Security Confidential S14 E10 Brian Vallelunga

Manoj Tandon: Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security: Security Confidential. Today we have another awesome guest gracing us on the show, Mr. Brian Vallelunga. Brian is the CEO of Doppler— a very interesting name for a company. He is a serial entrepreneur, and he has a ton of experience under his belt with success and, in his own words, failure on some of the research that we’ve been able to do about him.

His past stems from Uber, a big name in the industry, and he is a success branching out. So we’re grateful you’re here, Brian.

Brian Vallelunga: Happy to be here.

Manoj Tandon: How should we get started? Oh well, you know what? Everybody loves the origin story, so we’re obligated. So we’re going to do that. We want to know how you go from Uber to this. Doppler is not your first startup; you’ve done a couple.

Brian Vallelunga: Definitely not. It’s definitely not.

Manoj Tandon: And so, how does this begin? Where did the Big Bang happen? And then, what went right with it? What went wrong with it, if you want? And then we’ll get to Doppler as to what’s happening now.

Brian Vallelunga: Yeah, sure. So Doppler is startup number eight. So there’s been many failed attempts to build a successful company, and I’ve always wanted to build a successful company since I was very little. I mean, you could ask my parents and they would say when I was in Middle School, I was talking about this. I’ve just been very obsessed with this one thing for a very long period of time.

I actually was working on a startup in college and it wasn’t going that well. It was heading to summertime and I needed an internship. I applied to Uber and I got in. So while I was at Uber as an intern, I was actually working on my side project while also working at Uber at the same time.

Fast forward a little bit, I had a kind of crazy career at Uber. If anyone knows the history of Chris Sacca, who’s an investor, he had a kind of crazy career at Google. One of the things he did that I really loved and I started doing the same was just attending any meeting I could. Uber had an open-door policy, which meant if there was a meeting with the CEO and a bunch of VPs, if it wasn’t explicitly closed-door, you could join it.

I started doing that as an intern, and they started noticing and gave me bigger and bigger projects. At one point, my manager comes up to me and says, “Hey, a lot of engineers are kind of upset because they’re reporting into you as an intern right now, and that’s not cool for anyone.” So they kind of gave me an ultimatum: drop out of school or join full-time.

I dropped out of school for the second time and joined Uber full-time. While I was at Uber, I was still working on this side project. The side project was kind of like all the buzzwords in one: it was a crypto machine-learning marketplace. Boy, was that a hard thing to get off the ground. It was a real struggle; it kind of felt like pushing a boulder up a hill. Every foot you move forward, you slip five feet back from exhaustion. It was just really hard.

Manoj Tandon: I gotta ask you: was this crypto machine-learning marketplace—was that name or that description done to woo investors or was it actually a product idea?

Brian Vallelunga: It was a product idea. The idea was that machine-learning models are becoming more and more valuable. Crypto at that time felt like there were a lot of coins out there, but all of them were kind of shit in my mind. They never really served any underlying value, and coins needed to have value to really have a valid marketplace.

So the idea was compute was becoming more readily available, models were becoming more powerful, and there was this coin market that was exploding. So you could have a coin that allowed you to run inferences or predictions on models, and then other people could host their own compute. Someone could say, “I have this spare computer; I’ll just put it on the network and I’ll make some money” by allowing machine-learning models to run on it. If you had a model, you could make money by just putting the model on the marketplace, and you didn’t have to worry about compute.

We were a little bit ahead of our time there, because there’s now a company that’s very similar, not crypto, called Hugging Face that is doing exceptionally well. It’s a good example of timing fit, where we were ahead on the product and the timing, and that actually hurt us. But yeah, that was a real company and not just for the names, but also just because I thought it would actually drive real value. But it was hard. It was really hard.

Eight months into it, I was really frustrated and I just wanted to take a break from it all. So I took a trip to Cancun. The idea was that I’m not going to think at all about the startup; I’m not going to think about Uber. I’m just going to relax for a week. That’s not at all what happened. My mind was racing the entire time I was there.

What I realized was that sometimes you’re just not the right person for this business. The business could be good, maybe at the right time, but you’re not the right person for it. I realized that I was never going to get this company off the ground, but I’ve always been inspired by other founders. Kind of like how other people track NBA players and say, “This is how well they shoot” or “This is how they dribble,” I kind of do that about founders. I see them as playing cards or trading cards.

