Inside the $10 Billion Cybercrime Industry: Are We Safe?

0:04Joining us today, the guy who went from deleting his bullies homework at school to building a cybersecurity business valued at over 1.5 billion. Danny Jenkins is the founder of ThreatLocker, and on today's episode opens up about why you will be attacked if you don't take his words seriously. He reveals the biggest mistakes we're all making with our own personal cybersecurity, including why, even with all the precautions, you are still massively vulnerable. Danny shares the lessons he's learned in building his business, why trust is the biggest currency at play right now, and how entire nations are backing cyber terrorists.

0:39I promise you, this is an episode that everyone needs to listen to and then act upon. Supported by IFS, this is The Room Where It Happened with Danny Jenkins.

0:54When you watch a movie with a cyber attacker, it tends to be a person normally in a hood, sitting at a computer in some far-flung country, working away, tapping on the keys. One of the things that I've thought about in the build-up to this interview is the role of AI when it comes to cyber attacks. How has AI changed the landscape for all of us? So cyber attackers very rarely wear hoodies. They mostly look like normal people. They're not normally individuals either. They're normally organizations. They're companies. They have quotas. They have different teams that do different things. So hold on, let me just get this.

1:25Are you saying that like the people that are launching these cyber attacks are like businesses like ours? There's people in an office with targets, not, and I mean like financial targets, or they're trying to hit their incentives. They've got a line manager. They're like operating like a business. Absolutely. And they could be 500 people. They could be 30 people. And they also sell partial cyber attacks. So you'll have one department whose job it is to catalog vulnerable VPNs. And then you have another group of people that's job is to get and try and fish people. And quite often what will happen is, let's just say your job is to fish people and get initial access to their system.

2:02You might be in the UK. you might be in the US. So you're not going to launch a cyber attack on Marks and Spencers if you're in the UK, because you're going to spend the rest of your life in jail. So what they'll do is they'll fish hundreds of companies. Suddenly somebody opens an attachment, gives them initial access. And then what they'll do is they'll sell that to another crime gang. It trades all on the dark web. And then another crime gang will come in and say, okay, well, we're going to go in now and do initial recon. And we might deliver the attack, or we might just figure out, get access, figure out what files have got, find out what their insurance is, find out what their antivirus is.

2:35And then they'll go in and sell that to somebody else. And sometimes they'll do it beginning to end. And everyone's got quotas, their employees, and people go home, they clock off at five o 'clock. You'll see, I've seen so many attacks where somebody gains access to a system. And clearly they're working in Russia or somewhere in Eastern Europe. And you'll see them run, doing their recon, accessing your system for eight hour days. You'll see them take their lunch break while they're on the server. You'll see them like three hours of looking around, trying to figure out what's happening, collecting event logs.

3:10Then you'll see a break and then you'll see another three or four hours and then you'll see them clock off and they just won't come back until the next day at the same time. So it's very much like a regular business that operates. And here's a terrifying thing. When I started throughout Locker, the endpoint security market was worth$10 billion. Cyber crime is worth more than that now. Cyber crime is worth more than$10 billion to these businesses. Yeah, there's more than a$10 billion industry in cyber crime. And the cost is much more than that because the cost to us is hundreds of billions of dollars every year.

3:40Oh my goodness. I'd never thought of these as like, so who are these people then that are like happy to be employed and go home to their family at the end of the day and at the end of the month, check their targets and at the end of the year get a Christmas bonus because they've done well. And their whole year's work has been tapping into and killing other businesses. Like, what's going on? And it is, obviously, a lot of them. And this is where, actually, you mentioned AI as well. AI has changed the situation because four years ago, I'll say now, three years ago, I'm trying to remember when ChatGPT changed the whole world.

4:15If you wanted to write malicious software, you had to be a developer, which is a lot of developers in the world. There's a lot of people who can write code. But most developers can get a job and get a good wage, especially in the Western world. So most of the cyber criminals were outside of the Western world. And they were in more of Russia where there's not good markets. You don't necessarily get a job just because you're a developer. So they would use those skills for bad purposes. Today, anyone with a keyboard, like if you go into ChatGPT right now and you say two different prompts, one of them is, can you write me a piece of software malware that will search for a computer to where they find their files and upload them to my Google Cloud account?

