the things we're focused on here with Decoding Digital is really understanding as businesses transform digitally, what are the impacts? And there's always questions around security, data residency, and how to safely and securely bring your business online and digital from the exposure you have across the world. What are things that business owners need to be thinking about that could be potential concerns or pitfalls around security?

Sometimes I say that I feel like security did itself a dis disfavor for the first 10 or 15 years of existence, where security was a topic that kind of got put into a corner for the information security or the security experts or the IT professionals to deal with, and it wasn't really on the business agenda. I think that's actually changing and needs to continue to change. I kind of juxtapose that with something like artificial intelligence. I actually think that's not relegated to a couple of people in the company. I think it's much more top of mind at the. At the senior executive level. And I think that's good. That's a positive development. And so with security, cybersecurity, I mean, the truth is, is whether you're a small business, you're a nonprofit, or you're a large organization, there are all sorts of attacks online. And just even if I try and quantify it, we are one service provider, and of course we have a lot of customers, you know, 2.7 million. But every day our technology stops 45 billion cyber attacks on behalf of our customers. And that's every day, and we're just one provider, so it's real. So if you're a business owner and you feel like, oh, my God, I'm always under attack, the Answer is like, yes, there's a lot of malicious bots and people trying to do malicious things online. But the answer is not, oh my goodness, what can I do? I mean, the truth is today the solutions are much better than they were five years ago and they'll continue to get really, really much better. And so while there are cyber attacks happen daily, I think that the good news, and I'm a very half glass full person, I am definitely an optimist, is it's not like the Mission Impossible movies we watch online. It's not it. Or the James Bond where it's these really sophisticated attacks. And it's not that. Actually if you are a business owner and you do the ABCs of putting some security solutions in place, you will be for the most part in the top quartile of your peer group of being protected. And like a lot of those solutions are easier to use and a lot more cost effective today and very effective. And so the cloud, cloud computing has made cybersecurity a much easier problem to solve on behalf of customers. And again, we're one company where we use technology to be able to help protect our customers from all these attacks. And it works pretty well.

One of the questions we get a lot is around security brands. And I know in the on premise world there were brands like McAfee and Symantec, you'd buy them off the shelf and people would install them and think that that's security. But tell us about how things shifted in the cloud and maybe you could go into the ABCs that you're recommending.

Yeah, definitely. Well, I think that cybersecurity is a really big industry. There's lots of different pieces to it, but, and it can, and businesses need to be thinking about it at all levels of their infrastructure. But let's just take a website like a digital presence, where I want to be able to go look up, you know, appdirect.com and to see, okay, what does this company do? How do I get in touch with them? And almost many businesses, as I say, they're like, oh, I have that, I have a website and you know, might get a little traffic, might get a lot. And the step one is just making sure that is always online and not subject to attack because a, if it is taken down, it's embarrassing and it could be a brand damaging event. And at the worst case it can cause real damage to a business, especially if they're taking payments through that or doing sales through that. And so the first step of a digital presence, especially if you have a public facing website that you use for marketing purposes is just put a simple firewall in front, like a web application firewall. It kind of becomes the best way I could describe it. It's like a bodyguard for your online storefront. Right. And that bodyguard is saying, hey, you're a legitimate visitor, come on in. Well, right this way. And if you're not, if it's kind of like someone, hey, no, no, no, no, you are not legitimate. You have, you're a threat to this business. No, you gotta stay out. And cloud based web application firewall can absolutely do that for you. I mean that is a service. One of the services Cloudflare offers. And again I would say that is part of the abc. The other one that is part of the ABC is this idea. It's a word that comes up and I'm not sure everyone, sometimes I think it sounds scarier than it is. It's called a DDoS attack, like a denial of service attack. And the best way to describe that is if all of a sudden you have way more traffic coming to this public facing website than your website can handle. So let's take a digital world example. Let's say you were going to a bank and you really need to take some money out of the bank at the atm. And a physical example of this could be, well, somebody goes and organizes 500 people to stand in line at the ATM in front of you. And none of those 500 people are really taking any money out of the ATM. And so you are back of the line and you're like, I need money, But I got 500 people ahead of me. And I'm sure none of these are legitimate customers. If they're legitimate customers, I might be like a little bit more okay with it. But none of these people are legitimate. They're not taking money out. Like, can I cut to the front of the line? And so that's the same sort of thing. It's a denial service. It's somebody taking up all the resources of either that ATM in a physical world or online. And so that is a type of attack that often makes the front page of the newspaper because it become means you're often offline. It's a very violating experience. As a business. You think, how can somebody take me offline? I need to be there for my customers or our clients or employees. And so really the answer to that before used to be very hard to solve, but now cloud based DDoS services have basically solved this problem and made it go away. And again, I can say this, because that's one of the things that Cloudflare does and we do it extremely well. Where you put Cloudflare in front of that website and you will never get taken off by DDoS. Our pipes are bigger than the malicious actors pipes and so they just can never, they can never cut off access to the legitimate users. So that's really something that didn't exist 10 years ago that our team has been able to build and make it easier. Kind of a problem that used to be a big problem for businesses go away. And so if you're a business and it's like, well, I don't have any DDoS solution, well, go find one. And again, they don't cost that much anymore. The pricing is really attractive and they're really easy to scale. And all of a sudden like that, you can just, it's a problem that you can kind of say, okay, I feel like I'm protected. Well, against that one.