At the time I was really obsessed with Stewart Butterfield from Slack. I think he’s probably one of the best in the industry at failing upwards. He creates this video game; this video game fails. Born of that was Flickr, which becomes a big success. Then he goes back and says, “I’m going to create a video game for real this time” and does it again. It fails again, and born out of that was Slack that now everyone uses and was bought by Salesforce after going public.

So I was like, “How can I fail upwards here?” I started looking at all the problems that I was facing while running this project and managing environment variables and secrets— which are API keys, database URLs, configuration, anything you need to configure your code at the environment level. I kept having problems with it; a lot of different problems all from the same root. I was trying to figure out what was going on there.

After coming back from Cancun, I went to this dinner that Stripe was hosting called the Atlas Dinners. They would bring in a bunch of founders and developers and you just have great conversations. At one point I asked the room, holding up a glass of champagne, telling them about this problem that I’m facing. I’m like, “Hey, just be honest with me: is the world broken or am I a shitty developer? Because I cannot tell anymore.”

About 50% of them were really having problems with it. One woman in particular—this is the woman that really kickstarted the Doppler journey— she comes running up to me about 10 minutes later and she says, “I’ve had three outages this week. Have me a solution by Sunday.” It was a Wednesday and I was like, “No, no, no, this is going to take way longer than that to build.” She goes, “I don’t give a fuck. Have it by Sunday.” I was like, “Okay, I hear you. I don’t know if I can have it by Sunday, but I hear the pain.”

Right after that, I started talking to other companies.

Manoj Tandon: I have to interrupt here briefly on a few things that you mentioned that I’m sure our audience would love to understand too. You made the statement that you knew that you weren’t going to be able to get your crypto machine-learning company going forward. How do you avoid the trap of falling in love with your own idea and come to the realization, “You know what, I thought it was a good idea, but it doesn’t work. Call it a day.” How do you get to that place? Because a lot of people fall in love with really bad ideas and they keep them. That’s the first question. There’s a couple more, but if you could start there.

Brian Vallelunga: Sure. I think there are two steps in this process. The first step is to look at all the attributes of a company and see if it’s well-designed enough. In crypto, most people didn’t know how to use crypto outside of trading. Machine-learning models were incredibly expensive to build, and then you’d have to have monetization on the other side to make it worth it to take this model you spent millions of dollars making and then charge a couple cents on it. You really need a lot of volume there for the market to be really valid. There were a lot of properties of the business where in hindsight they just looked obvious, like, “The market isn’t mature enough yet for this.”

But I think the second step, which is something you build over time—you’ve got to fail a bunch of times at building companies to really hone those skills—is a little bit easier to do the first time around. Every three months, take an emotional step back. Don’t see yourself as the founder of the company or the CEO of the company. Just look at yourself as a bystander and ask the question: “Is it working? Am I pushing on the market for the market to buy this, or is the market pulling me?”

If the market’s pulling you, you have a good product; you have product-market fit. If you’re pushing the market, you don’t have product-market fit. If you’re pushing in that category, is it like if I push just a little bit I make some money, or am I really pushing hard and no progress is happening? The more you have to push, the worse your product-market fit is. After enough time, you basically can call it quits.

I went through two cycles of that—well, two and a half, because it took eight months. Three months in, okay, it’s not working. Another four months in, it’s still not working. I called it quits a little bit after that. But it’s really hard because you have this emotional connection.

Manoj Tandon: The presence of mind and the objectivity required for that decision-making—it’s akin to the mountaineering world where they talk about “summit fever.” A lot of people die on the way down from Mount Everest because they lose complete sight that getting up there is only halfway; you’ve got to make it back too. That’s when the majority of the people get killed. Had they made the right decisions and said, “You know what, today is not the day,” they would be alive. Thankfully, with startups, nobody loses their life. Thank God the downsides are quite low. It speaks to the emotion of it though, right? You get sucked into it.

Brian Vallelunga: I would say most of the companies before this—this is going to sound weird, but I think I’ve gotten better and better at killing bad startups. The first time I did a startup, I went two and a half years before killing it. This was a tiny startup that no one would ever be able to find on the internet, but it took way too long for me to kill that thing. I feel like every startup, I got faster and faster at it.

