EP. 27 Can AI Keep Your Data Safe? with Richard Tallman

00:01 - Career Journey in Technology and Cloud Computing

Matt Pacheco
Hello everyone and welcome to Cloud Currents, a podcast that navigates the ever-evolving landscape of cloud computing and its impact on modern business. I'm your host Matt Pacheco and I lead the content marketing team at TierPoint, a managed cloud and data center provider. Today we're thrilled to have Richard Tallman, senior director of global Cloud Security and MSP at Bitdefender. Thanks for joining us today, Richard.

Richard Tallman
Oh man. Thanks so much Matt for having me on and having Bitdefender on. Right. So thank you. I appreciate it.

Matt Pacheco
That's awesome. We appreciate it. So you bring over two decades of experience to the tech industry and you've witnessed and participated in the transformation of on prem infrastructure to cloud based solutions. At Bit Defender, you lead the global strategies for cloud security managed services, leveraging cutting AI edge AI machine learning tech to stay ahead of cyber threats. Really cool. So today I'd love to talk to you on this episode about the challenging face of cybersecurity in the cloud era. Possibly discuss challenges of compliance in a global context. Get your insights on emerging trends, strategies and fighting against cyber threats and then jump into Bitdefender's unique approaches including the elite Draco team and the commitment to innovation. Draco Innovation.

Richard Tallman
Amazing. They're so amazing.

Matt Pacheco
And their commitment to innovation and AI driven security solutions. So I'd love to talk about all of that with you today. So thank you for being on.

Richard Tallman
Appreciate it. Yeah, thank you so much. Where would you like to start?

Matt Pacheco
Yeah, so we'll jump right in. Can you walk us through your career journey from building your first computer to leading a global security team?

Richard Tallman
I finished college out in Southern California. Athlete and computers personal computing started coming up. So in my head I had this thing and I worked for a circuit board manufacturer. First job out of college. We were making printed circuit boards, right? And I'm like, I'm going to build my own. So I went to Micro Center. I don't even think they're in business anymore. Kind of like the before Best Buy was even around maybe.

Matt Pacheco
Oh, they're around.

Richard Tallman
Are they still around? Okay. Greatest place ever, right? If you're a tech nerd, greatest place ever. You can buy whatever you want, right? So it's bought every piece and component I thought I needed. Went home and kind of built it and looked at it and said okay, now what? And then I called a buddy of mine who was at the time at a company called Autobytel.com. It was like kind of just that.com era was just starting, right? My work, my. My wife worked there too. Sam. What I do now we gotta load the software on it. I was like oh. So helped me load software on it, turned it on 96, right. So and then from there kind of went to a company. It went to a company First American Title. And were in the escrow title flood insurance game.

Richard Tallman
But we started to build our own internal cloud even though it wasn't called cloud at the time. We had our own on prem servers and I remember seeing this thing in the middle of the room like what the heck is this beast with all these blue lights? You know, loud, hot. But we would keep. And we started to scan. We were very early adopters in that. So I left circuit board went into this. We were very early adopters and basically keeping everything. Keep it all right. Because if the county is going to record something on file we need to keep it two to make sure there's accuracy there. Because we're the ones ultimately ensuring the product for our customers, our banks, our lenders, et cetera and the customer, right. So we wanted to keep it ourselves.

Richard Tallman
And that kind of progressed over time from in our office in Irvine, you know, having stuff literally like a mini data center right next to escrow team and the title team to hey, let's put this in a. In a. In a site, right? So then we built a site, then we built multiple sites and then you co load and then you. You replicate the data and it just evolves right to the point where it progressed. Went to a partner and that partner basically then sold, right. I kind of went out of that world into a partner and said hey, I'm going to take knowledge base that I have. I'm going to work in kind of the Unix space and we're going to work with folks to just supply the materials and tools, et cetera that they need.

Had a lot of big customers, really Fun time, early 2000s in the world. But then eventually said hey I want to go to the manufacturer. So then from in the. Why. Why did I want to go? Because we the Unix game and back in the day veritas Unix it was massive, right? Buy your giant system as 400 was huge. But x86 platforms came out and this little thing called VMware came out and it just literally revolutionized everything. Like instead of one server for one application, it became one server for 10 or 20 or how much memory and CPU could get into this one little machine. So then I said well shoot, this is going to change the Game.

So I went to Dell and we basically worked with small, medium businesses in the data centers and selling them and providing them with the machine power, right, and the storage capacity to basically kind of create their own clouds, right, so that you didn't have to have it on prem anymore. Kind of progressed there. And then there was one day, Tim, and I know he's out there. I'm going to send this recording to him when he's done. I think it was 2012. I was with Tim at a baseball game. He was like, well, I'm not going to renew my contract with you guys and my $2.8 million hardware deal. I'm just going to go to Amazon. What we talking about? So he literally shifted his entire platform. He's like, early adopter. Not on the. A lot of times it wasn't.

05:45 - About Bitdefender's Origins and Philosophy

Richard Tallman
They weren't putting primary applications up into Amazon. A lot of people were just test dev. He's like, no, I'm sending primary. It works, I've tested, it's fine. So that was another big break. Like, oh, I got to get, you know, x86 cloud. Boom. I got to get out of this. So little progression. Started doing more cloud work in a sense. And then I noticed, right? So everybody I talked to was a city government, state government, educational systems, big businesses. It was like, buy the hardware. And then like 17th on the list was security or backup. What's even after that? It's like, this doesn't make any sense. Like, shouldn't that be the priority in this case? So I was like, 2015, 2016.

