Security Confidential S18 E1 Matthew Devost

Manoj Tandon: Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhino Security’s Security Confidential. Today we have another awesome guest—but before I announce him, please hit the like and subscribe button. We still work for the algorithms, and every click helps us bring you great content free of cost.

Our guest today is Matt Devost, a cybersecurity and national security expert with over 25 years in the field. He’s the CEO and co-founder of OODA and DevSec, and the founder of the Terrorism Research Center. He also founded the cybersecurity consultancy FusionX, which was acquired by Accenture, where he went on to lead the Global Cyber Defense Practice. His impressive résumé includes leadership roles at iDefense, iSight Partners, Total Intel, SDI, Tulco Holdings, and Technical Defense. Matt, welcome to the show. Thank you for joining us—I know you just got off a plane, so we appreciate you being here.

Matt Devost: Thanks, Manoj. It’s great to be here.

Manoj Tandon: Let’s start at the beginning. How did you get into this field? Was cybersecurity your dream from the start, or did twists and turns lead you here?

Matt Devost: I like to think I became the architect of my own profession. I had this unusual mix of interests—national security, particularly gray-area phenomena like terrorism, and computer science. I was a hacker early on, and by 1992 I realized those two worlds were colliding. Companies and governments were becoming increasingly dependent on technology, and I saw how easily those systems were being compromised. That was my “aha” moment—recognizing this as a national security risk.

So I started writing and speaking about it, not realizing how ahead of the curve I was. I even made it the focus of my graduate thesis: National Security and the Information Age. It caught the attention of U.S. government officials who, unbeknownst to me, had written a top-secret directive on the same topic. I was an outsider—no classified access—but saying the same things. That led to my first job out of grad school, supporting the Department of Defense and the intelligence community in a technical role.

Manoj Tandon: That’s fascinating. I have to ask—since you were working in that era—did you ever interact with Tom Clancy?

Matt Devost: Actually, yes. Tom Clancy used to be a participant on the Terrorism Research Center message boards. We exchanged emails with him about counterterrorism and cyber issues. He was a meticulous researcher, and you can see ideas from our discussions reflected in his later novels.

Manoj Tandon: That’s incredible. Maybe his work wasn’t so fictional after all.

Matt Devost: Exactly. A lot of what was “fiction” back then has become reality. I think I just had a knack for seeing where things were headed and putting myself in a position to be useful.

Manoj Tandon: A great lesson for our younger listeners—rewind and take note of that one! You’ve worked across cyber defense, risk management, and national infrastructure protection. In traditional warfare, the enemy is “out there.” But in cyber, the enemy is already inside. How do you manage that kind of risk?

Matt Devost: That’s the key difference. Attackers will penetrate your perimeter—that’s a given. When I helped write the first Department of Defense cyber strategy in 2010, I fought to include the concept of “presumption of breach.” You have to plan for operating and maintaining mission capability after a compromise. Lives may depend on it.

Another element is understanding what I call time-shifted intent. Some attackers breach systems today not to act immediately, but to position themselves for future advantage—maybe months or years later. Think of it like pre-placing explosives in an enemy’s infrastructure before a potential war. You don’t have to use them, but if conflict erupts, you have the option. That’s how adversaries view our critical infrastructure today—they’re already inside, waiting for the right trigger.

Manoj Tandon: It’s the perfect weapon—David Sanger even wrote a book by that name. And unlike kinetic weapons, cyber tools are reusable and deniable.

Matt Devost: Exactly. It’s stealthy, scalable, and politically flexible.

Manoj Tandon: The challenge for the U.S. is that much of our critical infrastructure—power, water, healthcare—is privately owned. How do you secure systems the government doesn’t control?

Matt Devost: That’s where public-private partnerships matter. Agencies like CISA and the Information Sharing and Analysis Centers (ISACs) try to bridge that gap. But awareness is still the biggest driver. Ironically, cybercriminals have helped raise it—ransomware attacks have forced many CEOs to pay attention.

Red teaming also helps—emulating real attackers to show executives what’s possible. Once you show a board that their crown jewels can be stolen or disrupted, they stop seeing cybersecurity as just an IT problem and start treating it as a business risk.

Manoj Tandon: How well are we doing as a country in protecting national infrastructure?

Matt Devost: Honestly, not great. You can read my 30-year-old thesis and find that many of its recommendations still apply today. As a red teamer, I had a 25-year career with a 100% success rate—we always achieved our objective, whether that meant stealing money or disrupting a system. That tells you something.

We’re still losing ground on defense. CISA Director Jen Easterly just wrote an essay in Foreign Affairs arguing the same thing. The hope now is that AI can help—letting us defend at machine speed, not human speed. But the industry struggles to truly innovate. Too often we repackage old solutions instead of rethinking the problem.

Manoj Tandon: That’s a quote-worthy line—we’ll be using it. We see that too. The same vulnerabilities show up again and again.