Now I’m like, “Okay, I can know pretty quickly within three months if it’s going to work.” A lot of times when I advise other startups, I can tell them pretty quickly even before. You kind of build up an almost Excel spreadsheet-like matrix. You can evaluate a startup based on the properties of the business. Push/pull is one property of the business, and you just get better and better at understanding what are the properties that really make a business valid.

Manoj Tandon: Of all the guests, we’ve never had anybody articulate it like that. That was worth the price of admission right there. Love it. No one’s ever actually said it that way, and I think it’s a very succinct way of putting it. I’m going to steal that from you.

Brian Vallelunga: Do it, please. I think if you can prevent the next entrepreneur from having seven failed startups, that’d be amazing because that was many, many years of my life.

Manoj Tandon: Which is actually the second question. You have very successfully raised money with venture capitalists. Now, when VCs a lot of times are by the numbers, how do they see seven failed attempts? Was that a negative against you when you’re talking to them?

Brian Vallelunga: No, not at all. Not at all. They see it as a positive. Who do you want in the ring? Do you want the guy that gets punched once and doesn’t get back up because it hurt too bad, or the guy who keeps getting up and keeps taking the beating because he knows all he needs to do is land one really good punch to win the fight?

That’s good entrepreneurship in my mind. You cannot avoid failure; that shit’s coming. That’s a train that’s going to hit you. But what you can do is choose to get back up and keep fighting and learn from it. Every time, maybe get better at dodging the train. That’s how I think they saw it for me.

I always have this fundamental belief in two things: one, in myself, that I’ll be able to iterate my way to success. Every time, I get a little bit better, or a lot better, at striking gold. And then the second is that I only need one win. It’s kind of like security in the adverse way where an attacker only needs one win and the defender needs to cover their bases. It’s the exact same thing in the startup world. You only need one successful startup to really make it big. Doppler is that one for me, and it took many, many years of failures. But I knew that if I just didn’t give up—the second I give up, the game’s over. So the only choice is not to give up. That’s the only logical choice if you want to play the game, and I really like playing the game.

Manoj Tandon: You have a huge amount of passion for it. It certainly shows through the way you’re putting it. That failure—I think a lot of people look at it as a negative, and you’re saying it’s a train that’s inevitable. I agree with you. I don’t know of any entrepreneurs that have not failed and are not able to answer the question: “Where did you fail and what did you learn from it?” If someone says, “I’ve never failed,” to me that’s all kinds of red flags. I don’t know what your thoughts about that are.

Brian Vallelunga: Yeah, I think that’s a red flag because if you’ve only had wins under your belt, you’re either God’s gift to the world—I.e., incredibly lucky—but also you haven’t learned. The learnings come from the failures. When everything’s successful, it’s easy mode. But not every part of your journey is going to be easy.

Jensen from Nvidia said this really well: “You build character through struggle.” You need a lot of character to build a good startup. I also think that humans by default are naturally bad at two things: they’re bad at exponential thinking and they’re bad at evaluating risk. People think very linearly, but being a founder, that journey is an exponential journey. You can go from zero to billionaire in three or five years. That’s not a linear journey.

On the flip side—the negative case—the risk is really low in my mind for a certain set of conditions. If you are unmarried, don’t have children, have low dependencies, and are young in your career, it’s actually very, very low risk because you almost always end up positive from the experience, even if you fail.

Think about what it takes to even just get a company off the ground. Think about all you had to do. You’ve proven that you have some level of stamina, some level of strategic thinking, and some level of product ideation. You’ve done a bunch of things you would have never done before. Now you take it up a notch and raise your first round of funding—a couple 100K or 50K. To be able to raise money, you have to be good at storytelling; you have to be able to tell a good story and have a good vision. You have to build a network. You have all these things that you can lean on for the next company.

It’s not like you reset to zero like in a video game; you just start at the place you were last at. If you fail at pre-seed, now you’re a pre-seed founder and you can go raise pre-seed again pretty easily. Then if you go and raise a Series A and that’s where you failed, getting to a Series A again will not be that hard at all. I could probably do it in under two months, maybe even faster than that depending on the quality of the idea.