So what happens when things do go wrong in this era? Obviously there's some bigger companies when there's a hack or when there's an attack and it makes the front page of the newspaper. But let's say you're a small or medium business. What do you do? Where do you start to actually get protected or to fix what happened?

You know, this is back to my, what I said earlier about how I feel like security did itself a disservice for a long time where, I mean, for a lot of times when that used to happen, businesses didn't want to tell anybody because they were really worried that customers would stop trusting them and all their customers would leave or that their competitors would use it as a tactic to try and convince those customers to come to them and say, oh, that company doesn't know what they're doing. I do think one of the good things about cybersecurity becoming more of a business agenda and media covering more of these stories and some large companies saying, here's what happened, here's what I'm doing about it actually means that we actually talk about it. So when you are that small business, you don't have to feel so alone. You can say, okay, I've read a little bit more about it, so I know a little bit more than knowing nothing about it. But I do think that you want to talk to your team internally and say, hey, what happened? What can we do to mitigate what's going on so we can start to diagnose and figure out where the next best steps are. So step one is to mitigate what's going on with your team and saying, okay, what do we do and where are we going? And sometimes you can do that all yourself, which is great. And other times it means reaching out to either providers you're already using or looking for a new provider to come and help. And I think it kind of depends on the situation. There are some examples where you're literally being knocked off by a DDoS attack. In those cases, what companies do, they're like, oh my God, let's use our current provider to get back online. If they can't, they go say, let's go find a provider that can get us back on as fast as humanly possible. In another case where it's like, wow, we maybe had a security breach but we don't know where the door was, we don't know how they got in. That's often a longer lead time. And so it's more about partnering with a good service provider, either internally or externally to go do that kind of forensic analysis and identifying it, patching it and going forward. So I think that there's a wide range of outcomes. The other really common one, and this might resonate with you, is there'll be a new soft known software vulnerability, like you're maybe using Microsoft software in your environment or Oracle software in your environment and there is a known vulnerability. And they say, go patch your servers against this vulnerability. And you know, again, if you're the ABCs of security means, okay, great, patch the servers within a relatively quick timeframe. But not every company is doing that, even small, medium sized businesses. And so that becomes a vulnerability for them. And so in that case it's like, how do I have a web application firewall who can patch that for me in real time while I go update my servers on my side? So there's lots of different things, but I really think it starts with having a team internally that you talk about what happens. And in some cases it also means bringing in outside service providers to help you.

And what advice would you give on external communication? You mentioned some of the fear in the industry today about announcing a release, but what are the best practices you've seen in driving transparency and customer trust when something does go wrong?

