Building Companies, Culture, & Cyber Offense and Defense in the Age of AI w/ Ron Gula

We are live. Ron, it is so it's such an honor to have you on Noise to Signal interview series. You have been a founder, you have been an investor, you have been a board member, you have been a philanthropist, you have been a mentor and a coach for hundreds of startups. And you know, you talk extensively about your early days, your early days at Tenable. One thing, you know, at as I was preparing for this interview, I've been listening to a lot of your interviews. And you talk extensively about your early days of

and how you created tenable, the journey of Tenable and so on and so forth. But one thing that rarely gets talked about is the culture that you created in the early days of Tenable. And as an employee, I experienced it at Tenable. And so I want to start the interview there. was, you know, you this was your second startup if I'm correct. And I I'm curious if the the cur the early culture of Tenable, was it organic?

or was it intentional the way you did it? Because there are two anecdotes I want to share from my perspective, but I want to get started with the f the the way you created Tenable in the early days, the we experienced it. what was your thinking behind the culture that you created at Tenable?

Well, hey, it look, it's a pleasure to be on the single sign noise to signal podcast. Very proud of what you've done, you know, after after Tenable as well. I wish you a whole lot of luck with your with your new startup. But but look, the culture of Tenable

Yeah.

Thank you.

You know, we we I got lucky, right? I was surrounded by great people. So my wife, Cindy Goula, Jack Hufford, Renaud Darrison, they all brought a lot of different perspectives about how to take care of people, how to have a culture, how to how to grow things. But I gotta tell you, I mean, I I was in the Air Force, I got to experience leadership and command from a lot of different things. And I kind of said, I don't really like that. I kinda like this, I don't really like that, I kinda like this.

And then, you know, I got to go to the NSA and again see different leadership styles that some things I liked and I didn't like. And as we went through through through through the career, you know, Cindy and I had the benefit of starting a smaller company, Network Security Wizards, that made the Dragon IDS. And that was over a pizza shop, you know, and we eventually sold that. So a lot of this, how do you take care of people?

When the products, you know, selling and bringing bringing stuff in. We were very, very lucky that we always made products that people wanted. And they say, you know, you can't products don't sell themselves, but when you're making money from customers, you can put the customers on a pedestal and basically enable your employees to support the customer. And there's a big trust factor there. So

You know, today in 2026, you know, some of the things we were doing in the early 2000s, I think a lot of companies do, taking people to the movies, you know, during work hours, for example. you know, doing an all-hands meeting with everybody. And, you know, today with so many remote people after COVID, it's tough, but

You mentioned a couple of things, you know, Cindy and I, we would get the donuts and the visibility of seeing us carry that stuff in. I think people say, you know, leader servant, you know, all that kind of stuff. But we really tried to just kind of make sure that the employees were there.

You live you both lived that you both lived that philosophy. And I think the thing I want to say, you and Cindy were a great combination. And I say this with all the love because you were much more Cindy was very strict. So I don't know if this is like a bad cop in a good cop kind of thing. Where Cindy Cindy was the most warm motherly figure that you could have in the office, but she would also be very strict. She would always be strict and you would always be very

Open your office door was always open. You could always walk in. Hey and Ron, I just had a great idea. So it was a great combination. And there are two things that I want to share. And as as you said, right? You we would have this breakfast, Friday breakfast, we would have Thursday lunches. Everyone was in the in the office room in the cafeteria having lunch, and we would stay share stories and whatnot. But you know, I want to share like two stories from my days at Tenable and how I experienced it as as an employee. And this was like

The this was like the worst time in the from from an economic point of view. It was 2008. The mortgage crisis was in full bloom and all the organ all the companies were firing people left and right. I was still I was still very new to the company. And my wife had gotten residency in New York. so I was essentially traveling back and forth. Friday evenings I would fly drive to New York and then Monday mornings I would come back.

I would drive down and obviously, you know, some days I would get late for the early first Monday morning meetings. I would like, you know, my eyes would be red, bags under my eyes, and and obviously and and there was a sense of fear that hey, I don't want to tell this because people might perceive this. Hey, is he maybe he's going to New York, so I didn't tell this to anybody, but the word got out and you came to know about it. You came to know about it that Mule has been traveling up and down every weekend, he's been doing all these things.

I thought you were just coding, you know.

And then one fine day I get a tap on my desk from you. You know, it's a Friday, you get a tap. Hey, I just listened, I just heard that you've been traveling up and down. And I'm like, my heart is a bit th is throbbing. What the hell? It's a Friday, what's going to happen? And you come and tell me, Hi, do you want to work four days a week? Just work just work an hour, you know, two hours every day more and just take Friday off. And that was

I was just blown away by it because here's the CEO. He comes to a junior, I was a very junior engineer. He comes to me. Hey, I just heard about something that's happening. I was like, you know, it was very impactful in that moment, in that crisis. Because if it was, you know, if if if it was a normal time, and no one would have cared. But this is like everyone was laying off people. But here is a CEO, like, hey, my employee is struggling, let me see if I can do something. And so I didn't take up take you up on the offer, but it was very impactful.

And and so this is like from a you know for a leader taking care of the employee. The second aspect I want share is this is before this incident, but you would tag me along for these dinners with prospects, right? You know, I was single, I was not doing anything in the units. You would come, hey me, what you what you're doing for dinner tonight? I was like, nothing. And you would take me to these prospect dinners. And this was the time when we were selling twelve hundred dollar Nessus feeds.

We were selling $1200 in Nessos feeds. That was my majority of our business. And there was this prospect who was convinced he has to buy passive volume scanner. And I don't know why. And it was probably a $10,000, $15,000 deal. Not a big deal, but maybe you know, 10 Nessa subscription. You know, so it's just significant enough for us to, you know, warrant attention. And the guy was convinced that he needs to buy PVS. And you realized for whatever reason that he doesn't need PVS. I think whatever he had.

is good enough. He doesn't need to buy PBS. And the guy kept and during the dinner, the guy kept convincing you, hey, I need to buy this. And you're like, no, no, no, you don't need to buy it. And I as an employee was wondering, should I just jump in and say, hey, we'll take the deal. Let's have dinner and then go. But the point the point I want to make is you also didn't like one is you obviously took care of the employees and and the culture, but then you're also very you're not trying to sell things customers didn't need. So you're also very

customer focus in the sense that you are not trying to take get more money. If if there was a genuine need you would sell everything and anything they would want. But like it it both these incidents were very spoke a lot about your your character and the company that you are building. I'm curious if you have any thoughts on that.

