Episode 26 Agile Resilience: Unifying Security in a Chaotic World with Bruce McIndoe

Welcome to Executive Checkpoint, the live podcast for security professionals. Each week, we explore industry trends, challenges, and insights with leading experts. This is your insider access to the minds driving change in our industry.

Checkpoint, where security professionals gather insight to navigate the dynamic and ever-evolving world of physical and cybersecurity. I'm your host, Tino Urbina, and today we have the privilege of speaking with Bruce McKendall, president and founder of McKendall Risk Advisory. With a rich background that spans national security, intelligence innovation, and operational risk management, Bruce will share his journey from government intelligence systems to building industry-leading platforms like iJet, later WorldAware, and developing his Agile Operational Resiliency Framework to help organizations thrive amid disruption. We're excited to have you, Bruce. It's a pleasure. I'm glad we finally made this happen. How are you, sir?

I'm doing great. It's good to finally be here.

Well, You know, you're well known among the security professionals, but we engage with a lot of newcomers. And for that reason, love to hear a little bit about your background, how you got started, what, you know, brought you to the security side of the business side.

Yeah, it's been my undergraduate degree. I was a physicist focusing on high-energy physics. So that's where this all started. But then I moved to Washington, D.C. and got a job at NASA, mainly in astrophysics arena, that kind of thing. And I started a master's degree in physics at Johns Hopkins University and fell in love with computers. And I fell in love with using computers to instrument spaceflight. both in space as well as ground support. And so I shifted my degree to computer science and was very involved in space missions and very much in communications. So the satellites, for example, the space shuttle and how it communicates and works through what's called the Satellite Data Relay System, right? So I worked on these systems, and then I got involved in commercial satellite communications, and that's what got me into the intelligence community because NSA came knocking at my door and saying, oh, Mr. Mackinder, you know a lot about international satellite communications. Could you help us? Right? So I left CSC and started a company called CSSI, Communications and Systems Specialists. We primarily supported DOD and the intelligence community. It was an Inc. 500 company, 5-time Washington Technology Fast 50 company. And there we got into cybersecurity and, you know, collection systems, intelligence processing, so all of those areas, and sold that company in 1999 to Nichols Research that ultimately it was acquired by Computer Science, so kind of full circle.

Right.

And under General Minihan when I left, started working in OSINT for the government. It was Interlink and those activities, and that's what got me creating IJET, IJET International, as the first 24/7— we call it indication and warning intelligence center, watch center— in Annapolis, Maryland. And later we acquired Kroll Information Services, Pinkerton Information Services, and grew to be the largest provider of open-source intel to essentially the Global 3000. That was sold in— well, it became WorldAware, then it was sold to Garda in 2020, became Crisis24. That's when I peeled off to focus on bigger problems in the industry than just intelligence. So we'll talk about that.

Absolutely. So let me ask you, I mean, obviously there is a great transition going from government to the private sector. What were the challenges or opportunities that you find, um, you encounter them, that, that shift?

So I was very fortunate through that whole arc that I was never officially a government employee, right? So, so with the creation of this company called Communications and Systems Specialists, while we were initially captive to the agency, we were, we were a commercial entity, but we were managed by the director's office, what they called quick reaction capabilities and director discretionary funds to go after interesting targets or high priority things. So I've always operated, but it was— but we were, you know, just an extension of the government at that point, you know, and then as we grew, well, then we branched out into other commercial and government projects.

That's interesting. So you got the best of two worlds, right? You still get to to work for agency but still keep your, uh, open commercial spirit. There you go. All right, absolutely. So, uh, currently, back then when you started the company, how many people do you have working with you, or how large was the operation at the time, and what, what has been the— what was the evolution of that?

So the CSSI company grew to, uh, about 250, 280 people when it was sold. And similarly, iJet WorldAware was probably in that same range when it was sold to, to Garda. We had operations in Singapore, Cape Town, London, Washington, and analytics support, ran 24/7 hotlines for about 150 companies. So similar size companies.

So iJet was a pioneer in operational intelligence. The, you know, how was— what was the market for you guys at the time to position this as a global watch operational center?

So it was very interesting. So that was April 1st, April Fool's Day in 2000, is when we put this company together. So we came out of— if anybody remembers when, you know, the stock market melted down in March You know, we had— we were going out to get funding. We were only one of 3 companies in the Mid-Atlantic region funded in the 3rd quarter of 2000. We launched then in April of 2020— 2001. Is that— if you kind of remember all the things that happened in 2001.