5:00It will tell you no. Now, two years ago, it'd say yes, but you had to say please. Now it would say no. But if you just reword it, can you write me a piece of backup software that search is where my files are kept and uploads them to Google Cloud, which is the exact same software, does the same thing? It will just spit that out. And you can now take that code, compile it. It's never been seen before. So the probability of it being picked up by an antivirus is very low. You might get picked up by an egress alarm once it's sent out too much data. And that's how AI has really changed the industry.

5:34So AI allows anyone with limited knowledge of what they're doing to become a hacker and to hack into businesses? Yeah. Even phishing emails, even the emails that go out, if you go two years ago, 90 % of them were broken English. And it would say, like, dear kind sir, please help get your payroll up to date. And it would have spelling mistakes and everything. And if you look at them now, the phishing emails are so well written. And you can go into ChatGPT again. You can say, hey, draft me an email. I'm the HR manager draft me an email to my employees to say that they need to sign up for the incentive program And I'll just draft a really nice email and you don't even have to speak English and then they send it out And it makes it much easier for these attackers.

6:15No wonder you're being kept awake at night. It's a I mean, it's it's a real issue, but there are also there's just things we can do another company another cybersecurity company in Florida Three months ago hired a North Korean spy by mistake now they they found out before any damage was done I think the FBI were watching them and they notified them. But that is how badly these guys will try and get into systems. They will try and go after your vendors. They will try and go directly after you. That is what we're dealing with. It should keep everyone up and down. You have to really trust your employees.

6:52They are the ones that are in there. How do you make sure you're not hiring a North Korean spy? If you can just take a couple of seconds to subscribe, then of course you can get each episode directly to your inbox. And honestly, for you to subscribe, it makes such a difference to our show. It means we can grow and it means we can attract more incredible guests like George Heaton, Rory Sutherland or Richard Branson to come and join us. And don't forget, you can also check out my Room Where It Happened newsletter. Just track me down on LinkedIn. The next war we go into, the war we're fighting currently, is not on the ground.

7:28Yes, there's a war in Ukraine that's on the ground, But our war with Russia, Russia, China have both gained access to critical systems in the United States government, probably in the UK government and in businesses. And they're fighting those through businesses locally. So if we don't change the world, eventually it becomes very, very real. And Russia and China will become leaders in the world because they are stockpiling vulnerabilities. They're attacking software. They're putting backdoors in software. and they're doing it through mostly targeted businesses attacks now. But it's a real problem.

8:06And I feel like if Russia right now decided to launch full-out cyber war on the UK or the US, we'd be in serious trouble. And we have to change that. And it's this sort of state-backed cyber terrorism because why would a bunch of Russians and a bunch of Chinese individuals decide to do this? Well, so bear in mind, there's two different types. And that's it. Right now, there is state backed or state sponsored. The state itself, which is another problem. So that's where the government's actually trying to get in. The state sponsored, which means we're going to support companies. And then I suppose I would call it state supported.

8:46And that is where individuals in Russia and individuals in China and lots of other countries too are being ignored and allowed to do whatever they want so long as it's attacking Western interests. And bringing money into Russia, bringing money into China is not a bad thing. So the government is taking a very light hand. I think I've known one arrest in the last five years in Russia for committing cybercrime. I've heard about it. And there's thousands and thousands of people doing it. So, and they're attacking everyone and it's affecting businesses, it's affecting individuals, but it's also a real risk to security.

9:24And if we don't change the way we operate, we're in serious trouble. And that's why we created ThreatLocker because our goal was we knew the right way to secure things. We just had to make it easy. so the goal was never hey let's run a business to get paid the goal was to run a business to change the world and getting paid is great by the way it's nice but absolutely and you are getting paid which is which is important um how many attacks are either being attempted or are successful every day like are we talking in the thousands or hundreds of thousands or i think in the u.s there's one 11 every 11 seconds on the on a business uh so there's a ransomware attack every 11 seconds was last year's start.

10:05I haven't looked at the updated data. They're being attempted far more frequently than that. And the reality is most of the stuff is not the big business. So we hear about the MGM, we hear about Colonial Pipeline, we hear about Marks and Spencers. And just think about this. These are the guys that have the good security systems in place. They've got a sock, they're watching things. They've got a full team that manages this, and they're still getting here. A lot of the attacks are actually on small businesses, but they don't make the news. and it's not like a small business is going to call the local newspaper saying, hey, can you report that I've been hacked?

