The Don of the Security Ratings Mafia

Alex, it's so nice to have you on the noise 2 signal podcast. Welcome.

It's a pleasure to be with you, Mehul

Thank you. Alex, you are you're known as the Don of Security Ratings Mafia. And I'm cu and I wanted to start the interview, how you got it how you got started with Security Scorecard. You are the CEO of Security Scorecard, you've been running this for many years. And you know, my sense is when you started this this category did not exist, this product did not exist. You were not even you were not, you're not, you don't you're not

a founder before this, you were working as a CISO, something happened to you. And the next thing we know is Alex is starting his own company. Right? So I wanted to start the interview there. How did you get started with Security Scorecard? What happened? What was your what is your origin story for Security Scorecard?

I was a chief security officer working at an e-commerce retailer in New York guild group. And my job was to protect its fifty million customers from cyber criminals. one day my team came to me with a proposal to sign for a fraud prevention service because we saw a lot of credit card fraud. Criminals were trying to buy Rolexes, luxury goods that guild was selling on a website.

And so signing up for a fraud prevention service sounded like a good idea. We asked the company for a copy of a pen test, and they provided to us a pen test, a beautiful SOC2 report. They sounded smart and credible. So we signed a contract and we started integrating with the systems of that fraud prevention system. And just as we were integrating with the systems, we discovered unencrypted credit card data belonging to other customers.

And that to me was a big wake up call. I realized that the biggest risk is not within my own company, it's all the companies that I'm connected with. Right? It's called third party risk. And so I left Gilt a couple of years later. and I became a CTO for another company and then I started getting together for coffee with Sam Kassoumeh who became my business partner at Security Scorecard. We used to work at Gilt together.

And we really kept thinking about this problem, how you could do everything right. You can buy vulnerability scanners, threat intelligence feeds, and really protect your environment. But then you send your documents to a law firm or an audit firm, they get hacked, and you are all of a sudden fired from your job the CISO because you lost your customer data. And I really wanted to disrupt how the industry was operating because everybody would just use pen and paper questionnaires to solve the problem. I wanted to have a

Your response.

objective trusted method to quantify risk. And that really gave an idea in twenty thirteen, why can't we come up with a technology where using open source intelligence effectively at the time, why can't you pick up signals that tell you if a company is doing a good job or a bad job? That was an idea. And so that was really kind of the genesis for security scorecard where it was a it was a moment that we had ourselves where we thought we would lose our job because of a negligence of a third party provider.

And was there any other company doing this at the time or were you the only like you when you saw the landscape at that time, you were you the only vendor or w you you were you the first to get this idea? Or was this idea already there but crappily executed?

So the idea when I was a CISO at Gilt Group never existed. You know, there was never when I was a chief security officer, there was never a company trying to quantify and measure cyber risk at the time. And when I decided to start the company in twenty thirteen, I think my main competitor Bit site started maybe a year before that, but basically it was still a very nascent market that did not exist. so it was really a completely new field, completely new market segment that did not exist.

I see.

I want to ask you a controversial question. You mentioned SOC2. You mentioned SOC2. What's your opinion on SOC2, especially after what we have seen with the Delve's and the other things that we have seen where it is almost like a checkbox compliance, but it's not essentially guaranteeing if you have all the right security controls in place. anybody can anybody can get a SOC2 compliance if you just follow the rules. What's your view on that?

Look I

Look, I think Yeah, look, I think compliance does not really mean security. Compliance just means you're compliant. You could be PCI DSS compliant or you can get a SOC 2 compliance and you are completely vulnerable to outside. Just like my belief that any type of stuff that you do needs to be continuous. Because attackers don't sleep. So if you have a static analysis of your system and somebody comes and tells you, you know what, congratulations, you're secure. Like you really

Everything.

you really it doesn't mean you're secure because just a minute later you you could have a sleep deprived IT administrator misconfigure the system and the hackers get in. So anything you do needs to be twenty four seven, completely dynamic dynamic, y you know, i i it's really crucial to have this continuous continuous three hundred sixty type of stuff.

And then, you know, you mentioned that you started Security Scorecard two years after you left Gilt Groupe, but were you incubating this idea for two years and then you started or you know, s there was like a confluence of factors that told you Alex, this is your time, you have to go now. Like were you like even thinking of security scorecard after you did?