So I think that’s where people get it wrong: the risks are really low because you almost always come out ahead. I used to hear this all the time from my friends at Uber. They’re like, “Oh, I just need one more promotion to Senior Software Engineer to be able to start my company.” I’m like, “Dude, none of that shit matters at all. The only thing that matters is getting in the ring and fighting.” Every time that you get knocked down, just get back up. You’re not at zero anymore; you’re at the place you just lasted at—the last level. It’s kind of like a checkpoint in a video game. If you die, you don’t go all the way back to the very beginning of Call of Duty; you go to the last checkpoint. That’s the exact same thing in real life. The risks are really low.

Manoj Tandon: For everyone listening, take that to heart because it’s very true. You have to have the tenacity and keep with it. And that foundational belief that you can do it. If you believe you can’t do it, then I kind of think you’re wasting your time even getting in the ring. I mean, if all you see are the odds against you, it’s already over because that’s a self-writing story at that point. I think if you really have the environment to do a startup—like you’re in the US and the right conditions are there—I think you really should do it. Especially because I think humans are genetically made for this. We are predisposed to being really good at taking something from nothing to something. That’s the reason why humanity has reached the heights it has so far. It’s built within you; it’s already there. All you have to do is be willing to trust in yourself and tap into it.

Doppler—it’s interesting that you drew upon the train analogy. Anyone that’s taken a fundamental physics class knows Doppler physics are taught with the train analogy. It’s the sound that starts off real dim, gets real loud, and then goes dim again. That’s the Doppler effect. Was that your inspiration for naming the company, or where did that come from?

Brian Vallelunga: That was actually our inspiration for naming one of our conference rooms back when we had an office. We called it Blue Shift Red Shift.

Manoj Tandon: You’re an astronomy fan as well?

Brian Vallelunga: A little bit. I think space is—I mean, we’re all in space; space isn’t “out there.” We are in space. Once you have that realization, it’s kind of hard to look anywhere else but forward.

But no, I think the name didn’t come from there. It was really a couple things. One, I wanted a name that felt familiar. I think most people even in high school are taught about the Doppler effect. So there’s this familiarity presence there that I really liked. But the bigger thing was I didn’t want to lock it into what we did today. I didn’t want it to be like “Doppler Secrets Management Company.” I wanted to be a company where you felt like you could do the best work of your career, and the company had to keep earning its name. If we slow down, we don’t get to earn the name Doppler anymore.

Doppler just had this really unique thing: it’s short, it’s easily spelled out, it’s memorable, and it feels like this is where you do the best work of your career. It was that emotional connection I had to it that made me choose the name.

Manoj Tandon: So, what is the problem set that you guys are solving? And are you experiencing a market push or a market pull?

Brian Vallelunga: I’ll answer it in inverse order, because I’ll build up into why I’m super excited to be on this podcast to begin with. I would say for us, we are in pull. I could argue that the market should be pulling us a lot faster than it is, but we’re still in pull mode for sure. A very easy way to mathematically quantify that is: if we just do nothing, do new customers come in every day? The answer is yes. We get somewhere between 50 and 100 customers a day just by doing nothing. That’s clear pull. I would love it to be a couple thousand a day—that would be the dream.

The reason why I came on this podcast is because I’m actually here to do a PSA. For anyone listening, if you work at a company in a dev position or an engineering position, or you’re a CEO or executive, this is the PSA for you. In short, what I’m here to talk about are something called “secrets.”

The backstory of why secrets matter is that the everyday person uses more and more services every day. We use Netflix, DoorDash, Venmo, and those services are getting breached every single day. There’s a real impact to both the company and to the people that are trusting those companies with their data.

A little background about what a secret is: it’s a fancy term that doesn’t really mean much until you have that background. A secret is a piece of data that is highly sensitive. It shouldn’t be out in the public; it should only be for that company to use and see. That secret generally is like a key to a door, and behind that door is a bunch of data. Think about Airbnb. Airbnb has a database, and that database has a bunch of listings, payments, and transactions. To get access to that database, you need that key—typically called a database URL or an API key. Those are secrets. You can imagine if the key is out on the internet open for anyone to see, like a hacker, they can go into that database and steal all the data out of it. That’s really scary for both the company and the people that trust the company. There are tons of examples in the industry today about this.

Manoj Tandon: Let me ask you the dumb question then: how is this different from LastPass or another password manager?

Brian Vallelunga: Great question. This is a really important difference between secrets management and passwords. Passwords are for humans. I have a Netflix password, and that is only for my account on Netflix. Secrets are not like that at all. Secrets are passwords for companies—generally for software. That one secret gives you access to everyone’s Netflix, everyone’s Venmo, everyone’s Airbnb, everyone’s DoorDash. It is the one key to the entire data kingdom.

