Protecting Small and Medium-Sized Businesses From Cyber Threats With Sai Huda of CyberCatch

Startups get the party. Startups get the party started. Startups get the party. Startups get the party started.

You want tech and tacos, Tacos in tech you know we got tacos and tech is on smash border green guacamole keeper captains counting beans Contador Quentan frijoles found us trying to raise some queso la vida San Diego school of rappy rapping fire tortillas round jalapenos in these modern times a crappy and coffee my coding yoga posse fold the body origami we be surfing coronado eating tacos El gordo, the taco standing puesto lucha libre and sombrero Got a shout out to cost angels by the ocean Watch the sunset La Jolla shores Entrepreneurs trying to get funded When San Diego Startup Week is popping in the summer Oceanside, the Tijuana Estee be full of hustlers from couch surfing to penthouses right on the beach Tech leaders believe stars are within reach we interview and founders who be shooting for the Moon hashtag SD TechOS with your host, Neil Bloom.

Startups get the party. Startups get the party started.

Welcome to the Talkers and Tech Podcast. I'm your host Neil Bloom and I am thrilled to have you here. On the Talkers and Tech Podcast we interview builders of technologies, of companies, of communities and we do it weekly. So thanks for tuning in every Tuesday and interview. And on Fridays we talk about what's new in the San Diego tech ecosystem from a news perspective. So make sure you join us there as well too. We also have a tech newsletter that comes out every other week@freshbrewedtech.com you can subscribe to listen to it without further ado. Enjoy this episode. I am joined today by Sai Huda, co founder and CEO of Cybercatch. Hey Sai, thanks for being on the podcast.

Thank you so much for having me. Honored to be with you, Neil.

Yeah, I'm excited to hear a bit about what you're building. Do you want to give us a quick one minute overview of what Cybercatch is?

Sure. Thank you. Cybercatch is a cybersecurity software as a service company and we're focused on small and medium sized businesses in North America, so U.S. and Canada. And what we do is via the cloud native platform, we first make sure that a small to mid sized business has all of the necessary cybersecurity controls in place to prevent, detect and respond to a threat. And then the platform then automatically and continuously tests those controls. 3 dimension from the outside, from the inside, and also the Employees via social engineering to find broken controls or missing controls and then we help the business fix them so there are no security holes that an attacker can exploit, break in and steal data or infect ransomware.

Very timely. More and more have we seen this? Even more so, more so now kind of when we're recording this right now is on the kind of the eve of the Ukrainian invasion where we're being warned that ransomware and government sponsored attacks could be even more prevalent right now. So very timely to have this conversation. I'm looking forward to diving into that, but I kind of want to get to know what got you into this world. Now I don't think every kid wakes up saying I want to, I want to work in cyber security. Hopefully maybe we're changing that and building more talent pool there. But where'd you grow up? How did you end up here in this tech world?

Yeah, so a few years ago I was working as an executive at a couple of financial services organizations here in San Diego running compliance and risk management. And then I saw the need for a cloud based solution for compliance with all these regulations that a financial services company had to deal with. So I left to start a company called Compliance Coach right here in San Diego and was one of the first cloud based software as a service focusing on compliance with all these laws and regulations like bank secrecy act and all the other good stuff and also providing training to employees to make sure they didn't do anything unethical and followed the law. So that's what my first foray was in entrepreneurship, leaving sort of the business world, being an executive. And it was a big leap. Never ran a business before in my life. And so it was just an idea from the back of a napkin. Got the team together, built the software, got customers and had their entrepreneurial journey of a lot of blood, sweat and tears, but a lot of joy. Neil, like you as a very successful entrepreneur yourself, you know how it is, it's lots of long hours and. But it's worth it because at the end you're doing something meaningful with your life and making a difference. So that's what got me started really in the whole risk area. And then I sold that company to FIS, a Fortune 500 company. And I stayed on to grow the business, got it to number one, RiskTech100. But that's where the cyber, you know, sort of passion started. Because one of my big customers was a government agency, very large. And so they required me as the executive overseeing the contract to get a high level security clearance. So I did. And of course, my data and my fingerprints were stored at the Office of Personnel management in Washington D.C. and so all of a sudden I get this letter saying, oh, si, sorry, we've been hacked and your data and your fingerprints have been stolen. I was like, what? This is unbelievable. How could that happen? Who did it? How could they bypass all these controls? And so that's where I started to really dig into cyber and realized nobody was safe and all these attackers could get in very easily. So that's where I started to really focus on cybersecurity. Created a couple of solutions with my team, but then I left to write a book called Next Level Cybersecurity. So that sort of got me into really cybersecurity because the book forced me to spend a year, Neil, researching all these hacks, Equifax and SolarWinds and all the big ones. How did it happen, why it happened? Could anything been done to detect the attackers before it was too late? But that's where it really got me to cybersecurity.