What I like to say is don't be a turtle. Don't kind of hide under your shell and think it's not going to come out. I think we've all seen that come back to haunt many companies. What I would say is a good gold standard is acknowledgement from the company and senior leadership at the company saying we had this incident. This is what we know, this is what who was impacted, this is what we are doing about it. And we take this seriously. That's the best. I think people want authenticity and transparency now more than ever. Like, I think our world is really craving that. Customers are craving that. And so that's ideal. For some companies that's just not possible. It might be totally counterculture, like where they're just, we would never do that. And that's just such a far departure. And so I think that's gold standard. But you have to do what fits within your business and what's most natural to the leader. I think the more authentic the better. But sweeping it under a rug almost never works anymore. And so it's better for you. Okay, assume the news will get out. If you have a security incident, just assume it's going to get out. If it does get out, think about do you want to control it or do you want someone else to control it and how that thinks. And I think. And then you gotta figure out what's authentic to you, but really gold standard is someone seeing the company, acknowledging it, explaining what happened, explaining who is impacted and what we're doing about it. And I understand that there's some companies who just, they're like, that's just so far of a departure of our company, we can't get there. Which is. So that's okay too. But I do think asking yourself, if this became public, what would we do about that? Or how would we react or what would be said if it wasn't us telling the story is a good question to ask yourself and your team.

And do you see any frameworks that are evolving on how you safely communicate something like, for example, does it have to be a press release or Twitter, or is there a more effective communication format?

It's probably not a press release and it's probably not Twitter. I mean, great, if you have a presence on Twitter, that's again, a way to connect with people one to one. But it might be, if you have a corporate blog, you might post it there or you might send an email to your customer base that was impacted. I mean, those are two sorts of places that you could do. I mean, I think that there are some companies, this is just an idea. I'm not saying it's a good one. I mean, there might be some companies who say, well, I have a really close relationship with a reporter. Let's turn our incident into a business case and a learning experience that we can share with other like organizations around the world. So it doesn't happen to them. And you imagine working with a reporter, tell the story and then the story comes out through kind of a piece of journalism. And again it's both about diagnosing what went wrong, but also learnings for others to learn. Like that couldn't be another way. So I think there's, you gotta fit toward what your company's already doing. I think what you don't wanna do is if you've never blogged in your life as a company, I'm not sure this is where to start. You don't wanna start. You know, this is not the place you kind of wanna take what you're already doing and lean into that. But you're probably sending emails to your customers or maybe you're talking, talking to your customers on a daily basis through your, through your client facing team. So maybe it's phone calls. You gotta take how your company is connecting with your, with your community and use that is a good place to start.

Got it. And you talk about bad actors and also how Hollywood gets it wrong. But in the old world, right, it was obvious someone could smash the glass of the building and go take files and that would be theft and, and sometimes it would be a random act to steal cash from the drawer or sometimes it would maybe be a competitor potentially or someone else. But how do these bad actors translate virtually? And who gets it right? Do people have clarity on who they really are?