Yeah, look, I appreciate bringing up both of those stories. And you look, I'm just gonna say, look, I was I was lucky, right? I was surrounded by really good people. We had enough revenue from customers that we didn't have the stress of having to fundraise and

Yeah, we're still managed cash flow and stuff like that. But basically, you know, when you talk about giving you a day off, or working fours, you know, that kind of thing. In the early two thousand, that was like progressive stuff that's very modern right now, especially after COVID. So things have really, really changed. But it the CEO's job is to remove barriers for their employees, whether they need a a tool, they a policy change, you know, something like that. And it's so hard. I mean, I think back in the day we were two hundred people, you know, which

You could get everybody into one room at that point, but as soon as we got to three hundred

I remember going to a movie theater for an all hands meeting. I don't know if you remember that. We fit tried to fit we booked the whole thing and then everyone was in there.

And we really, you know, we really tried. So for example, when we went on these sales calls, you know, typically you go with a salesperson. If you're gonna bring the CEO in, there's probably a salesperson who set that up.

And I always had a policy events. Most of our research team, the people who wrote the vulnerability plugins and stuff like that, they were very distributed. So Renault was always super concerned about you know, how do you get culture with these guys? How do you get them together? So we did some, you know, all hands with those kind of things. But I always made a point if I was doing a sales call in St. Louis, who from Tenable was there? Is it somebody in support, somebody in and bring them to meet a customer, right? So that was very, very important to me.

And on the other hand, you know, you talk about selling stuff to customers, and of course, we invented so many things at Tenable, right? If you look at the career of just having to span from scanning a network all the way to auditing SaaS and cloud apps, and you know, of course, Tenable's continue that with AI auditing now and whatnot. But every year there was a new technology. So the question is, what do the customers actually need?

And I felt like Willy Wonka, like we were coming up with so many things that were ahead of that curve. yeah. And I think you were right saying, look, the customer probably needs more coverage. we had a major customer that didn't buy. So you you mentioned the passive vulnerability scanner. So imagine for people who don't know this, a sniffer, like a network intrusion detection system that gives you vulnerabilities. It's real time, no impact to your network, that sort of thing. And it can that can be a political problem because if your your job is to scan for PC.

violations or federal regulations and a sniffer can find it in real time. Boy, that's that could be a big problem. That might have been the reason I was holding back a little bit on this, on this guy. But yeah, it's great to have things that people want and try to sell that, but the customer comes first. That's why the whole thing is is so we had such a good time with with the customers.

I'm curious, you know, I never experienced any turbulence at Tenable in the early days. Was it always like that or were there was it always smooth sailing or were there chan ch were there scenarios where tenable, you know, where tenable would not make it?

Yeah, so like like like now Goolatech Adventures, we're involved in almost fifty companies more because we're also involved with funds who invest in companies and we're kind of entangled with those things. So we we're we we can easily say we touch a hundred companies. So we've seen amazing success with poor CEOs, we've seen or founders, right? We've seen great founders that we think are great have poor success. So that there's really no way to predict those kinds of things. But for Tenable in particular,

You know, we had great success and you know, I don't think I ever got angry and yelled at anybody. We had to terminate people who didn't, you know, perform and w I I always felt we were slow to kind of make those changes in hindsight. but it was, you know, I was pretty happy with the culture and and and and doing things. And look for we still live in Columbia, close to the Tenable Headquarters. So we'll run into people who are are there.

And we hear about the culture and the effect and you know, Ahmed Uran, God rest his soul, you is doing doing a good job of mate maintaining that. Steve Vince is doing a good job. He was there, you know, seeing those kind of things. So so the the the the the point is is it's kind of hard to put your finger on what culture really is, but man, we we we got lucky with hiring good people.

Awesome. And Ron, as I was preparing for this interview, I obviously listened to a lot of your interviews. And one person that shows up extensively in your interview series is Viron. And V Ron is the virtual Ron. And you obviously you are a very prominent public figure in cybersecurity. You have a lot of thoughts you want to share, but you cannot share because you're public, you have a public profile. I'm curious if V Ron is the Larry David version of.

real Ron from Corvier Enthusiasm because V Ron is unfiltered. so I'm curious what is the thinking behind V Ron? and yeah, I would just start there.

So, you know, during COVID, I wanted to do sort of a Joe Rogan podcast with you know, sit people around the table, in-person, microphones, and and we did a lot of those. I think I did maybe, maybe 50 of those interviews. And I got some fairly senior cyber people from, you know, DHS on the show, Cyber Command, and it's and it's it's interesting. But, you know, what happened is I I'm gonna say I got briefed on

Okay.

Okay.

The typhoons before they were kind of public. This was really just China hacking into routers. And I wanted to visualize that. And this was before you can just go to a prompt and say, show packets flying around from China and stuff, stuff like that. So I taught myself 3D animation. And we also do a lot of videos on entrepreneurs, how to give advice for startups. And I was like,

Yeah.

I really can't say that I have a founder who did a really bad job on a panel, and here's how we should all listen to it. Or I would never, I would never do that. But at the same time, you know, if I say I was at this conference and I saw this panel, like I didn't, you know, it's pretty easy to kind of triangulate who are who I'm talking about in our portfolio. And believe me, that's a private conversation I want to have, but I'm also trying to be public about it. So I found out I can do animation with characters.

I see.

And I did a bunch of animations. And if you go back to like the early videos, it really looks like early Pixar type stuff, right? Because I was learning how to do animation and stuff. But the animation technology has progressed so much.

my, yeah.

I created this V Ron character that I can literally like right now, I've got Claude working on four or five scripts for for V Ron. You know, the Pope just came out with an AI ethics thing. I read, I read the first half of it. I'm like, this is great. Go write a script on this, make all the imagery, do that kind of stuff. So could I do that in person? I could. but I'm really getting a following with the V Ron stuff. And then for the stuff that I can't really talk about, for example, you did a great

Interview with Brian Martin, right, the vulnerability historian, right? It's really hard for me to come up and just basically say Sis is not doing a great job, or the White House is not doing a great job, or this policy should have been here. But putting it in animation, it appeals to more people, and I can also do comedy with it. I have a comedy guy called Gary Sinfeld.

Yeah. Yeah.

He can do humor, whether it's people like canvas getting hacked during finals week. You know, that's the kind of stuff I can do from a humoristic point of view. That's not me pointing the finger, still kind of raising awareness of this stuff. So I'm finding a great deal of enjoyment and following using the 3D animation. Plus, it gives me first hand experience working with AI. What can it do and what can it do? How good can it go on? So, yes, I appreciate you bringing V Ron up. I thought about a way to bring him on this show.

show but we'll w the technology's not there yet. It's coming.

