Security Confidential S9 E5 Philippe Humeau

Manoj Tandon: Hello everyone, this is your host Manoj Tandon with another episode of Dark Rhino Security Confidential. And today we have another rock star guest joining us. He is Philippe Humeau. He joins us all the way from France. He is the CEO and founder of CrowdSec. Check them out; it’s an open-source multiplayer firewall that’s able to analyze visitor behavior and provide an adapted response to all kinds of attacks. Very cool, and there’s a huge open-source component to it. He is using crowd power to generate a global IP reputation database to protect user networks. We’re going to hear more of that here in a minute. But also, what you may not know about Philippe is that he has created five startups and seeded 10 of them, which is amazing. And in his spare time, he’s a public speaker and a drone pilot and likes to ride horses.

Welcome to the show.

Philippe Humeau: Thank you. You know a lot about me, and I also love pinball, but that’s for another conversation, I guess.

Manoj Tandon: Ah, I do too! I’ve wanted to get a real pinball machine—a real one, not a digital one. The old ones, the analog kind with a steel ball.

Philippe Humeau: Well, I’ve got four of them.

Manoj Tandon: I do.

Philippe Humeau: Those are so much fun.

Manoj Tandon: Yes, they are. They are timeless. I see my kid and all his friends playing on them and, you know, it’s not digital, yet they are totally fascinated. So, the old world still does good stuff.

Philippe Humeau: Oh, it is! I mean, the mechanical clanging, bouncing around, and all the lights and alarms going off.

Manoj Tandon: Well, that was my generation growing up, so I guess I dated myself there.

So, Philippe, one place we want to start, given all the tremendous work you’ve done: we want to know your origin story. Because we think you were a network engineer at one time and then you left a job to become an entrepreneur and become self-employed. How did that happen? Give us a little backstory here.

Philippe Humeau: Sure. I think the transition is natural somehow, because there is five percent of the population that is actually made not to work for others but to try to get the group to work with them. This is natural leadership or something like this, and it dates back from the ancient times. If everybody were leading, then the group would die. If nobody were leading, then the group would die. There are so many cases where the group would die that nature decided that five percent would lead and the others would help build, organize, discuss, and exchange.

Sometimes they have headaches because they were precursors of potential problems and hazards in the environment. So, people that nowadays have headaches are the ones who were the sensitive people in the groups that would detect the weather changes. Did you know about that?

Manoj Tandon: I didn’t.

Philippe Humeau: No, this is fantastic. Keep going, please.

So if you ask me where it comes from, it comes from a long, long time ago. But more precisely and more accurately, it dates back from my 14th or 15th year. I told my parents I don’t want to be working for someone; I want to run a company of my own and have my group working together. I’m pretty sure I can do that.

My parents said—the only reaction they could have was—”Finish your studies first.” And they were right. So, I did my engineering degree. During this time, I met with an incredible person. This one guy was the one cracking games on Atari ST computers. We had those games, and being 10 or 15 years old with no budget to buy games, we were exchanging those cracked games through the post office.

Every time I would load the game, I would see the logo of this guy. It was running around in circles, and it was like, “I cracked it.” I was like, “Wow, this group is so impressive.”

Fast forward in time: during my engineering studies, I met this guy physically. He’s a student too, in the same school as I. And I was like, “Whoa, it’s you! You are the one cracking the games I was playing when I was a kid.”

“Yes.”

“But how old were you?”

“Well, ten.”

“Sorry? You were cracking games in assembler when you were ten?”

“Yes.”

“What are you doing today?”

“I’m doing cybersecurity.”

“Show me the rabbit hole. Show me how deep this thing goes.”

So, this is how I came to like security. I was working for a bank during my student years. I didn’t like it so much and I decided to create my company right after school. It was 2000. People were being paid a hefty amount of gold just to join companies as engineers.

I was like, “No, I’m going to do it my way.”

So, I ate pasta and drank beers but didn’t have much money in the pocket. Then, this company took off slowly but surely, and after 16 or 17 years, I sold it and created a new venture.

Manoj Tandon: Congratulations!

