Security Confidential S20 E1 Chris Nyhuis

Manoj Tandon: Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhiino Security’s Security Confidential. I have to remind you, please hit the like and subscribe button if you like what we do. Even if you like what you do, hit the like and subscribe button. It helps us with the algorithms. We all work for them, and it allows us to bring this great content to you. We have a great guest today. It is Mr. Chris Nyhuis. He is the founder and CEO of Vigilant. He has more than 30 years of experience in cybersecurity, so you could say he has been around the block quite a bit. He has worked extensively with executives and security leaders to strengthen their cyber resilience, improve incident response, and prepare for emerging threats coming from AI. He has also tackled the problem of nation-state actors, and we will be eager to get his feedback on that. Welcome to the show, Chris. We really appreciate you being here.

Chris Nyhuis: Manoj, I am so excited to be here. It is something I have been looking forward to, and I am happy to be here. Thank you so much.

Manoj Tandon: You are more than welcome. The honor is all ours. We have to start with your background. Give us a little bit about how the heck you got into this business. Thirty years is a long time, so there has to be a story here. What is the story?

Chris Nyhuis: It is a long time. I am tired, my friend. I am tired. I got into technology in general when my dad brought home a Commodore 64. It was awesome.

Manoj Tandon: That is an awesome machine. At one time, it had more games than any other platform out there, but I digress.

Chris Nyhuis: It did. It was amazing. My uncle had an Atari, and I thought that was pretty phenomenal. He would bring it to family get-togethers and we would play. The Commodore was amazing to me because it really stimulated the creative side of my brain. My dad brought home these magazines where they would print a program and you had to enter it into the Commodore 64 line by line.

Manoj Tandon: Yep.

Chris Nyhuis: It was the most frustrating thing sometimes because if you entered something incorrectly, you had to scroll through everything to find it. But it helped me be creative, and it also helped me realize that technology had to be incredibly detailed because it had to work. It was phenomenal. I learned to start coding there. Later, we got a Tandy 1000. We started going to bulletin board systems and meetups, and I remember all of that.

Manoj Tandon: Did you have the voice module with that, by the way?

Chris Nyhuis: I did not have the voice module, but that would have been freaking cool.

Manoj Tandon: What about the dot-matrix printer?

Chris Nyhuis: We did have a dot-matrix printer, and we bought a plotter when we got the 386. We printed out the Columbia spaceship—the space shuttle. Remember that? It was the big selling point for the plotters. They gave you that file, you could print it out, and it was amazing just watching this thing appear out of nothing. That really got me into IT. What was funny is that when I got to high school, I decided I was done with technology and went to college for paper science and engineering. I do not know what I was doing.

Manoj Tandon: Paper science and engineering?

Chris Nyhuis: Yes. Three years in, I decided it was not for me. I got back into MIS and got a tech job at a dial-up internet company doing technical support, which was an experience. It taught me patience in technology.

Manoj Tandon: This was not CompuServe or something like that?

Chris Nyhuis: It was based here in Cincinnati. We competed with companies like CompuServe and others. I just had these really cool moments in time that taught me different things about technology in general, and that really stimulated what I do now. From there, I found my way to an organization that was a trucking and food-warehouse company with ammonia control systems. We were putting in some of the first firewalls that had just hit the market. We were switching from hubs to switches, and it was an interesting time. The real impetus of change for me was when we started seeing people attack our network. This was before the cybersecurity industry was really a thing. We were all IT operations people doing everything, and it hit me that I wanted to understand why someone would attack our network. We had SCADA control systems and IoT systems. We had valves connected to a Windows 95 machine, and by clicking a button on the screen, you could open one of those valves and release ammonia into the air.

Manoj Tandon: Wow.

Chris Nyhuis: If you know a little about ammonia, even small concentrations can do devastating things. It can damage your lungs from the inside out.

Manoj Tandon: It is extremely toxic.