I kind of noticed that, like, this doesn't make any sense to me because to get into the building, you've got to go through the tank traps, right? Go into the data center. Give me your data center. You know, tank traps. You go into the building and you've already got 20,000 cameras on you and they know who you are. Interesting story about that from a data center up in Vegas. And once we got past the 20 foot walls, the man greeted us with his, you know, camos on and, you know, it's very interesting. Takes us inside and then you go through the check, give him the id. And we're literally on the tour of this data center for a customer of ours. It was a colo site up there, real big one. And he literally stops the lady that I had. Excuse me, ma'am.

He just reached into her purse without asking and pulled out a thing of water, like a bottle of water. I was like, ooh, they saw that out in the parking lot, they went back and watched the tape and they took it because they didn't want her to run up to some computer like a crazy person, you know, pouring it on the server. So but you know, you just saw that progression from I built my own computer to then reselling computer and building something, reselling computers for people, helping them to build environments, to then going into the manufacturing space and then just seeing the weakness and identifying, hey, there's a need for security out there and I think it's going to be a bigger bet that people are kind of neglecting. And then you kind of started to see those breaches.

The breaches were really happening at the big locations, right? The small medium business, you know, they were, if it was happening, they didn't know, no clue. So it's for the primary reason, like, hey, I'm going to get into this business, I'm going to focus on this, I'm going to help customers to bring them the best solutions possible at a cost, correct price, that they can have the enterprise grade solutions that the giant Fortune 50 has right to protect their deal. So that kind of led me to Bitdefender. So I was at Semantic for a bit, went to Bitdefender. I've been here six years and it's fantastic. I mean Bitdefender's been around since 2001 officially, and the history of Bitdefender is amazing. Like, if we had time, I'd love to share that with you. So it's. But that's kind of my journey.

My career was really long winded and I apologize audience but you know, everybody's got a story to tell and I've been doing it for more than two.

08:49 - Cloud Security Landscape and Challenges

Matt Pacheco
Decades, you know, so that's exciting and exactly what we want to talk about. Can you, can you actually give us a little bit about Bitdefender before we start asking you questions about it?

Richard Tallman
Yeah, I'd love to. I would actually love to. So it's interesting. So Florian Talpis, our CEO and founder, co founder, he was doing this in the early 90s, like mid-90s, like helping big corporations, right? Post Soviet era in Roman Bucharest, Romania. That's where our company's founded, helping big companies as a contractor to create antivirus to protect the known, right? Let's say the known things. And it's fabulous to hear him tell the story because he basically said, hey, look, if it was me or anybody, we all knew what the known was. That's a given, right? So hey, this is the known That I know what that is. I wanted to develop stuff with my teams to find the unknown. Right.

And that's really put him on his Quest from the mid-90s up into 2001, creating Bitdefender, which then led him into the world of machine learning. I think we have over close to 450 patents total, not just machine learning, which then became AI. And it's just an amazing thing to see the story and the progression from being a consultant in the industry, genius, mathematician, to kind of building Bitdefender and just organically growing and meeting needs for people and most importantly, meeting the needs of the people that might, like I said, like the small media business that needs a cost correct solution. That's his heart ultimately. And if you don't believe me, I think there was an attack a couple months ago in the healthcare industry in England. He basically donated the MDR services for anybody that needed it.

And MDR is like our SOC team, right. Our SOC analysts with three locations worldwide and go into that later with you. But it's just said, hey, if you need it, we'll help. Right. There was another incident that took place a couple years ago and he basically said, hey, bit to finish free for you guys in this one particular country over in Europe. You guys need it, take it. Right. Because we want to help you guys. Which then leads to things like just the heart and the willingness to help. Basically the tagline we have now. And it's amazing, it's two words. Trusted always. That's it. Trusted always. And it really is at the heart of the foundation and the footprint of our company. It comes from the top down. Trusted always.

Matt Pacheco
It's very exciting and we're glad to have you on here and hear a little bit about Bitdefender. You can feel the passion for wanting to help your customers.

Richard Tallman
Absolutely.

Matt Pacheco
It's really cool. Love to hear it. So let's talk a little bit about the evolution of cloud security. A little bit. So at tierpoint, we recently ran a modernization survey and we put out a report and something really interesting we found. When it comes to modernization priorities, we interviewed or we surveyed about 400 IT decision makers. We found that 53% of them at the top of their IT modernization plans were cybersecurity. That surprising? Over cloud adoption, over data management, all cybersecurity was at the top of their list of priorities. And we know the landscape has been changing in cybersecurity and that's probably why so many are prioritizing it. From your perspective, how has the landscape of cloud Security changed over the recent years. And what are some of the most significant challenges organizations face today when it comes to security?

Richard Tallman
Man, it's interesting you say that, and I love the research and the data you guys bring back because it's like going back to my story, let's say 2012, 1314, it would have been 17th on the list, right? I gotta buy data, I gotta buy hardware, I gotta buy storage, you know, fast storage. And now it's like, no, I need to protect my data, my intellectual property to stay in business. So that's very interesting. I'm surprised it's not higher than 53%. It should be like 99.99%. The biggest initiatives that have kind of pushed us in this direction, going back to maybe the virtualization solution and the ability to then spin up multiple things, multiple places, consolidate and centralize. It first starts at the cloud industry, right? Then the fast lines, the fast cabling boom. It allows us.