10:36Because I think this is what's really important for people. If they're listening to this conversation now, they're driving their car, they're walking their dog, they're out for a run, whatever, and their blood has run cold because they realise that they're responsible or they own a business, they might have some processes in place. But as you've just said, it's often the processes don't matter because you've got individuals that can just make one simple error. What are the steps that we should all be taking regularly in our lives? So I think what we think about business is, because when you think about an individual, you could take steps to protect yourself.

11:10And that's very easy. Make sure you don't fill in, click on links. Make sure you check the link is going to where it's supposed to be going. It's Microsoft.com if you think it is. Make sure you don't give your credit card number out. Don't take phone calls and call the bank back. There's little things we can do personally. But business is a bit difficult because now you've got 100 people. So you've now got to say, well, I can't control 100 people or 1 ,000 people or 100 ,000 people. So what I need to do is actually make sure the business puts controls in place. And the business controls should be really simple controls.

11:42We can't control if our users, if the people who work for us go and get phished and put their password in somebody's website. We have no control over that. But what we can do is we can put dual-factor authentication on all their accounts. So in order for someone to log in, they have to get a push to their phone. So it doesn't take away the fact the user is going to get phished, but the attacker won't be able to get into their account. The other things we can do is rather than trying to say, hey, we don't know if a user is going to download a game or download TeamView or get tricked. Quite often you'll hear somebody say, oh, no, it was the IT department told me to run this on my machine.

12:15or and but what we can do as a business is say well this is the software you use on the network this is the software you use in our environment new zoom and chrome and office that's all that can run i don't care if it's unknown malware or or angry birds if it's not in that list it can't run because then you're saying it doesn't matter if the employee makes a mistake we're going to stop that from happening and then you could also get into well what does the software need to do because the other types of attacks which are less common are when a software vendor gets attacked and that software is on your machine.

12:46We saw it with 3CX. We saw it with SolarWinds. Not very common compared to regular attacks. But you can also say, well, I'm going to accept that this software might get breached and I'm going to limit what it can do in my environment so it can't see more than these two. And that's really the focus, putting those kind of controls in place. Now, I wish I could, they're all in one go. We have a white paper called Less Hackable, which gives a bigger list of tips, but it's that type of thing that's going to save your ass. Where can people find the less hackable white paper? I think it's up on our website.

13:14So you can just go to our website and search for less hackable or go to our blog. I think it's our blog page or our white paper page. You can find it there. And it's got like 10 steps. The reality is there's probably 170 things you should be doing, but they're going to be the 10 most important things you should be doing in your environment as a business to stop your employees making you vulnerable. And your message for someone listening to this who's never even thought about a cyber attack, they've created a business. They're a business person. they love owning their own business. They've got a few staff, things are good, but they've never even considered a cyber attack.

13:46What's your message to them? You have to focus on your cybersecurity. You have to think about what am I doing? What are my employees doing? If you're very small business and you don't manage your IT, ask your IT company for, are you doing this, this, this? Actually, you can download tests. If you can download TeamViewer on your computer and you don't use TeamViewer, if you use it, that's a different exception. But you can just download TeamView and run it, and you don't usually use it, you should call your IT company and say, why can I do this? I shouldn't be able to do this on my machine. So if you're using external, make sure you're asking them the questions.

14:20If you've got your internal IT, make sure they're doing those things. Make sure they're putting controls in place. And you should be worried about it. You genuinely should be worried about it because it is the most likely way you're going to go out of business. And should every employee have two-factor authentication turned on? Absolutely. It's basic security. Two-factor authentication, block untrusted software, the two things that you, and close all ports on your firewall, they're the three things you should be doing, absolute minimum. And if you don't, eventually you're going to get hacked. It's not a case of if, I think 15 % of companies have been hacked in the last year or something.

14:57So you're going to get hacked and it's going to cost you a lot of money. An attack that I helped to recovery with back in 2014 and this is what really changed my thought process on cyber security and how it affects not just IT professionals but entire businesses and people. If I go back essentially I was at this point I was really doing consulting I'd start doing ethical hacking and I was getting a lot of calls from IT professionals saying hey can you help me with this cyber attack someone hacked us or someone hacked this company I'm working with can you help me with this attack and essentially this was a a small insurance broker if you're like 50 employee insurance broker in australia and they'd been hit by ransomware the idea of ransomware is you essentially take control of somebody's systems encrypt all their files and say if you want your files back then you have to pay this ransom and this is the first time i'd actually seen ransomware in real time before that most it was pop-up inappropriate content, slow computers, things like that.