These pieces of text are no longer than a password; a lot of times they’re even shorter. There are thousands of them within a company. It only takes one of these secrets to get out for there to be incredible cost to both people and the company. I can talk about those costs—they’re quite massive from a company’s perspective.

Manoj Tandon: If we centralize them all—playing devil’s advocate here—I’m sure you have an answer for this. When you centralize them all into the Doppler ecosystem, then all I have to do is hack Doppler. Now I really have everything.

Brian Vallelunga: Yes, it’s partially true. We offer something called Enterprise Key Management. The idea there is that a customer can connect their AWS, GCP, or Azure account to Doppler and use their own encryption keys. So even if you were able to hack Doppler, you still don’t have those encryption keys; that comes from the customer. You would need to be able to hack AWS, GCP, or Azure to get that. There are layers of protection in place.

Also, the place where Doppler stores those secrets is not accessible by the internet; it’s very far removed and very locked down. It would be very hard for a company to breach that. Let’s just say they did breach that—they got through all of our walls of defense. We double-encrypt the data. We encrypt it once with our encryption key per customer, and then we also use the customer encryption key. Now you need to breach AWS or GCP twice—or sometimes even AWS and GCP depending on what cloud provider we’re on and the customer is on. There are layers and layers of defense there that really silo each customer’s secrets to them by themselves. There’s a level of data isolation that should protect those customers.

We have over 50,000 companies using us today. We fend off attacks every single day, and we haven’t been breached. I think we do a pretty good job because of the security architecture we built.

Manoj Tandon: Wow. So you’re very much taking—like an API key from Stripe. Would that be an example?

Brian Vallelunga: That’d be a great example of it.

Manoj Tandon: Before we get too much into solution territory—because I really don’t want this to be an hour podcast on Brian pitching Doppler—the point is to really help anyone listening understand that you probably do have this gap. What are the costs of this gap?

Brian Vallelunga: From a company’s perspective, if you have a data breach, there’s brand reputation. Think about Equifax and how much that’s tarnished their brand. You could lose customers from it. You’ll probably have a lot of unplanned spend because now you have legal issues, PR issues, and insurance premium increases. Your team’s going to be focused on fixing this breach instead of shipping new product. If you’re big enough or in a regulated industry, the government could step in and add more regulatory scrutiny. There’s litigation risk. If you’re not protecting your secrets, which are the literal keys to the data kingdom, you’re negligent. That is totally valid for companies to go and sue you for.

On the people’s side, I see this all the time and it is very frustrating: I see companies talk about data as just data. “Oh yeah, we have data, we store data, we have terabytes of data.” But that data is from people. People are trusting Uber and Netflix. That’s real people’s data. That’s my data, that’s your data. When that data gets out, it hurts real people.

I can tell you a real story. I live in Austin and I brought my mom out for a weekend. We were going to this barbecue joint and I got a call. It was from a spam caller—but at the time I didn’t know that—claiming to be from Texas Customs. They’re like, “Hey, we have this package in your name that has illegal drugs and illegal money in it, and we’re investigating you.” They start rattling off a bunch of facts that no one should have known. There were easy ones like my address, but there was stuff that clearly was from a data breach. It felt so real in the moment.

Remember, I’m a CEO, I’m a target, but I know this is happening to a lot of other people right now. They were able to make it feel so credible because there was a data breach from another company. My data got exposed and they were able to use that to get even more data out of me. I accidentally leaked one more piece of data that I shouldn’t have, and I’m sure the next time they try to attack me, they’ll use that.

So it’s really important to remember that this data that companies are charged with protecting is real people’s data that has real consequences when it gets out—not just some extra burn for the company or some bad PR. So it’s really important that we protect those secrets. That’s the PSA. We can go into why this is happening and how to solve it.

Manoj Tandon: Well, foundationally, is it not happening because we’ve traded convenience for security?

Brian Vallelunga: I think there are two parts to it. One is there is a lack of knowledge, which I’m trying to fix right now, around secrets. I would say that the entire software development and DevOps industry is quite mature. There’s a lot of robust tooling. But one of the few things that people just haven’t invested in is secrets management. They’re like, “Oh, I have these API keys; I put them in this file and I’m good.” It works, and they’re only thinking about it from an “it works” mentality—my server stays up or my developers can keep coding. They aren’t thinking about the implications. If just one of these pieces of text in this huge file of keys gets out, the whole company is fucked and all the customers are fucked. Sorry for the language, but it’s true.