No, but yeah you're when I we when I listened to the Brian interview, Brian Martin's analysis interview, I was like, whoa, is this who is this say is this Ron saying this or is this we Ron, right? And I'm I'm curious, do you prompt it in a certain way to guide it? This is these are my opinions and I want to say

Yeah. I I absolutely. So, like for example, the the Pope being Catholic, I'm gonna read that script very, very, very thoroughly before I even try to record it. Whereas, for example, with your interview with Brian Martin, I wanted to get the best, most controversial stuff and make sure that Viron wasn't like saying, This is good, this is bad. It was just he's just factual saying this is what Brian Martin said on the inter interview.

And you know, kind of leaving it at that. And and that's it gives me a lot of ability to kind of just put that information out there. At the same time, you know, when the White House comes out with an executive order or a finding about, you know, what they're dealing with China and stuff like that.

You know, I can also use V RON to do that and not necessarily look like I'm politically supportive of of of of this administration or the previous administration. You know, I I really just try to be independent and doing doing that sort of stuff. So it gives me a lot of latitude to go and and test content and put content out.

Have you?

Have you gotten pushback for some of the commentary from Hero or is it like always free, you know, al

No, the only you know, I mean, look, don't if you ever have a channel, don't read your comments, right? You know, there's always somebody who's who's saying this or saying that.

you know, look, AI pulls lower than the White House does right now. Like people are very concerned. Cause I'll so I'll get, you know, for a video that gets like a hundred thousand views, I'll get a clank or shut up clank or comment, you know, something, something along those lines. And I think that's funny. And it really I I really feel like I can, you know, also experience what people are experiencing. Cause some people just don't trust AI. They think it's gonna take their jobs, they think it it could be full of full of errors and stuff like that.

So it's it's again that from a social point of view, it's a really interesting thing to get involved in.

I guess. So, Ron, let's switch to your time post Tenable. you know, you've been in one of your biggest contributions post Tenable is venture investing, coaching, mentoring, startups. I remember when when Tenable did its first series A, it was a fifty million series A, one of the mass one of the biggest series A at that time.

And I remember you were bootstrapped for an almost a decade or so. Tenable didn't take any venture money in those days, to the extent possible. I'm curious how has and but now 50 million series is not a big deal. But in those days it was probably the top 10 venture series A deals of that time. But now series A you know Tenable probably had thousands of customers.

And millions of dollars in ARR before it got before it got to 50 million series A. But now you could have a sub-1 million ARR and still get a 50 million series A, or sometimes even a hundred million series A. You just put an AI on top of your company and you're like, boom, this this, you know. I don't know if you saw the the shoe company, the Allbirds. And they they put AI in their name and they it went off.

I'm curious, given your deep experience in venture post-tenable, how has that business changed from your point of view, the way you see it?

Yeah, so a couple a couple comments there. So tenable, we were extremely successful with, you know, generating revenue, supporting customers, just hitting the market at the right time. And when we raised those rounds, the $50 million round, the $300 million round, not only were they record setting at the time, but they were direct.

Secondary sales. And what that meant is that money went to the employees. Typically, today, if you're a million ARR and you see a headline, hey, somebody raised 20, 30 million dollars, that goes on to the balance sheet of the company, right? There might be a little bit of secondary sales for the founders, maybe some key people. But with those rounds, we had that experience of bringing employees into a room and saying, this is what's happened.

you might have enough stock to buy a house, pay off your s your student loans, you know, become a millionaire, right? We had a range of people that were that were doing that. And very, very, very unique. And with that experience, when I talk to founders, when I talk to startups,

I'm always imagining how this company going to exit. Is the founder prepared for the financial management of becoming a millionaire? Are they prepared to guide their employees to do that? It's really tough because if you're a crappy founder and you're just greedy and you have a lot of equity and stuff like that, you know, an option pool or something like that for your employees might not be that inspirational. But if you create a company that's worth, you know, $500.

million dollars and the employees have 10 to 20 percent of that if you include the founders and stuff that's a significant amount of wealth creation and a lot of founders kind of miss that opportunity to kind of say there's ways to exit before you know you're super super successful or before you have to raise two or three more rounds, right? When you see a company does a series A, a series B, series C,

Boy, maybe that company's great and they're making money and increasing value at every step of those ways. Maybe they're doing these are dilutive rounds. It's hard to say sometimes, you know, what is going on with some of these companies. again, I can't name names, but you know, there's a company I passed on. Yeah, really. But look, there's a company we passed on. I said you're never gonna be able to raise. Within a week, they raised $30 million. And then guess what? Three years later, revenue is still about less than a million ARR.

Maybe a V maybe a V Ron episode.

I see that a lot in this industry. And that's the kind of thing I want founders to avoid, right? If you're raising a dollar, you better be putting that dollar to work and making at least a dollar from your customers, right? Because

I can if you can take a $20 million investment and turn it into $2 million of of of of revenue and you still need more money to pay for your company, that's not a successful business. And and I'm always reminding people, you know, put the customer first. You have to have a product that people want. And then look today with AI, what I'm telling people, whatever you do is almost irrelevant because you can make it with AI. So it's more important to engage your customer.

support the customer, perhaps even merge what you're doing with other people who have similar types of customers so you can create value. You can't use a prompt to create customers. And that's going to be the biggest thing differentiating startups now, into the next couple of years. Do does anybody really care about what you're doing? And that's that's kind of where we're at right now.

What happens you know, you bring up an interesting point in the sense that you can literally create anything you want, right? And you know, you could there is there is there is a feeling, hey, I can cloud cloud code my way out of this. And I've seen this in our discussions at Contro as well. Hey, why can't I cloud code these things and so on and so forth? And the reason typically founders go and raise is because they need, you know, they need to hire, they need to do sales, marketing, and so on and so forth.

But a lot of these things could be automated or you know, the the need for hiring is not as much. So the re need for hire raising a bunch of capital is also not that much. So what happens to in the age of AI? the n what is the role of the VC? If the the capital needs, I mean, unless you're like training big models, you'd obviously need a lot of capital, right? If you're building data centers, you need a lot of capital. But if you're building software,

you don't you probably don't need as much capital. And I've seen like you know, you know, in the competitive competitors in my space to raising forty, fifty, thirty million dollar rounds. I know why why are you raising all that money? What are you going to do? Going back to your point, to if you make, you know, if you take a $30 million investment, you probably need to make 300 million, 400 million, you know, or get to that scale. So what happens to this venture side of the business when the ca need for capital is not as high.