15:58And I started working on what happened, started looking at the logs, essentially an attacker had got somebody to open something on their computer, and then they gained access to the network, they gained access to the server, and then essentially encrypted everything in the entire business. Where it got really strange for me is about a week into the attack. And at this point, I'm just dealing with the IT company that engaged me, but the owner of the business called me and he was a 60 something year old man. and he's quite agitated he's like well when's this going to be fixed what's happening and i i said well i don't know how we're going to get the data back right now i know you've paid the ransom the key that they gave us didn't actually decrypt your data all of your backups are gone so you're talking about databases customer lists email everything in the business is gone and what we're trying to do is recover from low level recovery tools and it got suddenly very awkward for me because the guy got very emotional and started voices cracking on the phone and I really didn't know how to respond to this because as an IT professional I'd never dealt with a business owner breaking down that his entire life's work was about to go away the good news is we managed to recover enough that he didn't lose the business and he did lose a lot of money I guess because a lot of data had to be recreated and they got back up and running but I think that was really what made me say security is changing and we have to change the way we defend against it too.

17:22Man. And these are hacks that are killing businesses. I mean, there would have been a moment where you realized that that Australian insurance business was going to go under unless you helped them out. And I guess it was the guy crying on the phone, right? Every other piece of malware I've ever dealt with in history before that was about my computer got malware and I spent four hours cleaning it off or I had to rebuild my computer. I'd never dealt with the idea that a business can fail. And that just blew my mind. This business can fail. And I couldn't even comprehend that before that. It was always an IT problem, a technology problem when you got malware.

17:59And the issue to the business was more about, hey, my computer's not going to work for so many hours. But this changed it for me. And that's really why I went in and said, we've got to change the way we're doing security. Because I thought, this is actually entire businesses. People are going to lose their jobs. And it's, you know, if the customer gets, at this point, I feel like as a consumer, my data's out on the internet anyway. So if I get a letter from an insurance broker saying they leaked my data, I'm not even raising my heartbeat anymore because it's that common I get those letters. But as a business, just seeing that disappear, seeing people's jobs.

18:31And this guy was retirement age. His entire life's work was about to go up in smoke. So when that happens, what is, and they call you, what's the first thing that you can do for them? So typically, if you're going to call an incident, in this case, I was coming in much later after they called somebody and they couldn't get data recovered. But normally you're going to call an incident response team. And the first thing they're going to do is try and get every network connection killed from the network, every power killed from the network. And the reason being is because normally these encryptions take a long time.

19:06So if you're halfway through an encryption, you maybe have to recover half the data. So the first thing that they're going to do is try and get everything shut down as fast as possible. So what, you just unplug everything? Literally just unplug everything and say, because especially in smaller businesses, where they're more likely to be able to get the entire business in one go, it's much better to just say we're offline than to say the files continuing to encrypt and upload. So the first thing they're going to do is that. And then the next thing is really going to be trying to assess how much damage has been done.

19:39The old school ransomware in 2014 was we would encrypt your data and you'd have to pay us for the keys. The new ransomware is we're going to extract your data and then we're going to encrypt your data. And so in the old way, if you had a good backup that was physically disconnected, you'd be able to get your data back. It might take you a few days to get online. Although people don't often underestimate how difficult it is to recover thousands or even tens of computers at the same time for backups. But the new ones are now saying that we've also got your data. So what typically I would be doing is once I go in there, I'd be trying to figure out what systems have been compromised.

20:16How was it compromised? Can we just clean every system and recover the data? Was data stolen? Can we see evidence of what data was stolen? And in some cases, the customer doesn't want to know because if they know data has been stolen they have to take an action on it and if they don't and that's a terrible thing to say but sometimes people just say i'm a medical clinic or a dental office if all my customer files have stopped being stolen i have to notify them that their files have been stolen if you're telling me all my files are encrypted that's different because that means they didn't take the data so sometimes customers will actually kind of cover their ears and not want to listen to data theft because that's almost more terrifying for them because now they have to go out and tell everybody.

