Security Confidential S14 E6 Richard Hollis

Rory: Hello everyone, this is Rory Meikle, welcoming you back to another episode of Security Confidential, filling in today for Manoj. Our guest today is Richard Hollis. Richard is the founder and chief executive officer of RIS Crew. He is a seasoned cybersecurity professional and ardent privacy rights advocate who possesses over 30 years of hands-on skills and experience in designing, implementing, and testing the security integrity of business information technology systems. He lives and breathes cybersecurity and understands how to simplify it and make it relevant. Richard, thank you.

Richard: Oh, thank you, Rory, for having me. Thanks for that wonderful intro. Absolutely seasoned, by the way—the seasoned part is salt. It’s salty, no pepper, just all salt at my age.

Rory: Nothing wrong with that. Absolutely. Thank you for being here. So I guess let’s just get into a little bit about you—what’s your story, your background, and how did you get to where you are now?

Richard: My story, my background—it’s a long story. I’m an old guy. I’ve been in cybersecurity for well over 30 years. Prior to that, I was working for the government as a physical security expert—bypassing locks, alarms, CCTV systems, and whatnot. I did that in Washington, D.C. for years. Then computers started to become more attractive to me, so I transitioned into what is now cybersecurity. It wasn’t called that at the time—I think it was IT security—but it’s gone through a lot of changes.

I started with the government, moved into computer security, then into the private sector. I came over to Europe and started a company in London called RIS Crew. No products—just services like risk assessments, penetration testing, red teaming—basically breaking into systems. I’ve had the company for over 20 years now. We’re based in London and having a blast. It’s a great time to be in cybersecurity. It wasn’t very exciting when I started, but now everyone’s talking about it.

Back then, nobody cared. I started the company around the dot-com boom—everyone was focused on e-commerce, but nobody thought about security. Our industry has always been a step behind innovation.

Rory: That makes sense. So did you start the company specifically for e-commerce services?

Richard: We started around 2001 in London. At the time, the only buyers for penetration testing were banks—financial institutions doing online transactions. We were early founders of OWASP in the UK, and the focus was on web application security. So we started with application penetration testing.

Eventually, regulations like PCI came along and mandated testing. Then we expanded into risk frameworks like ISO standards, supply chain risk, security awareness, etc. We’re still a smaller company—half pentesters, half risk consultants. It’s a lot of fun.

Rory: When you talk about pentesting, do you do it manually or use automated tools?

Richard: It’s all manual. Pentesting has become commoditized—you can get “free” pentests online now—but we focus on sophisticated clients like banks who understand the value of manual testing. We prefer on-site work so we can transfer knowledge and show how vulnerabilities are exploited.

The real value now is in red teaming—not just technology, but people and process. Social engineering, physical access—it’s a more holistic view of security.

Rory: That’s a great point. It’s less about the technology and more about the human element.

Richard: Exactly. Companies spend all their money on technology—firewalls, IDS, products—but attackers take the path of least resistance. That’s usually people, not systems.

There are three attack vectors: people, process, and technology. Ask any company how they split their budget—it’s almost always 100% on technology. That means they’re neglecting two-thirds of the problem.

Rory: We talk about that a lot at Dark Rhino—people, process, technology. And you’re right, cybersecurity has become more about marketing than effectiveness.

Richard: I’m at a point in my career where I’m disappointed in the industry. Vendors sell products that don’t work. We keep buying more, yet breaches increase every year.

Take ransomware—it’s just malware. Everyone runs anti-malware software, yet ransomware still succeeds. That suggests those products are failing.

Products are often outdated by the time they’re released. Vendors keep selling them to recoup costs, even if they no longer address current threats.

Rory: So what’s step one to fix this?

Richard: Accountability. If you buy a TV and it doesn’t work, you return it. Why don’t we do that with cybersecurity products?

If your firewall fails, why aren’t you demanding a refund? Vendors have no accountability. We accept poor performance.

Cybersecurity vendors profit from insecurity. Just like pharma profits from treating symptoms, not cures. There’s no incentive to fix the root problem.

Rory: That’s a strong analogy.

Richard: It’s true. And we don’t even do basic due diligence. Before buying a product, Google the vendor—have they been breached?

Most top cybersecurity vendors have been hacked in the last 18 months. They don’t even secure their own systems.

Yet we trust them to secure ours.

Rory: That’s a huge disconnect.

Richard: Exactly. And we don’t connect the dots. We don’t demand excellence. We accept failure as normal.

Take SIEM tools—40% false positives. That means 4 out of 10 alerts are wrong. Imagine any other product with a 40% failure rate—it wouldn’t survive.

But we accept it.

Rory: And that leads to analyst fatigue.

Richard: Exactly. Analysts stop investigating alerts because they assume they’re false positives. That creates real risk.

We don’t demand better—and that’s the root problem.

Rory: So how do we make this more understandable to non-technical people?

Richard: Make it personal. People don’t care until it affects them directly.

Your data is valuable—it’s cash. Companies monetize it constantly. Until your data is used against you—denied a loan, denied insurance—you won’t take it seriously.

We need consumer awareness, just like car safety evolved. It took public demand to force change.

Rory: That’s a great analogy.

Richard: And cybersecurity needs the same shift. People need to demand better protection of their data.

Rory: What about cybercrime itself? It’s evolved a lot.

Richard: Cybercrime is now a business. Organized crime groups operate like corporations—CEO, CFO, HR, marketing, sales.

Top cybercriminals make millions annually. Coders make $1M/year. It’s low risk, high reward.

These groups are more sophisticated than most businesses.

Rory: That’s wild.

Richard: And they’ve adopted e-commerce models. Ransomware operations have customer support, refund policies, even review systems.

I’ve seen it firsthand—they ask for ratings after you pay.

Rory: That’s insane.

Richard: It’s a fully matured business ecosystem.

Rory: So what’s your advice to business owners?

Richard: Get in touch with your inner hacker. Try to hack your own systems.

All hacking comes down to three things:

• Change configuration
• Upload a program
• Gain physical access

Test your own vulnerabilities. Google how to hack your own systems. Watch YouTube videos. Learn how easy it is.

That awareness will change your perspective.

Rory: That’s great advice.

Richard: Make it personal. Understand the risk. Don’t rely solely on vendors.

Rory: Any resources you’d recommend?

Richard: Yes—go to risccrew.com. We have a white paper called “The Cybersecurity Industry’s Circle of Failure.” It includes actionable steps to improve your security posture.

Rory: Perfect. We’ll link that. Richard, this has been incredibly insightful. Thank you for your time.

Richard: Thank you, Rory. I really appreciate it.