Episode 17 – From Ethical Hacker to CEO: Leading Change in Cyber and Subsea Data Centers

Welcome to Executive Checkpoint, the live podcast for security professionals. Each week, we explore industry trends, challenges, and insights with leading experts. This is your insider access to the minds driving change in our industry.

Let's see. Of course. Welcome to Executive Checkpoint, where security professionals gather insight to navigate the ever-evolving world of physical and cybersecurity. I'm your host, Tino Urbina. And today our guest has carved one of the most unique paths in tech and leadership. None other than Maxine Reynolds began her career in offshore underwater robotics. before shifting into cybersecurity, where she specialized in ethical hacking and social engineering. She is also an author of The Art of Attack and now serves as the CEO of Subsea Cloud, a company pioneering underwater data centers designed for secure, sustainable infrastructure. Today we'll explore Max's background and experience and learn a little more about what else she's been getting involved. So Maxi, welcome to the show. Thank you for being here today.

Thank you. Thank you for having me.

Sorry about that. No, no, uh, it's been an interesting, uh, connecting with you today. I think that will be a good point, uh, to begin our conversations. Where are you, Maxi, today?

I'm in Singapore. I'm not coping well with the time change. So like, as I was saying to you, just as we were coming on, I was saying, oh, I have a production facility and I said New York instead of Norway. It's my production facility. So I think the lack of sleep is probably dragging my IQ down just a little bit. But how would you tell the difference?

And so we are about 13-hour difference. I'm in Vegas. for ISC West and, you know, still in the security side. So we make this work finally.

Yes, finally. I know.

Well done.

So, Maxie, I'm sure a lot of people know your background, especially, you know, being an author in your book. But I like to start from the very beginning back in Dundee, Scotland. How was it growing up there?

Ah, it was, It was— you don't know any different, you know, as you're growing up. So I thought everyone had similar upbringing to me in the similar culture. And it wasn't until I left Scotland when I was, you know, 18, 19, that I worked out that's actually not what the rest of the world looks like. Um, but, you know, I, I think I probably see it with rose-tinted glasses now.

I—

Yeah, you are a product of your environment, and, you know, I'm okay with who I am, so I guess it was good. But yeah, I left Scotland late into my teens to work offshore oil and gas because I wanted to travel. I really wanted a job that sort of took me places, but where I didn't really have to pay for that. And so I ended up working offshore oil and gas for about 10 years. I met my first husband Um, just racking them up. I met my first husband there. Um, and, uh, you know, we, we, we traveled around the world together, um, both working offshore. He, he owned an oil and gas company. And then I moved into cybersecurity from the offshore environment because, uh, when you work offshore, you have like basically a month on and a month off. And on your month on the oil rig or the vessel, you actually have a lot of downtime, quite a lot of the time. And so I'd managed to rack up some long-distance degrees. One of them was computer science. And then I went to work for PwC down in Perth, Australia, which was a really good time, but it was also my first adult job. And I was like, I'm sorry, You come into you come into work every day, like and then you only have two days to decompress, but you're thinking about work on. I did not cope well. I was not I was not sort of prepared for that. I had no idea that that's what it was like, and I didn't enjoy it. Like just the scheduling of it. I enjoyed the work, and then I moved back to the States. I went into social engineering and red teaming, which I'd had a little sort of taste of down in Australia, and so that's obviously a very niche subset of cybersecurity where you physically as well as logically hack into different environments. And then I'd gotten a contract for a data center provider, and it was like a big deal at the time that, that they were even allowing that pen test at all. Um, we had to be like guarded, I suppose, accompanied by people from their own environment. And we'd gotten in and it was a huge deal that we'd managed to get in. We got in through the sewers, actually.

Oh, wow.

And then, yeah, that was— it was not— I didn't enjoy it. But we got in through the sewers and I was thinking, God, if you want to keep them safe, you should put them underwater. And then I was like, is that a good idea? So I actually phoned Like my old boss from offshore and was like, do you think this is a good idea? And he's like, not the way you've designed it, but yes, like it's a good idea. And then he has helped me ever since and we work together now. So that kind of brings us up to present day. That's all. That's all folks. I'll leave now.

Well, that's a very unique career path, Right? It's almost like you were looking for the right opportunity. Um, is it true that you at one point worked for movies?