21:01So I obviously host this business show. I also have another podcast that I host. I've met a lot of very interesting people. Many of them own businesses. Many of them are successful. Some of them are individuals. And knowing that we were going to have a conversation today, over the last sort of 48 hours, I've messaged a lot of people in my network and just said, I'm doing a little poll. What are the three things that you think are most likely to take down your business. Of the people I messaged, how many do you think replied and said a cyber attack? I hope 70%, 80 % of them. I think probably more like 40%, but I would hope it's more like zero.

21:39Zero people replied and said a cyber attack. They spoke about cash flow. They spoke about a recession. They spoke about changes in government. They spoke about staff letting them down um they spoke about themselves as the leader getting ill and being unable to run the business no one said in the top three things that can kill my business is a cyber attack and yeah it's interesting actually because it's not only the most likely thing is it's not it's the most likely thing to kill it in almost an instant and you you go home one weekend you come back in on monday and everything you work for is just gone and we're a security company and i constantly uh we have some of the best controls you can imagine in place we are constantly being attacked i think there's a hundred thousand login attempts on my email alone from russian ip addresses every single day is that because of the business that you were in yeah so we we would be well look so all businesses are targeted there's two types of targets there's direct targets which is what what Threat Locker would be, what Marks & Spencer's might be, what Barclays Bank would be.

22:46Someone's going to go after them because they've got a big enough checkbook. And then there's indirect targets. And that's really where you're going to throw a scatter campaign out and then someone's going to bite and then you're going to go in and destroy the business after the fact. So smaller businesses tend to be less targeted. But obviously, we're looking after federal government, big banks, hospitals, airports. So we're very, very targeted. But we have so much security in place and it should be the thing that keeps you up at night. It's the thing that keeps me up at night every single night.

23:17And I have so many external tests happening to make sure that we haven't misconfigured something, done something wrong. Because one of the other things is the reality of these attacks is they're not sophisticated. Everyone thinks they're sophisticated, but they're not. They're very, very simple things. And that's what scares me more than anything that we just missed something really simple. We hear the word sophisticated because reporters love to say, or companies, I'd say, we had a really sophisticated cyber attack. It wasn't sophisticated. Somebody ran a piece of software and let somebody on your network.

23:48Let's explain to people the fact that there's a slight element of poacher turned gamekeeper with this conversation today. Because at the very start of your career, shall we say, you were less on the side of stopping other people getting hacked. And you were actually the one doing the hacking and I think as someone that suffered at school right with some very nasty bullies I'm going to be totally honest with you and say that I rejoiced when I read this part of your story and I know I shouldn't because it would have caused some anguish to other people but also I sort of think fuck them so I'd love to hear you explain this for us well look so I grew really really late so when I was 16 or 15 when I left high school or regular school my do my GCSEs um I was five foot two now I'm six foot so I grew eventually um and I was pretty badly bullied and beaten senseless pretty much every day um so I I kind of would miss most of school apart from four subjects did you miss school because of the bullies that the bullying was so bad you didn't go to school oh yeah I wouldn't like I knew if I was go I'd get beaten senseless like so I I was kicked down the stairs I was beaten with a piece of wooden nails in it it was it was a miserable school it's in it's in Telford and it's gone now thankfully the school unfortunately the people that went there it was it was it was a horror horrible experience it's and I I kind of couldn't get revenge because I was sure I wasn't very strong I was just scared to be honest and this is that I didn't even have a computer at home this is pre-computers I'm 44 years old so this is uh like people those computers at school but only in business studies at that point in time.

25:24So no other classroom had computers. And I started learning how Windows works and how DOS works. So it was Windows 3.1. And I realized that you could script things to start automatically in Windows. So in the computer, you'd script, there's a file called autoexec.bat or whilst back then. And you could write things in there. And when you turn on your computer, you can start applications automatically, which is great. But I realized I could actually also delete files and do things like this. So I started programming it and the homework was all on your floppy disk to delete the files off floppy disks automatically when the machine started.

26:01And I would write these scripts and put them on all the computers for people I didn't like that were using those computers. And if I was not using that computer, I'd just not put my disk in until after the computer started. And it was my little bit of quiet revenge that no one ever knew about. Well, they know about it now. And I actually applaud it because I think it's so interesting that this is the approach that you took that kind of kept you sane and safe. So, no formal education, no qualifications to speak of, yet here you are as the founder of a business, and you probably don't want to talk about what it's been valued at, but I saw reports of a valuation of over a billion, right?