Yeah, so it's a great question, right? So, you know, I have this thing called the five-side pitch deck, right? What problem do you solve? How do you solve it? Show me some proof. What's your ask and what's your victory conditions, right? And we invest in a lot of different companies, right? Some people in our portfolio are primarily doing business with the Department of War.

Some people in our portfolio are doing business with with the the consumers, right? People who have phones. There are apps on phones, you know, that sort of thing. So the go to market is very, very different for those things. The ask might be, gee, we need to do a lot of marketing to push our app, our thing, on this consumer thing, like the Apple iPhone market, you know, that kind of stuff. maybe the ask is, look, we have a great product, we really need a human sales force.

you know, maybe the ask is, hey, we actually have a lot of engineers, but they haven't been using AI. We need to transform this process into an AI first, you know, engineering teams. I'm seeing all sorts of changes going across out there. we have a company in our portfolio. Again, I don't really want to say they were doing a lot of what I would consider services, and they had a wide variety of scripts that were used in these services. And now they are bringing all that into a unified kind of SaaS platform.

That's, you know, can could they do that with their budget? Do they need to raise? In this case, they're doing it within their budget, their cash flow. So they're they're fine. you know, the other thing to think about is, you know, coming out of COVID, coming out of some of the the economic downturns we've had a couple years after that, most companies what I consider are their steady state. They're basically cash flow neutral. Maybe they're growing 10%, 20%. That's because they had to cut.

Yeah.

And and do that. We've you know, we have some of those companies in our portfolio. Most most cyber funds companies like that in their portfolio. What do you do in that case? My advice is like, look, you can raise, but maybe it's not at a term that you like, you're gonna have to give up too much if you're a company. So you need to do things to increase your revenue. I you know, one good example of that in our portfolio is we have a company called Threader.

And they actually bought, you know, the highest DNS security business. So now they can do inline blocking with a hardware device and secure DNS, which just, you know, they got some customers with that. That is the model what I tell companies who are trying to grow. Put your customers first, try to do MA that's gonna make you you know, a bigger, a bigger base of customers and offer something that complements your product.

On the on the on the topic of MA in maybe acquisitions, you have you know listened to your interviews where you say you see these big numbers coming out. You know, this so-and-so company got bought for five hundred million or a billion, but the founders actually didn't make a bunch of money. It was essentially some kind of financial engineering that happened behind the scenes. And I see this all the time. There is a perversion of there is a sense of perversion of capital in the sense that

l the companies like the companies that you build, like you know, product first, customer focus first, you know, let's get to ARR, let's build a a proper business and then you know get to a point or get to an IPO. I see less of that and more of hype. There's more of a lot of marketing hype. Let's go and you know get our pictures in front of Nashdaq and and

we you know make a very splashy news event and and then it get acquired for four hundred million or three hundred million but it is essentially the the money is just exchanging hands between investors rather than the founders or building a proper company. And my co-founder Sasan experienced this at CrowdStrike. He was do doing a due diligence for a company and he was the head of engineering and product and he passed on. He said, hey guys this pro product doesn't work, not functional. There is no way we can use it here.

Two weeks later company bought for three hundred million dollars. I don't know what what you have to say on this, but you probably experienced this from your point of view as well. Right? Do you do you think there's a version of

Yeah, so it's it's kind of hard to relate because most people are not founders. Most people have not done what you've done, which is you've you said, I'm gonna take a risk, I'm gonna start a company and and and and do it. And soon as you start a company, you could be on a track to sell the company for a headline amount, $100 million, $300 million, $30 million. It's crazy that that you can do it, but but the story is look, 99.9% of the companies never get past $100 million in revenue.

They either go out of business, they get acquired, they just can't grow. And and so it's that's a really difficult

it's a really difficult thing for people to get their their their heart eyes around. And if you're gonna incentivize somebody at a company like that, you're also competing with Google and OpenAI. They're throwing around salaries big enough that if you gave somebody 1% of your company and they work for you for like five years and you're sold for $300 million, they might take home the same amount of money working at Google. So it's it's it's a really interesting thing. What's changed though is the advice. I used to tell entrepreneurs that.

Yes.

Look, once you build the technology, before you build your business, you have an opportunity to sell. And that might be the maximum amount of money return that you will ever make for you and your employees. And it's just crazy because you might have no revenue yet. But if you have a unique, defendable set of intellectual property, a thing that's really hard for somebody to duplicate, they might, somebody might buy you for a lot of money, where the founders might still own more than 50% of the company.

You do a couple rounds of fundraising though, founders are diluted. Maybe you don't get the best deal going forward. Maybe you get this amazing deal. It's it there's there's all sorts of stories out there with with this. But with AI, I've said, look, whatever you're building right now, it's tough because

somebody at Cisco, somebody at you know, Microsoft, whoever these acquirers are checkpoint, whatever, somebody's gonna be in there saying, I can build the same thing that that just give me a give me 10 weeks, right? Give me whatever. And that's a tough that that kind of upsets that. So now my advice for founders, get some customers. Like you can't just have technology. You've got to have customers that are using it and paying for it and are happy for it.

Ron, you give a lot of advice on startups and one of your one of your best or most prominent videos is the five slide pitch deck. You know, you said, you know, what problem are you solving? How are you solving it? what are you going to do with the money? what proof do you have? And then what's your what's your vision for success? It's pretty straightforward, pretty self explanatory in understood. But not many people

are internalizing it and they still I mean you probably s even now see pages that are all over the place, right? from your perspective, what are some of the common mistakes founders are making? Even after you I think you promoted this for over four or five years now. It is it has been

Yeah, and we we did it out of a little bit out of frustration because we would get pitches from companies and we couldn't tell if it was a nonprofit or a commercial company, right? It's especially it's i if it's kind of fuzzy. Cause at the time we were doing a lot of these competitive grants for cyber nonprofits. And you would see somebody who has a cyber training for maybe veterans, and we're like,

Yeah.

Is that a commercial company? Is that a nonprofit? It was so, you know, the big point of the five slide pitch deck was to get to a no or a yes as quickly as possible. Because a lot of these funds, people don't realize that when you're in a meeting and somebody says yes, somebody else at that company has to go tell your story. So if you've got 30 slides and they're telling a different story than what you're telling, it's probably not likely you're going to get a fundraise, you know, from from from from from that.

That company. Now, a lot of the mistakes people do is they put other things in there. Like they tell me how big the market is. They tell me that they've got four advisors on their on their team. Like those are details that are going to come out after, you know, there's a transaction. You don't need to lead with that, right? And then sometimes people are like, like, I literally got, I I I don't want to say names, but I got I got I had a a female CEO, founder, who said, Hey, so-and-so invested our company. Would you want to invest?