Yeah, I'd done some stunt work for some independent movies and, um, almost like production stunt work where it's for live audiences. Um, and that was also really enjoyable. I was sort of weaving that throughout working offshore. when I'd moved to Los Angeles. So yeah, I enjoyed that. I got to, you know, yeah, it was fun. It was nice.

That's the skill of Marilyn, right? Preparation for being a CEO, right?

Yes, mentally it's actually a really hard job. And just for the fun of it, I'm taking a stunt course next month, a stunt driving course. I don't expect I actually think I'll probably be safer at stunt driving than just normal road driving.

Right.

But yeah, so I'm doing that just for the fun of it. I do enjoy just doing what I find to be interesting things. I've got maybe a strange point of view on it, but for me it's enjoyable and it keeps me sort of moving forward. I'm never at rest, so to speak. So one of the things that I think about that I know a lot of people don't like to think about is, you know, I've probably got, you know, maximum 50 good years left on Earth. And when I say good years, like, you know, I'm independent, and if I only do 2 interesting things a year, that's only 100— that's only 100 interesting things for the rest of my life. That just doesn't seem a lot. So I'm trying to rack them up. 2 is my minimum. Yeah.

I saw this, uh, uh, I think it was a TED Talk where they break down all the weeks that you have.

Yes.

For the rest of your life.

Yeah.

Minus sleeping, minus eating, minus— and that, that's, uh, so it's brutal to look at. Yeah. And I have that. So I'm, I'm in the mindset just like you. I'm, I'm here coming up Kilimanjaro. I'm doing the Kilimanjaro trekking.

Amazing.

And, uh, you know, as scuba dive as it is. But by the way, do you scuba dive?

I do, but I don't enjoy it. I don't like to hear myself breathe, and I'm terrified of open water, so it's, it's not my favorite thing to do.

But you were better with the—

I like to be on the ROV side. Yeah, you drop something into the water, you look around. Yeah, yeah. No, I have the poster, so there— I got— I can't remember where I got it from anymore, but I heard it on Peter Attia's The Drive, which is basically a health Longevity podcast that I listen to fairly frequently, and he was talking about this like poster, and it marks the weeks of your life from your birth year to like I think 100 or something. And I've got mines, and I'm like to see it is one thing to think oh I'm a third of the way more than a third of the way through my life, but to see it I was like oh like I like more there's more to do there's more to do so yeah I'm in the mind the same mindset I love to see videos once you Yeah, if I get through the course, I will send the videos. Yeah.

Well, let me ask you, I mean, this is interesting, but as a CEO, as a leader, it seems to me that you have this mindset that is innovation and not so much taking risk, but calculated risk, right? To me and everybody I spoke to so far that I mentioned, yes, you know, we're having a conversation about underwater data centers. is there comes a lot of questions, right? Technical questions and whatnot. So would you break down a little bit, just the basics of the technology for layman's terms?

Yeah. So I guess I'd start by saying, whenever I talk to people also about subsea data centers or even just the subsea environment, I'm met with the same, often like trepidation or They're like, what is going on? Because it is hard to understand in its niche. So a couple of things to say on that. Everything that you and I are relying on right now, from our computers to the power, to the power that's provided for the internet cables, for the subsea cables, all comes from oil and gas. The cables that you and I are communicating on, we're not going over satellites now, we're going subsea cables. Our computers are built from oil and gas products, everything from our shoes to the seat I'm sitting on to this rug, which is definitely like, I'm sure, polyester. So it's around us all of the time. Our lives couldn't function without the oil and gas environment and everything that is subsea. So it's not actually that hard to put things underwater. It's just that there aren't that many people that know how to do it. we honestly don't need that many people to know how to do it. So there's that. And then on my technology side, it's actually very simple. So we take what looks like a 20-foot shipping container, we build them in-house, and we rack and stack, it's called, just like industry jargon. So we put racks in there, servers in, and then we fill the unit with a fluid. And essentially, when the servers work, all servers is similar to your computer. You know, when you're working your computer and it produces heat onto your lap, you're like, "Oh, that's hot." It's the exact same for servers, of course. And we have you know some data centers have hundreds of thousands of them in there. We we have about you know just call it about a thousand in there at a time. They produce heat as they work, and then the the molecules within the fluid that surrounds them gets excited and it creates this turbulent flow because you have 2 different densities in the fluid. And then the seawater dissipates the heat because the excited molecules, that excited fluid goes to the top or the sides of the container and then the seawater dissipates the heat. And it doesn't actually heat the surrounding water itself because water has a very high specific heat. And the example I often use to get that point across is that, you know, you're sitting at the beach, you forgot your flip-flops, you need to get into the water. So you're like, skid across the sand really quickly, like, it's really hot. And then you get into the water and the water's cool. It's the same sun, right? You're in the exact same geographical location, but the water's cool. And that is because water has a very high specific heat, which is just a way to say it takes more energy to raise the temperature of water as it does the same mass of air or really any other material. Compared to most materials and elements, water has a very high specific heat. So sand gets hot quicker and differently than water.