I love analogies too. So for the cybersecurity experts listening to this give me a little bit of leeway because the in person online is sometimes the analogies fall short. But you said smashing the windows, taking the money out of the drawer. So examples are attackers will look for poor passwords, they'll be checking password fields where they'll have a list of emails. Emails are fairly easy to guess or find and they'll check to see password 1, 2, 3. And they have a dictionary of attacks that they'll just write a program and they'll be able to go through like literally an encyclopedia of common passwords and test against that. And you think, well, if I've been using password 1, 2, 3, exclamation mark as my password and they have my email address, they can then log into something. So, so they're looking for weak passwords. And you know, there's a lot of people around the world and you think there's a lot of people who have weak passwords and so it becomes an attack vector. I mentioned the NPatch software. There's very few businesses that aren't using software from someone else. And those softwares have vulnerabilities. We know that it's okay as long as you're patching these known all vulnerabilities. But turns out it's just like another to do on somebody's list of have to go patch that. So if there's a known software vulnerability and it goes unpatched, I mean the data shows that as soon as a new and new software vulnerability is out, like attackers start trying to find companies that are using that software who haven't patched it within like 30 minutes. Nobody is patching their servers in 30 minutes. I mean it's just really fast. So there's like a. Okay, how do we drive down now? One of the ways to protect against that is using a cloud based web application firewall that can patch it for you. And then you still have to do the server side, but you kind of buy yourself some time. So it's kind of like you saw the cash, but it's in a safe instead of the drawer. And so they, they might get through the window and there's nothing in the drawer, but then they go to the safe and it's like, well, they got to now crack the safe before they can get the cash. It's the same sort of thing. There's phishing targets. This one's really common where there are people who make up companies and they try and say, well, I'm going to take one of the employees and send them a link with a malicious. Send them an email, spoof it looking like it's coming from the CEO and send them a malicious link and get them to type in credentials that then go lead to some bad action. And this happens. I know many businesses where especially certain times of the year where they're getting emails saying where somebody on the finance team gets an email saying, hey, can you please wire x Number of dollars, $200,000 from this account to that account. And they send the link. And you know, so the IT person or the finance person clicks on the link and does a transfer. And it turns out it wasn't actually coming from the CEO, it was somebody who spoofed. They like impersonated the CF CEO. It's like someone in your real world example, you have a twin evil brother who comes into the store and does something malicious and then blames it on you, right? And then if you, what I would say is kind of like a bear website. Like if you're out there, especially if you're low or high profile, but you Have a bear website with no DDoS mitigation up front. Like, then you're just kind of a sitting duck because turns out it's actually really easy or easy for attackers to amount resources to overwhelm Most websites, fairly easy. Which is why you need a service, some sort of cloud based service, whether it's Cloudflare or something else that just sits in front and absorbs all of that so you never have to see it. And but you need that, you need that bodyguard in front so that your club doesn't get too crowded. And so those are some of the examples that would translate to the digital world.

I love that and the bodyguard analogy. But what are these people? Bad actors, thieves, villains, what do they look like and where are they and who motivates them?

You're a business owner, you're like, who are these people? And they want to really focus on the who. And I'll give you some examples. And I would say that if I was a business leader in your shoes, that that's not really the question to ask your team. I think the question to ask your team is, hey, where are we? Where are the gaps from a security standpoint and what are the places where and where are we against closing those gaps? Like, I think that's a really, a good place to start. So here are the types of attackers. Okay, so some are the mission impossible, some are the nation state attackers. That happens online. There are scary nation state attacks that happen. So that, that definitely happens. But that's a minority, not the majority. It can be a competitor. It's one of those things where that just is hard to believe, but it's true in some industries, competitors, it's like such a, such a competitive space that it's one of the tools they use to try and get ahead of each other. And so it's like a competitor launching an attack against their competitor to try and knock them offline. So they're online for those few moments. Some of them are criminals and they're literally profiting off this. And so I'll give you an example. There, there was a really well known online flower company and four days before Valentine's Day, they get a ransom email saying, pay me $25,000 or else I will knock your website offline. And it's Valentine's Day. Is that florist's busiest season? They make a lot of money during that time. And if you're a florist, and this was not a large florist, was a medium sized florist, they paid the $25,000. So they're saying to get knocked offline. Right. And so that's somebody like, that's like kind of like a digital criminal. Well, there's two other groups that I think are less known. So the first is there's kind of a group online of hackers where they think that there are some companies who haven't taken security seriously. And so they almost see it as their mission to go find who those are and make examples of them. It's not about financial gain. It's almost more about showing that a large Global 2000 company isn't take security service almost as a service to all of the customers of that company to say, this company isn't taking a seriously. So vote with your feet and wallet. And, you know, there have been some cases in the past and, you know, again, you know, when the Xbox security breaches happened a few years ago, a lot of people said it was because of those sorts of things like that. That is a group. And again, those people are hackers. They're hacking in, but they're really doing it to say, this company isn't taking it seriously. And until you take it seriously, we're going to keep trying and finding your vulnerabilities. So you kind of don't want to be on the bad list of the hackers because they become this real nuisance for you. You're just like, oh, my goodness. And then sometimes it's a group, there's two other groups, and then I'll be done. Sometimes there's a group where especially if you do anything controversial and controversial is not what you think it is. I mean, it could be religion, it could be science. Science is controversial, could be artistic, can be controversial. It can be. Human rights is controversial. It could be journalism. Journalism is controversial. You are a journalist reporting on human rights abuses in maybe a developing country that is controversial to some people. And so in some cases the attacker saying, I don't like what you're saying and that should not be online. I don't agree. It's almost like I don't like that. So in the real world, it might be a fist fight, but instead they go say, I don't like what you're doing. And so I don't want to see it. It's almost like they're boarding it up. And then the final group, which might scare some parents on the call, it's. There's a lot of teenagers that are doing. They start to fall in love with computers and technology and they start to get the power of like, oh, My goodness, I'm learning a ton. And instead of throwing eggs at houses and running away, which is kind of what happened when I was in high school, they're kind of throwing eggs online. And those eggs sometimes get a little bit more powerful than they think. And they think, wow. And again, it's just curious teenagers who kind of find themselves with using technology in a pretty powerful world and feeling like, wow, I know a lot, and that company knows nothing, and look what I did. And sometimes can really get themselves into trouble going too far with that.