Chris Nyhuis: Exactly. At the time, most computer attacks were things like viruses opening and closing people’s CD-ROM drives or taking over keyboards. They were more of a nuisance. That was the moment when I realized there were genuinely malicious people who did not like what we were doing. They probably thought we were evil too. It is all ideology. But at the end of the day, there was someone who wanted to get into that network badly enough that the ultimate result could have been releasing ammonia and killing people. That was when I realized this was an industry I wanted to be in because I wanted to go against that kind of evil.

Manoj Tandon: Wow. Back in the Windows 95 days, was the interface to the IoT system actually running through Windows 95?

Chris Nyhuis: It was. There was an application running on Windows 95, and when you clicked something, the application would turn little servos. It could open and close valves or read sensors for temperature. If you compress ammonia, it gets cold very quickly, which is why a lot of food-distribution facilities still use ammonia systems today. It is a great refrigerant. Those environments are a lot more secure today than they were back then, but they are still a supply-chain concern, especially for the food supply. If you take down one of those warehouses, you can disrupt east-west traffic of preserved food across the United States.

Manoj Tandon: I completely understand that. Ammonia is still used extensively today in warehousing large quantities of produce and other goods. What is amazing is that back then, knowledge of those systems was not that common. Someone had to figure out that not only did they need to know Windows 95, but they also had to understand the underlying control system. Then they had to find your particular company. Somebody had to actively case out your organization. That required real work because it was not easy back then.

Chris Nyhuis: It was not easy. The internet was not what it is today. We were still getting MSDN discs. For anyone who does not know what that is, instead of having help websites or chat rooms you could search, we would order these books full of discs and search through them to find information about how to fix a problem. It was very early. One thing I think happens in the United States, and in countries with similar ideas about human life and its sanctity, is that we tend to look at adversaries through our own eyes. There is a psychological component to this. If you think everyone is a liar, perhaps you are projecting how you see yourself. We tend to see other people through our own morality and worldview. One challenge we have in the United States and other like-minded countries is that we assume our adversaries think the same way we do. We think they want to follow things like the Geneva Conventions. We think they will give us our keys back if we pay a ransom. We think they would never release ammonia and hurt people they have never met. We also assume they will not put in the effort required to figure out how to do something like that. What I think was happening even back then was positioning. I believe our adversaries have been positioning themselves inside the United States, our companies, small businesses, medium-sized businesses, enterprises, control systems, and power infrastructure for decades. I actually know they have. Back then, I believe we were already seeing evidence of that. They had already done the work and tracked these things down. We also do not do ourselves any favors. For promotional material in cybersecurity, and even back then in IT, we release all this information. We publish handbooks and manuals for ammonia control systems and other infrastructure. We make it easy for adversaries to open a manual and see exactly what they have to do. But psychologically, we think, “Well, I would not do that, so they would not either.” That simply is not true.

Manoj Tandon: Someone has to be motivated by something beyond money, Chris. That is my gut reaction. If it is only about money, there are easier ways to ransom people. If you are getting into the territory of intentionally causing damage to life and property, your motivation is more than cash. You are not looking just for money.

Chris Nyhuis: One hundred percent. I would say there are probably two broad camps of ransomware. There is ransomware that is purely about money. Then there is ransomware where the money helps fund terrorism or broader war efforts against us. I would also argue, based on our experience, that many ransomware attacks are not over when the ransom event ends. A lot of these attackers are embedding themselves quietly into multiple systems inside an organization to create backdoors. They wait and they are patient. In many cases, when we see ransomware affecting banks, critical systems, or infrastructure, I believe the ransomware itself is a diversion tactic. It is a diversion that makes people think, “The incident is over, so we do not need to keep looking.” It is also a way to make money, but the larger objective can be creating an implant that allows the attacker to remain there longer. To your point, I do not think the end goal is always simply money. The real objective may be to maintain the ability to shut down infrastructure later. Look at Colonial Pipeline.

Manoj Tandon: Yeah.

Chris Nyhuis: I think that incident was either a test or an embedding exercise. I would guess they may still have some type of presence, although I do not know because I did not work that incident. But if I match it against patterns we have seen in other incidents, especially in critical infrastructure, it is very possible that attackers either established persistence or used the incident to learn what they could do later.