And then the antennas and then this little devil right here, this, the tablets, the ability to log in anywhere, anytime. I mean, how many times have you gone somewhere and say, oh, just put your username and password in now. It's so easy, you know, and we probably, each of us probably has a hundred of those at this point. It's like, oh my gosh, you know, the ability to not have to sit at one device or even sit, like you can walk around and work on your phone anywhere you want, right? Any country, anywhere you want. That has evolved to the point where it's like, okay, where the heck is my person? Where are my people? What are they looking at? Who's looking at them? More importantly and more importantly, how do we secure all that data? Right?

If they're going to log in on 14 different devices, we need to ensure that my data as a company is secure. And that's, I think, where the evolution is. And that's probably why these people are at 53%. More than half are saying security is a big deal. You know, especially let's say law firms anywhere. That's a lot of critical data, right, that they, that can't be shared and yet it still gets shared on accident, right? And oh, public WI fi. Let's just join this. People have access to your stuff. You know, once you join this free WI Fi. Free, yeah. I think that's probably the biggest thing is the multiple devices, the ability to host things from a centralized site or multiple sites. The giant, you know, I think that's probably the biggest thing. Just easy access.

I mean, what we used to say it's like anytime, anywhere. You know, we used to say that back in data, anytime, anywhere, just get it's there, it's there for you.

14:26 - Bitdefender's Security Approach and Innovative Teams

Matt Pacheco
So this could be a fun one. Can you discuss the parallels of the adoption of cloud computing and trends in cybersecurity solutions?

Richard Tallman
Yeah, so the parallels, right. So you still have this anytime anywhere mentality with any device. And now you probably want to add that as the third anytime, anywhere, any dev. But okay, so how do we get those parallels? How do we then protect this data? I think the best way to do it is to have a history of things to know, the known and the unknown. You need to have that ability to do both in a sense. What can we see that's there and how can we pivot quickly to the things that we recognize that we don't know to go and correct those things very quickly.

So the way that we've mirrored that solution with our product here, our Bitdefender MSP and our sales groups here, and then our engineering and our product and our dev and our labs, I mean there's a bunch of different layers to the solution is we offer those continued layers to the customer, but we do it through our cloud based platforms where we have multiple data centers in the United States, multiple data centers throughout Europe using multiple different providers. Right. So we have compliance components. Right. You have to have this data secured in region and there's certain standards that you have to comply to adhere to SOC 2, et cetera.

You just have to these days because people are wanting to trust us with their data in a sense and we don't really ever see the data, but we protect people from getting to the data and then acquiring the data or pilfering that data out. So the ability to basically mirror the industry. This is where I'm getting to this, to mirror where the industry's gone. Right. The industry has gone to cloud first, application first. Right. It's all an application. It's just an application username and id. Just get into this for your CRM, for your sales records, for your engineering tools, for your art, for your marketing. Just keep going down the list. How do we mirror that? So we mirror that and combat that. In a sense, we live in that world too, right? So we also live in the cloud world.

So if something goes through those, our cloud data lake in the center here, Asia, overseas, in Europe, then we can quickly scan that data before it even goes to that whatever device, anytime, anywhere, you know, so in a sense we can spin that back, in a sense. So that's kind of. You have to mirror the enemy. If you think of, like, your enemy, in a sense, they're coming at you with 20 horses. How do you mirror that? What are you going to do? And then behind that layer, what are you going to do for the next move, in a sense? So you have to kind of. It's amazing to see our Draco unit and our labs team think about those ways because they're very proactive and not just dealing with a reactionary component. They're thinking years ahead of things.

So that's kind of very interesting. Very interesting to see. But ultimately, we. You have to mirror the solution that's being offered to people, and you need to fit into that solution very seamlessly and simply so it doesn't detract from what they're trying to do. They're trying to use these applications. You can't be the primary focus when somebody's sitting in an Excel spreadsheet. It can't be your blinky light going off. They just have to use the Excel spreadsheet. They don't even want to see you, in a sense. Right.

Matt Pacheco
Well, now that you mentioned it, can you tell us a little bit more about the Draco team and its role in your cybersecurity?

Richard Tallman
They're in a mysterious organization. It's very. They are. I would say they're kind of like our elite Delta force, in a sense. You know, they are the best of the best when it comes to helping Interpol, Europol, FBI, doj, government agencies, et cetera. Something happens. And that team, which. There's a couple names that we know, right. If you search the Internet, because they're the leaders of the organization, a lot of them, you don't know who they are because it's, you know, it's. It's just that they need to be anonymous in a sense. Right. So they can go and do their jobs. They basically will hunt things down in particular, and find things that then will protect you, that country, military organization, or even big business, in a sense. And they are amazing at what they do.

They were just featured on a National Geographic documentary. It was trafficked. And they're actually featured in there, I think, in our HQ office. And some of the leaders of the Draco unit are in that episode. And it's just fascinating to see how and what and why they're doing it. But, yeah, kind of cool that Bitdefender took part in an episode of National Geographic and won an Emmy for our efforts. You Know, wow.

Matt Pacheco
I have to look that episode up and watch it. Sounds really interesting.