Matt Devost: Exactly. I like to cite The Gray Rhino by Michele Wucker. Everyone talks about “black swan” events—unforeseeable crises. But a gray rhino is a huge, obvious risk we can see coming and still ignore. Most cyberattacks are gray rhinos. They’re predictable, preventable, and neglected.

Manoj Tandon: What’s the best way to overcome that inertia?

Matt Devost: Education and demonstration. Red teaming can be transformative. I once briefed the board of a Fortune 10 company where cyber risk was listed seventh on their priority list. After we demonstrated that their top three existential risks—financial, operational, reputational—could all be caused by cyberattacks, they moved cybersecurity to number one and tripled the CISO’s budget.

When you make risk tangible, executives act. Showing them “we stole $10 million from your bank undetected” lands far better than listing 700 medium vulnerabilities.

Manoj Tandon: Jaguar Land Rover could’ve used that advice—they’re living it now.

Matt Devost: Unfortunately, they’re not alone. Every week there’s another example—a carmaker, a hospital, a logistics firm—facing operational paralysis from cyberattacks.

Manoj Tandon: On that note, should we legalize more white-hat activity? Let ethical hackers report breaches without fear of prosecution?

Matt Devost: To an extent. Structured bug bounty programs already do that safely. But opening it up entirely would create chaos—you don’t want 100,000 people spearfishing executives “for practice.” Even good intentions can cause real damage if you’re probing live systems.

Manoj Tandon: Fair. Interestingly, the State of Ohio allows people to hack their election site without penalty if they report how they did it.

Matt Devost: That’s creative—a self-run bug bounty. But you need proper incentives; otherwise, you won’t attract the right talent.

Manoj Tandon: True, especially when the black market pays more.

Matt Devost: Sure—but selling exploits for profit also means living with the fact that you may have enabled crime. That’s not a tradeoff everyone’s comfortable making.

Manoj Tandon: Looking back to your thesis days—what’s changed the most in terms of threats?

Matt Devost: The speed and scale. When I wrote my thesis, the internet was just emerging. We predicted a connected world—and now everything is online, from our finances to our military systems. Technology evolved faster than our ability to secure it. We’ve been playing catch-up for three decades. Attackers out-innovate us because they’re faster and unburdened by bureaucracy.

Manoj Tandon: And AI is about to make that even worse.

Matt Devost: Exactly. We’re entering an era of exponential change—AI, autonomous systems, and quantum computing are converging. Most people think we’re at the start of that curve, but we’re already on the back half of the chessboard—where the doubling effect becomes incomprehensible.

Manoj Tandon: That’s a great analogy. Some might just throw up their hands and give up.

Matt Devost: Inaction is still a choice—but it’s the wrong one. You might make mistakes by engaging early, but at least you’ll learn. Every company, in every sector, needs to figure out how these technologies affect their business before they’re left behind.

Manoj Tandon: But history repeats itself—like SCADA systems. They were never designed with security in mind, and we’re still paying for that.

Matt Devost: Right. We made them “user friendly” and connected them to the internet—then gave attackers point-and-click access. AI might help balance that by letting defense operate at machine speed, but security can’t remain an afterthought. I once had a client hire us to test a satellite system—after they launched it into space. At that point, there wasn’t much we could fix. That’s what happens when security comes too late.

Manoj Tandon: Lesson learned: bake in security early. Before we wrap up, tell us about your ventures—OODA and DevSec.

Matt Devost: Sure. I run a startup studio in Reston, Virginia called the Hack Factory, home to several innovative companies like Tidal Cyber, CoverAI, and Blackwire Labs. My consulting firm, OODA, advises boards and executives on enterprise risk management. We also run the OODA Network, a 400-member global community that meets online and at conferences to share insights on cybersecurity, disruptive tech, and geopolitics.

Then there’s DevSec, a startup born from the studio. It builds LLM-enabled tools for large-scale fraud investigations and breach analysis—essentially AI for complex data forensics. It can scan millions of documents to identify patterns humans would miss, like crypto seed phrases hidden in emails.

Manoj Tandon: That’s amazing—and probably faster than a team of forensic accountants.

Matt Devost: Much faster! We’re not replacing investigators, but augmenting them with machine intelligence.

Manoj Tandon: Before we close, anything you’d like to plug for our audience?

Matt Devost: I appreciate the conversation—it’s been great. If listeners want to learn more, they can visit devost.ai—it’s a free LLM trained on my writings, interviews, and the research that’s influenced me. It’s like having a conversation with my brain—useful for surfacing cybersecurity insights and source material.

Manoj Tandon: That’s fantastic—and we’ll link it in the show notes. Matt, this has been one of our best episodes yet. Thank you for sharing your expertise and experience.

Matt Devost: Thanks, Manoj. It’s been a pleasure—I’d love to come back anytime.

Manoj Tandon: We’d love that. Take care, Matt.

Matt Devost: You too.