Manoj Tandon: Chris, why is it technically so difficult to find that persistence?

Chris Nyhuis: This is a mistake the cybersecurity industry has made. How familiar are you with the OSI model and the TCP/IP model?

Manoj Tandon: Very familiar, but tell our listeners about it.

Chris Nyhuis: The OSI model is basically a framework that was created years ago because, at the time, companies like Apple, HP, Compaq, IBM, Microsoft, and others were all racing to create their own complete proprietary systems. That was killing innovation because you would have proprietary technology from the keyboard all the way through software and the operating system. Eventually, people realized that if everything remained proprietary and companies refused to work together, the industry could never innovate as quickly as it needed to because no single company could solve the whole problem. So they established seven layers. Within each of those layers, manufacturers could do almost anything they wanted. They could patent things, make them proprietary, and innovate however they wanted. But when they moved information from one layer to another, there had to be a standardized way for the data to move. That process involved encapsulation. As data moved from layer to layer, each layer added information, and on the receiving side those layers could be unpacked and interpreted. That created massive innovation because companies could remain proprietary while still making products that worked together. That is why, when we built computers when we were younger, you could take one network card from one manufacturer and another from someone else, install the drivers, and make it work. You did not need a network card manufactured specifically for an HP computer. The problem from a cybersecurity perspective is that each layer gives someone opportunities to manipulate or interact with data. IP addresses operate at the network layer, while MAC addresses operate at the data-link layer, for example. Over time, the cybersecurity industry developed an aversion to the OSI model. If you search for discussions about it today, you will see people saying, “This does not matter anymore. Why do we even need to learn this?” What is interesting is that humans are effectively at the top and the physical network cables are at the bottom, with all these different things happening in between. The cybersecurity industry gradually moved its data collection higher up those layers through virtualization, VDOMs on firewalls, endpoint logs, and similar technologies. The higher you go in those layers, the harder it becomes to find a threat actor. The lower you go, the easier it becomes to see a threat actor.

Manoj Tandon: Sure.

Chris Nyhuis: Here is why the industry went in the opposite direction. The higher you go, the less expensive security becomes to deploy. It is easier. You do not need to deploy as much physical equipment. The lower you go, the more physical equipment you need and the more expensive things become. Vigilant is privately held. We decided very early that we wanted cybersecurity to remain a standard-of-care industry. We never took private equity or outside investment because, at the time, I watched peers do that and say, “They are removing our ability to do what we need to do.” That is what happened. The higher you move in the stack, the more margin you can create. Private equity itself is not the enemy of cybersecurity. The issue is the decision-making around what is important for finding threats. To wrap all of that together, because security moved up the layers, attackers learned to move down the layers. They can operate there in ways that are effectively undetectable by many modern technologies. That was already a big deal before last year. It is an even bigger deal now because AI is being used offensively. Guess where many of those efforts are primarily being carried out? At lower levels. Now we have a perfect storm where attackers have advanced attack technology while defenders have limited detection technology. Even if you apply AI to the defensive problem, you may still be feeding it only the top two or three layers of data.

Manoj Tandon: At what level does the kernel of the operating system sit?

Chris Nyhuis: The kernel is more at the endpoint level, which leads into the next major problem. Not only did the cybersecurity industry move up the stack, but it moved everything toward logs and endpoint telemetry.

Manoj Tandon: Correct. Please keep going. I think I know where this is headed, but I want to hear you say it.

Chris Nyhuis: If you have followed the news over the last year, and especially over the last six months, one of the things we have seen is that with endpoint processes, you can decouple a process, embed your attack, and then put the process back together in a way where the endpoint manufacturer may not realize what happened.

Manoj Tandon: When the first computer viruses were being created, that was essentially how some of them worked. You used machine-language code to modify the header of a file and told it to point somewhere else before returning to the original code.