Richard Tallman
It's pretty intense. Wow. Yeah, you know, it's. You know why it's intense? Because you put yourself in the shoes of the person that's being held at ransomware. It's scary. You know, we have an interesting story about that where were actually at a conference. I just gotten off stage, talking to 3,500 people came down and a partner came up to you because I mentioned something about our decryptors, right? So that team of the Draco unit works directly with our. Like, we have layers, right? Like I said, so you have to have those layers. 50 horses. 50 horses. But we have all these other layers. And our labs team is just amazing. Heavily involved in education, a lot of teachers, mathematicians throughout Europe, et cetera. These folks are amazing. Dragos is one of our leads. He's just amazing. Like, the guy's genius. Think he got his.

I think he got one of his PhDs and like, right? He wrote his own operating system, right? Like pretty amazing. So, but like got off stage and I mentioned, hey, if you need help, right, if you ever need help, we. We write these decryptors. Our labs team offers these decryptors up free of charge. Just go search. You can go search on the tool. On Bitdefender ransomware decryption tools, I think we've offered 33 or 32 or 33, I think up for free. Two partners came up to us right away, hey, we're being attacked right now. I grabbed one of my lead solutions architect, said, hey, can you help real quick? What's the name of the ransomware? They searched it up and no joke, you saw this relief, like this burden on top of them was just like carrying 1,000 pound weights.

Like, oh my gosh, I see the light, I can see it. So they use the tool, clean it up, blah, blah. But those are kind of the things that Bitdefender is willing to do, right? So we have all this knowledge base. Let's give it away, right? Let's give these decryption tools that way. Fantastic things, like through our labs team, just the genius and they're the ones that are not only looking at the known, but there's the ones looking for the unknown too, because they've taken that same mindset that Florian Talpis has created. Great known's Fantastic. Let's go find the unknown and then when we find the unknown, let's fix it so it doesn't happen to somebody else again. And let's be able to offer that back to the community. Right. The global community.

Matt Pacheco
Really interesting. And you mentioned the kind of 50 horses of the enemy matching that force. I'm sure you're using tools like AI, machine learning. Can you talk a little bit of how those technologies have transformed your approach to threat detection and response?

Richard Tallman
Yeah. And just to be blunt, you have to at this point, right? Because let's say the other side is doing it and they're doing it to create things. It's just a component of automation and how fast things are being thrown out these days. I mean, you probably use chat. It's. I use it for. But here's the downside about chat. I use chat for. We homeschool our kiddos. And my son was in chemistry class last year and we use chat to correct or just to check this one chemistry problem. You know, two seconds, gives you the answer, the solution formula. And then he's like, it's not right. It's like, what do you mean it's not right? You know, just assuming you're trusting this thing that just did all this work for you. He's like, it's not right. Okay. Hey, you sure this is right?

Oh, I'm sorry. I was in. I was wrong. That's. I always call it her and I don't know why I call it her. She was wrong, you know, but. And that happened to us like six times. You know, at nighttime we're just checking chem stuff. If people are willing to take things like that and to use a tool, third party tool, it's not yours. You don't own it. You don't know what's going on behind the scenes and maybe write code with it or you're going to use it to create things, it's going to come back with little errors. Right. It's not right. So our ability to take those same tool sets, implement them inside and test them and validate them, it basically is helping us and our company create that automation.

Like to meet it head on in a sense because you need to do it from an offensive component versus in a defensive component. Because they're coming at you with the. I mean, I don't know. Honestly, Matt, the amount of things we stop every day is like. I heard a statistic one. It's the amount of stars in the galaxy. That's the amount of data points that we're. We're monitoring every single day and protecting like, it's just. There's a number I used to be able to give. We can't give it anymore, but it's staggering. And that's the interesting thing, is people out there still don't know who Bitdefender is. It's shocking to me. I would say the automation. You'll see more from us. Can't give too many details, you'll see more from us in regards to AI.

But that's like Martin Zugic and his team and Dragos and the Draco unit, the Labs team, they're creating things, not necessarily just for next month, they're creating things for years out. Right. Somebody told me, I think I was talking about quantum computing. Be ready for it. It's coming. Oh, yeah, you know, so what are we going to do? You know, what are we going to do?

Matt Pacheco
News report on it. I think 60 Minutes did something on it a few months ago.

Richard Tallman
It's really such an interesting world to follow that from back in the day when they started talking about Quantum. You've got a zero, a one and now a three or a two. What do you mean? You know, it's not black and white anymore, you know, so. But yeah, there's. We have amazing teams. Our engineering team, Cloudio, Soren, they're just very proactive. I can honestly say. It's the first company I've worked for that actually listens. And that's why we have things like our msp, Global Councils, you know, here, Europe, over in Asia, where we'll bring people in, you know, MSPs, we'll bring them in. What are you seeing? What's going on? What do you need? You know, and we actually listen, generally listen.

And then we bring them back a year later and we show them what we did to hopefully meet those demands and meet those needs. Very interesting. You know, I've worked at places where you didn't even get to talk to engineering. You didn't know who they were, you didn't know who these product people were. You know, here we're working hand in hand with them, we're setting up these events, these calls, and they will deep dive into meeting people firsthand because they generally care, you know, they want to help, they have the tool sets and the skill sets to help and they want to share that with the world.

25:29 - Compliance, Global Operations, and Talent Strategy

Matt Pacheco
So you talked a little bit about AI and your specific example of the chatbot giving you something that could be incorrect and validating it. You said your child validated that. So human interaction is still really important when it comes to AI. How do you balance that at Bitdefender, the use of AI with human expertise?