Very interesting. I saw a similar application of technology on mining. Yeah. When I say mining, I mean data mining for Bitcoin farms.

Yeah.

They will use, you know, they used to use fans, but the electricity bill was incredibly high.

Yeah.

And they put in liquid to minimize that. So the other benefit, I think, and correct me if I'm wrong, but is that there is no pressure. I mean, withstand any kind of pressure, right? Water doesn't compress.

No, water doesn't compress. Exactly. You can't compress it. So yeah, we can put the units down to their depth rate to about 12,000 feet or 3,000 meters.

Oh wow.

But it's just a big flex. I mean, there's nothing down there. We wouldn't— we really have no reason to put them that far down. We tend to be rivers, ports, dams, and then a little bit further offshore with other, like, maybe assets, oil rigs and things like that, where we might go down to 1,000 or 2,000, probably maximum. But yes, so they incur the pressure of the water That way. It's the internal fluid.

The other question that I've had, you know, having this conversation about the technology is, so what happens with maintenance, right? Something goes down. Now to replace that server.

Yeah.

How do you do it, right?

And obviously— Yeah. There's a few sort of— yeah, it comes up a lot. It comes up a lot. You know, every potential client we talk to has the same question, sort of rightfully so. So Uh, we have to talk about this a few ways. Um, one thing is, you know, when I first started, we only knew about really CPUs. We were not— we did not care about GPUs at all. Wasn't a thing. And so for CPUs, you know, it's fairly inexpensive. You can fail in place. If one rack fails, you load balance. Um, if an entire unit goes offline, then we would investigate that. bring it up to deck. We essentially, for our critical mass, our threshold number is 20 units, which for CPUs is about 20 megawatts.

Right.

Once we have 20 megawatts or 20 units on site, then we have a dedicated vessel. Just, it's economically feasible at that point. And so that would then help us maintain. So we bring it up, it takes a few hours depending on the depth to bring up to deck, uh, drain it, and then, uh, like assist in the, in the maintenance cycle. So there's also that way to do it. And then the other thing is, again, like either load balancing or putting down a new unit, um, something like that. So there's like multiple ways to do it. GPUs, it's a little bit different. We had to put in like bypass loops because you can't It's a network, right? It's this neural network. So you can't just take up one without— we were like, how are we going to get one unit back up and not take down the entire network? And so we had to think about that. That was not my brainchild. I just went to my team and I was like, I think you guys need to think about this. You hired me. Come back to me with a solution. And they did. So yeah. So we have that sort of down pat.

And, you know, I think we're going to see more and more. I think I see a lot of practical uses, right? One, as many new technologies, adoption tends to be a little higher, right? And I think that as is, you know, it will come down. But I see examples of, you know, larger corporations trying to do the same. I'm sure this is not new in your conversations, Microsoft with Project Natik.

Yes, that's right. I really appreciate Microsoft actually. I'm in touch with basically the— I was going to call him grandfather of it, but he'll kill me. The father of that project. I said, like, we went back and forth because they designed theirs slightly different. Well, they designed theirs a lot differently than ours in that theirs is sort of built on the principles of a submarine. So they essentially, they make the walls thick enough to withstand the pressure, but you can only make the walls so thick. By the time you get down to like a depth where you're outside of marine traffic or even just away from some of the wildlife, marine life that you would want to be away from. the walls are so thick that the server coefficient is off. You get one server, the space server coefficient is off. And so we have gone back and forth on that, but ultimately the outcome is the same in that you're being cooled by seawater and that is very effective and efficient. And then I think a couple of years ago we were in the Wall Street Journal. I'd sort of just started, well, I was just finding my feet at the company in terms of like, you know, running it. Listen to the word of the law. Yeah, yeah. And so we ended up in the Wall Street Journal and I was like, I remember being nervous about that. But Microsoft had come in and also said, we are not doing it and here's why, but you know, this company is and we like them. And so I was like, thank you, Microsoft. Well done, yeah. So it was like, yeah, a vote of confidence, I think, from them. And then the other thing As you know, we see our Chinese, um, like counterparts, I suppose, they are, they're doing the same. So I think DeepSeek is being run off of subsidy data centers, and that's like quite interesting.