And what tangible advice would you have for our listeners? A lot of them being digital heroes. So people at large organizations that might be in spaces like automotive or manufacturing or more traditional industries that may, like you said, have this IT pro, but majority of the employees are not digitally savvy. What advice would you give them to start? Who do they speak to? How do they transform within their big company?

Yeah, and the most part is all those businesses I'm sure, have already started, but some might be further along than others. And so I think that if I'm a leader in one of those companies, first thing is just acknowledging, where are we? Like, give yourself a grade. Are we getting Fs? Like, we literally have never talked about it as an organization or an executive team, or are we getting Cs? Because I think that there are differences whether you're failing or whether you're getting a C or a grade of a B or if you're like, well, yeah, actually we're doing pretty good, and there's some areas we have to work on. And I think you just have to acknowledge, like, where are you? Where is your readiness as a. As an organization? And I don't think that, again, it's not one person's job in the company. I really think it's a management team or executive team discussion of, like, how. Where are we? And again, cybersecurity cuts across lots of different teams in lots of different ways. You know, my website's example, automotive website, consumer facing. Maybe your CMO really cares about that, Right? They really care about making sure your website's online versus your, you know, your CIO might much more care about, okay, our employees and making sure they're not getting phished. Look, I don't want that email example. I gave the phishing email where someone's sending an email internally impersonating someone else that's under the control of the cio. Or it could be your engineering team shipping the next product that has bugs built into the software. So how are you doing Code review to help catch these things. Like it really cybersecurity is not one person within the organization. It's really across your whole executive team. So the first step is having a conversation and really kind of saying where are we? And again giving yourself a grade, a letter grade under 10 just something and then you start to say okay, where do we have to start? You can't do everything at once, but where are you starting? And I think you start with the ABCs and there's kind of ABCs on public facing properties and ABCs on internal practices. You start with the ABCs and once you have the ABCs, the belts and surrenders surrenders then you can do all the advanced things. But you got to be able to do the ABCs. It's really the belt. The, all the advanced stuff doesn't matter. You're overcomplicating it because you'll get, you'll get hung up on one of these small things. So like I see it all the time with these large organizations where they'll. A company will do a ton to secure their most prominent Internet properties. So like the, if you're an automotive company and it's like you're running many brands within that automotive company with many public facing websites and they'll put all the resources to the biggest ones. It makes sense. They're the biggest ones and they, the ones get the most traffic and there'll be some set that they'll say I don't have money left over to deal with these. And what happens is it's the, it's like the ugly stepchild. It's like the, it's like the, the problem child over there, the little ones over there, the runts of the pack that get no attention. One of them gets compromised by like an automated bot that like was not. This is again not mission. This is not Tom Cruise in Michigan Cross bowl doing you know Hank, like it's just a bot that some high school kid wrote in their basement. And the bottom basically can hack into this, you know, take off this problem child or the small child over here and and all of a sudden the media story because that's a very public facing thing is not hey all their main sites data. And it was just this one obscure site. The story is enter global 2000 automotive company is offline. And it wasn't their main site but it's a small site and if you're now explaining, if you're trying to explain as an executive, well everything was fine except for these sites. It just sounds like excuses and so, so it's. You start with the ABCs, acknowledge where you are put in the ABCs, and then once you have do that, then you can talk about the phase two. And again, continue to build in the right people internally, like bringing in the DNA internally and evaluating the right external parties to work with. But it is, it is really interesting that if you can't even have a conversation internally at your executive team, then you haven't done the basics. And then the next step, which is also part of the basics, is bring it in culture internally so every employee at these companies have some language about it. We all have to become better digital citizens. Like, that is the world. The world is going that direction. So companies have a responsibility to help their employees be better digital citizens. And one part of being a digital citizen is understanding a little bit about cybersecurity. You don't have to be the expert. We have to understand a little bit. Just like you need to understand a little bit about personal finance. Like, there's a lot of things you got to understand, and they're just. The Internet has. Has introduced a whole new set of tools that all of us, as citizens, employees, and business leaders, have to become better at. And then you can no longer outsource it to one person in your company. It's just like technology is everywhere. That's why you have these podcasts.