Richard Tallman
You have to. The Checks and balances need to be in place, right? You have to have those checks and balance. I come from the again. I've been doing this for a long time. I'm a product of the X Files. Trust no one, you know, trust but verify. It's, it's just you have to have those steps in, those, in those things in place to trust but verify always. Right? So it's because if we're going to go run around with this trusted always mantra, you know, we better be watching our own stuff. And then if something did happen, how do we fix it? Because stuff, everybody, no one's perfect in this world. Just so we're clear, you can't point me in any direction of anybody out there. Oh, we do it, blah, that's great. What happens when it hits the fan, right?

Are you going to run? Are you going to roll your sleeves up and get in and help? And that's the difference between. I literally think that's the difference. Like we show up. There's been several early morning calls that I've been on where, hey, we're under attack. I think one attack. We stopped, we helped over 600 partners that were basically locked up with ransomware. None of our data was right, so it was other third party data. Everything that the Bitdefender on it was fine. Again, not that we're perfect. But then what we did is we came back and we said, okay, let's put our labs team together, let's figure out what the issue is, let's write the decryption tool for it and let's free it up. And I think it was like a billion dollars that we helped free up. Just ridiculous.

That's a lot of commas, man. I can't even fathom that. Less than our national debt, but a lot. Yeah.

Matt Pacheco
So you got the human expertise to interact with the AI on the other end.

Richard Tallman
There's Matt. You have to, right? Because it's a machine, you have to control it. You know, you can't just turn the lights on in a data center, say go for it. No, you have to run the power, you have to ensure the cooling's there. You have to make sure, you know, whenever that amber light's on, better hit the road, like go figure out what's going on. You know, you can't let certain people in. You have to be able to take that water bottle out, right. If you saw something. So you just, you can't, you have, it's still a machine. You still have to control it. Right. It's it's not a free for all yet.

Matt Pacheco
So humans could also be a vulnerability. How do you go about educating your staff and making sure your team. Because I bet in a lot of these instances where your third-party partners got ransomware, it was a break in the chain. Somewhere someone clicked an email, someone downloaded a PDF and did the wrong thing. How do you ensure security within your own organization?

Richard Tallman
We, our security Org, so we have another organ site that's a security org that just focuses on Bitdefender and they will constantly send out phishing email. It's. First of all, it seems like mostly it's human error, right, that's causing this. But again, if you balance that up against our. Her, she doesn't. She's not accurate either, right? So you throw a chem problem at her and she'll come back with an air. But if you let that air persistently run its course, you're gonna not end up in Vegas, you're gonna end up in Bullhead City, right? So it's a matter of like, wait a second, where am I? You know, so it's a matter of finding that and managing it in a sense. I don't know if I answered your question, but yeah.

Matt Pacheco
And I think you talked about you have an internal security team too. Who's that? Those phishing emails, That's a good test.

Richard Tallman
Well, I won't even share that sample. So they're sending them out all the time and they're really good. I mean, they will. I mean, it's. But as soon as we find out, hey, did you see that? Everybody's telling each other, don't touch it. You know, so the humans are working together. You know, it's almost like we're on the island of, you know, the lost boys. Yeah, don't touch it.

Matt Pacheco
So it's, you build like the culture around it. It's kind of, we're.

Richard Tallman
Yeah, it's. But it's. It seems like. And I can't remember the statistics, it's been a while since I've read those. But it's, it seems like social engineering is the component, you know that it's just the industry in the world needs more, right? I mean, think about the world we're in now and I'll divert real quick. Think about senior citizens, right? And the world we've given them. It's scary, man. Like, you've got to have a phone, you've got to have an app. You've got to log in. You have to trust this. You have to. You're just giving this trust away so you can get on Facebook or whatever. And I don't mean to, I'm not bashing Facebook anyway, but it's just an example, right?

And it's like how many things that are taken from that and then you've got the scammers behind the scenes trying to fish or grab. And I mean, it's just, it's kind of sickening in a sense, right, that people are being taken advantage of in that sense. But we've given them the world without an education. We've given them the power of a space shuttle. In their hands, they can access anything, anytime, anywhere. But with what education? You know, and that's the part we don't offer that educational component. We really just stick to our. We were going to help protect. But there's really good companies out there that will and that do. And I don't. I think that's something that we could offer more of. Right. And to be blunt, you shouldn't have to pay for that.

I mean, every kid in school has a tablet or a PC or something, you know, so it's, there's, it's not stopping anytime soon, you know, so the educational component and how to secure yourself. Don't join this wifi. Don't trust, you know, trust but verify. It seems like the world has become just trust and there's no verify anymore. Like, just trust, you know? Yeah.

Matt Pacheco
Get a vpn. I trust that VPN too.

Richard Tallman
Yeah. Greatest example, right? So, greatest example, you have a house. Do you lock it at night?

Matt Pacheco
Absolutely.

Richard Tallman
Do you have a ring doorbell on your.

Matt Pacheco
Yep.

Richard Tallman
So. Right. So there's two layers right there. You lock your door and you have a ring security system. So if they came in, do you have motion detectors? Right. It's like those layers are built in to protect your family. People need to think with that same mindset of their data. This is my data. I own this data. I'm just not going to accept and click all and join some free airport wifi that might not even be an airport wifi. It could be just some dude or whatever sitting next to you.

Matt Pacheco
Change the name of his phone. Yeah, yeah, it's device.