Interesting. Through all that research, was there a common thread of, yes, there are different kinds of attacks, but is there something, a few pieces that you learned that you saw throughout all them?

Yeah, great question, Neil. Absolutely. One of the discoveries with that research spending a year was that there are five steps that happens in, in every single hack. And so that was a commonality that I discovered. There've been other sort of views on this in terms of the steps, but bottom line is it's five steps. So first step is reconnaissance. So the attackers will spend some time checking you out from the outside, right? Your website, anything that's Internet facing. So reconnaissance, they'll look at your employees, they look at your company, whatever they can dig up on you to figure you out, like, how strong are you when it comes to controls? What's your cyber risk vulnerability? Is this worth it for them for ransomware or data theft? So that's first step. Second step then is once they figure you out and say, yeah, this is a good target, then of course they will make the intrusion. And so that's second step. So the intrusion happens from the outside or from the inside for the employees. We'll talk more about that second step. The third step then is lateral movement. So I'm inside now. I'm going to move around, I'm going to see where are your crown jewels, your most valuable assets? Where is it? Is it in the cloud? Is it in the local area network? Is it on someone's PC or a laptop or, you know, MacBook where the heck is it? Let's go find it. And then the fourth step is to say, okay, got it. Here it is. All right, Now I got to have a connection to my server on the outside, command and control. And I got to have a communication means to pull that data out if that's what I want to do, or I want to inject ransomware. So that's the, you know, fourth step, which is command and control communication. And the fifth, of course, is the execution, which is, okay, I'm going to steal the data out, pull it out, or I'm going to infect ransomware and steal the data. So those are the five steps. So that was a common discovery. But the other thing my book does, Neil, is called Next Level Cybersecurity. Detect the signal, Stop the Hack. It's an Amazon bestseller. And what it does is it reveals 15 signals of the attackers. So all these hacks are going to have signals. And the key is to look for them, hunt them as early as possible. And if you do that, then you can stop the hack. So that's what that book does. But that was a real great, groundbreaking sort of move movement for me to really dig in and realize that, you know what, this is an opportunity to make a difference in cyber security.

Yeah, fascinating. So were you. And when you were writing that book, were you intending to already create a cyber security company or not yet?

No. Yeah, Neil, great question. No, actually, no. I mean, I had already started a company. It was successful exit. I had made a difference, grew it. I was happy. It was really. And I was enjoying speaking. I was speaking around the country on the book. And the book has been adopted by lots of companies. It's being used by a bunch of universities. So that was really gratifying, teaching students through some of the guest lecturing, but also just speaking at different conferences and events. So I hadn't really thought about starting a company. But what happened was one of the folks I got to meet, I had the privilege of meeting a lot of very interesting and accomplished people because of the book. They were reaching out to me. And one of the folks I met was Tom Ridge. I don't know if you remember him, but you know, when 911 happened many years ago, he was the go to guy for creating our Department of Homeland Security to make sure that 911 doesn't happen again. And so he created this agency called the Department of Homeland Security to protect us in the United States. And he did a great job. He brought in like 22 agencies together into one and created an Amazing engine to protect us. And so the DHS started under his vision and leadership, but then that model was replicated in other countries. So he read my book and I had the privilege of meeting him and we really connected. I didn't know him before and so that's where we started to talk about cyber security, what he was doing and what I was doing with my book. And that's when he said, really Sai, you're doing a good job in educating with the book, but I think maybe you need to start a company and really create a solution that truly addresses the root cause and makes a difference. So he was really inspiring and that's what started the genesis for Cyber Catch to go. Okay, I think he's right. We really need to put together a team and create something unique.