26:40Yeah, our last round was 1.5 billion, and it's probably a decent amount of ups and cents. Wow, okay. I think we just need to talk about how someone goes from wiping the bully's homework to creating a business valued at 1.5 billion at the last round. When was the first time that you thought to yourself, this could be a career, this could be a life for me? Because you said at the very start of the conversation, you became an ethical hacker. Yeah. So, and probably going back before then, when I left school, I immediately got a job in IT at, well, 16, say, because it was just before I was turned 16.

27:15And I got an apprenticeship, 50 pound a week and i learned and i learned i learned i was there for a year and then i got another job and i learned and learned and then um i started tried to run a business that was a failure and i ended up moving to ireland and um eventually i got another job in corporate it and that's when i really got deep into security because i got very lucky in that i was in the corporate head office as the only it person in a four billion dollar company worldwide that had 140 different IT departments and suddenly they'd all been connected together. There was no one else to stop the threats between them.

27:48So I started learning security. I founded two email security businesses. And one of them, well, none of them were a failure, but one of them was a very well learned lesson about investors and how not to take investment and who not take investment and what structure you should always have. So one of the things that I insisted when I set up that locker is we maintain full control of the board. It doesn't matter. So would you just give us the biggest lessons you learned from those mistakes if possible for people uh yeah so i mean essentially what happened i'll give you the fast version is we took investment from my employer at the time they got i think it was 51 of the company for 150 grand which seems like a lot of money when i was 23 24 years old um and that we built the company it was doing relatively well it was called mxweep and it ended up with um him one day saying uh there was another investor who wanted to come in didn't want to take that investment and say it was$60 a share.

28:42I don't remember the exact number. He said, instead, we're going to invest more. I was like, okay, you want to invest more. That's fine. He said, no, we're going to invest at one cent a share. And basically, and then they fired me and it turned into an 18 month high court battle, which the lawyers won, they lost and I did okay. So that was, that was my lesson on distrust of even more people than I distrusted before so the i started another more lifestyle business email security as well i i sold that to a uk company but it was small it was like a few hundred thousand dollar exit so it wasn't it wasn't big and then i i wanted to do something fun so i said i want to go into do ethical hacking um so i had a four-year period where it wasn't supposed to be just be ethical hacking but it ended up being more recovery of ransomware by the end of it and what is ethical hacking So basically, the idea is you charge a company to try and bypass their security defenses so they can strengthen them up.

29:42I wasn't that good at sales. So the way I did it was I said I won't charge you unless I gain full control of your system, which made it a little bit easier to get someone to sign an order. Because if I came to you now, if anyone came to you and said, hey, I want to test your security, pay me$5 ,000 to test your security, you'd probably say, no, my security is fine. Go away. But if you go in and say, well, look, pay me$10 ,000, but only if I get full control of your system. If you say, well, your security is fine, so we won't have to pay you then. So let me do it. Sign the form. It's a little bit easy to make that sale.

30:10But what happens is you do a couple of those and then you get this reputation of someone who's really smart and everyone wants to call you because they keep getting these cyber attacks. And that's ultimately what it turned into, more ransomware recovery. And that's really when we decided that we had to change the thought process from default allowed to default deny. What does that mean? So basically the way most security works on your computer right now, if you go and download a piece of software, if you download anything, unknown malware, it's going to be allowed by default. And if it gets, if it's on a bad list or does something known to be bad, it'll get blocked.

30:46But the default position is allowed. And what I wanted to do was change the default position to be denied. So unless it's on your list, it doesn't get to run. and that's it's called zero trust now it wasn't called zero trust back then um but it's it's referred to as zero trust security now and essentially the idea is is rather than trying to chase every bad guy in the world it's kind of like if you're letting someone in your house you don't say you can come in my house if you don't have a criminal record you say you can come in my house if you're my friend and that's the same principle for computers you like you don't say you can run on my computer if you're not no bad software so you can run if i want you to and my business wants you to.

31:26I think the really interesting thing about this conversation, right, is that we all know our businesses. Like, I know my business inside out, upside down, who I employ, what our processes are, how things operate. I wouldn't have the first clue what to do if we were breached from a data perspective. So I call someone like you in. What are you actually looking at? Like, are you looking at, like, complicated lines and dots and, like, code on a screen? Like, how are you able to work out? like what's gone where's it gone is it recoverable mostly we're looking at logs and that's it and it's not complicated dots uh we're going to look at processes that are running on the computer we're going to um things especially if your system's not well secured something could be injected into a process so we're going to look at processes that running we're going to look at what those processes are doing if they're doing anything out of the norm to try and figure out what is the actual attack we're going to look at logs and it's really very boring everyone thinks it's like really exciting John Travolta hitting a keyboard.