Yeah.

Anyway, but we were going in with this open source and focusing on, you know, people protection, travel risk. And, uh, that's when the airlines cut commissions to the travel agencies. And so we were, you know, gonna go sell to travel companies, and that— they— so they all pulled back. And then we were going into the ASIS in, uh, September of 2001, and guess what happened, right? So, uh, so after that A lot of companies were focused on their own facilities, you know, bollards and bombproof glass. And, you know, so they weren't so interested. But in the— in 2002 is when we started to get traction because we had companies like Prudential and Cigna and others that were on the platform during 9/11.

Right.

And so they were the ones that actually knew where all their people were. Right? Who was on flights and where'd they get diverted to and all that. So they were our spokesmen out there saying, this is— you got to have this tool, this is really important. And that's really when we took off in the summer of 2002 as far as that business, and then partnered with Kroll. They were an investor. We acquired KINS, which is the Kroll Information Service. Later in 2003, we acquired Pinkerton's Global Information Service. We Acquired Kroll's Hotline. That's what became our hotline capability and just went from there and grew, and, and kind of the rest is history. It was, it was a lot of fun.

So this is now WorldAware, right? That's the—

Oh, what happened was, so we had iJet International. In 2018, we acquired WorldAware from Aon. Oh, and the private equity guys that backed us up, they, they didn't really like iJet because every time they'd go in and do a portfolio presentation about them, Oh, you're in the fractional jet business? Or, oh, you— what are you doing selling Steve Jobs' airplane? You know, iJet, you know. And, uh, so they took a lot of heat for that. So when they acquired— when we acquired World Aware, Aon had all the world, you know, IP for that, right? And so they said, well, we want to rebrand the company from iJet to World Aware. So in 2018, we told all our clients, we're not iJet anymore, we're World Aware. And, uh, you know, off we went.

So it totally was rebranding, had nothing to do with evolution of the company. Yeah, so that's, that's great. See, those details are definitely not known. And then you started your, your advisory, risk advisory, in 2020.

Oh yeah, so in, in, uh, kind of April time frame of 2020, the PE companies were gonna, you know, realize their investment, right? So sell it. And we had a few bidders on that. GardaWorld came in, all cash deal, minimal due diligence. And so they closed in August. And so I left and started my own shop, you know, Mackinder Risk Advisory. And that's what I've been— so I basically have gone back. I had, you know, we had obviously hundreds and hundreds of clients. I had a group of about 30 of the Fortune, I'm gonna say 100, maybe 150 CSOs that I've worked with for probably 15, more than 15 years now, and other clients. So kind of worked with that group, and what I've been focusing on is looking at the industry and seeing just almost intractable challenges that are preventing us Collectively. So I'll call all the protective disciplines physical security, cybersecurity, business continuity, crisis management, which I allocate to crisis communications, incident and emergency management that can escalate to crisis, right? Supply chain security, environmental health and safety, on and on. Compliance, legal. All of these are protective disciplines that all operate still largely in their own silos, their own tribal silos.

Right. And that's, that's common for most organizations. I feel the more mature the organization, the less those silos are, or the better connected they might be. But yet—

I love you using the word connected because when I go into companies, they say we have to break down the silos, right? We have to converge people. And, and I try to tell them, stop. Words matter. People don't want to be broken down. People don't want to be converged. Right? It's like, use these terms. We're going to bridge the silos so that they can work jointly together in a common mission, right, toward a common objective, right? So, and, and I, when I go out there now, and I'm going to be speaking at ASIS here next month on this, is using the team of teams, General McChrystal's team of teams kind of organizational structure to say, Because going into a company and saying you're going to rewire the organizational chart is dead. Everybody has their fiefdoms, they have their budgets, they have their people. But when you go in and say, we're not going to change that, but we're going to take these experts and we're going to put them together on a multidisciplinary team to achieve this objective, people can get their head around that, especially when I go in and I say, Tino, I say, and what I'm about to tell you, this you've already done. What did you do with COVID You went out and said, my God, my business is— I have an existential threat. I'm going to bring all the experts together to keep my business going. I'm going to shorten the decision cycle. I'm going to let them run and solve the problem. All I'm doing is telling you, institutionalize that because it worked, right?

Right.

And then you, then you have to do other things to get data sharing and all of that, which is not easy either.