Yeah, I think, I think it's not going away. I feel that the credibility with— if someone was questioning the reliability and Yeah, the proof of concept, having, you know, them be part of, you know, tipping the hat to you guys. That's, that's—

yeah, yeah.

What do you see you guys in the next 5 years, uh, as a leader in the industry? I feel like you guys are leading, you're the most visible, you've been there.

Yeah, I mean, so what I'll say about, you know, being first through the door is sometimes being first through the door means you you're the first one shot also. So we'll sort of see how it goes. I think I have huge confidence in us as a company because of course of the team. And we like— everyone at the company likes to problem solve. And that's really the only thing that matters. That is what running a company is. It's solving problems. I say this all the time. I'm sure people are sick of it, but essentially My job and then so my team's job is to solve problems. And sometimes the problems that we've created and sometimes the problems that we see in the market or with the adjacent industries like power, the power constraints that we're running into in terms of data centers, we know that that's a problem and here's how we are solving it. So I have high hopes there. I think you are right. We've faced like the innovator's dilemma, which is a really I guess, what would be the word? What's that term where people, like a cult? It's like a cult. It's got a cult-like following, The Innovator's Dilemma. It's a really, really good book. But basically, we faced a little bit of that where it's been hard for some companies to adopt our product for reasons that are actually really nothing to do with us. Um, or, or our product. It's just that we're niche. And for instance, like, Microsoft's a good example. So the reason that they are not— well, I think the reason that they are not following through with their subsea data center projects is nothing to do with the technical feasibility. They know it's— they know, like, that it's got great potential, and they know that it works, right? They tested it. But it doesn't affect their bottom line. There's not enough people who wanted to adopt that so that Microsoft, a public company, could go out and push it onto the market. It would take them too long to grow it. And so it's like, they— that's how disruption happens. The larger companies, they, they're no longer disruptive. They have to keep their revenue, right, both generating and, and hopefully, you know, going upwards. We don't face that as a startup.

Right.

And so like, that's one of the benefits of being a startup. But there are some disbenefits, like we get slapped around by some of the hyperscalers because they know they can. So, you know, benefits.

Well, I will say that, like many corporations have done before, they're just waiting for you guys to have that tremendous growth and success.

And then likely they're gonna be like, oh, we actually, we've been trying to get in touch with you for ages.

This much market.

Yeah, exactly. Exactly.

Yeah. So let me ask you, part of the people that we engage in the show is obviously leadership, you know, CEOs, CTOs, but yeah, also people are just coming into the industry in different, different levels, right? Some from college, some from the field, some from the technical background, some from the sales and marketing sort of. It feels to me that as a CEO, you're the ultimate problem solver, like you said, right? If a problem gets to your desk, it's a real problem, right? If you are the one that is expected to solve it.

Yeah, if it's only me, the consultant. Yes, exactly.

So you have a very unique path to where you are today. So what, what do you think someone starting their career should approach their professional path, whichever industry they're in, especially maybe in security? You know, sounds to me being at Red Hat has been fun. Stoneworks, fun.