Manoj Tandon: That’s pretty much the right description. The last time I looked, I have been in 17 data breaches or something like that. That number is way too freaking high.

Brian Vallelunga: Companies need to be doing a better job, and it’s not that hard to solve it. Actually, the thing that I’ve learned the most from my time at Doppler is that the bigger the company, the worse their security posture is. The reason why is because you really need to bake security into the company and into the product on day one. If you just slap it on as an add-on later, you’re never going to do a good job. Remember, you need to cover all your bases as a defender; an attacker only needs one entry point. There could be millions of secrets.

I like to ask companies three questions. This really is the nuts and bolts of it. If a company cannot answer these three questions, they have a very serious problem. It’s not a matter of if they’re going to get hacked; it’s just a matter of when.

Very simple questions: Where are all my secrets? Literally every piece of secret—where are they? Are they in production infrastructure? Are they on developers’ laptops? Are they on past employees’ laptops? Do contractors have them? Who has access to them? And can I stop a data breach when it happens?

If an API key gets out in the public, can you quickly remediate that without bringing yourself down? I’ll tell you a real story. We had a customer come to us—I can’t say the name, but I promise you know the name. You probably use their product on a daily basis. They told us that they had a data breach where someone inside the company was like an implanted spy who stole the secrets and left and sold them on the black market.

When that happened, every single secret now—because when a data breach happens, you don’t say, “Oh, that one secret that got out is now vulnerable.” You say every secret is vulnerable because we don’t know what our risk exposure is. So they decided rightfully that they had to rotate. You swap out the locks, right? You say this key is void and this new key is valid and working.

They said they had to rotate 15,000 secrets. It took their team of three security engineers six months to rotate every secret. That was six months of the roadmap that just got reallocated on a dime. That was six months of security headcount that went out the window. That was six months of risk of further attacks happening because the window for an attack was still open. That’s how bad this gets. If you don’t have the right tools in place before the attack happens, you’re now in a manual process of playing this game where you need to swap out the keys to the kingdom while not bringing the company down in the process. You have to do it very slowly, which gives the attacker the advantage. They have all the time in the world to basically use those keys to attack you.

Manoj Tandon: Brian, if you bring this up to the beginning of the development cycle, it becomes that classical problem where most dev teams are under a time crunch to deliver an MVP by an X date. The easiest thing to deep-six is QA time, and what’s even easier is to hell with the security. They never had that in mind when they did it. That is a classical thing that happens every single day. How do you get to these decision-makers who have little understanding of a development cycle? What they’re asking for is potentially a compromise of their brand, of legal and financial losses, and of regulatory fines. They don’t see it that way. How do you make it a tangible connection?

Brian Vallelunga: I think we usually get customers from two different points of view. The first point of view is the security side. They’ve grown the business enough where they realize, “Oh shit, we built something valuable; we need to protect it now.” That side is pretty easy.

I think the other side is that there’s this misnomer in the industry that security comes at the cost of productivity. For a lot of tools, that’s absolutely true. For all of our competitors, that’s true. The one thing that makes Doppler very unique is that the right security tool makes everyone more productive too. I like to think about it as making vegetables taste like candy. If you make the vegetables taste like candy, people will want to eat them every day. So we spent a lot of time doing that.

The second side people come to us from is they say, “Hey, we have all these secrets all over the place and that’s causing production outages and loss of developer time. We need to make the productivity problems go away so our developers can get back to writing code.”

What we’ve found is that it’s really, really hard to convince someone who doesn’t think there’s a problem that there’s actually a problem. We’ve tried a whole bunch of different ways. What I’m trying to solve here with this PSA is—and I’m not saying go buy Doppler; you can go buy someone else. I’d love it if you buy Doppler; hopefully, I’ve proven that I’m an honest, trustworthy person. But even if you don’t pick us, go solve the problem. I probably have my data in your systems, and I don’t want another data breach. I’m pretty sure everyone else doesn’t want another data breach.