But— Well, it sounds to me that you like challenges. So this is what you call agile operational resiliency, right?

Correct. Yeah.

And so, you know, can you walk us through an AOR model? I mean, particular concepts like unified protectors on how organizations break down silos. So you mentioned some of the connectivity, but is there a framework that you You sit with your customers and go, okay, guys.

So again, it's, you know, since people live, have the lived experience of COVID I always come back and say, how did it, how did that team work? Right? They came together, they looked at the key problems, they came up with solutions, they deployed the solution. If it worked, they scaled it. If it didn't work, they came back and reworked it and figured out how to put it out again. That's agile, that's team of teams, right?

Right.

All these people were pulled in from other departments. It's that, it's no more complicated than that, right? But what you did is when COVID was quote unquote over, you disbanded it. And what we're saying is, well, in some cases that you might want to do that in this model around operational resilience, that you have a mission objective that's definitive or you have an ongoing mission objective, which might be integrated supply chain risk management or, or people risk management, right? That includes, you know, travel and consultants and, you know, EHS as far as in your facilities and that's those kinds of things. So, so now if you want to talk about people holistically, Yes. bring those people together that actually have a nexus around people as a, you know, multidisciplinary team. And what you're going to find is reduction in redundancies, clarity of focus, rather than missed opportunities. You know, you're going to actually get— have new opportunities present themselves. And it builds an esprit de corps where everyone sees what they're bringing, but they don't have to all have to wear the same uniform. I can have Air Force, Space Force, Army, Marines come together. take the hill, right? And they all get to wear their uniforms and their certificates and all the things that they've invested in their identity, rather than saying, oh, we're going to converge you into some department which wears gray suit. They don't want that.

Right. It's different cultures, right? And like you mentioned, this is a new approach to helping organizations prepare for complex, modern threats, right? So can you share an example?

Yeah, multidimensional threats. Exactly.

Multidimensional. Yeah, I definitely like that. And I love the fact that you're using people as your main cohesiveness for this approach. Can you share an example of how companies have implemented to bolster resilience and protect their organization?

So yeah, so the concept of a— I think you've said a unified protector, and it's been Phelim has used some different terms, but the point with this is, especially now, and, you know, talking about this 3 years ago, people like just gave me a blank look. Talking about it now in the age of AI, they get it. And that is, if the human is going to be in the loop, you've got to become more multidisciplinary about what you do and more fungible within the organization, right? So if I'm a business continuity person, that's great. But you know what? There's 4 other key disciplines out there. Number one, crisis management and emergency management. That's foundational. Go learn about that and learn about physical security, learn about cybersecurity.

Right.

And then your discipline, business continuity. If you can have master one and be knowledgeable in the other areas, you become a multi-capable player in this company as demand for resources and people ebb and largely flow away, you know, you're going to be more valuable in the long run. So that's what we call these, you know, multi-capable protectors or unified protectors that can go in and have a conversation about, you know, advanced persistent threat, or they can about, you know, exercising and BIAs and, you know, and be knowledgeable with the language and understand how it all fits together. And And we have what we call the continuous risk management cycle that these joint combined operations centers execute against with all of the disciplines that are involved in that ongoing cycle of, you know, threat detection. You know, is it relevant to the company? Do we need to lean forward preparation? Do we have to respond because it's already hit us? Right?

Right.

So then we respond. Is the response an incident that we can handle locally? Is it an emergency that requires outside resources? And is— or is it a crisis that's gonna impact the organization's value or reputation? Once that's over, we do our after-action, multifunctional, what do we need to do? And you just keep doing that. And I love it in the age of AI because every new threat that comes in, you've— you essentially fork off an agent that says you now own this through that entire cycle, whether it completes or not. I might get an incident, minimal impact, done, after-action, done, or I have preparation and it never happens, right? So, so it doesn't— it's not a continuous cycle, a sense of, you know, each one, but you can see how you can kind of end things early. And, and so when, when the team comes together and understands that's the basic process that we're executing, they fully understand the combined mission and operate amazingly.

Yeah, I love that. Well, let me ask you, from your vantage point, what are the biggest gaps or innovation opportunities currently in the security and resilience platforms?