Yeah.

That's a tough, that's a what what do I do? Because if I say no, it might get back to the the the person who's a prominent person in the industry that didn't want to invest. But that's not a reason to invest in a company. So you're putting me in a tough, tough thing. And then the second thing is, we just close three customers. You know, do you want to do you want to meet us? It's like it's still, I still don't know what problem they solve. Is it competitive with any of our portfolio companies? That that sort of thing. So I need to know as much as possible before we even take a meeting. And it's the same across all.

the other funds. Like a lot of time people don't realize that most of these cyber funds, they talk to each other. And if somebody passes on something, it's not necessarily like your blacklisted or whatever the right phrase would would would be. It because somebody out there is gonna want you to like this is one of the big things we started Gulatech Adventures, because we, Cindy and I had invested in all these funds. And you know, we had some opinions on what founders were investable and what markets were investable. Some of those companies didn't or some of those VCs

Yeah.

yeah.

didn't like us. So we said, look, we should go start our own fund and and do these things. So there's so much talent out there, but there's also a lot of people who can talk themselves out of or investing in a company.

I think.

And are are are you still seeing the same kind of mistakes that you saw in the early days of you know five slides pitch day where cust where the founders come in with, you know, hey, so and so invested in my company, you should still invest. or are there other new kinds of problems that you're seeing? Because the the thing I wanted to touch upon is the thing I wanted to touch upon is because building companies in the age of AI is completely different. And you've talked about this in your in your interviews where

Well it's

And the thing the the line that comes to mind is there is no easy exit in the age of AI. There is no easy exit in the age of AI. so I want to touch upon that aspect of it, like how does building in the age of AI change?

Mm-hmm.

Yeah, so the the the big thing with the AI is if you're building your technology on AI, you know, you might be building a great product, but you're dependent upon that AI. Who what's who's got the real innovation there? Who's got the intellectual property?

If you build a cyber product and you're talking to Cloud, you're talking to Anthropic, talking to OpenAI, talking to Gemini, whatever you're talking to, if that is your core IP, you're more of an integrator than you are an innovator. And that really gets people frustrated. But we've seen this pattern with the cloud. You know, so if you write your own, for example, your log analysis tool, your your parsers, your your you know, whatever.

Okay.

They gotta run somewhere, but if you build everything on Amazon to the point that you use all of their APIs, you might be able to come to market really quickly.

Yeah.

I tend to think you're also an integrator. You know, you're really dependent upon the pricing of Amazon, the, the, the, the fluctuations of Amazon, their technology decisions. And we've seen cyber companies that are all in on Amazon and guess what? They're stuck there. They can't go to Google. They can't go on-prem. Because if you're going to get big, whatever your product does, you got to have an MCP interface for it. You have an API for us. Your GUI has to look nice. It's got to work in a container. It's got to work in an appliance. And and

And by the way, you know, if I'm a no Amazon shop, I gotta be able to move that to Azure. So you have to do all these things as a as a as a startup. It's really interesting to figure out that impact. I I just, man, it's tough. I I I actually had a company pitch me, they claimed that they're doing an AI thing that's somehow better than Claude and Anthropic, but at the end of the day, they're wrapping Claude and Anthropic. So it's like you're even then you're still dependent upon these things. So

Again, what problem do you solve? How do you solve it? If if if you're leveraging AI to solve that, man, I don't know if that's an investable company. And that's controversial for a lot of people.

Do you think the the c you know, you mentioned the cloud transformation where companies went and integrated with Amazon and then they had to go with Azure and so on? Do you think the the AI transformation is similar compared to or compared to the cloud transmission?

Absolutely. It's absolutely similar. And so, like, look, look, if you're building your product and your engineering team is using anthropic, using I mean perplexity, you're using whatever, whatever, you know, cursor, whatever whatever people are using, look, that's great. At the end of the day, though, if your actual product, the thing you ship, is dependent on anthropic for its core value.

What's the barrier to entry for another company to come in and do that? So and then how do we even value that, right? Because you're really a rapper for anthropic. If you're a wrapper for anthropic, it's you're like I said, you're an integrator. You can make money, but it's almost like you're in the services business. And and that's that's kind of the way I look at it. Now, we've invested in some companies that are very dependent upon anthropic to do certain things, but

Hmm.

The people who are using that are doing things we have, they're very first. They're they're they're it's the first of their kind, you know, kind of kind of thing. So we have an animation company that's powers v Ron. You know, that's you know, they have so much IP on top of that. Yes, they're dependent upon anthropic, but they're also dependent upon 1111 labs for you know for voice, they're dependent on other things for for you know, do doing types of analytics. My point is.

If you are a wrapper for multiple services, you can probably create value. And I've seen some companies do this in cyber. I'm seeing people do it in healthcare. We have a healthcare investment that's in stealth right now. They're doing some amazing stuff with their own technology and with anthropic. So it's like the what do you problem you solve and how do you solve it? It becomes very easy to say, hey, that's intellectual property that the customers are going to buy. And someday somebody might want to own it because it's very, very unique and hard to reproduce.

But Ron, it the the the kinds of companies that will get created out of AI will by design be AI native. For example, when iPhone came out, that created the Ubers of the world. without iPhone, Uber would probably would not exist. So the the new companies that come out, they have kind almost AI is a substrate layer where the reasoning and the thinking this was simply not possible before.

Most of it was very rules based. You could you had to code every aspect of your business process and so on. So my sense is these kinds of company, the new kinds of companies, AI native companies, will still get created bas built on this substrate. I mean, they could obviously be seen as a wrapper, but obviously they have to build their IP. My question is, how do you then expand? How do you then grow the companies in this AI native world? Is this because the historical model was land and expand? You land in with one.

product, one solution, one niche, you go in, I'm gonna solve this for you, you get that, you make that customer happy, then you expand to the adjacent, what else can we do for you? And so on and so forth. So is land and expand still a viable strategy for startups in the age of Aeon?

So I I I I think it is. So the the question really is what problem are people solving? And and when you mention AI, people are like, we need AI guardrails. Well, there's a lot of companies doing that. There's a huge gold rush of companies that are saying we can control or detect how you're using AI. My my issue with these a lot of these companies, we haven't invested in in a lot of them, we did someone I'll talk about that in second. But my issue with a lot of these companies, there's so many ways to interact with AI.