No, I wasn't I wasn't thinking of a security scorecut. I was a CTO in a media startup, wasn't a security startup, and I really wanted to get back into security and I wanted to work with Sam also, who became my business partner. Like actually a really good advice. Whenever you start a business, make sure you pick as a business partner somebody that you really like. Not just somebody who's good, but somebody that you really trust. Because so many early stage startups fall apart because founders don't trust each other, they don't all put the equal amount of work.

Yeah.

So in 2013, Sam and I started just getting together for coffee on the weekends. And sometime in the middle of 2013, we wrote down ten ideas on a piece of paper. We crossed out eight of them. One of them was Coinbase, but Mr. PhD in cryptography here thought cryptocurrency is never gonna work, so much for my judgment. And then we had an idea why can't you measure and quantify risk? And interestingly, you know, the inspiration for security scorecard came outside of cyber.

I read about Dr. Virginia Ebger, a very famous doctor, who pioneered the concept of when babies are born, you know, you can just pinch a baby and see if the baby cries or if it's pink in complexion. But instead of doing all these complicated tests, why can't you have a simple check, kind of like a scorecard check system? Does the baby cry? Is the baby pink in complexion? So I thought, why can't we have like a simple checklist for cybersecurity? Like you go to a website and you see on a website

Mm.

Mm.

It says copyright two thousand ten. But it's twenty twenty six. It's not a vulnerability. You can't exploit it. But still, like it's a data point. If they've not bothered to update the copyright date on a website for the past, I don't know, ten, eleven years, what is it? What is it about everything else? What are they doing? And I thought we gotta be able to gather this data. And so we had an idea, we did not know exactly how we're gonna build it, but we started incubating it on the weekends. I hired a couple of consultants on

They probably have something else going on too.

you know, old desk to try to help me build. I was using my own money for it. And then you know, after three, four months of doing it, I said to myself, like this sucks. I'm working full time, then after midnight I'm staying up until three o'clock in the morning trying to incubate it more. I really gotta find investors. The problem of course is I did not know any investors, so I had to figure out how to raise capital.

And and you didn't have and you didn't have cloud code. And you didn't have cloud code. You had to code it yourself.

There was no full code. I did not know investors. And so I went to the first investor in twenty thirteen and he said, You know, you're never gonna be able to measure security. It's too complicated. And then I went to another investor, he said, You know, it's not a big enough problem. It's never gonna get past a million in revenue. So I kept getting like one rejection after another, but every time I would get rejection, I would incorporate those objections into my next pitch. So I would say, Hey, here's how it could be big, here's how I'm going to build it and then we were lucky to partner with

Evolution equity and bolt start and the end of twenty thirteen we raised a two million dollar seed round, which kind of now seems very small because now we're seeing rounds at a hundred million. But you know, I do believe actually less money is amazing because it forces you to be creative and think outside the box. And so I was able to quit my job and start doing it full time in twenty fourteen.

I very small. Yeah.

Totally agree.

I have two follow-up questions. You mentioned you're a PhD, so you're engineered by profession. So did you start writing code yourself? And then the follow-up question I have is when you got when you got to your seed round, did you already have customers signed up or were you you did you have like design partners by the time you signed up for the seed round?

So the first few lines of quote for security scorecard were written by me, actually I

Is your code still in there? Is your code still in sa running in security score card somewhere?

Unfortunately, because my team like you know, I made the choice to use MongoDB in the beginning, and my team has been trying to get rid of MongoDB for like eight years after. and the reason I chose MongoDB is I because I couldn't figure out how to use anything else. I wasn't you know, I was rusty, I wasn't a very like I wasn't as good as I used to be. And so and so interestingly like that decision, like some architectural decisions that I made

You are not into programming, yeah.

They haunted us for like eight, nine, ten years after. And the team but like finally I think the team got rid of it. and in terms of customers, I did not have any customers. I had people that I vetted and validated the idea with. So when I was thinking about security scorecut early on, I started talking to people and telling What if I could just help you objectively quantify risk? And the feedback was kind of a little bit lukewarm.

I guess.

Mm.

It wasn't like, yeah, yeah, I'm going to buy if I build it. To me, that was a good signal because if everybody tells you it's a great idea, you're too late to the game. Everybody else is going to be doing it. Right now you go do AI security. Everybody's gonna tell you it's a great idea, you're too late to the game. And so we spent six months building the product in twenty fourteen, and then we went back to all of our early kind of people that we talked to who said, I'm going to go buy security scorecard if you build it.

Okay.

Everybody's doing it. Yeah. Okay.