I think the right tools make it really easy. You’re seeing this across the board in security these days—like Wiz or Doppler—where it doesn’t take that long to get the win in. With Doppler, a small company can get a win in a day. An enterprise can get it in two to four months. If you buy the right tools, they actually make your developers more productive. You get two wins there: the company’s more secure, and you can think about it like an insurance policy. If something goes wrong, you can unfuck yourself really quickly.

Manoj Tandon: Well, obviously in the cyber liability world that’s not holding true very much, but that’s a whole—we could do an entire show about that. Unfortunately, some of our best customers have come to us after the horse left the barn. Or they are educated through experiences—maybe not in their current format, but in prior formats—and they understood that not addressing the security issue is a potential death knell for the company. I can tell you in the SMB world, six months post-breach, the majority of companies are out of business.

Brian Vallelunga: 100% true. They just don’t have enough working capital to like give them the runway to recover from that. I mean, it kind of like what is it—it’s where like in nature the strong survive and the weak die off. It’s like that. If you didn’t protect yourself, if you didn’t build the shield from the obvious attacker that’s incoming, then you’re gonna get taken out by the arrow, right? And like the arrow is the hack. And so in my mind it’s like if you want to build company that’s worth anything then you have to protect it from it being destroyed and the very obvious solution here is to add some security on. That’s the whole point of security.

Manoj Tandon: Brian, where does open source—how does that play a role in this because you’re borrowing those libraries as a developer?

Brian Vallelunga: Open source in my mind is very complicated because there’s lots of different dimensions to open source. I think from a purely security lens open source is a good thing because as long as those packages are audited then it’s you have more eyes on it than not. But I do think that they run the risk of supply chain attacks.

Now Doppler does something—and I think most companies should be doing this—is it’s called package freezing. Basically what we say is we audit every package that we use internally and then we freeze it. We say we’re only going to use that package and all of its dependencies are frozen too. So if there’s a supply chain attack, we watch the vulnerability channels. So we’ll be like, okay a vulnerability is now popped up for package in a future version than our current package and we handle that before we basically bump up the version.

And then on our most precious parts of the infrastructure, like what we call our tokens server which encrypts and stores the secrets, that has no dependencies. The only dependency it has is Golang which is then converted into a binary. So the dependencies are very low. It’s not subject to a supply chain attack outside of Go itself being breached and then somehow it’s like an old breach or like an old vulnerability that then is subject to being able to attack our binary. A lot of things would have to happen for that attack to work.

But yeah, it’s a real problem. I’m glad there’s companies that exist now that really watch closely like the open source community because it’s very easy for, imagine if you’re a well-funded attacker, it’s very easy to go to someone who has this package that’s been around for years, extremely depended on, has probably like million weekly downloads on NPM and say, “Hey, I’m going to offer you $100,000 for this.” And they go, “Oh [__] payday of all paydays.” And then in the next version they just sneak in a little attack and that package is used 20 million times a week by other packages. So like you think you’re downloading React but you’re actually downloading 50 other packages along with React because React needs those packages and boom, now you’ve been hit by the attack. So it’s very, very real. But I think the benefits outweigh the cost if managed properly.

Manoj Tandon: Where do you think—and it’s obligatory for me to ask this so I’ll apologize—I really don’t, I’m kind of tired of hearing the term machine learning and AI because it’s been—yeah, seems like you can’t even the toilet flushing mechanism has AI in it now for some reason—but where do you think AI, how is that going to impact what you’re doing at Doppler and in terms of secrets management? And let’s go one step further, if you were looking into the mid-range future, where does Quantum Computing—does it affect what you’re going to do?

Brian Vallelunga: Yeah, it’s going to. Both are going to affect everything, I think in the same dimension, which is again attacker needs one entry point to win, right? And then the defender has to cover all their bases. And AI is just going to make the attacks more sophisticated, making presenting entry points that weren’t even thought of before. And Quantum Computing is just going to increase your ability to try multiple attacks at the same time and they’ll also be able to like break the current encryption standards.

I think the whole world is going to have a huge issue when Quantum Computing becomes readily available because like AES-256 cannot withstand a quantum computer. That will break every—the AES-256 is like basically the default encryption standard for like almost every company, right? Like SSL is built on that and a bunch of others. And so if that gets broken all encryption today will get broken and all private data is essentially public data.