Philippe Humeau: Yeah, and during this time, I was pretty much endorsing all the roles, but the one I liked the most was pen tester. I did a lot of team pen tests. By then, it was like, “Do whatever you want as long as you get in and you tell us how.” That was basically the contract. It was a lot of fun and a steep learning curve.

I loved it. Then I switched to the business side ten years ago, doing business development, being a CSO, being a CMO. I love that too. I’m kind of a hybrid profile that betrayed the technical front to become the dark side guy that does business.

Manoj Tandon: I don’t know if you betrayed them. I think it’s an inspiring story because there’s this impression, especially in cybersecurity, that there’s a back room of people in hoodies who are just working and you never see them. It shows that if you want to be in the daylight, you can be, and you can be what you want to be if you have the perseverance and the intention of doing it.

Philippe Humeau: Most of us need variety, otherwise the mind gets bored. And when you get bored, you’re not that good. On top of that, being a pen tester, you can only be that kind of person for eight to ten years, because after that you have a family and friends. You cannot dive continuously into new exploits and new techniques. You just have to settle down and pass this to someone else. I had a very brilliant right hand, and the guy took over. He is now my CTO, by the way.

Manoj Tandon: That’s fantastic. You know, that is the number one—if you go back and look at some of our old episodes—we’ve had a lot of younger people on who wanted to start their life off as pen testers. It seems to be the number one thing in cyber; it’s like, “I want to be a pen tester” or “I want to be an ethical hacker.” That’s the term everybody uses. But you’re absolutely right, and for our listeners, take his advice seriously. That is absolutely correct: after a while, you do get bored and you do have to settle down. It’s a profession where you have to be on top of your game all the time, and that’s just the way it is. So, there are a lot of people who think about becoming an entrepreneur and want to be a leader. What do you think are the biggest hurdles in making that transition? It seems for you it was natural—you’re a natural leader—but still, there must have been some hurdles.

Philippe Humeau: Yeah. I like history, and I had the chance to be able to connect when I decided I would take these things in hand. I was six—I was actually the age of my kid currently—and what happened is that in school, we were bullied by taller, stronger kids that were doubling and tripling our age. They were just taller and wider, so we couldn’t do much. I was tired of that. At some point in the schoolyard, I decided I would federate everyone and put them in front of reality: we were 50, and there were three. They would lose the game.

At some point, we were only stopped from hanging them because the teachers were like, “What the heck is happening here?” They saw the 50 of us circling the three guys. That day changed my personality deeply and forever. I understood two things: one, if you want to win over these kinds of problems, you have to team together; and two, if you can be the leader of it, it’s even better. This was a life-changing experience, and years after, a shrink found it in my personality. That was very interesting.

And then what it takes is—the weird thing is—people think you’re not doubting because you’re the CEO. You’re the one selling the story; you’re the one on the TV sets and stuff. But the reality is you are doubting constantly. It’s your role to not be sure about something, to be unbalanced about something, and find solutions against that imbalance.

Where people expect you to be comfortable and confident in everything, internally—at least for myself—I’m doubting. And I cannot show I’m doubting, whereas I should doubt constantly. This is a very tricky situation where you shouldn’t get too confident with yourself. You should always take into consideration whatever is happening around you and your surroundings—what’s going well or wrong, or what could go wrong in the future. Anticipate those and lead the team without showing any doubt. Show that you know the path, you know where you’re heading, and so on. So, it’s an interesting mix of schizophrenia, somewhere.

Manoj Tandon: You know, what you’re describing is that you have to be very comfortable with being uncomfortable, and making sure on the outside you are very direct so that it doesn’t show through. I think that is the part that many people struggle with psychologically.

When you’re thinking about leaving a comfortable job that gives you a salary every two weeks, and you’re going to give that up for an unknown, that’s not an easy decision to make. And if they make it, a lot of times people find they weren’t cut out to do it.

Philippe Humeau: Yeah. Reciprocally, if you live in a job that is paying every two weeks but you feel uncomfortable—you feel you don’t belong—it’s like a bug in the Matrix. You’re like, “It just doesn’t feel right.” It means you were not meant for that.