Richard Tallman
Yeah, we used to do that actually when I was with my buddy Mike. We would go in and we would set up like a dummy wi fi and people would join it and then we'd be in front. I remember one time were in front of like 400 people doing a demo. I would say like, so who's this? And we pull it up and we'd show their, like Wells Fargo. You're Wells Fargo. And then we would show their username and password, but we'd blank it out. And this one guy was furious. Take it off. Take it off my phone. Now it's like, hey, you joined the wifi. But yeah, no problem. You know, it was an example of how vulnerable we are and how almost too trusting we are in a sense, right?

As human nature, you want to trust, but in a sense you have to verify too. And you can't trust everything that's out there today.

Matt Pacheco
Very true. So let's talk a little bit about compliance, especially when it comes to multiple regions. Bitdefender is global. How do you get across or get by? Some of those big compliance challenges. When operating outside the US in multiple.

Richard Tallman
Countries, you start with a big legal team first. So our legal team is phenomenal. And I don't know how they do it sometimes, like you have to deal with, I think we operate in 170 plus countries, you know, so it's. You have to work, it starts with legal, right, because you have to protect yourselves, you have to protect the customer. And then from there then you have to set up the infrastructure and how we deliver this data, man, how do you. And then you have to adhere to the standards that are set by that region of that country, right? So let's say it's you're in Europe and your gdpr and now you're diving down into the individual country, right? Germany or France or Spain or Italy or, you know, what's their specific.

So you have to adhere to those standards and work from the top down. So you not only meet, but you would exceed some of those standards. It is a constant game, I will say it is a constant chessboard that's moving. And there's new talk here even in the States, right, where they're saying, well, we're going to go state by state. In a sense, that's what you're hearing on the street, where you're going to have to. Basically some states are more strict than others and they want to hear it. Seems like California sets the standard for that. Like look on every package that's out there, you know, according to California. I was like, when did California get to put their name on every package of food that's out there? You know, why isn't it Washington, why isn't it Idaho?

You know, but it starts with those lawyers and you just have to make sure. But ultimately it's the best interest of that customer. They're doing it for a reason and adhering to those. So what are we employing and what do we deploy? You start with working backwards to meet those demands and exceed those demands. And our infrastructure team is amazing. Right? They are, they're everywhere. You know, we are multiple sites, multiple places, multiple countries, multiple regions, crossing the pond, across the Pacific, et cetera. But then on top of that. So how do we then take that data and give it back to the customer so they don't have to worry about the compliance component? Right. So we're focused and fixated on the endpoints particular. So how can we put. We just rolled out our CSPM plus our cloud security posture management tool. It's phenomenal.

Right. So if I were to ask you, Matt, and let's say you're running your company, how do you know where all of your people are? Not necessarily people, but all those devices, where are they and what are they logging into? Right. How do you even know. Where do you start? What map? Is it a whiteboard on your. Or can we just basically ping all these devices and we can show you. Let me show you where they are. And then on top of that, let me show you the vulnerabilities that are in place at this particular moment. But then let me show you not only vulnerabilities, but how do you correct those, giving you those proactive remedies inside of our gravity zone security platform. This is the problem. Here's the path, here's the potential solution.

That's the path we're doing for the end user base and the MSP and the MSSP base to allow them to. Again, you don't want to make it a full time. Oh my gosh, this thing's all I see all day is Bitdefender. Do you want to hide behind the scenes and you want to help make things? Just know again, you want to trust the solution, you want it verified and you want to be able to work and do the rest of your things. You can log into the other 17 apps that are out there, you know, that you have to work on every day. Yeah.

Matt Pacheco
And then also in certain regions and probably in the US eventually there's going to be compliance around AI too. That's. That's darn.

Richard Tallman
I hope so. She's. She's not always right.

Matt Pacheco
I'll just say no, she's not. I think it's from. From her. Right. From Scarlett Johansson, from.

Richard Tallman
From the robot or Dave, I guess we could go back even further to Dave, right? 2001 Space Odyssey.

Matt Pacheco
Oh, yeah, Dave.

Richard Tallman
Him. Scary movie. Anyway.

Matt Pacheco
Oh yeah. So another big trend that we saw in our report and outside of our report, it's just something that's everywhere is this skills gap, this, these skills that you need for cybersecurity talent. Everywhere. Everyone's struggling with finding the right talent to do what they need to do for their security programs. What strategies has Bitdefender employed to attract and retain top tier cybersecurity talent?

Richard Tallman
It's, it is only going to. I'll tell you this, right? Let me, let meet that question first. It's only going to get bigger because data is not getting any smaller. And I think, you know that being inside the data center, it seems like we're saving everything, right? And then we kind of neglect it and forget about it. But it's still there and you still got to protect it. So it's only going to get bigger. The gap's only going to get bigger. I think you're seeing universities now. We do a lot of teaching in Europe. We have a lot of professors that are teaching cyber firsthand. We work here. So our Security Operations center, we started this about seven years ago. We founded our Headquarters for Society in San Antonio, Texas for a very specific reason. It is basically military, usa, right?