So six months later we had a prototype in the middle of twenty fourteen. We went back to all of them and guess what? Nobody responded. So I'm like, what do I do? All the people that said I would buy, they're not responding. So I gotta go find new customers. So I had to then so then I had to go and figure out, like, hey, I gotta go knock on a lot of doors, and if I wanna survive as a startup, I gotta get somebody to take a chance on me. And so we started seeking out customers in the middle of twenty fourteen. But the revenue was zero dollars at the time.

Zero is always good because you can always go up from there. You cannot go down from there. before I get to the next question.

It's so scary it's so scary, it was very exciting and it was also scary. Every day you don't know if you're gonna fail or if you're gonna succeed and candidly I still feel the same way every single day. I never lost that excitement for the future and fear for failing. Every single day I still feel the same way.

Before I get to the next question, I wanted to ask you, you said your eighth idea was the Bitcoin. Did you buy Bitcoin in two thousand and f twelve? No.

My my business partner my business partner ended up doing it and he was smart. I did not do it at the time.

Too bad. why did you come up with the security scorecard name? W was there any thinking or was it like I mean, the thing I like about, you know, I like the things that things when you name something, it is self-explanatory. So in some ways, security scorecard is a very self self-explanatory name. I'm curious if that was the genus that was the thesis behind the naming it, or did you have some other ideas to name it security scorecard?

So we started on some ideas when we when we started the company. And actually the first name of the company, and if you look at a seed stage investment decks, it was called Jigsa because I like Jigsaw puzzles. But Jigsa but Jigsa was owned by Salesforce, Jigsa.com. And so I changed one letter, I changed the W to an R and called it Jigsa, which was a terrible name. But I thought the domain was kind of short, it would be easy to remember. And then I'm like, you know, I really don't like the name.

Aleksandr Yampolskiy (12:37.879) How do I become like more expressive about what we do? So I started thinking about short ideas and I'm like, let's call it SecScore. But then when you look for Seccore, you have all kinds of adult websites come up. So I'm like, that's not gonna work. So I registered securityyscorecad.io and then.com was not available. And I found a guy who owns securityyscorecad.com. He was registering thousands of domains. I emailed him and said, I'd love to buy that domain. And he responded to me.

Mm.

Mm.

with like a long story of how he's going through a divorce and everything and said, I'm going to meet you for dinner. So I met him for dinner and I had to listen for five hours about his divorce. And at the end of a day he tells me, You know what, Alex, I like you, I'm going to sell you the domain for five thousand dollars. So we ended up buying security squarket dot com for five thousand dollars at the time.

That is that is a funny story. let's let's let's switch to the next phase of your journey. I mean, you obviously started, you didn't have customers, you started to get customers. And my sense is, you know, g given where you are today, security scorecard in some way scans the entire internet daily, right? So re achieving that scale must have not been easy. Getting to the point where you're scanning the entire internet daily.

What was that journey like? How did you get from like the z customer zero to I guess customer million? I don't know how many customers you have, but you scan the internet every day. So probably, you know, you could c consider everyone as part of your demand chain. what was that journey like?

Yes. Yeah, so look, we scan every single company in the world, every IP address in the world multiple times a day. We have one of our largest malware sinkholes where we reverse engineer malware and then infrastructure picks up when infected computers talk to our infrastructure. We look at exposed open claw agent instances, we look at ransomware, we look at patching stuff. So look we really gather everything and then we have

Over thirty two hundred paying customers in forty six countries and then over two hundred thousand companies claimed their profiles so they contributed additional like internal evidence. Look, I think zero to one look, zero to one million.

I see.

Well, before we get to zero to one, what who was your first customer? Like what how did you land the first paying customer?

You basically have to look for people who are going to believe in you. It's a classical cross-and-the-chiasm concept where you go to CISOs who know that your product is early on. And they know that, you know, you you know that it's early on. And I remember meeting Jim Routh, who at the time was a CISO of Etnam. Now he's a friend and advisor to Security Scorecard, but he became one of our first customers. And when I asked him, Jim.

Mm.

Why did you take a risk on security scorecard? He said, you know, if you want to mitigate risk, you have to take risk. I could go buy software from Cisco or Microsoft, but I know they're not going to give me as much attention and they're not going to be as agile as you are. So he took a chance on me, that me and Sam would be able to deliver it. And we did. and so and so I think early on you have to look for those visionary CISOs who are going to take a chance on you and really believe in your vision.

And then

Even when they know the product you have is not fully baked.