So I think what will need to happen is like we basically wrap—we have a new encryption standard, a new encryption standard will need to be quantum safe and we’ll need to wrap all the existing encryption keys with that, with the new quantum safe protocol and basically we need to protect all the old and then produce only new quantum safe encryption keys going forward. So I think the industry needs to get ahead of that now. Like we need to be doing that now because we have no idea when Quantum computing is going to become readily available. It’s already starting to become more and more available, but when it becomes super readily available where you could just like spin up an instance on AWS, that’s gonna be scary.

Same thing with AI. AI is just gonna find more entry points and it definitely is going to make it harder for every business—Doppler and every other security business, every other business on the planet. Every business that needs security, which I’d argue every business does, AI is going to make the problem a lot harder and so it’s better get ahead of it now.

Manoj Tandon: Well I think with the quantum Computing you’ve described the problem that’s going to create an industry. If you remember back at the Y2K days nobody cared about it until it was inevitable. I have a feeling the way human nature is no one’s going to care about this until it’s inevitable and then all of a sudden there will be massive Consulting houses that will offer services to—

Brian Vallelunga: Yeah, I don’t know. I think this one’s really interesting because like I think both AI and quantum computers, the best models and the best quantum computers will be held by the companies with the most resources and so there is a strategic Advantage there for actually acting in the shadows, right? Like instead of going and every company gets hacked on day one and then every company goes oh [] and updates all their crypto keys overnight, right? It’s better for them just to be able to like—and I’m not saying any company in particular is going to do this or any nation states in particular is going to do this—but whoever has those, they are strategically advantaged to just like hacking companies quietly and companies trying to figure out how the [] did my encryption get broken and then they’re gonna—and then they may realize years later, oh, with a quantum computer. And this will just happen in the shadows for a long enough period of time where they have such a strategic advantage that it makes sense for them to open up about it or the industry to become aware of it.

So I think there’s not going to be like one big doomsday with AI and Quantum. I think it’s just going to be a lot of attacks that are very Target and strategic that are going to be very, I guess like flawlessly executed. So it’s going to be really big attacks, very infrequent, that it’s going to make it very hard to figure out is it actually a Quantum attack, is it an AI attack, or is this just a gap we had in our existing security posture.

Manoj Tandon: Brian, we’re at the hour. I wanted to make sure that we gave you a little bit of time here to plug whatever it is that you’d like to plug. You know, if you—any call outs, anything, let our audience know anything you want them to know about, anything you’re up to.

Brian Vallelunga: I’ll keep it very simple for everyone in the audience so they can stop listening to me. I’m going to give you a quick smoke test and this is going to tell you if you have a fire. Basically can you answer these three questions: Where are all my secrets? Who has access to them? And can I stop a data breach when it happens? If you can’t answer those three, you need a Secrets manager. Doesn’t have to be Doppler. I’d like you to use Doppler, but it doesn’t have to be us.

And a good Secrets manager should do the following things: it should centralize all your secrets so that you know where all your secrets are that you have to protect, give you the ability to manage who has access to them, give you auditing tools to know when they were accessed, it should natively integrate in your infrastructure so when you make a change it updates in your infrastructure so you don’t have outages, and gives you the ability to remediate a breach quickly when it happens. If one of our customers has a data breach they can fix the problem under five minutes versus six months.

So if any of that feels familiar to you or you feel those pain points, I strongly recommend going to doppler.com/unfuck and that will give you a walkthrough of what we’ve been talking about on this podcast and give you the early links to go to to start learning about how to solve the problem.

Manoj Tandon: If someone wants to reach out to you Brian how do they—what’s the best method?

Brian Vallelunga: Brian, B-R-I-A-N, @doppler.com. I always respond to emails. Just put that you saw me from or heard me from this podcast and I’ll respond as quickly as I can.

Manoj Tandon: You’re phenomenal, Brian. Love the enthusiasm. Sage advice on the entrepreneurship front, on the secrets management front. Keep doing what you’re doing. I think you’re making us all a little bit more secure, which is the mission that we’re on.

Brian Vallelunga: I appreciate you hosting us and having this podcast and everyone who’s gone this far and listening to the podcast and hearing us rant for an hour. I really appreciate you too. Thank you so much.

Manoj Tandon: Yeah yeah thank you everyone and don’t forget to like And subscribe so that we can keep producing this content. It matters people. Like subscribe, download, tell your friends about it. It helps us out, so appreciate it. Take care everyone until next week.