I tried to be an employee—I really honestly tried—and I always failed. Honestly, it’s not made for me. I cannot be an employee.

Nowadays, I think entrepreneurship has evolved a lot; startups have evolved a lot. So, if you are a professional and have skin in the game or tech skills that are unique, you should ask for shares. This company is as much my company as it is my co-workers’ company; they all have skin in the game. It’s a totally different thing to be a leader of someone who is partaking in an adventure and will get fruits out of it, and not just you. You’re leading them because they accept your leadership, because they think you’re the person proper and fit for that job. But on the other hand, they are also enriching themselves and not just you, which is super important.

Now that the workforce is shifting toward retirement, on average, there will be one person retired for one active person twenty years from now in most modern countries. Meaning, the people who are now coming into the market are gold—pure gold. You cannot hire them on the cheap, and you cannot not associate them if they have the skills and the competences. So, obviously, it changed totally the way you perceive entrepreneurship and the way you should react and interact with people.

Manoj Tandon: You know, the model you’re describing there—there was another gentleman way back when that people may be familiar with, Tom Siebel, who started Siebel Systems.

Philippe Humeau: No, I don’t know him personally.

Manoj Tandon: He eventually sold his company to Oracle, and there were a lot of millionaires created in his organization. He gave the option to his employees of taking whatever percentage of their salary they wanted as shares in the company. There were some people who took their entire income as shares in the company, and when the company went public, it created millionaires. I remember his admin—it was millions and millions of dollars.

Philippe Humeau: I don’t think she’s an admin anymore!

Manoj Tandon: But it’s a story that dates back about two decades, and that was the first that I’d ever heard of that model you were describing. Now, I think you’re absolutely right: we see a vacuum in the marketplace. Cybersecurity is an area where the demand for people far outstrips the supply of available good talent. So, people need to be creative. You want people to be a part of your organization, right? You don’t want them to just be employees; you want them to feel like they’re a part of something.

Philippe Humeau: Yeah, absolutely. Specifically when you run a company that is based on the crowd and a community. I mean, if you don’t act like this internally, you don’t drink your own potion.

Besides, we are selling knowledge, and there is one thing that is absolutely fantastic with knowledge: the more you share it, the more you enrich yourself. It’s not like a physical good; if you split it, you have just half of it. But knowledge—the more you share it, exactly what you’re doing with this podcast, Manoj—the more you share it, the more you enrich yourself.

That’s why dealing with virtual goods like data or knowledge is so enriching.

Manoj Tandon: Very well said. So, let’s talk about cybersecurity. I believe I read somewhere while we were researching your background that you use the term that a lot of people take the “Captain America approach” to cybersecurity. Can you describe what that is?

Philippe Humeau: Yeah. For the last 40 to 50 years, what we’ve seen is all types of organizations—big and small, no matter the budget—being breached. The way I interpret it is the following: their defense stance is something along these lines: they create a “super soldier.” This corporate entity creates a super soldier with tremendous tools, which could be laser-sighted with fantastic data—the goggles that see through things, X-ray goggles—and then they have the Batmobile and the Captain America shield and the jetpack.

But they are still one soldier—a super-equipped soldier, but one soldier against an army. And what proved true over the years is that when you fight alone against an army—except in Hollywood—you die. Period. You lose.

Manoj Tandon: Absolutely.

Philippe Humeau: And that’s exactly what’s happening. So, the CrowdSec approach is the following: if you want to beat an army, you need a bigger army. Since we are outnumbering the bad guys ten thousand to one, we have an edge here that we need to leverage to beat them at their own game. We are just more numerous.

It now boils down to another problem: the difference between “complex” and “complicated.” There is a misunderstanding about the cybersecurity problem. People think it’s a complicated problem. A complicated problem is like Einstein solving gravity with special relativity. This was a complicated problem for sure, but a complicated problem can be solved by one person who is extremely smart—one genius.

A complex problem is sending people to the moon. Even if you are Einstein and you’re super smart, there’s no chance you’re sending anybody to the moon, even though you know about gravity, because you need a lot of different skill sets to be able to put together and assemble a rocket, put people inside, and send it to the moon. For the last 40 years, we treated the cybersecurity problem as a complicated one, whereas it’s a complex one. That’s why we need collaboration.