Yeah, there's so many, actually, unfortunately. I would say the biggest gap from what the clients that I work with— now, these are very large companies, Uh, is that the legacy providers are so encumbered with their investments that they've made. When you look at Everbridge or Crisis24, any of these that went out and bought, you know, Anvil and OnSolve and Topo, and, you know, and they— so they have a tremendous pile of investment in technology that's 10, 15, 20 years old. Right? That's a lot of technical debt, a lot to manage, which hinders their agility to move forward in a modern world, and the clients are seeing that. But then I go out, I have 5 companies that I'm an advisor on, and what I see them delivering— and we just did a presentation today for Apple with one of them, and I think that they were really like, wow. And, you know, when you have an agile, adaptive new entrant that has this technology, you know, toolbox at their, at their disposal for leveraging AI and, and, and, and various incantations. It's amazing, you know, I can just see them coming out and accelerating.

Right.

What I'm helping all of them is how do you do this in a multidisciplinary model that if you're— what you're doing does not bridge these silos and enable people to share information, which is the core of the whole game, right? And one of the companies calls them data hubs, but it's essentially, you know, think of it as like a mega large language model of everything the company knows about the company and brings in external data to feed into that about what might impact the company and then pull out of that, so what? It's like, okay, here's this issue, it's going to impact this, facility, the facility insured total insured value is $1.5 million, not a big deal. Oh wait, it's our, it's our manufacturing plant in the Philippines, in Puerto Rico, you know, the total insured value of that plant is $250 million, that's more important, right? So they want the, the people that are using the technology want to know, so what, like, what does this mean and how important, and then what should I do about it? So based on—

Right.

essentially learning models that says, how best should we deal with this threat or with this incident? That's what I'm helping these companies wrestle down and resolve so that we can step our game up and be more effective, more efficient with fewer people, no question.

I love the fact that you translated the different segments within the organization on their language model to simplify the the use and, you know, facing AI from a geopolitical shift.

Mhmm.

The impact in these companies is gonna be great, especially for the security strategists advising them. Right?

Oh, yeah.

It's, it's a new skill set for sure. And I think, do you feel there's a gap on that sense on, on the professional side of security? Yeah.

So that, so that was the other, you know, I mean, I'm fortunate because, you know, I worked with, you know, AI since 1990, '94 when it was called artificial neural networks, right? So, right, date myself. But anyway, so, so, you know, so I have the— fortunate that I followed that technology and deployed it, you know, 20 years ago. So, um, what I see with a lot of— I would say more at the management level, I think at the worker level, like when I work with GEOC operators and people like that, They're already experimenting because they're seeing the benefits of synthesizing information and pulling out the key points, a lot of the things that AI can do and really add value. Where I see the gap is at the management level because they don't see that hands-on, they don't see what it can actually do, but they overhear more on the nervous side of, well, where's that data going to be stored and we're going to lose access to it or whatever, right? And so they tend to be more hesitant just because they're entering the unknown and they don't know what those risks will ultimately be. So anyway, so that's that piece of it.

Yeah, I was in Mexico City this week and talking about specifically implementation of AI in physical environments and It's so interesting to me that some people were surprised to know that, you know, this is really not a new technology. It's just, it was in the lab for so long until I think AlphaGo came out and Netflix, people go, oh, okay, it actually exists. And of course ChatGPT kind of expedited that, but behind it, all the subcategories and now it being utilized are great. Well, you, you've been named protective Uh, Intelligence Pioneer by WisdomTree.

That's what happens when you're old.

Well, 25 Most Influential Executives. Let me see, there's one more. Top 40 Global Thought Leaders.

Yeah, 2 years in a row. Yeah.

Yes, sir. And how, how is this recognition influence your, uh, work and contribution? Or it really doesn't just—

that just happened because you're influencing Yeah, I, yeah, I definitely don't run after them. Uh, actually, the, the, the, this top 40 influen— most influential, uh, one that, um, Michael Gipps and team put together, you know, they came to me and said, you know, hey, you know, you're doing podcasts, you're doing, you know, presentation. I probably have, just looking on my board here, 9 sessions that I'm doing between now and the end of the year, all, you know, globally, right? You know, just fill out this thing, you know, this spreadsheet and send it in and And that's all we're asking you to do, right? The other ones are just people that have seen me, you know, in the market for 20-plus years. And, you know, I had, you know, like the Ontic teams, Chuck Randolph, you know, basically say, like, we'd love to recognize, you know, the work that you did and that you created this space. And, and, and, and that's actually like one of the things somebody asked me about travel risk management.

Right.