Chris Nyhuis: Exactly. It has not changed. I was in the Denver airport once and sat down next to someone. I talk to people all the time. My friends are always saying, “He is talking to somebody again.” I started talking to this older gentleman and found out that early in his career he had worked at Los Alamos. He was somewhat down on himself, and I asked why. He said, “Everything we worked on is obsolete.” I told him, “No, it is not. Everything you worked on still exists. It is just smaller.” The unfortunate problem is that people do not understand those foundational things anymore because we have stacked so much on top of them and stopped teaching the fundamentals. I told him he was a treasure trove of information because everything he studied, learned, and built still exists today. It is simply smaller. You said much of your audience is younger. I would encourage them to study the past because these things keep coming back around. As you said, machine code was an attack vector back in the day, and it still exists today. All an attacker has to do is get to that level, which is not necessarily difficult. Once they do, they can use your endpoint technology to turn you into a robot for them. They can use it to control you. They can make it look like an attack is occurring on one side of the network when it is actually somewhere else. They can minimize the information you receive about the attack. They can manipulate AI systems if you are feeding endpoint telemetry into an AI-powered endpoint technology that is learning from those inputs. I have been in cybersecurity for a long time, and in every incident I have ever worked, the logs were manipulated every single time. As an industry, we have to stop placing all our faith in things that attackers themselves can control and manipulate as our single source of truth.

Manoj Tandon: To me, that is almost a hollowed-out process approach. You have an actively running process. I get down to the machine-code level, intercept that process, inject my own code into it, and tell it to point to another piece of code that I want it to run before it goes back and executes its original instructions. That trick is as old as time.

Chris Nyhuis: It is still used today. Because AI is now involved as an offensive tool, the problem becomes even larger. I am a big believer that if AI defense is your only way of protecting yourself, and a company is trying to sell you on the idea that AI defense is amazing and will solve everything, that is a big lie. Offensive AI has something incredibly important: time. It has time to learn, time to plan, time to carry out an operation, and time to test. When you take an AI system that has had time to prepare an attack and place it against a defensive AI system that also needs time to learn what is happening, the AI system that had the time advantage will win consistently. The issue becomes even bigger because most of the telemetry we receive from our environments and networks comes from laptops, desktops, servers running endpoint software, or log-collection technologies. As you said, attackers have been able to inject information into those streams for a very long time and remain undetected. We have seen that play out multiple times this year. It has been crazy.

Manoj Tandon: Chris, recent computer-science graduates probably do not even know what machine language is.

Chris Nyhuis: Many of them do not because they are not being taught it.

Manoj Tandon: Unless they are specifically in chip design or writing fundamental controllers where there is a reason to work at that level. That would suggest a high degree of technical sophistication. Is this mainly the domain of nation states that are focusing on these techniques rather than some backyard kid who decides, “I think I am going to have some fun”?

Chris Nyhuis: It is not quite the backyard kid yet. However, they now have opportunities to learn extremely quickly. You may remember years ago when there were tools where someone could essentially design their own malware. You would go to a website, click a bunch of checkboxes, hit submit, and it would compile malware based on the options you selected. That may have been around ten years ago. It dramatically lowered the technical bar someone needed to become an attacker. Around 2020, we started seeing behavioral changes. This is not necessarily mainstream analysis; it is something we observed at Vigilant and developed as a hypothesis based on what we were seeing. Around 2020, we saw a proliferation of advanced skill sets appearing much more frequently and across a wider population than before. You had a lot of people with a lot of time on their hands, and you also had nation-state actors effectively saying to mid-level hackers, “We will give you technology. We will train you. We will teach you. But we want you available when we need you, and we want a portion of the money you make.” When that happened, we also saw a major increase in advanced attacks and overall attacker skill. Most attackers initially gain access to companies through social engineering and email because those methods are easy. Once they are inside, that is when the advanced skill set starts to appear. They become low and slow because they want persistence. They want that connection later. One interesting thing to watch is dwell time. When we started Vigilant 16 years ago, the average time between an attacker beginning activity and actually being detected was around 90 days.

Manoj Tandon: Right, and that number has gone down to hours and minutes now.

Chris Nyhuis: No. It is about 287 days now. What changed is the marketing.