You and you know, you you mentioned initially that you started building your own open I mean, maybe you've started leveraging the open source tools, but to get to the scale that you have, I mean, I'm sure you have to build your own technology in terms of your own scanners and so on and so forth, right? Even like the traditional scanning players haven't ventured into what you did, in the sense that like Nessus doesn't scan the internet, Qualys not scanning the internet, but you do. But you're not, you know, it's not something that you you you know, you've essentially built your company around. So

Did you end up like you're using open source tools and then modifying it to your needs, or did you b end up building proprietary tools completely off, you know, your own team, a building building them in house?

No, we ended up building all proprietary tools. so like now we c like because you're trying to understand what's happening behind the firewall from outside. So you have to gather the data from all over the internet, multiple locations. Initially, look, initially when you start, you you do in order like it's a expression that Brian Chesky, the founder of Airbnb, said in order to scale, do things that don't scale. Right? Like so when Airbnb was started, Brian Chesky would actually go to the

Correct.

apartments and photograph them using his own phone, like himself. Obviously it doesn't scale. So like when we started security scorecard, initially we would just go use Nmap to scan some IP addresses, right? Or we would use we would go to like websites where they would advertise malware infected IP addresses and just basically say, Hey, like this website is showing to me that IP addresses are infected. Obviously that was like the early days, right? Like we were just trying to build a prototype

But as time went on, we had to build our own very complicated infrastructure. And from a very beginning, we made a choice that we want to control the data. Like we want to own the data collection. We never want to license the data because we wanna control the accuracy of a data, the provenance of a data, right? Like that's very, very important for us to stand behind what we do. And so from a very beginning, we started building the infrastructure and look, and look it

Yeah.

It never it never stops, right? Like even now, the big push right now is how do you layer lots of agents and other type of stuff on top of the data lake that we have. Like it like I think the work never really stops.

Yeah.

And you know, the one one thing that is you know, so quick qual follow-up questions. When you are thinking through does the did this insight come to you later on in the security scorecard journey that we have to own the data, or was that like right from day one, it was very, very clear to you that we have to own the data, we have to own the tools, we have to own the scanner. That was very clear to you, or was it something as you were going forward in your journey, you realize this data is valuable. We need to control this and own this.

I think it was a combination because basically licensing a data from other people would just end up being too expensive and then the quality of a data would be very like variable, you don't control it. We wanted to collect like we wanted to collect data ourselves, right? Like for example, like look, let me just give a simple example. Let's say you tap into something like Shodan or Census to get port scale data, you're gonna have a very limited

Yeah.

Mm.

sparse representation. For example, if you're trying to look at a a tech surface of a company in China, you have to gather data within China, otherwise you're gonna be blocked by a firewall and then you have to and then you have to extract the data and analyze.

And the other the other challenge is the data could be inaccurate and then you are at you are relying on somebody's data that is inaccurate. You're telling your customers that hey, I found this, but they are like, dude, I don't have this on my what are you talking about?

Yeah, like look, let's say you let's say you license somebody's data that, you know, Moody's was mentioned on a hacker shader website and you just surface it in your score and say, you know what, they're being mentioned on a hacker's website. Like but j like look, just being mentioned on a hacker's website doesn't mean that you're vulnerable or that you're being attacked. So like we really wanted to control the provenance of a data, I think also

Yeah.

Yeah, so like I I think actually like look, how did I make a decision? Candidly. Candidly, maybe it was just a lucky decision from the very beginning. Like what's interesting is a lot of the decisions I thought would be good ended up being bad. And a lot of the decisions that were bad ended up being good. So like I think the big lesson honestly is in entrepreneurship, that's why speed is so important. like my board member who is a founder of Axonias Dean was telling me

Like a lot of a time people like take too long to make a decision. But imagine you're doing a test with multiple choices, and it doesn't matter how many you get wrong, you just need to get one question right. Right? And so like then you would answer the questions as fast as possible. And so like I think the same in startups, like l like if it's a reversible decision, i if it's like a reversible decision where it's not like a life breaking decision for your company, just make it as fast as possible. And so again, like in hindsight, I think

like you really get humbled because I think a lot of the things you do, you're like, wow, this is going to dramatically transform a company. It did not. It was bad. And then some things just like you know, they worked and you doubled down on

Yeah, one of the one of the good decisions you made was and this is something that I find fascinating about security scorecard is finding or tapping into the insurance market. I don't know if that go to market motion came naturally to you or you stumbled into it. because i you are essentially now the kind of the backbone for the insurance cybersecurity insurance industry, where they l rely on your scores to assess this premiums.