And I said, yeah, you know, we— I came up with that when we were in the travel, you know, with iJet and all that kind of stuff. But I said, in 20 years of 20/20 hindsight, I was wrong.

Okay.

Yeah. And I said, if I knew then what I knew now, I would have started with people risk management. The asset we're protecting is the person. Yes, an element of that is when they're moving. They may be moving in a car, they may be moving in a ship, they may be on a commercial ticket, they might jump on a train inner city and you don't even know, right? They're still the asset, they're still moving, so it's travel risk. But where do they fit in the program? And oh, by the way, except for the commercial air ticket, most companies don't even know. who's driving a car, who's on a train, you know, unless they get that. So there's huge gaps in most TRM programs. What I try to do is get these people to come together and start saying, let's focus on people and where they are when they badge into the facility, when they log into the network, when they use their app. And if they want to, they can hit a check-in button if they're a lone worker. Bring all of that together. and focus on those— all your people, doesn't have to be employees, could be all people that support your business all the time. That's the game we should be playing, not just when they have a commercial travel ticket. So that's—

Modest, because you definitely have a different perspective on security, and you've continued to evolve. And so you're a guiding beacon for a lot of professionals. But Well, speaking of that, being a guiding beacon, a lot of the folks that listen to the podcast are entering the security industry or might be interested in transitioning maybe from a military perspective or government to the— since you have experience doing that, what will be your word of wisdom to these folks starting their careers, maybe from that perspective?

Yeah, actually, I just— I do workforce development, you know, as a volunteer and some other things. And I was actually just speaking with a young group of kids that were going to get ready to go to college, just started this. And I told them, I said, check your ego at the door if you want to really advance your career. Find people that are smarter than you and also connect with people that have different views or even counter your position. I love it if I'm sitting here now and somebody comes back from this podcast and says, Bruce, I think you're full of you know what. Blah, blah, blah, blah. And it's like, let's get on a call. I want to hear your perspective, right? So it's— you have to constantly be open to being challenged, and you're not the smartest person in the room, right? And so if you can do that, Right. then I don't care whether you come from law enforcement, military, you know, just fresh out of college. If you're— if you have that constant curiosity, constant learning, constantly challenging yourself, and looking and saying, oh, here's a new perspective. I need to learn about Stoic philosophy. I'm reading this. I just finished reviewing a book on the mindset of resilience. It's really good and it's a lot of philosophical foundation for how does a human and then ultimately the organizations that we create, become more resilient, right? And what are the keys?

Gabe, um, Dr. Gabe, uh, is that called Resiliency?

Um, let's see, it's— I'm reading 2 books at the same time, but I'll, I'll send it to you.

He was on the podcast, you know, like a couple weeks ago, right before he launched.

So, okay, maybe it is. Yeah, yeah, it hasn't been published yet.

So interesting, very interesting read. Absolutely. Well, Bruce, this has been a pleasure.

Yeah, my pleasure too.

I'm so glad that we get to talk. I'll get to see you in ISC West. Um, Or I know it was GSX.

I'll be there. Yeah.

So we invite—

and I'll be doing 2 sessions. Hopefully people will check them out.

Absolutely. Come and see Bruce, say hi. And if they want to contact you in a professional fashion, what's the best way?

I welcome it. LinkedIn, Bruce McIndoe, mcindoe-riskadvisory.com. But always love to get inbound interest, and we're actually putting together in ASIS— I think you were just in Latin America— we're putting forth a new working group which is Ops Center Next Gen, right? And what we want to do there is get multiple disciplines to come together— risk, compliance, everybody— and said, what does an optimal framework architecture what would that look like to have an operate 24/7 operations capability to support your discipline? How do we build a standardized framework and language so that you could start with alarm monitoring and eventually move that to travel risk monitoring, supply chain, cybersecurity, you know, and, and, but you have a common, common construct, common understanding that will ultimately facilitate for the providers to provide a modular ops architecture so that you can actually do that, you know, through their technology. That's the goal of that effort. And then anybody that's interested in jumping into the working group, and we're going to meet at GSX to kick it off, would definitely, you know, if you bring something novel or interesting experience or just curiosity, Yeah, bring it on.

Put my name on the hat.

All right, man. Well, thank you.

Thank you again. Uh, this was a wonderful conversation. I think we can do it for much longer, but again, thank you for your time. For our listeners, listeners still, uh, until next time, stay informed and stay secure, and we'll see you on the next Check Point.