Got it. So in this scenario, did you bring back some of your former team members from past companies that kind of bring the band back together or how'd you go about starting this?

Great question. I did. So some of my old band members are with me. Absolutely. So for example, Andy Kim, he's VP CISO at Cybercatch and he was with me at my prior two companies where he led the cybersecurity consulting practice. He's one of the leading CISOs in the world. He was the former CISO at Allstate after he left, left my other company and so I brought him back. So he's back in the band, if you will, Neil. And then we've got Brian Rowe, he's our cto, another great talent from my two other companies. So I brought him back and we've got several others. The board includes Kay Nichols. She's amazing. She was the executive actually that led the acquisition of my company at fis and so she's one of my board of directors. Former IBM executive from fis, executive, brilliant person. And then several others, Tom Bridges on my advisory board. So it's just a great team we been able to be privileged to put together.

That's great. So it sounds like you are doing part your own software, part service. Is that true? You build some technology to do what you're doing as well?

Yeah. So it's software as a service, Neil. So the customers who are small to mid sized businesses, they subscribe to basically a three year term and they pay one fee every year based on the size of the organization in terms of employees. That's it. And for that subscription, they get us between our cloud platform and our team of virtual CISOs to help them implement the necessary cybersecurity controls and then automatically Continuously test those controls, find those darn holes and plug them so the attackers can exploit them. So that's the model.

Okay. Well, San Diego has some pretty deep roots in the security and cybersecurity world. I imagine you pull on that from a talent perspective and maybe also learnings from past companies take us through a little bit about, I don't know, the cyber tech world here in San Diego that you're a part of now.

Yeah, it's amazing. It's, as you know, Neil, kind of a best kept secret still. But there's a lot of talent here. There's a lot of brain power, creativity going on, you know, entrepreneurs like you and others. And so it's an amazing talent to be able to have for guidance, advice, all kinds of benefits, but certainly talent pool, it's very tight right now, frankly, because there's more of a demand than a supply. So all of the talented engineers are busy working. So at Cybercatch, I've been able to fortunately pull together some of my, you know, previous band members. So that's been beneficial. But we're looking to hire more folks from schools. So recent graduates from some of the, you know, schools here in town, they've got some really good programs, bunch of universities. And so we're looking for folks maybe that not have a cyber background, Neil, but maybe some technology background. And what we're doing is we're just hiring them because at least they have some technical background and good business skills and then we're putting them together through our own training program on cyber. We were formulated that, and that's how we're sort of managing the gap between demand and supply. Because there's definitely a shortage of talent, no doubt. But I think bringing in some of the young graduates and then getting them to our cybersecurity training in terms of the skill sets they need, depending on the job, seems to be working as a nice, smart way for us.

Definitely. That's great to hear, especially the training part. A lot of startups don't really actually have the time or bandwidth or manpower to, to focus on junior talent. It's just all hands on deck and you usually hire senior so that you're trying to chase your incumbents. But it's great to hear that you have the capability to kind of train a whole new workforce. That's great to hear. Is the product. So it sounds like the product's live, like give us a sense of where the product is now and kind of its maturity.