You have multiple bases. Cyber Warfare Command is there. Air Force, a lot of other agencies are there. So when they're maybe done with their government security analyst position, hey, you can come to BitFeder, right? Come work at Bit2Feder and be a security analyst for us. So we have a facility there in downtown. But that doesn't mean that we rely wholeheartedly on that facility. We have three facilities. We have one in security Operations center with best of breed, I think. I think I asked Tyler and Josh, what's the average just out of curse. Tyler was still Air Force Reserves, right? He's been there 18 years. On a call with him once, it was kind of funny. He's in his gear. I'm like, dude, you on base? He's like, yeah. So he's. But he's helping with a call and he's on base, he needs his gear.

And you know, I asked him like, what's just give me. He's like, oh yeah. Our av, our average real world operational deployment experience is about eight and a half years person of our security analysts, right? So we have layers in the SOC as well, right? So you have your sam, your security application manager, that's your first, that's your person, right? There's a person there you're going to communicate with. Our security analysts are then up there. They're the ones fighting the fight. They're the ones. If something's happening, they're fighting the fight. They can pull in. Yes, we have a building, but that doesn't mean that everybody's in the building. They can remotely dial in from that heads up display on their giant wall. Boom. Somebody else is on. Somebody else is on. And now they're all engaged in this particular battle.

And the same can be said for a Bucharest location or a Singapore location. You can just keep people popping up. And now you have multiple security analysts fighting that same particular fight. And then you have again, multiple layers. Right now we have our labs team is going to engage and they're going to deep dive into what's really going on so they can print, prevent that solution and that fixed to the particular issue that's taken place. So it's an interesting world. The ultimate goal is you got to prevent, detect, respond and report. Because if you don't reply that report back to somebody, they're not going to know what to fix. Right? Like, it's like, hey, we prevented it. Crickets, crickets. Like, what was it? You know, what was it? What do I do? Who was, where did they get in from?

You know, what's going on? So prevent, detective, respond and report. We actually did. They did a study on mitre, ATT and ck. Mitre, ATT and ck. So they did a study on MDR services. And again, we've been doing it for about six years, maybe seven. Our particular offering in the MSP community, we've rolled out about almost three years. It took us a while to build it because when you're in the MSP layer and the MSSP layer, you don't often talk to the end user. Right? I'm talking through a distributor or an RMM tool. They in turn have a partner, an MSP or an mssp. A partner who then in turn has a. So it's a B2B2B2C world. They're working with the end user. So I don't really talk to that end user. Martial Arts. So how do we build that tool?

So if one particular end user is set up to utilize our SOC services because they don't have the hands, right, how do we roll back up the chain? So if an incident takes place, how can that SOC analyst, security analyst in Singapore or Bucharest or San Antonio, how can they engage and know exact who, what, when, where, why and how right away, right? So to know. So from that MITRE ATTCK report, we actually ended up number one, which was like whoa. And were against some big dogs, man, I ain't kidding. Like we've been around a long time, but were against some big dogs in that fight and we ended up number one, which was really cool and pretty exciting and.

And again, I will say this, we're not perfect in any way, shape or form, but we're willing to roll up sleeves and get in the fight with you.

Matt Pacheco
Yeah, it sounds like you guys have a very robust security strategy and talent strategy and how to use your different teams. What's some advice you can give to listeners, organizations that are looking to effectively bridge their skills gaps in their security teams?

Richard Tallman
I think just letting them know that they're not alone, right? That there are companies out there, be it Bitdefender or somebody else, there's somebody out there that they can rely upon to use their security expertise, right? To use their analysts. Somebody that's been in the cyber warfare command for 18 years, right? And then those people, because first of all, they're not cheap. You can't go out and get your own. You could, but you know what it costs. Maybe you're a six person shop, you know, and you want to protect that business is all you have. You put everything into that business. Well, what happens if you got breached? Right? So it's like their data is no less important than somebody who has 50,000 employees, right. To that particular person.

So you have to take the individual one by one and treat them as such, like you are important, right? So just to know that you're not alone, to reach out to folks that do have that level of expertise and just to ensure like hey man, like if something happens, what's the plan? How can we prevent, detect, respond and report and hopefully. Honestly Matt, nothing ever happens. Hopefully. But if it does, you got to plan for the worst case scenario. I often use and people hate it, our hq, when I say okay, Rich is on a plane and I die, how are you going to access my data? And they always say that's pretty morbid. I'm like, I'm just. Worst case scenario, how do we use the worst case scenario? Taking a six man shop to a 50,000 person shop.

Worst case scenario, what's going to happen? Is our data safe? How can we report that data? And then more importantly, how can we remediate that and then go back and then fix It. So it's not there anymore. It's the known and the unknown. So we can make the unknown known and then move forward.

43:33 - Future Trends and Managed Security Services

Matt Pacheco
That's great advice. Wow. Yeah. Okay. My favorite part of the episode, looking forward in the future trends Question for you. What emerging trends in cybersecurity are you most excited about?

Richard Tallman
I think you've already touched on. I think compliance is a component that I'm very excited about and being able to offer that back to individual. The six man shop or the 50,000 shop, like there's people out there that today will do it. But how do we get it to the individual unit? How do we get it to the actual. Like, hey, is this tablet compliant with nist, pci? Whatever, Right. Whatever it is, you need to be. So I think compliance is a big deal. It's just in. The lawyers will bring that to us whether we want it or not. So be ready. Right. So how do we meet that demand? But it is kind of an exciting thing that you can validate, trust and move on. Right. To me, AI is interesting.