32:24It's not. Mostly we're looking at event logs. We're trying to figure out who logged in. The first stage is trying to stop that damage continuing. The second stage is really twofold. One is trying to determine, do I need to rebuild my entire network from scratch and restore from backups? But also trying to figure out how they got in and what they gained access to. Now, sometimes what can happen is you get the customer up and running from a two-day-old backup and find out that the malware is in the backup and it was already on the system. So immediately they get hit again. So, and that's why the second part is very important too, that we're actually looking at everything that was happening at that point in time.

32:59So we know exactly when did they gain access? How did they gain access? You know, the reality is it's really simple how they gain access. Somebody got sent an email saying, Hey, there's an urgent update on your computer. And it only takes one employee to open that email. And then they have full access to your, they have initial access to your system and then they can move from there. So just go through this with us then, because I think this is really valuable for people because we all think that we've got like antivirus protection and we've got firewalls and every time we get an email about you know make sure your security's up to date and we do it and you assume these big companies you know the providers of your software and your hardware they tell you that we've got the latest stuff to protect you but these companies are still getting through so you're saying the first thing that tends to happen is you get a message asking you to update something and and then i'm just like well those happen every day in every business How the hell do we know which ones to trust?

33:49I think that's really the point. It's hard. For me, it's very easy to look at something and say, well, that's not a real update. That's not. But I remember getting quite mad with the user. And they had said they'd opened something, they'd clicked on a warning, and they'd allowed a macro to run in Office, which then downloaded something that gave somebody access to their machine. And I was like, why did you click it? It's just a security warning. And I was getting quite mad. And this is before Threat Locker Days. And then they just said to me, look, how do I know what to click? I download an Office document.

34:21It gives me a warning. Why can I click this warning and not this warning? And for me, it's very simple because I live and breathe this stuff. But for someone who really hasn't grown up with in the era of technology and doesn't use technology all the time, they don't know the difference between a pop-up in a browser and your Zoom app updating on your machine. So it's very difficult for some people to interpret that and decide what to do. And typically, there's one of three ways they'll get into your network. One is you've got an open port, and that's pure bad IT management. The other one is a vulnerable VPN.

34:52VPNs are a big problem. And the third is the most common nowadays. It's just somebody gets phished. Somebody gets tricked into opening a piece of software. And they don't necessarily get onto your network with bad software. They'll actually gain access using good software. So things like TeamView or AnyDesk or unknown software that's not got any reputation. And then they'll actually use that once they're in your network. They'll encrypt your files with something custom made that isn't in any antivirus database. And when these hackers do get access, obviously they're doing it for financial gain.

35:23What sort of numbers are we talking about in terms of the sort of ransoms that they charge for giving you back your data? They vary. They've gone up significantly. If I think back to 2014, that ransom that the insurance company paid$22 ,000 and they didn't get their data back. Today, I've seen them as high as$70 million. dollars and I think the lowest I've seen recently is like 200 ,000 they'll actually figure out how much you're willing to pay and one of the things they'll do is they'll actually try and get access to your bank statements while they're on your network because let's just say I'm a hacker and I take full control of your network and let's just say you've got a million dollars in your bank and I say to you pay me a million dollars so you don't get your data back you're probably going to go well no I'm out of business anyway if I take you a million dollars on go to hell and so that What they'll do is they'll pick that number that's somewhere between 20 % to 30 % of what they think you can afford.

36:18And then they'll ask for that because you're more likely to get paid if you do that. They'll look at your cyber insurance policy. Now, cyber insurance policy covers nowhere near enough. But they'll look at that to determine can they get more. And they'll look at what it excludes as well. Because a lot of these are in Russia or somewhere like that. And then there's certain sanctions in place that makes it hard for the cyber insurance to pay. So they'll decide, you know, where am I going to request it from? how much is your insurance, how much do you have in your bank account, all of those things to determine how much to pay.

