Security Confidential S15 E2 Vivek Ramachandran

Manoj Tandon (00:01.715)
This is your host, Manoj Tandon. Welcome to another episode of Dark Rhiino Security, Security Confidential. And we have a really awesome guest here. But before I tell you who he is, I need you guys to like and subscribe. Hit that like button, hit subscribe. We’re over 160 episodes now almost. And if you want us to keep generating this content, we need to just see a little bit of love from you folks. And not that you guys haven’t, but please continue and support us.

So our awesome guest today is Mr. Vivek Ramachandran. Some of you who are hardcore in cybersecurity have most definitely heard of him. He is very, very well known, well over two decades in this industry. He’s a security researcher. He’s an author. He’s a speaker. He’s spoken at Defcon. He’s spoken at Black Hat. He is an entrepreneur.

You might remember he is the founder of Pentester Academy and in his latest work, he’s the founder of Square X, which we will talk about. He has advised government agencies, Fortune 500 companies. He’s brilliant, specializes in finding vulnerabilities and threat vectors that are unique. And I’m gonna oversimplify that, but we’ll get into that. Vivek, thank you so much for joining us on Security Confidential.

Vivek Ramachandran (01:26.402)
Thanks so much Manoj for that kind introduction and we are super excited to be on the show.

Manoj Tandon (01:27.955)
Well, you know, we have to, this has almost become a tradition now that everybody, because cybersecurity is such an eclectic space and it seems people come from all these different backgrounds, they love hearing about, just give us your brief origin story. How did you get in cyber? Like, why not finance? Why not something?

Vivek Ramachandran (01:52.482)
Yeah, yeah, no. So I mean, you know, I was born and brought up, the short version is I was born and brought up in India at a time where you could only be an engineer or a doctor. I’m just kidding.

Manoj Tandon (01:57.907)
No, you’re not kidding because I know that. And that’s kind of, you know, that’s the one thing for everybody from the Indian subcontinent. I’m an engineer by training, so I can tell you that that is factually correct. And everybody else in my family is a doctor. So you just proved the point.

Vivek Ramachandran (02:16.738)
So, but, yeah, so, but, you know, kind of going back, I think this was the year 1999. And interestingly, you know, my dad had gotten me a computer and an internet connection. And those days in India, it was so expensive to even get an internet connection. You wouldn’t believe, right? It was $300, $400 a month. And yeah, I was preparing for the IIT exams.

And this was the time when I had heard these attacks happen on Yahoo, AltaVista. I mean, you know, some of us would remember. And there were these massive denial of service attacks, distributed denial of service attacks, which were happening. And I read this news article about a hacker Mixter who’d actually created a security tool called Tribal Flood Network, which was being used by attackers to bring these massive websites to their knees.

So, you know, being young, being curious, I was really surprised and thrilled at the same time. I was like, how can someone create this one tool which can bring entire infrastructures down, right? And at that point I knew nothing of programming, nothing of cybersecurity. Just out of curiosity, I started Googling and finally managed to download that tool, opened it up. It was in a language which looked alien. It was in C, but of course I knew nothing of C.

And then I told myself, why don’t I start learning and teaching myself? Because I just felt that this was so much power for one person to have, right? And as a child, as a superhero fan, you’re always looking for something which could give you very disproportionate power. So anyway, I started learning. One thing led to the other. I cracked the IIT exams, went in. Out of a batch of 150, I think 10 people had ever touched a computer. I was one of them.

I wanted to keep that lead. So I started teaching myself more and more cybersecurity. And one thing led to the other. But that is really where everything started.

Manoj Tandon (04:27.987)
Wow. So you had a passion for it and you pursued it, which is so different. Like most IITians I know, they are at IIT and then they’re getting their MBA from IIM or a very fine institution in the US or the UK. And then they’re in the finance sector and raking it in.

But you chose a different path and you’ve been very, very successful with it. And if looking at your experience, and this is more as a personal question, for some of our younger audience members who would be listening and are contemplating following a passion, building, starting their own company—what might be a learning or two that you might want to share with them?

Vivek Ramachandran (05:32.322)
Yeah. I think the key learning, if I kind of look back last 20 years, is you need to have a lot of patience and believe in the power of compounding.