It's scary, but it's interesting because, you know, she doesn't, she's not always right. So use my example. Quantum computing, I think it's priced out of the world for most today, but so was UNIX back in the day, right. So was VMware back in the day, right. So at some point there will be a compression and a consolidation onto that once it's released. It's out there now, but it seems like it's universities and large, large businesses today. But once they figure out a way to commoditize that solution and bring it out to the masses, it's coming. So that's an interesting world to me. What's going to happen over the next five years. But I think primarily is the compliance standpoint.

Matt Pacheco
How do you see the role of managed security services providers evolving in the next few years?

Richard Tallman
They will have to adapt and move on. You got to move with the times. They're going to probably get bigger. Just like there's a, you know, back in my day, last century, you could go, I remember we used to go to a lawnmower shop and that lawnmower shop sold bicycles, right? And then Lowe's popped up and Home Depot and then the lawnmower shop went away, right. There was kind of a consolidation of things, which was a bummer because then that expert who could fix the lawnmower disappeared. You know, there's no more expert in a sense. So I think you're going to see a Consolidation of that world as well, right. To go from mini stores to giant Costco. Well, now people are just stocking shelves and there's no expert.

In a sense, I think you'll see the same thing happen in this world where there's going to be a mass consolidation of things and the experts are still there. But how do you access those experts? Right? How do you. How do I find the person that can fix my lawnmower or secure my, you know, data center? You know, it's. They're there, they're just being consolidated under the companies like Bitdefender, et cetera. So it's just a matter of finding the expert, giving access to those experts in an easy, simplified way so that we can help.

Matt Pacheco
Very interesting. Last couple of questions before we wrap up. I feel like we could go on forever, but. Yeah, but if you can impart one key piece of wisdom to cybersecurity professionals listening, what would it be?

Richard Tallman
I think trust but verify, right? It's like definitely engage in some type of social manipulation experiment, right, to make sure. Because it's again, like you touched on it earlier, Matt, that's the number one thing, right? How they're going to get in. You know, someone's going to hold the door open, right? Even if it's not secure, they're just going to hold. Oh, I'll hold the other. You know, it's one of the elevators where it's going to the 50th floor and you have to badge and somebody jumps on at the last second, like, wait a second, who are you? So some of those things, right? Deploy, deploy train. Just trust. BitVerify, I think, is the bigger thing I would recommend.

Matt Pacheco
It's a reoccurring theme and I love it. It's great. Simple, straight to the point, but effective. Last question for you. What's next for Bitdefender in terms of innovation and growth in cloud security?

Richard Tallman
I think for my specific group, it's really not necessarily pushing and not pushing and pushing is the wrong word. Not offering, just an agent that does a bunch of stuff. It's offering the services layered on top of the agent, offering the manage detection and response group. How do I give people that access to the person that can fix the lawnmower? I'll use that as analogy. But it's my security analyst, right, My security analyst here in Texas. I'm not in Texas, but here in the United States, in Singapore and Bucharest. How can I, how can I take that layer of defense of a person and an expert And a team of experts to put on top of those 50 horses. Right. Right behind the thing behind that is then a prevention technique is the offensive services. Right.

We just, we acquired a great company out of Singapore called Harangi, which means tiger and Korean. They offer offensive services.

Matt Pacheco
Right.

Richard Tallman
Pen testing. Right. How do you know if you don't know? So maybe look to that. I think you'll see a lot of that too. And those price points to get tested come down in the world for a long time. There was very, let's say, a few experts that could offer it and the price, they could charge whatever they want. I think you're going to see not necessarily commoditization of that, but more offerings and the availability to utilize something like that. That's. I think we'll see that on our group and Bitdefender, where it's not just our software, but it's the services behind the software, be it a prevention and detection solution or an offensive solution. Right. We're going to take the fight to them and figure out. And then here's your report and then we'll fix it. And then behind the scenes, the.

Our defensive folks will be able to monitor, prevent, detect, respond, and then report.

Matt Pacheco
Awesome. Seems like a very bright future for Bitdefender. And it was. It's great hearing about it and we really appreciate you being on the episode and speaking with us today.

Richard Tallman
Yeah, you know, I appreciate you, Matt, and I appreciate your company for doing it and getting the ability just to showcase because like I said, not a lot of people Even know who Bitdefender is, you know, so it's. We're more than just antivirus, you know, which we tend to win, I think 12 or 13 years in a row. I don't know, something like we win every year. Antivirus. Well, yeah, that's the first step. That's the first layer. That's the, that's the lock on the door, you know, but then the ring camera and the motion alarm. We've got all this other stuff behind the scenes, you know, to the watchdog, even, you know, so from our Draco unit, to our labs team, to our engineering groups, lawyers, we all have one purpose, right. We want to become trusted always to our customers out there.

Matt Pacheco
Well, we appreciate it and appreciate the conversation. This is a lot of fun and I'm sure if we have you on in the future again, we'll have a lot more trends to talk about because.

Richard Tallman
You know, you know, who would better, you know, who'd better to have on is Martin Zugic. He is. He's one of our solutions. Forward, thinker, architect, dude. He is. You'd want to talk to Martin. He's phenomenal. I can make that happen.

Matt Pacheco
We'll get him on the list. We appreciate it. So thank you for joining us today and for our listeners, we appreciate you listening in for more episodes of Cloud Currents. Check us on anywhere you get your podcasts, YouTube. If you're interested in the report I referenced earlier, you can find [email protected] and I will link it in the description of this episode. So thank you, everyone, and thank you, Richard, and have a great day.