Because

Trying to say you're detecting it all or or stopping it all is really tough, right? If you have a BYOD computer, you know, Microsoft might put copilot right on that computer, right? you know, can I go to the web interface and interact with Gemini, you know, in my private Gmail? You know, that's there's so many different AIs that that that that are out there. It's interesting. how do you want to detect it? How do you want to enforce it? One thing that's really interesting though is for people who write their own LLMs, it's a completely different conversation.

Where was the data at? Is the data good? Is it clean? Is it sovereign? If we're gonna spend a half a million bucks to train a new LLM, what happens if it comes out and we forgot to put this guardrail and we forgot to do something like that? So this type of interpretability, I think, is the future because people don't really want to rely a hundred percent on anthropic for core decisions, right? They don't want to rely on open AI. Now, now some companies will, but if you're Citibank,

maybe that's not good enough. You have to maybe train your own LLM. And this is a whole new world of doing things like that. We have an an investment in a company called StarS here. They literally can take an LLM off a hugging face, make it faster, you know, add guardrails, add add that type of thing. And the the the technology is called the interpretability of that.

Again, it's different than using AI and trying to police it versus creating an LLM and trying to change it after. But those that's kind of how I see this this industry right now.

Do you s do you think the do you think the you know, for example in cybersecurity there's a lot of s platformization. from an end user perspective, they either go to Palo or CrowdStrike or some of these and I think there is I see a parallel of that emerging enthropic

Gemini and so on. So one way to look at this is all these platform companies will either bake that capability into their product, like you know, this feature, you know, whatever startup you're building becomes a feature in their product, so they they buy it, or the other way to look at this is a startup expands, does does something new, expands, and then you know builds the new.

platform that is going on. And I saw this with the CRMs of the world, right? Where you start with like one use case in the like the HubSpot, you start with one use case and then you know you expand, expand, expand, and you serve a lot of these customers. Do you think there is do you think the platformization and the value concentration will go into like these big companies or there is room for smaller companies to evolve and then make a you know make something successful out of

Yeah, so we did a couple of videos, live videos, not V Ron at the beginning of year. And and one of the things I I talk about in sort of these predictions of what's going to happen over the next couple of years is indeed this platform platformatization, right? So one, everybody's gonna do everything. Now they're either gonna be acquiring other people or they're gonna be building it with AI.

Yeah.

And you know, what does that mean? Well, you know, is CrowdStrike gonna be able to do vulnerability auditing? They already do a little bit. Can tenable detect malware? Well, they've already been doing a little bit of that. You know, it's gonna get interesting to see what these companies do to expand what they do for customers. And this goes back to your land and expand that. But the second thing is like, look, this is a good thing. If you have a platform company, I don't care if you're checkpoint, your CrowdStrike, you know, I my favorite question to ask sales engineers is like, what percentage of the NIS cybersecurity?

Security framework, do you cover with all your products? And increasingly, it's like the answer is like 80%, 90%. and if you're an MDR.

You're or an MSSP, it's 100% because you know, all of these services that you're offering are kind of kind of interest interesting. So I think what's going to happen next is that you're going to have this ability for somebody to say, I not only have instrumented all of your network, but I can compare that to all these other customers I have. Checkpoint's got a lot of customers. Tenable does a billion dollars in revenue, right? CrowdStrike's got a lot of customers. The point is that if you can instrument an enterprise, whether it's a small business, a large

Enterprise with your platform.

you can then really start making some decisions about what is a real threat? Do I have a control in place? You know, do I have compliance issues? And you can give that feedback to the CISO. And I think in some cases, if you put AI on top of that, you might replace the CISO. So I actually said, you know, CISO's watch your back. So my third prediction, I think these companies are going to come in and say, look, we can not only can we platform what you're doing, but we will be, you know, we will do everything. We're going to make these decisions for you.

Why? Because we've got AI, we've got all these customers and that sort of thing. So platformatization, even though it's going to look where the cyber industry is going to look like the auto industry in about four or five years, it's going to be a good experience for the customers. It might be a bad experience for people in cyber, you know, because if they're not going to be needed at these companies, where do they go? Maybe they go to CrowdStrike, maybe they go to these other MDRs, but we'll see what happens. That's that's where I think we're going as an industry.

If that is the case, how do startups build modes in the age of AI? Because you don't have the data, you don't have the customers.

They gotta have customers. This is why I'm saying what you build is interesting and unique. That's cool. If you can't attract customers and grow your business, you're not going to be relevant. And that's why I say, look, if you do this niche thing, because that's that's one of the other issues with cyber, we've been around for a long time. You know, there's new patching companies, like we're investors in Automox, but patching's been around for a long time. You know, there's there's there's a lot of CI CD companies out there, there's a lot of EDR.

And

Lot of incident response companies, right? So if you're gonna do something in that space, it becomes very niche. You know, like there's you know, companies that just they're starting to do incident response on phones. That's kind of cool. It's also very niche. Like there's not a lot of demand for that. So my point is if if you're gonna do something, it's gotta be defendable, it's gotta have something that people want. You have to answer every one of those five slides pitch text. If you can do that, you're probably gonna be in good shape.

One thing you touched upon is the job of a CISO getting replaced by the service companies. My question is to you, what is the future of jobs with AI? Are we seeing a situation where service offerings will take out full time jobs, even the CISO?

Yeah, look, the way I look at this, if you think about a smaller company and they want to be CMMC compliant, they go to a a service like Drata, Vanta, or even like look, look, we're an investor in an MSSB called Bemo. BMO can get you CMMC certified if you're a Microsoft shop. They can do all the configurations, they can do all that. So

Is it as good as having somebody like you know Reliot or Arctic Wolf with your own SOC team looking at that? But look, if you're a 50-person company, working with BNO is probably state of the art for somebody of that size. But look, as you go up into small business, medium business, enterprise, large enterprise, Fortune 2000, Fortune 100, you're not going to have a one-click, we're compliant. There's no way. So those people are always going to have something like a CISO.

That has to do with policy decisions about data flowing, data training, partnerships. There's so much to do at that scale of a company. You're we're never gonna like not have a CISO at these Fortune 2000 companies. But look, when you go to these small companies, they don't have any cybersecurity right now. So they're probably gonna have it outsourced to that. Somewhere in the middle, there's gonna be conflict, right? Some people are gonna be like, hmm.

Yeah. Yeah.

Hey, instead of just outsourcing everything to this MSSP for monitoring or this MDR, why don't we do everything and reduce our staff? Maybe, maybe even get rid of the CISO. Like I can, I really do see those questions happening right now.