Manoj Tandon: So, how does CrowdSec specifically address that? Because I think a lot of people listening are going to say, “Okay, I understand the philosophy, but how does the actual technology work?”

Philippe Humeau: The way CrowdSec works is actually pretty simple. We have agents deployed on machines, servers, endpoints, and infrastructures. Those agents analyze logs locally, so the privacy-sensitive data stays local. Then, when an attack pattern is recognized, only the signal—the metadata about the attack—is shared with the community.

So if somebody in Tokyo gets attacked by a malicious IP doing credential stuffing or SSH brute force, and five minutes later the same IP tries to attack someone in New York, the New York user already knows this IP is malicious before the attack succeeds.

This is where crowd intelligence becomes incredibly powerful. One machine alone is weak. Thousands of machines sharing attack telemetry become extremely strong.

Manoj Tandon: So essentially the community acts as an early warning system for one another.

Philippe Humeau: Exactly. This is what the attackers already do. The attackers collaborate massively. They exchange tools, exploits, infrastructure, techniques, malware, everything. Defenders historically did not collaborate nearly enough because companies were ashamed to admit breaches or afraid to share data.

We decided to reverse that model. Let’s make defenders collaborate at internet scale.

Manoj Tandon: And the open-source aspect of this is very interesting because open source in cybersecurity has always had this fascinating duality to it. Some organizations are nervous about it because the source code is public, but the reality is some of the strongest technologies in the world are open source.

Philippe Humeau: Yes, because transparency creates trust. Open source allows people to audit the code, improve it, contribute to it, challenge it, and harden it.

Security through obscurity has never really worked. Open source doesn’t mean insecure. In many cases, it means more secure because more eyes are inspecting the software continuously.

The Linux ecosystem proved this years ago. Most of the internet runs on open-source technologies already.

Manoj Tandon: That’s a very important point because people sometimes don’t realize how much of the internet and cloud infrastructure is actually sitting on open-source software.

Philippe Humeau: Absolutely. And the community effect is critical. Alone, you can only see what attacks you personally receive. Together, you can see the internet.

That’s the paradigm shift. That’s why I say cybersecurity is not about building a bigger wall anymore. It’s about building stronger collaboration.

Manoj Tandon: That is a phenomenal way to describe it.

Now, one of the other things I wanted to ask you about—and this is something we discuss often on this podcast—is burnout in cybersecurity. You’ve been in this industry a long time. You’ve built companies, you’ve done pen testing, you’ve led teams. How do you avoid burnout?

Philippe Humeau: You don’t avoid it completely. Honestly, you learn to manage your energy and your passion. Cybersecurity is emotionally exhausting because the attackers only need to succeed once and defenders have to succeed every day.

At some point, you realize you cannot carry the entire world’s problems on your shoulders. You need hobbies. You need to disconnect. That’s why I ride horses. That’s why I fly drones. That’s why I play pinball. You need moments where your brain does something else entirely.

Also, surrounding yourself with smart people helps tremendously because you don’t feel alone in solving impossible problems.

Manoj Tandon: That’s fantastic advice. I think people underestimate how mentally exhausting cybersecurity can be. It’s a very high-alert profession.

Philippe Humeau: Yes. It’s permanent asymmetrical warfare. That takes a psychological toll over years.

But it’s also one of the most intellectually rewarding fields because you’re constantly learning. The moment you think you’ve mastered cybersecurity, you’ve already lost.

Manoj Tandon: That may be one of the truest statements ever made on this show.

So before we wrap up, for listeners who want to learn more about CrowdSec, where can they go?

Philippe Humeau: They can go to CrowdSec.net. The software is open source, so they can test it freely, contribute to the project, join the community, and start protecting their infrastructure collaboratively.

Manoj Tandon: Philippe, this has been an absolutely fantastic conversation. Thank you so much for joining us from France today.

Philippe Humeau: Thank you very much for having me. It was a pleasure.

Manoj Tandon: And thank you to all of our listeners for tuning into another episode of Security Confidential. We will see you next time.