When you’re young, your expectations are so high. You want things to happen so fast. You put in a little bit of effort and you’re like, hey, I want to see great things happen. But anything big takes a really long time. For a long time, everything looks like a plateau where you feel like you’re just doing things in the void and nothing is coming back.

You’re shouting into the abyss, but it’s just darkness. If you can get over that sense of isolation and believe in compounding, eventually you start seeing results.

Manoj Tandon (07:01.395)
For us, you’re right. In the podcast business, it’s very difficult to get a following, but you just keep at it. This was a passion project. We focus on SMBs—they’re neglected. Enterprise gets all the attention.

We wanted to educate people that cybersecurity is a business problem, not a tech problem, and it’s a people problem. That’s how this podcast came about.

Vivek Ramachandran (08:19.554)
Yeah, absolutely. Nothing looks like it’s going to work until it suddenly does—and then compounding kicks in.

Manoj Tandon (08:50.643)
Let’s talk about ransomware trends. Payments are slightly down, but data exfiltration payments remain steady. Why?

Vivek Ramachandran (09:57.09)
A lot goes unreported. There are cases where payments are hidden or structured through intermediaries.

Also, psychologically, when data exposure becomes real, companies panic. They may prefer to quietly resolve the issue rather than deal with public fallout.

Different jurisdictions also handle this differently, which affects reporting trends.

Manoj Tandon (12:41.651)
Phishing is still the main attack vector. Why are well-known issues like phishing and DDoS still unresolved?

Vivek Ramachandran (13:39.106)
For DDoS, it’s due to how the internet fundamentally works—routers forward packets blindly. The system wasn’t designed to filter malicious intent upstream.

For phishing, the issue is human behavior. New users constantly enter the system. Also, SaaS proliferation and credential reuse make things worse.

Until we move to passwordless authentication globally, phishing will persist.

Manoj Tandon (19:00.179)
Why isn’t user awareness improving meaningfully?

Vivek Ramachandran (20:06.114)
Because training is treated as compliance. People click through it.

Also, attacks evolve faster than training. Teaching users to identify sophisticated attacks like malicious browser extensions is extremely difficult.

Manoj Tandon (27:53.075)
Should CISOs report directly to the board? And should they be held criminally liable?

Vivek Ramachandran (28:23.81)
Yes, CISOs should have direct board access to be effective.

Criminal liability is tricky. You can’t blame one person for a breach—defenders must be perfect, attackers only need one success.

Accountability makes sense only in cases of negligence or concealment—not for inevitable breaches.

Manoj Tandon (36:14.995)
Tell us about SquareX.

Vivek Ramachandran (36:34.498)
SquareX focuses on protecting users at the browser level.

Most work today happens in browsers. Traditional security like secure web gateways is outdated because modern web apps are too complex.

We built a browser-native security layer that detects attacks in real time, using local processing instead of cloud-heavy analysis.

Manoj Tandon (50:53.107)
Does it slow down the user?

Vivek Ramachandran (51:15.97)
No. It’s lightweight. Most processing happens locally using efficient technologies like WebAssembly. It actually uses fewer resources than many endpoint tools.

Manoj Tandon (54:02.451)
Very cool. Example?

Vivek Ramachandran (55:05.762)
We can trace an attack chain end-to-end—for example, from a LinkedIn phishing message to the downloaded malicious file—and even reconstruct the user’s experience without recording everything.

We do this by intelligently capturing key events, similar to video keyframes.

Manoj Tandon (01:00:12.211)
That’s impressive. DEF CON talk?

Vivek Ramachandran (01:00:32.002)
We’ll demonstrate how secure web gateways can be bypassed entirely—these are architectural flaws, not patchable issues.

Manoj Tandon (01:02:04.979)
Anything you want to plug?

Vivek Ramachandran (01:02:14.69)
Visit sqrx.com. We’re publishing research on vulnerabilities in widely trusted security systems. Reach out if you’re interested in working with us.

Manoj Tandon (01:03:09.523)
Fantastic conversation. Hope to have you back soon.

Vivek Ramachandran (01:03:27.234)
Thank you, Manoj. Looking forward to it.

Manoj Tandon (01:03:48.019)
Thank you.