For many organizations. How did you end up in that bucket? How I mean is that something that you found naturally or something that you you know, like the the the insurance companies came to you?

The insurance companies came to us because they needed a better, more accurate way to underwrite cyber cyber risk. Like a lot of insurance companies, I mean it's basically a business where let's say you collect a thousand dollars of premiums or like a like a hundred million dollars of premiums. I think in cyber insurance the loss ratio was like a hundred twenty percent or more for main insurance companies. So if you collect a hundred million of premium.

You would pay out a hundred twenty million in losses. So the so why why was it a lucrative business? Because there was so much demand for cyber insurance. You don't pay out a hundred twenty million right away, right? You collect a hundred million in premiums right away, but you pay out a hundred twenty million over time. So you can take your hundred million and invest it into stocks, bonds, other type of stuff and generate a lot of float, right? Like the interest rate. So I think it worked for a while, but then

Insurance market is very cyclical, so you know, you have up demand and less demand from companies. And so they really needed tools and technology to to make better, more informed decisions. And so now, for example, using security scorket technology, we have many top brokers, insurance companies who've reduced that loss ratio significantly. Like let's say you collect a hundred million, but you only need to pay out thirty million. And so instead of 120, because you underwrite much more thoughtfully.

Yeah.

And so just in general, like look for us always we wanted to make a world a safer place. So the whole point behind security scorecut data is it's not just to give you a score and that's it, and you can't do anything about it. We want to give you the tools and techniques to also become more resilient. We wanted companies to also have financial benefits. You get a good score, you get a lower interest you get a lower price at more insurance premium, for example. And so it came naturally, they came to us and and they're very, very happy with results because

Yeah.

We showed statistical correlation that companies who improve their hygiene they're less likely to suffer a data breach. We've shown that companies with a D or an F rating, they're thirteen times less likely to get hacked than companies with an A. And so like we stand behind what we do.

And were there any fun stories that as you were scaling, as you were going into the insurance market, where you know you were, as you said, you know, I'm the the decisions that you think are good turn out to be bad. The decisions that you think are bad turn out to be good. Any good decisions that turned out to be bad in terms of like scaling the company where you were like, dude, I should have not done that.

Yeah, look, I'll give you two examples, one good, one bad. so for example, I had an idea, I think like five years ago. Let's build a functionality to measure concentrated risk. You have a portfolio of companies that your are your suppliers. How do I tell you about common vulnerabilities that could be used to exploit all of the companies at once? Like think of it as catastrophic risk. You have a number of houses standing on a on a on a beach.

And if there's an erosion on a beach, the houses can fall down. And so I thought, let's let's build it. It's gonna be a sure win. So we spent millions of dollars building the functionality, it looked very cool. The problem is nobody in my team knew how to demo it, except me, and so it didn't generate a single dollar of revenue. So I spent millions of dollars, I spent five weeks five months building it, and it didn't lead to any more sales. Conversely, look conversely.

we had a developer, engineer who worked with us in the first couple of years. and he had an idea. Let me just go incubate a widget on a website where you put a widget on a website, and somebody can go request a security score. Like, hey, what's your score? It became one of our leading lead gen mechanisms for many years. Nobody asked him to do it. Wasn't a strategy, he just went and did it and it worked. So the moral of a story is we adopted the

framework called five by five by five by Michael Schraig. He's our advisor at MIT. Five people, five thousand dollars, five days. So whenever somebody comes and tells you it's gonna take me a month or two months, I'm like, how do you five by five it? How do you do it on like five days? What could be an experiment we can run to validate or invalidate it? So you shoot bullets, if the bullets hit the hit the target, you shoot cannonballs, right? You don't shoot cannonballs first. You validate that something works

Mm.

So it's really all about doing like five, six experiments and seeing which ones work and which ones don't work.

And how do you decide the five K? Like well, five K is the employee cost or the infrastructure cost? Like what's the five K in the in the spin, in the five five?

It's an arbitrary it's an arbitrary number, but the goal is limiting to five people, five days, five thousand dollars is just a small enough number where you can like start th forcing people to think outside the box. Because if like if you ask people to do something, they're gonna tell you, it's gonna take me a million dollars to do it or or two months. If I tell you, hey, can you do it ten percent cheaper, you're gonna figure it out. But if I tell you how do you do it ten times cheaper, it starts forcing you to think outside of the box.

Yeah.