Manoj Tandon: Okay. A lot of insurance statistics I have seen say ransomware can be deployed and operating within 90 minutes, and speed has become king.

Chris Nyhuis: Yes, ransomware can be deployed very quickly, but that goes back to misunderstanding the attacker’s objective. The objective of the attacker is not necessarily ransomware. It is persistence. That is why you see companies hit by ransomware, recover, and then get hit again later by the same group. Why? Because the attacker remained there. In the insurance industry, we often see an incident labeled as ransomware. People attribute it to a threat actor, clean up what they can see, say the incident is over, and move on. When we come in after some insurance-led incident responses, we sometimes find that the ransomware event was actually a diversion. The attacker wanted time to establish persistence. In some cases, the ransomware attack occurs months after the attacker initially entered the environment. It becomes the final diversion. When you look at the 287-day dwell-time number, it is not that cybersecurity systems suddenly detect the attacker on day 287. In many cases, the attacker finally reveals themselves. Cybersecurity is not necessarily getting better at detection. In some ways it is getting worse. It is easier to get into organizations today for several reasons. One is that most companies have moved full-stack detection out of their environments and shifted heavily toward endpoint telemetry. Another major change happened in 2020 when everyone began working from home. Companies suddenly developed much wider threat footprints that they did not know how to manage. Then you started seeing things like SD-WAN and similar technologies, but organizations still were not performing the kind of detection necessary to find these threats. That is why things are getting worse. The number you mentioned, where an attacker gets in and deploys ransomware in 90 minutes, can happen on what is actually day 287 of their broader presence. When incident responders come in and say, “This attack happened a week and a half ago,” sometimes that is simply because they do not have forensic data that reaches back any farther. Often, the attacker deleted that data and covered their tracks. It becomes a major data problem. At Vigilant, we have taken a different approach. This is not meant to turn into an advertisement for our company. Your listeners can reach out to our team if they want that. But we have been able to reduce that kind of detection time from 287 days down to around four hours. You have to perform security in the right places. You need the right data, and you need continuous validation of that data to find the threat. Forensics are the key.

Manoj Tandon: What is the approach, then?

Chris Nyhuis: First, security cannot be one-size-fits-all. It has to be a continuous loop of decision-making. Most organizations perform edge security based heavily on logs from a firewall. Look at what has happened over the last couple of years. Every major firewall manufacturer has had serious vulnerabilities or breaches involving its software. That means you have a supply-chain risk. Years ago, there was a firewall manufacturer whose development supply chain was compromised. Someone embedded malware into its firmware, and that firmware was distributed all over the world, including to U.S. government systems.

Manoj Tandon: I remember that. That was a huge story. I just drew a blank on the company name.

Chris Nyhuis: I did too. But those things still happen. There are vulnerabilities in firewalls because all code has vulnerabilities. What we have to realize—and nation states that attack us understand this very well—is that you need something passive in front of your firewalls that itself cannot easily be attacked. If your detection system has an IP address, it can be attacked. It is difficult to defend when the system doing the detecting can itself become a target. One of the standard rules of warfare is that whoever has the most visibility, or the high ground, usually wins. In the cyber war, we have visibility that can be highly manipulated by the enemy, while we often have very little visibility into the enemy themselves. That is one of the biggest problems. Organizations need to understand that the very device they have placed most of their trust in may itself be compromisable. If you do not believe me, just look at the news. It is pretty clear.

Manoj Tandon: There is another aspect to this, though. A huge percentage of cyberattacks are also the result of human error. How are these systems going to prevent that? You cannot really idiot-proof everything, so to speak.

Chris Nyhuis: You cannot. I would frame that a little differently. I think businesses place too much responsibility on their individual team members. Think about it this way. If you take a hacker and put them in an accounting contest against your CFO, I hope your CFO wins because the hacker is not an accountant. Your CFO should probably win every time. Even if the hacker takes a few accounting classes, put them against the CFO in a closed-book accounting test and the CFO will still win most of the time. Now reverse that scenario. Put the CFO into a contest against a hacker. The hacker is going to win enough times to get in, and the attacker only needs to win once. It does not matter how much you train your employees. Training is good because it raises awareness, but their primary job—the thing they are employed to do every day—is their actual role. That is going to be the first thing on their mind.