So what so what do you recommend to the CISO who is in the CISO chair today? do should they take like a front seat for these AI decisions or should they

Well, look, I've always said, look, there's a lot of great SISOs out there. And for some businesses, if you have a huge like there's some SISOs who have like 20 other field CISOs working for them, like those are large organizations, right? Be aspiring to be the CISO there is probably your your your career goal of doing that. But if you're a small business and you're in IT, like I think you should be aspiring to be, you know, the head of operations.

Even the CEO, like the sometimes security people know the business so well, they might be able to do marketing better, they might be able to do other things better. And I've always kind of felt bad that cyber people kind of say the the best job we can have is CISO. Boy, I think operations and CEO is a good job because if you're looking if you're CISO, you gotta touch everything. You gotta touch marketing, legal, you know, IT, budget. there's so many things that you have to touch in that business. How do our customers engage us?

Mm.

Mm.

If all of that's happening and AI is controlling all of that, who better than a cybersecurity person to be in charge of auditing that and running that, making those decisions? So I see the CISO role being replaced with what are the policies the AI is doing for our business and how it flows and how it works, you know, what apps we're using, what it has access to. The the the the cyber community is is are the people who should be running that.

So so do you recommend then the CISOs take a head on charge of all the EI initiatives that are happening?

Yeah, so what what I'm saying is if you're a CISO, you should be fighting to run any AI initiative you have in your company, whether it's exploratory, whether it's writing your own stuff. there's a couple of friends of mine at large energy companies. They literally are the CISO and the head of AI operations. And that's boy, that's that to me is the future. Now, I don't think that it's gonna last forever. It's probably gonna be AI operations in the long run. It's gonna subsume most of the cyber operations. but right now, and you know, if you're

Not lobbying for that role, you're going to be out of a job because I think your MDR, your MSSP, your vendor is going to replace you.

Interesting. Ron, final topic. Let's talk about the future of cyber offense and cyber defense. This is both near and dear to both of our hearts. you've obviously built companies around this. When I started at Tenable, the the the time and the cost required to build exploits was was hard. No, we had to learn IDA Pro, reverse engineering, figure out

Like for example, when these new vulnerabilities would come out, we had to spend like time, days to figure out how to exploit this safely and then write an SS signature for it. And now it is possible to write a f reasonably working exploit with a prompt. Hey, this is a CVE, this is the patch, what's the best way to exploit this? And these models are good enough to go out and

Give you an exploit. And we are part of, for example, cyber verification program. You can see this firsthand. These models are getting better at crafting the exploits. Or not necessarily like you know in terms of like weaponizing it, but you can still see how it is going. How can you if you're a skilled, relatively skilled attacker, you can now go from taking a vulnerability information and then going from there. So my question to you is what is the future of cyber.

Offense. What happens from here? What does the future look like from your point of view? That's the first question. And then the second question is how do organizations defend against this AI native offense that is coming your way?

Yeah, so look, that's like a whole hour conversation, right? But let's I I can summarize it pretty briefly. So one, look, we might elevate cyber command to cyber force. But if you said, do we have a civilian agency that's already doing offensive cyber?

Yeah, it's called the National Security Agency, right? We have another one called the CIA, right? They do a lot of offensive cyber. And do they support Cyber Command? Do are there's do they have the right titles? I mean, absolutely. And for the first time, you know, we've ever we this is this administration has publicly acknowledged we're using cyber in these operations, right? Whether it was Venezuela,

Whether it was the the the the bombing campaign in Iran, we're using cyber. What does that mean? Look, when you do offensive cyber, a lot of people assume it's just like direct hacking and and that sort of thing. And may you know, maybe there's some of that involved, but the tradecraft could be a lot more interesting, right? Do we have a human in the loop?

Working for us, right? Do we have the ability to deploy something? I mean, we there's an article came out yesterday, a parachute can drop a cyber munition and and and do attacking, right? So a lot of times people don't forget or they forget that in war, it's the entire triad of confidentiality, integrity, and availability. Maybe we're not hacking in and spying on people. Maybe we're preventing the email from being sent. Maybe we're preventing the email from being sent with jamming, with a physical attack. That's all understanding.

cyber command, special operations, and that sort of thing. are we gonna do more of it? Maybe. There's there's a couple of articles that have come out. I'm doing again more research for for for V Ron.

where they talk about look, most of these plans, if you're going to do a cyber attack on a facility, you probably have six months, maybe a year to plan for it. And and look, if you're doing a bombing campaign, it's very similar, right? We don't just like wake up one day and say we're gonna attack this country. There's plans way ahead of time, and maybe even training, you know, that goes with that. That's how the modern stuff works. but if you want to talk about defense,

Yeah.

And you know what that means in the age of AI, I think it means a couple things. You know, one, I think modern businesses have to realize that cyber hygiene, you need it, but you can't rely on it. If you can't patch fast enough, if your EDR doesn't have a signature for the latest attack, you're gonna have bypass. And if you're attacked by a nation state, your layered defenses of controls are not gonna prevent them, possibly not even detect them.

So what do you do? I think you have to invest in separate networks, whether it's an air gap network, a cryptographically separated network. but we have the technology to do these things, right? Whether you're a Zscaler or Show op using Tail Scale, like in our portfolio of something called Enclave. Can you take your core decision team and have a separate network that is literally separated from the internet?

From any content that might come in. Once you think about the internet, is that any content, whether it's a network connection, a packet, a file, that could be an attack.

So if you have the ability to segment that and remove that, you're much better off at being able to defend yourself from China, from Iran, from Russia, or possibly even industrial espionage. So I think these separate air gap networks, these separate cryptographically network is going to be something that people are going to use mostly to keep AI out of things. I want to make sure that none of this data gets to AI, but look, a byproduct of it is you're going to keep China and Russia out. People are going to be more afraid of giving up their corporate.

Data to the AI companies, and they're going to implement these things as air gaps. And the byproduct is China and Russia are going have a lot harder time hacking into them.

Ron, what you said makes sense for for the government, like the NSA. They've been doing offensive security for a long period of time. My question was more targeted towards like the attackers, the ransomware, as a service companies. You know, it was very difficult to create exploits to go in and you know compromise systems. But that equation would change with these AI native tools that would come out. So my question was more targeted towards that, what happens in that scenario? Less about a government focus.

Yeah, so look, it's probably gonna happen that ransomware is gonna increase, but it hasn't yet. As a matter of fact, paying per ransom is going down. The cost of a ransomware event goes up because you have legal, you have to, you know, notify your customers and you have to do, you know, s understand all the recovery stuff. So the cost of a ransom is going up, but the actual ransomware actors have had to go into smaller and smaller accounts, and those accounts are paying less than than than than normal.