Yes, absolutely, Neil. So product is live. We have over 250 customers that are using it and they're all small to mid sized businesses, anywhere from 10 employees organization to 450 type organizations, if you will. So all our customers are less than 500 employee sized organizations. That's kind of our focus because we feel they're the most vulnerable, they're the most really exposed today and don't have the resources to really looking constantly for security holes and fixing them because they may be outsourcing some of that to a managed services provider. But those folks are just running the business. They're not necessarily focused on security. So we're focused on security. And so we are now in a growth mode. We are looking to expand here in the United states. So our two target markets are US and Canada. Canada. And Neil, there's 30 million small to midsize businesses in the United States and Canada has almost a million and a half. So just these two markets are very large for us to really help. And most of these are completely exposed. So to give you an idea, Neil, so we just did a study. It's called the Small and Medium Sized businesses Vulnerabilities Report. And what we did was we used Cyber X ray, which is one of our tools that we have as part of the subscription, which scans anything that's Internet facing. So a website, web applications, web servers, any other an attacker would be able to scan. So we scanned it and we looked at 21,850 companies and the US was 20,000. And guess what we found a third, Neil, A third had vulnerabilities that could be exploited within minutes. So for example, spoofing was a vulnerability we detected. And that's where the code is so bad, Neil, on the website that you could actually inject a script or, or some code and fool the web server or the website to think it's legitimate and respond back with usernames, passwords, or even a database, like one out of three. That's pretty alarming. So that's why we're focusing on this market and really going, hey guys, you guys are exposed. And what if it gets attacked like a ransomware for example? You won't be able to recover.

Right.

Because the impact's so significant. Imagine a small business out for like three weeks. How can they survive that? They're just going to be able to survive that.

Yeah, and all these small businesses do not have a chief, a ciso, let alone maybe even a head of it. Right. There's definitely like, it's usually all outsourced in that regard. So no one's really staying up Watching for this kind of stuff, which is, I guess, where your platform comes in. Kind of the eyes and ears for any small business, in a sense.

That's right, Neil. That's right. Well said. We are the eyes and ears when it comes to security.

Very cool. So where are you headed? So it sounds like you're protecting a lot of companies now. Is the idea to just add in more companies or are you adding more products and more kind of expertise to the platform for other kinds of attacks?

Yeah, so certainly more customers. It's a large market and we're badly needed because these small to mid sized businesses are really critical part of our supply chain, if you think about it.

Right.

So they're not only the growth engine of our economy, they hire more people than any large companies out there collectively.

Right.

But they're the supply chain also. So they're suppliers to larger organizations. So they could be the way in, into our large organizations or, or to the government, because they supply the government. Like just in San Diego, o', Neal, there's, you know, tons of companies that are defense contractors. There's over 6,500 in San Diego alone and there's 300,000 in the United States.

Right.

And most of them are small to mid sized businesses. They're supplying software, services, machinery, machine parts to either to larger suppliers or to the government directly. So that's really the key here. But so get more customers, make the supply chain stronger. That's a key focus for U.S. in both U.S. and Canada. But also we're looking to also use artificial intelligence, Neil. AI. So we're looking to essentially one of the things that our software does is it not only tests from the outside inside, but also social engineering, but it generates a cyber breach score. And so it's based on the testing. And so the score tells you dynamically, like how risky are you for a cyber attack?

Right.

Because, you know, of the holes that we found, so we're able to now track how long it takes that business to plug that hole. And so that starts to give us some data points in terms of the ability to not have that happen again or risk, if you will.

Right.

So a company that, you know, plugs that hole in four hours is less risky than somebody doesn't plug it for eight, eight days, you know, or eight weeks. And so, so we're going to be able to really help the companies plug the holes, but also take that data in terms of the response, where is it? What kind of a control was it that failed and start to then use that data to Predict risk and to be able to say based on your behavior of when we alerted you and when you fix the holes, we can predict with 95% confidence that you're going to have another control failure here and if you don't fix it within four hours, you're going to have a breach or you can have a ransomware and that's going to be really powerful, Neil?

Definitely. Well, like you mentioned, majority of our businesses are small, medium sized business entrepreneurs like you and me trying to just build a company. And a lot of our frontline defense and or weakness is just generally everyone as employees. What are they clicking on? Right. So here's the especially in this new changing work landscape or hybrid, are we back to work in person, virtual? Like all that is still completely up in the air now, you know, as we go forward. Any tips for small business owners right now and like what they should be doing and think about prioritizing how to think about, you know, the protectiveness of their company.