And I don't know why

My my thing is ringing. The the follow-up question I have for you is you said you had this idea, you ran with it, you have spent millions of dollars on it, and you you know, there was not a single dollar of revenue that came out of the idea. Now that instinct could be very dangerous in the age of AI, especially with Claude My question is, do you now go into Claude code and build your prototypes now or your designers or engineer building and because now it is less less about five by five by five, it is like five by five hundred by five.

You know, sense in the sense that you can now quickly experiment. You don't even have to spend five hundred dollars, you probably spend like hundred dollars in tokens and get a prototype out. how does that change for you? Does that have you seen that level of fast experimentation? Instead of five, we do fifty experiments going from here.

So I think Claude is amazing. I think we live in one of the most amazing times of you know, being an entrepreneur in general. You know, the job of a product manager and a user designer, experienced designer really changes. Before we would have to build a product spec, it would take you a month to write a product spec, then it would take you another month to create creating

Yes.

Get feedback. Get feedback from the customer and work with the engineering.

Now all of a sudden you three months later, now just go build it, right? Like my my seventeen year old son is using Claude to build software, right? Like I'm using Claude to build software. Like I'm making sure every one of my executives is able to use Claude. Doesn't matter what your job is, like I want you to use Claude. So like I think it just allows you to very quickly build a prototype instead of, you know, we can spend an hour talking and sketching, or just go build it, basically.

Yes.

But are you shipping like what you write, the code that you write, does it go into production in security scorecard now? Or is it more or so your code is now cloud code is going into production in security scorecard?

Yes, yeah. Yeah.

So we are writing about sixty to sixty five percent of a code using Claude and we wanna get to a hundred percent, you have to have guardra you have to have guardrails, right? Like you can just have Claude write code. You have to have guardrails and protection and quality control and security assessments, otherwise you're gonna build bad software. But if you pre create the proper harness and you have like proper guardrails

Yeah.

security checks all baked into your process. I actually believe that we're going to be in a world where a hundred percent of code is written using AI. And by the way, that's kind of the case in Google and many other companies already. Like most companies, Google, Dow Jones and various others, they're almost entirely automating how they write code, not using humans.

my personal story is I've written more code in the last year in my than in my entire career. Like, you know, and obviously Cloud Code is my go-to partner for coding. let's switch to the next topic that I have in mind. And you're called the Don of security ratings mafia for a reason, right? You know, if you're because and primarily it is driven by the score that you guys put out. Right? If your score is good, everything is the everything is good, the CISO is happy, the premiums are low.

But then if the score is bad, then it is really bad. And you know, then they are fighting with you, they are arguing with you, and their premiums go up. I'm curious what is your take on this perception that, you know, sometimes some organizations could be unfairly rated lower. Maybe maybe the data was not accurate or the the data was not reachable or whatever it is. You know, y I'm sure you've seen this criticism all the time.

it is it it is a nice to have like people complaining they're using your software and they're you know they're and and they're driving some outcomes for them. How do you see this from your point of view?

Look, if I come up with a really complicated and hundred percent accurate algorithm to judge how good looking somebody is, and I tell you, Mehul it's like a hundred percent accurate and I ran it on your wife. She's not that pretty. You're not gonna invite me home for barbecue. It doesn't matter if my algorithm is right or wrong, you just

By the way, on the topic of wife, I love your comments on LinkedIn where you're like your wife is already so that right. I think you you c you do quite a b a few of these where you're always promoting your wife. So I don't know if if that is kind of a gun to your head kind of a thing or you do it naturally, but

she's been a great she's been a great supporter, great partner, right? Like it's very important to have this support system. Look, from the like I think like I think the pushback on the security rating scores in general, if they're used improperly, is completely legitimate, right? Because like when you're trying to gauge security posture from outside of a company, there's going to be so many things that you're not going to know. You know, you could have

Compensating controls. you still advertising old software that looks like it's not patched and it's a compensating control. Or you discover a malware infection in a company, but it's a guest wireless network where instead of your corporate DMC. So there's like a hundred corner cases where you could believe somebody is insecure but then they're actually secure. So like I think the very important part for us and we need to you know we need to

make it known better. First of all, any company completely for free, zero dollars, can claim the scorecard and we tell you exactly how to improve it. You can upload compensating controls. You can, you know, we tell you how to improve it. You can upload your IP address footprint. We acquired a company called Hyper Comply last year, and you also have an ability to create a trust center where you can upload your own version. So you can create a trust center, you can upload evidence

your policies, your pen test, and share your internal version. Right. And so just like in general though, I envision a future where we want to become a unit of trust. In order to do it, we need to keep making it easier and easier for companies to provide their version of a story. Hey, I gotta compensate in control. Hey, here's my network segmentation. And we have already today over 200,000 organizations worldwide who's done it. And

out of our thirty two hundred customers are monitoring millions over twelve million companies worldwide and engage them about the security postures, MA targets, investment targets, supply chain targets. So I think look I think the I think the score and the information is a start of a conversation. Right? Like if I give you a score and say, Michael, here's your score and it's an A or a B, what do you do about it? A bad response would be I'm perfectly secure. I got it covered.