But yeah, yeah, I mean, here's what I'd say. First of all, look to solve problems in any industry, no matter what it is that you want to do. I think that's probably the most important thing from a mindset point of view. But here's probably the other thing that matters. Skill matters, and the more skill you have, the more luck has an impact, right? So if, if we have 2 of the best people you know, 2 of the best soccer players on a pitch— football, football players on a pitch, I'll get killed in Scotland for saying that— if you had Beckham and Ronaldo on a pitch, and let's say, and I don't know, but let's say that they are of equal skill, then luck matters to them in that situation more than anything else. Like, where does the ball go? How does it hit off the foot? Like, there's things that are just outside of your control, even if you have a lot of skill. And so you have to upskill all the time and be curious and persistent, which is one of my sort of key messages in the cybersecurity book that I wrote a few years ago. But you have to also know that luck matters a lot. And I don't mean like divine luck, I just mean it's, it's randomity essentially at the end of the day. So what that says to me when I put those 2 things together is to look out for opportunities. And I'm always on the lookout for opportunities. And if one comes knocking, you have to be able to identify them, which is probably its own skill. And I don't think I'm actually qualified in terms of how to notice them, but I think when— or how to notice opportunity. But when it does come knocking, when it is clear to you, like, go for it. The, you know, the only— I like to think of things in terms of, okay, if I do this and it doesn't work out, can I just come back to where I am now? And there's only a few things in which that's not the case. For kids, you can't put them back. So like, you know, outside of like those, those really hard, um, decisions, if you're gonna have kids get married, like all those things matter. But when it's just you and a decision career-wise, try it because—

Right.

You just come right back to where you are most likely, and you were there already, you know what that's like. So that's kind of how I started the company. You know, I was thinking, okay, I'm gonna like leave this job and the salary and, you know, this community of hackers and other misfits, and I'm gonna start this in an industry that I really know nothing about. Okay, if it fails and if I fail, it's gonna suck, but well, just come right back here. And so I kind of I kind of mentally guard like that, and I have some skill because I know subsea engineering. But there's a lot of luck, good and bad, that's gone into getting the company to where it is now.

Right.

So yeah, yeah.

Well, you know, I find I find it very inspiring when. in your book, you're talking about consistency and persistency, right?

Yeah.

And that's on everything. So, um, another thing that you mentioned, and we were talking about this earlier, is how much of an avid reader you are.

Yeah.

And I think that's kind of where luck is an element, but it's not the larger percentage of the success of someone.

Yes. Yeah.

In preparation and investing in yourself. I see that, you know, it's like, I, you know, tell people, look, do the hard things early on in your career.

Yes.

And later you come with that much more experience.

Yeah.

I agree with that. That's it.

Yeah. Thank you. So there's a little bit of like, I guess you could call it luck or randomality, but it's genetic expression, right? So there's some people where they're, they're, they don't enjoy reading. It's really hard for them for whatever reason. That's okay. Like, I read, I try to read, not being good on it this year so far, but I try to read one book per week, 50 pages a day. You know, I can do 25 minutes in the morning, 25 minutes at night, and I get through a book a week. And I kind of enjoy that. It takes a little bit of, you know, self-restraint not to turn on the TV at night and to pick up the book. But then once you've gotten into it, and it's not— I, I happen to read a lot of nonfiction, but I really do enjoy fiction. I think it's really good for the imagination, and imagination is what solves problems, right? So it doesn't matter what kind of book you're reading. I'm not very snobbish or uppity on like, oh, you read novels instead of nonfiction, just read. But if you're one of those people who actually doesn't enjoy it, and it could be, it could be genetic expression, it could just be culture, it could be the, you know, the household that you grew up in, it could be whatever, find a different way to get information. I think like I always want data. It goes back to what we were talking about at the start. I want to know how many weeks I've got left to live. I want to mark them off every week. And I want, you know, I go and get my labs done every 3 to 4 months to make sure the vitamins that I, you know, take, that I don't just really have expensive urine essentially. So like, I want data. I like data. And I think the more data you have, the more you can synthesize and the more you can synthesize, the more you can see around corners, at least partially. And that's kind of how I am, like, slowly walking through life, hoping, like, you know, not to stand on a landmine. Well, that is until you start driving that fast car, and then I hope, like, they have, like, just big fences around it, because otherwise it's just going to be a lot of casualties. There's no way I should be allowed to do this. I'll send you a link. It's going to be— I'm really looking forward to it.

I can't wait to see the videos. Well, I'm sure. Yeah. Oh God, Maxi, I know we can do this for another couple hours. This has been fantastic. You're great, um, for joining us today. Um, incredible story, great experience. Thank you for sharing. Um, I would love to invite you back. I think in the coming months we'd love to have a few people with different opinions about technology or security in general, or, you know, in this case, leadership. But I hope you have a safe trip.

Thank you.

We'll see you soon. And for the folks at home, stay safe, stay informed, and we'll see you in the next Check Point. Thank you so much.