And no, I love it. And I love your concept of digital citizen because it really aligns with what we've seen across our community, where we see digital heroes as being people who have the vision, the foresight, the tenacity, the energy, and to think differently and transition things online and digitally. And that comes with a whole new culture and a new way of operating. And the reality is that would have been, in 2009, a few people operating in the cloud. It's now fairly pervasive, but the speed of which people are digitally transforming, it's almost like you can't keep up with your training on how to be a good digital citizen, and that's when bad things happen. So I would love to hear from Michelle, like, what you talked about, the ABCs of cybersecurity. But what are the ABCs of being a digital citizen? And how do you think that evolves in the next few years?

I mean, being a digital citizen is just. It's not a special power. Like, it's not. It's not. And it's not hard. And it's just like, okay. And it's like, don't fear technology. Kind of embrace it and find ways in your life that will make it make your life better. And the truth is, is it can make your life a lot better. It can make it easier to connect with people. And I think this pandemic that we're currently going through really shows that. I mean, the true heroes of COVID 19, of course, are the medical responders and the first responders. I mean medical professionals, first responders, they're absolutely the true heroes. But like the trusty sidekick has been the Internet. I mean could imagine if you couldn't do a video call to your loved ones who right now you can't see them. And people are doing lessons online and you just think about that's all working behind the scenes. And technology is making you feel connected to somebody even when you physically can't see them. So it's don't fear technology, embrace it and find ways in your life that you can make it better. And so whether it's, oh, instead of making a phone call, maybe I'll make a video call so I can see someone and can see their facial reactions. And all of a sudden I'm like, oh, wow, that was a different experience than just hearing your voice, for example. Or, or maybe it's the way you've been doing a lot by pen and paper. But it's hard to share with somebody a list. Maybe try a digital list and sharing it and seeing like co editing something and being like the spark of joy of like, wow, that's way better. And I'm not saying you have to be full techie all the time, but just lean in and embrace it and just say this is not going away. Technology is not going away. It's not a fad. It is here to stay. It's going to continue to accelerate. And that doesn't mean you have to be the first to try everything. But I do think a digital citizen is willing to find the places where they are willing to embrace technology that doesn't have to be in everything. There's some things, I mean I work in the industry and there's many things where I still perform prefer the analog, but there's find the places where it does work for you and then talk about that with your friends because they'll be like, oh wow. And it's almost like recipes you exchange in person when you meet up with folks or your new favorite movie or whatnot. Talk about, hey, I've been doing it this way and it's amazing how much easier this is or whatnot and make it almost a topic of conversation. And that helps Spread it among your friend groups and they'll do that. And again, we. It's almost like all tides rise. And I think the more that all tides rise, the less scary it becomes. The more of, like, finding the happy, good stories. And we need more happy, good stories.

We definitely do. And speaking of that, you're an inspiration to so many. Having been in that, you know, plug and play room and saying, I can be an entrepreneur too, and then creating a company, taking it public, impacting as many businesses as you've done, and really safeguarding people from, you know, potentially terrible events. It's incredible what you've done and accomplished. What advice would you have for, you know, someone in your shoes?