This is not accurate, it's I'm perfectly secure. That's a person who doesn't wanna have a dialogue. A better response would be like, look, here's what I'm doing, here are my compensating controls, I'd love to talk to you, I'd love to engage with you. Because if this type of stuff did not exist, you would have to go back to questionnaires and static attestations, and then then you have no data to inform your conversation. The goal never was to be a one-catch-all solution, but the goal has always been how do I really

make the information more intelligent? How do I completely for free enable any company to claim their scorecard and to provide their view and provide their story? And so if used properly, it could be an extremely valuable tool, right? If used improperly, like any tool, it could be wasteful. In general though, if you look at the strategy for security scorecard, the big focus for us in the past few years has been how do we expand from ratings to solutions? How do we become

Claude for third party risk management. So like the products that we've been launching have been products like Titan Secure, for example, where you have agents that can go remediate issues, engage with your vendors, collaborate with your supply chain to be more secure. So we're really expanding from ratings to also solutions to secure your entire ecosystem. Ratings are still there and it's an important part of the equation, but it's but it's a beginning of a conversation, not the end.

The the question I have for you is somebody who's then doing these compensating controls, uploads these compensating controls, then do they do you then take them on the face value or do you also validate them that okay, these compensating controls are in place and then do you also do some level of validation that they're actually in place?

There's a validation involved. If you upload Everens into Security Scorecode, we have a customer support team. And then also there's an AI automation process. But basically we validate and engage with the companies to confirm what they what they told us. Yes. You need to have a level of validation for compensating controls. Otherwise, if you don't, people are gonna start gaming their you know, they start gaming their reputation.

Yeah, then yeah, obviously it is n then it is no different than attestation, right? Hey, I have these controls, take my word for it, and improve my screen.

It's kinda successful if if you're gonna start gaming it.

Yeah. let's let's talk about let's talk about the future, especially with an AI native future in mind. The thing I find the the the thing I find a bit surprising is and you you touched upon this, you think of you know the future is cloud for TPRM, but you are in this position where you could be not just T T PRM, you could be, you know, like a major player in cybersecurity, not just for TPRM. You could

Do a lot more things from there. So why restrict yourself as cloud for TPRM, but not like widen the widen the scope? Maybe it is like the resources constrained, whatnot. I don't know if that is the case. The second question I have, or the follow-up I have, is like, what do you what do you think happens to security ratings with with all these AI tools that are coming in, the shadow AI that is getting used? Or you know, does that then impact the ratings of the companies?

Because you know they're using all these AI tools. How do you incorporate the use of AI and maybe judge them positively or negatively?

Yeah, so there's quite a lot of changes happening in a cybersecurity world. First of all, the time for exploitation used to be seven hundred and forty-five days in 2020. Now it's down to seconds. Also, we've seen anthropic mythos model via Project Glasswing. They discovered a 27-year-old bug in OpenBSD, which was a code reviewed and audited and tested by humans for nearly three decades.

Correct.

So what does it mean? It means that everything needs to be automated. Like we don't have a situation anymore where you can log into a tool, look at the user interface, download reports. Shouldn't speed changes everything. You have to fight robots with robots, you have to play asymmetrically. It's no longer about just seeing the insights, but it's about how do you see it earlier, contain it faster, and recover before it matters.

Yeah.

So you shift from visibility to intelligence to action. So we really envision a future where we're going to become a system of action, right? And look, I mean, we we're going to be two hundred million in annual recurrent revenue this year, cash flow positive. We think we can triple the revenue and get it to six hundred million by becoming a system of action and really becoming a even more massive player than we are, to really become the tool.