Mm.

and if you if if you look at some of the big ransomware events, like I don't I don't know what Canvas you know paid to the to the ransomware actors, I don't know if that's public or not, but there's a lot of big payouts for people who've made mistakes that skews the ransomware thing higher. But this the story there is basically: look, these people who've been hit with ransomware, they got religion, right? So maybe they're happen be CMMC compliant, maybe they have to be SOC2 compliant, maybe it's PCI, maybe who who knows what it is.

Post-ransom victims tend to have a better posture against future attacks going on. But look, I think the whole industry is waiting for like a wave of AI enabled zero days and stuff like that. We're not seeing it. There just hasn't been that much of an increase.

What on that topic, what happens to vulnerability discovery and reporting in the age of yeah? Like we were used to maybe hundred vulnerabilities a day back in the days of early days of Tenable, and we would decide to do five of them that were like Microsoft or Adobe and so on. the Glasswing update just came out. They said they found 10,000 critical and high vulnerabilities in them. They were scanning thousands of open source.

Ten thousand vulnerabilities. Crazy. Yep.

repos for finding working with maintainers and so on. Do you do you sense this happens over the next year or so? There is a massive explosion of vulnerabilities and then it plateaus, or do you think my biggest concern is the chaining of vulnerabilities, not necessarily the one because you know typically you would find a remote code execution vulnerability, break into it, compromise the system, and so on. Now you could chain multiple medium severity vulnerabilities. So the

The attack chains would increase, but the vulnerabilities may may come down. I'm curious what you think. Do do we see a plateau or do we see an explosion from here? things get better or worse from here?

So I think it it's gonna be difficult. So look, I don't have access to mythos, but I've talked to companies who've had access to mythos. And what they're telling me is that look, they found a bunch of vulnerabilities in their stuff, they're gonna fix it, issue patches, and and that's a good thing. But if I said, Do you think there's more vulnerabilities in there? Of course there's more vulnerabilities in there. We're we're not done yet. you know, and if mythos found it with this level, what happens if mythos two comes out and it can find, you know, even more? So when you think about secure by design,

I would like to hear more companies saying, you know what, we're going to completely re-architecture our coding to do minimum attack surface stuff. So for example, when when you code is just a simple C program, hello world, right? It pulls in a library. Well, that library, you know, might have APIs that your code doesn't need, but it just got linked and it could be exploited.

So is there are there new technologies and new projects out there? And I've been pitched some of these things that have minimum viable attack surface for the libraries you want to include, right? That's that's a game changer. You know, there's another concept called unikernels out there, right? Instead of having a container that runs on you know, a my gosh.

you know, container platform, you know, Docker, you know, that kind of stuff. maybe you could have a VM that just has the APIs that your program needs in in the VPN or VM I'm in the VM. And my my point is you're reducing your attack surface to to to do these things.

But when I hear about a company that says, okay, look, our code's pretty ancient. We've got a lot of bad structure here. We're going to completely redo it. And at every step of the way, you know, there's boundary checking, there's variable checking, there's all these things. It's going to be secure by design because if somebody fails along an API, there's going to be all these other checks that, that, that stop that. When I hear companies talk about that, I get a lot more confident that we're going to have more secure software. There's no question that we are going to have more secure software because of mythos.

Ron Gula (01:00:43.632) stuff. But are we still going to have more vulnerabilities? Unless we have really well written programs, we are we we, you know, we we will

Mehul (01:00:51.916) Do you think most of the pr programming is done with AI in the future because of this?

Ron Gula (01:00:55.48) Well that that's the question. So, you know, I'm on a mailing list or a a a signal list. I think I can quote it, but Chris Visopel's on, right? Vericode. He's like, you know, could you ask Claude to write code that it can't break into, right? That's a good good question. But I've seen I've seen code written

Mehul (01:01:10.33) Yeah.

Ron Gula (01:01:13.612) I do a lot of shell scripting for my what I for my animation. I see a lot of bad practices every now and then. Every now and then it's sort of like, you're including an API key here. You should have changed that. I'm like, I did change it. Why, why do you still have access to it? So so it's it's it's crazy. But you know, the other thing that's going on is people are just hacking GitHub directly. You know, they're put they're making commits, they're doing things. That's a hard one to find. you know, if you look at that copy fail exploit, that was like three different things that you had to chain together to get root. I'm working on a there's a

Linux backdoor story where somebody added a you know, if if you you know UID equals zero instead of it could be zero and it and it sets it. So there's so many potential attacks with GitHub that we're dependent upon. That's crazy too.

Mehul (01:01:57.378) And not l and because of AI, a lot of non coders or non programmers are going to p be po publishing publishing their code to GitHub and it may or may not be safe. They maybe they expose the environment variable. Who knows? The dot n file.

Ron Gula (01:02:11.006) You know, there's there's there's like like for example, the IoT devices. It used to be that you could never ever on your own replace your firmware. But you you could literally say, I bought this device, I'm just gonna tell Claude to to to write code for it that does this and let me fix it. So that code, that new code might have vulnerabilities, but it's not gonna have as many vulnerabilities as that old code. And maybe that code is unique just to your organization. And that's a crazy thing about AI. If I start writing my own SaaS.

my own Salesforce CRM. If I start writing my own Gmail, my own stuff like that, maybe it's gonna be, maybe it's got more vulnerabilities than that. But if nobody else has it, how does the attacker ever really research it?

Mehul (01:02:42.8) Yeah.

Mehul (01:02:55.078) Super fascinating. Ron, this has been an amazing, amazing interview. I'm grateful for your time. You're way too generous with your time. What's what's the next big video dropping from V Ron?

Ron Gula (01:03:06.382) I have I I I've got an one I'm waiting for Rob Joyce to approve. But Rob Joyce just came out with a paper that basically said that China attacks on our ports and our phone infrastructure, it's the equivalent of like digital dynamite. So he's got a really good, it's like eight or nine pages. And I I've already recorded, I'm ready to publish it, but that should be coming up next.

Mehul (01:03:28.558) Awesome, awesome. thank you, Ron. Thank you for coming on Noise to Signal. This has been epic.

Ron Gula (01:03:33.976) Hey, thanks for the great questions. if anybody wants to contact me, gula.tech is the website and I'm on LinkedIn. We're pretty active. Find us on YouTube. really appreciate the opportunity to to talk about this stuff. You have some good questions. Absolutely.

Mehul (01:03:45.922) And we'll include all that information in the show notes. So that will that will show up. So I'll stop recording now. Hold on.