Manoj Tandon: Sure, but training eliminates some of the low-hanging fruit. It is like locking your doors. It is good hygiene.

Chris Nyhuis: Absolutely. I am not saying do not train. What I am saying is do not train people and then hold them personally liable, fire them, or create a culture of blame when they fall for an attack.

Manoj Tandon: On that, we agree wholeheartedly.

Chris Nyhuis: People are attacked constantly with social engineering, and these hacker groups sometimes have psychologists studying your employees before they attack. They look at LinkedIn profiles. They look at travel schedules. I think out-of-office replies are one of the worst things companies can expose from a footprinting perspective. Attackers study team members before they come in. There are ways to defend against these things well and make your organization a less acceptable target even when humans make mistakes. The problem is that organizations are often unwilling or unable to do everything required to execute those defenses. Budgets are limited. Cybersecurity is more expensive than it should be because of how the market has evolved. At the top of organizations, executives often do not understand what they are actually up against. They understand how to run the rest of the business, but their strategic thinking is disconnected from this one thing that may be the most existential threat to the organization. That disconnect is a problem.

Manoj Tandon: If you are a small or medium-sized business rather than a large enterprise, what advice would you give? How should they design an effective cybersecurity program? What should they be doing?

Chris Nyhuis: If you are a small company, the first thing I would do is seek out a cybersecurity organization that focuses specifically on cyber. If that company is a reseller of technology, I would make sure it is deeply connected to the manufacturer or software developer because cybersecurity changes constantly, and you have to be able to manipulate and adapt technology quickly to defend well. If you are working with an MSP, make sure that MSP is tightly connected to the manufacturer or developer and that you can verify that relationship. Otherwise, you may be working with an MSP using technology that, based on the development lifecycle of many cybersecurity companies, could effectively be 12 to 18 months behind. You either want to work with someone who can change technology more frequently or work directly with the cybersecurity company that actually builds and controls the technology. Here is a good litmus test: ask whether they will guarantee the outcome. If you get breached, will they cover your forensic costs? Do they have any skin in the game? If they do not have skin in the game, I would not work with them because they may not have your best interests aligned with theirs. I believe every cybersecurity company providing a service should have some skin in the game. Cybersecurity has become a margin-driven, hypergrowth industry. It did not remain the standard-of-care industry that it was at its inception. Because of that, the outcome of care is no longer always the main focus. Instead, the focus becomes how much revenue can be generated by selling units. I think that is a problem. Small and medium-sized businesses have to evaluate the companies they work with much more carefully. Enterprise companies should do the same. You need to understand whether there is real skin in the game because most providers do not have it.

Manoj Tandon: You just eliminated almost the entire market.

Chris Nyhuis: Right, which should tell you something. If cybersecurity companies are allowed to be wrong 100 percent of the time with no culpability in the relationship, when they are supposedly standing in the gap protecting you, that should be concerning. The second thing I would say is that your cybersecurity company should understand your business and business objectives. If you are trying to move from point A to point B, competitors may target you. Inside the United States, certain activity would obviously be illegal, but outside the United States, especially in countries without meaningful oversight, companies can become targets. If you are in critical infrastructure, you may become a target when geopolitical conflict occurs because of what your company provides. You are going to be pulled into this whether you want to be or not simply because you operate in the United States and are part of whatever the United States is doing. At the C-level, make sure your cybersecurity provider has skin in the game. Second, make sure you are having conversations with your cybersecurity company about your strategic objectives, not only your cybersecurity objectives. Tell them how you are growing. If you are going to acquire another company, they need to know. If you are going to make a major strategic move that year, they should know so they can understand how to defend you. The third thing, and this may actually be the best place to start, is for C-level executives to sit with their frontline cybersecurity people for at least a week if possible. You may think that is a waste of your time, but it is not. I want executives to learn the lifecycle of triaging an alert before the company is attacked. I guarantee that if you have an incident, you will meet those frontline people. There will be so much happening and the situation will be so chaotic that unless you understand how an event is triaged and what your team is going through, you will not be able to make good decisions. I have sat in rooms with boards and CEOs who, against our advice, chose the wrong path because they did not understand what was taking place. In some cases, those decisions shut the company down. Executives need to understand at least the fundamentals of triaging an alert. Sorry for the tirade, but I see companies go out of business all the time when they do not have to. I am not talking about our clients. I mean organizations that eventually come to us for help.