Of how companies engage and collaborate with their suppliers. AI, by the way, AI only increases the urgency of third and fourth party risk. Because look, if you hire an intern, you're going to do employment background check, you're gonna train the intern, you're gonna do all that stuff. And with agents, you just lend an agent and all of a sudden it has access to your

all of a sudden it has access to your production database, right? So so really we're going to see exponential we're going to really see a huge exponential explosion. So you have to fight robots with robots. And by the way, we see in many companies do it, including your own company, Mehul right? What you're doing at Quantro Security, how you know how you're solving the problem by really having agents that never sleep, right? And they assess your organization and look for risks.

that are vulnerable and exploitable. You can no longer have a pen tester do it. You need to have agents doing it twenty four seven. And so you need the same for vulnerability management and exploitation, which is what you're doing. You need the same for third party risk management. So I really think it's a fantastic opportunity to rewrite the rules of the game.

No, no, no, I I don't disagree with that. What my question is why can't security scorecard be first party risk management? Why restrict to third party risk management? Why not be the player who's doing the first party risk? That is where I'm trying to go to. Is it, I mean, one is maybe you have the maybe you have the you know the vote from the customer that you are really you're really good at third party risk management, but why not be the first party risk management? Be the vendor who can actually do you know, you don't have to be, you know.

rely on just the score, but you could do the internal assessments and so on.

We do you know, we we any company that uses us to look at other companies, they also use us to look at themselves. So first party use case is something that almost every one of our customers uses us for. We have companies reporting to the board, putting our data into SOC, into SIM, on different type of indicators of compromise using what security scorecard provides on the internal assessment of security, meaning like inside out.

Yeah.

Maybe possible down the road, you know, maybe possible down the road. We're not seeing incredible pull in the market for those capabilities at the moment. We're seeing a lot of pull for assessment of AI, we're seeing a lot of pull for third party and for third party capabilities and the system of action that we're becoming. Like we just think it's a huge total addressable market. For inside out things like a CTAM or inside out vulnerability, we've definitely

The top.

I get

Yeah. Because it's right for you. The reason I say that it's ripe for you, like you've already done the outside scanning.

Yeah, we've we've definitely we've definitely looked at it, like including some acquisition targets. But you know, I don't think it's a huge priority. I don't think it's a huge priority for us this this particular moment.

I see. Not worthwhile at this point.

Question on the the the the AI native aspect of it. Do you think your ratings will change as these AI tools get much and more and adopted? If so, how do the security ratings change because of AI?

You if nothing changes, nothing changes, right? That's kind of what my board member Nick D'Nofrio says. You know, you always have to evolve, right? Like we've always evolved the type of signals we consider. We've always evolved our models to make sure they're up to date and and reflective of recent threats. I think as agents like we have a partnership with a number of companies, SSPM companies, where you can actually

like tap in on the inside out and see what type of shadow IT, shadow AI is being used. So yeah, I understand a future way security scorecard could be rating not just companies but products, software, inside out, AI agents, AI foundational models. I think there's a lot of ways of how we could expand it down the future, potentially.

Mm-hmm.

Hmm.

And and you mentioned that sixty, sixty five percent of the code is, you know, you your t your your enterprise is using Cloud or some of these equivalent tools. Do you also see a w you do you also see a path for you to build your own models, fine tune your own models to assess these ratings or is it like too far out? Those kinds of things. Do you think do do you see a need for doing that or no?

We collaborate with a number of companies. Google, for example, has been our investor from Series B stage and they're doing a lot of interesting stuff on Gemini. You you could envision a future where you might have not necessarily large language models, but you might have small language models which are customized and tuned specifically for cybersecurity. I think one huge advantage that we have compared to anybody else is we're sitting on twelve years of data. For any company in the world.

Mm.

Hmm.

The vulnerabilities, the threats, and we've correlated the data from the very beginning using AI to the likelihood of a data breach. And then on top of this huge data lake, we have contributory feedback loop where every company that enters a ecosystem provides a feedback. Just like a person can click on Google Ads and Google becomes smarter based on what you like and what you don't like. So I think there's a lot of ways of how we can do models, but look, we're building agents on top of security scorecard. We're actively

using Claude internally inside the company for every single department. So so like we're all in on the AI transformation.

Awesome. That's that's a good note to end the interview. Alex, thanks for your time and sharing your journey and sharing your story. It was it was really fun engaging with you and discussing the journey of Security Scorebird. Thank you.

Look, I appreciate the dialogue, Mehul I'll make you an offer that you can't refuse. But as Don Carleone has said, so it was a fun conversation and I like the provocation also around kind of like a don of security ratings. It was a fun interview, really appreciate your time.

Thank you. So stay on the stay