You know, one of the things that I like to say is, go find a meaningful problem. Like, if you find a meaningful problem that actually will impact people. And this kind of goes back to where we started being a doctor. Find a meaningful problem where you're actually solving a problem for somebody and ask yourself, is there more than one person in the world that has the problem? And if the answer is yes, a lot of people do, and it is meaningful, then I think you should go full force and do it. It's an incredible experience. I don't think you should ever do it just because you want to be an entrepreneur. And I definitely don't think you should do it if you don't have a meaningful problem. Like, it really starts with find a meaningful problem that you're proud to work on and then go run at it as fast as you possibly can because you will meet incredible people along the way. You will go execute on this, solving this meaningful problem, which means you're going to meet customers or people, partners around the world who say, oh, my God, you changed my life because of this in this way. And that will fuel you to keep going. And so that's what I say, go find a meaningful problem and then assemble the team to go do it.

You make it sound easy.

Again, I'm a half classical person. It is a lot of work. And that's why I say salt, find a meaningful problem. Because it's a lot of work starting a company. And, you know, especially the first four years, I mean, it's always a lot of work and we're 10 years in, but like the first four years, it's a lot because, you know, you think hiring your first couple people to come join you is hard. You gotta fundraise. You usually gotta find some way to fund this. You gotta get your first customers. You gotta build what you say you're building. There's so many things. But try Getting employee number 30 to come join or 50 to come join. It's like, why would they join you versus, I don't know, app direction, which is already a success story. And I can work with smart people and, you know, you're not going out of business tomorrow, and it's, it's so hard. And so one of the ways to make it a little bit easier is if you were solving a meaningful problem for a lot of people, it's all of a sudden you have customers telling you. Things that I heard early on were, I remember. Let me tell you this story. I, I remember early on when we were back at the campus of Harvard Business School and we were working on this as a business business plan. And we did a survey to people to, to these small businesses that you mentioned. Actually, it was just a small businesses, not the global 2000s to small businesses. And I sort of, as a good business student does, I sent a survey saying, how much do you care about how big of a problem is cybersecurity for you? And I had like, you know, quantitative, where you can, like, market. But then I had open text boxes so people could also kind of just leave comments. And, and the answers were things like this, Web spammers are the scourge of the Internet. They are criminals and should be locked up. Web spammers make me believe in the death penalty. And so there were just these very strong statements that you're just like, wow, there's a real problem here. So that was the first part. The second part of the survey said, okay, what do you do to protect yourself against it? And what was really clear was these small businesses had no good solution. They all had homegrown solutions that were kind of like duct tape that they had done. They hired an it IT consultant to do it, but they all felt very vulnerable and exposed. And so we said, wow, there's clearly a problem here. Can we use technology to create the solution? And it turns out there's many millions of small businesses around the world. And then we kind of had the end developers around the world trying to build the next big companies. And then we said, well, if we can do the developers and the nonprofits and small businesses, why can't we also do the large enterprise? And that's how we really started to do this. And so, you know, when you have that vision and you have those web spammers make me believe in the death penalty, it makes recruiting that employee a little bit easier or, or, or getting a customer a Prospect actually try your service, because they have a real pain point. And so find something meaningful because it helps you carry you through all the low points.

But talk about those sacrifices. You know, what. What do you go through as an entrepreneur? And you mentioned the four years being really tough, but obviously, you know, even this year, with having to deal with COVID and other challenges, you know, the global economy, what goes through your mind?

Yeah, I mean, it's highs and lows, like, 10 times a day. And now they're highs and lows, but they're much more spread out, maybe weeks apart. So it makes it much more stronger foundation, which is great, which is what you want as a business. You want the highs and the lows to be more spread out. And so I think that's a sign of maturity as an organization. The best part of my job are the people I get to work with. I mean, it is such an honor to have a team of people around the world who, you know, care showing up. You know, our mission is to help build a better Internet by helping our customers be faster, safer, and more reliable. And it's just. It doesn't matter how good you are, you're going to need a team. And I just. I am. I've had a lot of jobs in my life where I wouldn't have said that, but at Cloudflare, like, literally, the best part of my job are the people I get to work with. They are so committed, they care so much. They're ex. They teach me so much. Like, and. And. And vice versa, I think I teach them. And we are all there to say, hey, let's go execute on this vision again, this big, meaningful problem. The second best part of my job are our customers, because we're solving their problems. We're solving a meaningful problem for them. And so they tell you when you're doing a good job and when you're working really hard, and someone says, hey, I really love your service. It's almost like the adrenaline you need to get through the next challenge. Or they tell you when, hey, you really fell short here. And that's always hard to hear, but it's good to hear because then you can get back up and make it better. And so I always feel like our customers are rooting for our success. They're like, you're solving real problems for us. Go do more. Please solve more of my problems for me. And I love that your team is so great to work with. And so I, again, if you're an entrepreneur, starting or wanting to start, or even if you're a big company thinking, hey, how do I partner with a smaller company? I do think the people first aspect is huge. And then whether you're a startup or a large company, you want to partner and have happy customers on either side of the coin. And at the end of the day, it really matters a lot.