Manoj Tandon: What is the approach specifically for finding persistence?

Chris Nyhuis: Persistence hides in encryption. It hides in entropy. It hides in irregular communication patterns. Many detection systems look for something obvious, like a ping happening every five minutes, but advanced attackers build randomness and chaos into their connections. The ability to find persistence starts with collecting data where you can trust the source. You have to trust where the data came from, trust that it has not been manipulated, and then compare it against data that potentially could have been manipulated. Once you can do that, it actually becomes easier because you can essentially diff the two data sets. If your trusted data says one thing and another data set does not match, you have found an anomaly. Go investigate there. The problem is that this becomes a big-data challenge. You have to process enormous amounts of information and know how to work with it. A small or medium-sized business probably will not have the internal expertise to do that. An enterprise could, but it would have to invest significantly in technology and build many capabilities internally. At the enterprise level, I think organizations should partner in a co-managed model with an external provider. Unfortunately, I see a trend right now that I sometimes call the celebrity CISO. You have CISOs who are trying to make a name for themselves. They eliminate service providers, hire large internal security teams, and try to rebuild programs from scratch. Security programs should be built on legacy and continuity. You should not simply wipe everything out and start over. Companies are experiencing breaches because they are making enormous amounts of change while the plane is still flying.

Manoj Tandon: That is a story as old as time too. Empire-building has always been a tradition in the enterprise.

Chris Nyhuis: It has. Another issue is that you have this 287-day dwell-time problem while the average lifespan of a CISO at a company may be only around 18 months. A decision one CISO makes may be inherited by the next CISO, and the new person is held responsible for things they did not create. If you are a CISO, I would be very careful about changing jobs right now because you can inherit something that your organization cannot even detect. It is a crazy situation.

Manoj Tandon: This has been very enlightening. We have not even gotten through a fraction of the questions we thought we would ask. We also want to make sure we hear a little about Vigilant and give you a chance to plug anything you would like to talk about in these last several minutes. Chris, tell us a little about the company and what you do.