Yeah, Neil, excellent question. Because it's really limited time and prioritization, right? Absolutely right, Neil. I would say ransomware is one that is a really big threat for small to mid sized businesses and frankly all businesses. Because ransomware has evolved now where it's not just encrypting your data, right. And then demanding a payment and then saying hey, if you give me the money then I'll give you the decryption key. It's actually evolved to extortion where now what they're doing is they're going to encrypt the data and then say hey, pay me. Otherwise I'll guess what, I've also stolen a copy of your data by the way. And so if you don't pay me then I'm going to disclose some of the data on the web and embarrass you.

Right?

And I might disclose everything or I might sell off that to a third party like the Dark web or a foreign government. So pay me. So it's become extortionware. So it's a double, you know, threat if you will.

Right?

Because you're, you've got your data extorted or exfiltrated, but also you got your data encrypted and you can't access it. So that's a huge threat. And I would say every single business faces it, but especially small to mid size because now they can actually be in a greater pain point because as I was mentioning, if a ransomware shuts down your files and your computers as a small business and you're out For a week, two weeks, three weeks, it's just going to be very hard to come back. So that's a big threat. And so what I would suggest everybody do is do a tabletop exercise, Neil. And it doesn't cost that much money. In fact, Cyber Catch has a very cool 3D virtual tabletop exercise solution called Cyber Incident simulator. It's only $95 per year for small businesses subscribe. And basically in 90 minutes or less, in 3D, you'll be able to simulate a ransomware attack and say, okay, if we have ransomware attack, could we survive it? How would we respond? Who would do what? What would we do?

Right?

So if you do a tabletop exercise like that, using our tool or just getting people in a room or via Zoom and walking through your incident response plan, that'll be a wake up call to go, Whoa, you know what? We're not ready for ransomware. Guess what? Guess what? We found the backup files that we thought were offline. Oh, really? They're not offline. They're actually here in our land or in our cloud. And so therefore the ransomware can actually search and find them and actually encrypt them also. So we won't even have the backups available.

Right.

Maybe that's a discovery you have during that tabletop. But that's what a really cool, easy, smart step would be to do that. And often you get to see where you're holes are. That's one key step. The other thing is kind of what we do, which is figure out, are you having enough controls? Do you have prevention, detection, response controls? Where are they? You know, where are your crown jewels, right? And then test the heck out of them before you get an attack. So those are the couple of things I would suggest right away, Neil.

Those are great. Those are super helpful. It sounds like we should do my own company should sit around the table maybe over some tacos. And do what? At least it's a pleasant feeling while you realize how vulnerable you are and how much holes you got to plug up.

That's right, that's right. The taco will help a lot, Neil.

Yeah, exactly. Make you feel a little better. Speaking of tacos, we got to know you got a favorite taco spot here.

Oh, boy. There's so many choices, Neil. As you know, right? Such a wonderful place. We're blessed to be living in San Diego. So many taco places. I'd have to say, Neil. Probably my most favorite is Tamarindo in Del Mar. And they've got a fantastic couple of taco choices. And my favorite is the Mahi Mahi grilled taco. It's out of this world, so that would be my favorite.

Neil, that's a good one. That's a good one. It's a unique one. We don't get that one mentioned as much, but it is a great one. So appreciate that, adding it to our taco database. Thanks Sai and thank you for being on the podcast. We really appreciate it not just for for what you're building to protect small businesses, but just sharing the knowledge here so that more of us can can be protected. So thanks very much and thanks for being on again.

Thank you so much, Neil for having me. Honored to be with you.

Thanks for tuning in to the Tacos and Tech podcast. You can find all of our episodes on freshbroodtech.com as well as on Twitter at Tacos and Tech Pod. Also follow Fresh Food Tech on all of our social platforms and make sure to share and give a review on Apple Podcasts, Spotify or Google Play. Thanks again.

Startups get the party Startups get the party started. Startups get the party Startups get the party started.

You want tech and tacos, tacos and tech, you know we got it.

Hey.

Startups get the party Startups get the party started. Startups get the party Startups get the party started. Startups get the party Startups get the party started.

You want tech and tacos, tacos in tech, you know we got it. Hey.

Sam.