It's incredible. And I think that that focus on vision and values is really what defines companies that, that succeed ultimately from ones that don't. And I look at 2009, so many companies emerged to do great things, but I found that it was the leaders that had clear vision, solving a big problem, but also this sense of values that made sure that when they had to make a decision that was like probably a big one, and tested their ethics and their morals and where they're at, they made the right decision and that allowed them to continue to scale and gain trust in their community.

Yeah, no, I think you said that really well. I been saying it more recently than normal, but it turns out leadership matters. And so it's, you know, whether you're an executive at a big company or startup, it's like people are noticing where leadership really matters and sets you apart. And part of that is the values that you mentioned and making consistent decisions and following through and how you act and how you communicate and how you treat people. These things all matter. And I actually think that's a good thing. That gives me hope for the future where those things do matter. I want to live in a world where those things matter.

It's incredible. So the concept of the future digital citizen really leans on leadership that matters. Where do people start when they want to become a better leader as a digital citizen in the future?

I think actually what Hadi is doing at Code.org, hadi Partovi is a incredible tech founder and executive who's built many amazing companies and been part of many amazing companies. He started something called code.org and it's, it's basically kind of ever giving anybody, and I mean like literally anybody, like my mother, my 10, 10 year old niece to myself have done their one hour online coding course. And it's just you don't have to be a professional coder or developer, but just understanding it and being like, oh wow, I can do this and, and learning what it means and whatnot. And so what Hadi has done@code.org with both people taking the programming and schools, I mean he's really helped expose what I think when people say what is writing code, they don't even know what it is. He's basically kind of helps demystify it and make it accessible. And it's free and anyone can do it for the first hour. And even they can basically have some AP like advanced computer science high school classes that they can put people through for a really very economically traffic business case. So I think, you know, people like you, Dan, talking about it, showcasing it, I think it's services like code.org that again is accessible to anyone young or old to just be like, I'm going to go do this, I'm going to tell you when I'm doing it. And then if you like it, next time you see your friends at dinner, you can say, hey, I did this really cool thing called code.org and I was able to build this thing. You should try it. And you want to do it together, Come over and let's do it together. Instead of baking together, crocheting together, let's do a co.org class together. And so I think things like that are places along the way. And of course then there's, you know, the Fortunes and you know, medium posts and you know, Fortune magazine does a lot of great content. Harvard Business Review writes a lot about this. So there's also the traditional media publications where I think there's a lot of great content for leaders to say, that's how I used to do it and here's where it's going, here's where the ball is going. Or as a I'm a Canadian, what Wayne Gretzky would say is skate to where the puck is going. And I think resources like Harvard Business Review and Fortune magazine and other reputable organizations like that can help you go to where the puck is going.

Well, it sounds like the puck is going in the future where everyone needs to be a digital citizen and be educated on things like security and Cloudflare is a great solution for that. So really appreciate you sharing your story and sharing your insights. This was so exciting. Thanks again, Michelle.

Thanks so much for having me.

Take care. On the next episode of Decoding Digital, it's funny, there are founders that like.

Can see the world 10, 20, 30.

Years out or have this really potent.

Personal vision that they spend a lifetime kind of imposing on the universe. We did not fit in that category.

Co founder of WePay and innovator at JPMorgan Chase, Rich Aberman. Listen on Apple Podcasts, Spotify or your podcast player of choice. To learn more, visit decodingdigital.com until next time.