Chris Nyhuis: Thank you, Manoj. I am incredibly proud of our organization. When we started Vigilant, as I mentioned earlier, we decided we wanted to build a legacy business. We put some stakes in the ground from the very beginning. One thing I would encourage people to understand about any company they work with is what motivates that company. That is true not only in cybersecurity but in any partnership. I love our story because, at the beginning, we said, “We are not here to build this company up and sell it.” We created a not-for-sale policy. We have had many investors approach us over the years, and we have told them all no because we wanted to build an organization that could control its own destiny and remain focused on providing a standard of care for clients. We have an incredible retention rate. We have clients who have been with us since the very beginning, which is unusual in this industry. We created a partnership model with our clients. What do we actually do? From the beginning, we created technology that sits inside company environments and provides what we call forensically validated detection and response. That means from the moment data is collected all the way through analysis, we can forensically validate that the data has not changed, that it is what it is supposed to be, and that it has not been manipulated. Over the years, that forced us to solve big-data problems in cybersecurity—and, more specifically, the right-data problems. We had to figure out ways to make long-term data instantly accessible and put that information in front of humans who can make decisions. We have integrated AI and many other technologies along the way, but the core has always been forensic validation because it ties into everything else. We can receive around 155 different data sets right now. If someone has a unique new data set, it generally takes us around two hours to onboard it. Traditionally, we brought that data into an application and delivered it through a SOC-as-a-service model. The market has changed. There are now many people coming out of school with cybersecurity degrees who want to be directly involved in the fight. Over the last few years, we have converted our technology, client interfaces, and data access so that many of the tools we originally built for ourselves are now available directly to the market. A client can self-manage, or we can bring in our team as an overwatch layer. Over the last 16 years, we have been able to reduce detection time from the traditional 90-to-287-day range down to around four hours. We are able to stop threats before they do significant damage. If clients use our overwatch service, we guarantee unlimited incident response, which effectively removes their forensic costs. Insurance companies love that because one of the largest costs in an incident is incident response. If a client were ever breached, we provide that response without additional cost. Our approach to cybersecurity is that it is a team effort. As I said earlier, technology has to be able to change rapidly. Depending on what a threat is doing, we can sometimes change technology the same day and pivot quickly. The broader industry may be operating on a 12-to-18-month software-development lifecycle, and that is simply too long. Remaining privately held and not taking private-equity money has helped us remain strong and flexible. We protect organizations across healthcare, manufacturing, IoT, OT, automotive, and many other industries. We are involved in almost every industry you can think of. Sixteen or 18 years ago, companies often wanted providers that specialized narrowly in one industry. The reality now is that those companies all use Windows, Macs, similar firewalls, similar cloud platforms, and many of the same foundational technologies. Data is data. Learning how to defend across all those environments, especially with supply-chain risk involved, is incredibly important, and we have been able to do that. Our team helps organizations understand threats much earlier. Another thing I am very proud of is what we decided to do because we did not have outside investors. My wife and I asked ourselves, “Where should we put the money that would otherwise go to an investor?” Early on, we decided to put that money into orphan care around the world. We wanted to come alongside organizations doing real orphan care and support them with our time and our resources. We have helped children through school and provided holistic care. Long before this kind of technology became common, we worked with Rochester Institute of Technology to develop a 3D-printable mechanical arm with an opposable thumb that could be driven through shoulder movement for a boy named Raj in India. He wanted to become an engineer, so we helped connect him to education. We work in Nigeria, Mexico, and here in the United States. I have had the privilege of watching children grow from age 11 to graduating from high school in Nigeria. I was just there last year. It has made everything we do matter even more. In cybersecurity, we are keeping companies in business and keeping people’s hopes and dreams alive. That by itself is enough to keep you going. But we also know there are children around the world depending on us to support them.

Manoj Tandon: That is very cool.

Chris Nyhuis: Over the last two years, we have also started working in anti-human-trafficking efforts. When you become involved in orphan care, you begin to see how vulnerable children can become part of a pipeline into human trafficking. We have taken our technology and resources and funneled them into organizations working in that space. There are many incredible people who have done far more than we ever have in anti-human-trafficking work, and we are still new to it. We are learning. We are trying to come alongside those organizations, develop technology, provide funding, and sometimes put boots on the ground. It is an enormous and frightening problem, and cybersecurity is at the core of a lot of it. Once you start going down that road and seeing what is happening, it becomes pretty scary.

Manoj Tandon: That is a great place to end this conversation, Chris, but we look forward to having you back at some point.

Chris Nyhuis: I would love that. This was a great conversation. I really enjoyed your questions. You have some great insight into a lot of this, and I am excited for future conversations.

Manoj Tandon: We are looking forward to it, as will our audience. If someone wants to get hold of you, how do they find you?

Chris Nyhuis: LinkedIn is great. You can also reach me on Twitter. Just look for Chris Nyhuis. There are a few of us out there. One lives in Michigan, one lives in Australia, and I am the one here in Ohio. Look me up. I respond on LinkedIn, although it may take me a few days. I am usually faster on Twitter. You can also visit our website at vigilantdefense.com. We are in the United States, so we spell “defense” with an S, not a C. Go to our research tab. We put some interesting material there about breaches. There is also a really interesting supply-chain attack we have been tracking since around March.

Manoj Tandon: Very good. Thank you, Chris. We will try to put some of those links in the show notes as well. It has been a pleasure having you here, and we look forward to having you back at some point.

Chris Nyhuis: My pleasure. Thank you so much. It was great.

Manoj Tandon: Take care.

Chris Nyhuis: Thanks.