36:46Ned, and I think the stat is 96 % of the time they won't, they'll give you your data back, 4 % of the time they won't, which is, imagine that feeling, you just pay someone$300 ,000 and you don't get your data back. Danny, we've spoken a lot about what businesses can do. What about us as individuals? Are there things that we should be doing right now to protect ourselves? I mean, there's a lot you should be doing, And I think if you start off with the basis that you've got to never trust anyone. So I would say that probably if we have to pick three things, I'll say four because I'm not sure if the third ones will work in the UK.

37:20The first one is whenever you get a link for anything, make sure it goes to the website. Go to their website directly. So if it links to Microsoft, go to Microsoft.com and make sure that it's actually in the link and not just at the end of it. The second thing I would say, never take a call from anybody and give you information. If your bank calls you saying, I'm just verifying information on your card, can you tell me? I guess you don't have social security numbers, but whatever verification, date of birth, mother's maiden name. Just say, I'm going to call the number back on the card. And the third thing is don't download anything on your phone or your computer unless you absolutely know the source.

37:55And if you don't need it, but move it. Those apps on your machine, every app you run on your computer can see all of the files on your computer. So when you get that free game that's jailbroke, don't just consider that it can see all of your files. Wow. So when I give my phone, which is not a rare thing to my kids who want to download a game their friend has got, I need to be well aware that that could give the person that owns that game access to everything. Yeah, and the phone is a little bit better and that will actually prompt you saying this is trying to access your files or access your thing.

38:25But once you accept the prompt, especially if you're giving it to your kids, it can now access it at your computer. It can just access those files out of the box. So I would make sure you remove anything you don't need. People often don't realize that everything on your machine can see all of your files. That little webcam support app made in Taiwan or whatever can see all of your files on your computer. And that doesn't mean it's going to steal them, but it could do if it either has a backdoor or has a vulnerability in it. I say one other, I'm not sure if this one's useful in the UK. I always recommend in the US to lock your credit reports.

39:01Because if somebody steals your identity, they can't apply for credit in your name. I don't know if that's a big thing in the UK as much. But if you can lock your credit reports, I would lock them. And what about the future? Because when someone ends up as the founder and creator and owner of a business with a one and a half billion pound valuation, there is a moment where you can say, do you know what? I've spent enough time away from my wife and kids. I've spent enough time in the office. I don't need a life to myself. Do you think about an exit strategy? Do you think about what your future looks like?

39:30You know, sometimes I have bad days and sometimes I have good days. And one of the nice things about this, I founded this company with my wife. And my wife is the COO. So thankfully, I get to see her a lot. Although on the downside, we seem to talk about work until we fall asleep. And that's the downside. Two of my kids work at least part time in Threat Locker, which is nice. um i i think you know if you ask me some days when i'm having a really bad day and you know we're hiring 40 50 people a month we're firing probably 10 people a month and there's more drama than you can imagine sometimes and uh things happen that just stress you out and service technology issues and there's a lot of stress in running a business but i i think sometimes i think why didn't i just quit sell the company but then on the other side say well what else am i going to do like i can't take two days off work like how am i going to survive if i don't have anything to do and i think what we're doing right now is more important than uh just spending time at home and we call it work-life integration so if i'm if i'm going to barcelona for work i say hey kids you want to go to barcelona little do they know how lucky they are look i yeah i think it's an amazing story.

40:43I think that you've created a business built on passion. You have clearly got amazing business acumen as well as incredible knowledge of the field that you're in. And I think that's built on passion. It's built on a desire to change the world. But I think the thing that is most impressive for me is that as the threats become greater, it seems that your desire to end them becomes greater. You don't seem to me like a man who senses that he's going to be defeated by this. You have the air of a man who thinks in the end, whether you can ever win against them, I don't know. But I think in the end, you feel like you will come out on the right side and you will have changed a lot of lives in the process.

41:21Yeah, I think that's what we're thinking now. We've got thousands of companies or 70 ,000 companies that are protected that weren't. Millions of endpoints. That's jobs that we're saving. We've stopped hundreds of thousands of cyber attacks, I'd say. and whether they be smaller or bigger one or at least thousands of substantial cyber attacks. And I think I feel good about that. And that's really what we focus on as the core of our business. Make sure people educate people and build better product. Well, thank you so much for your time. And for me personally, it's been a real education. You know, I didn't really have this idea that there are nations in the world where you've got the government backing these things and then you've got the government making it easy for these things and then you've got the government not stopping people for just doing these things.

42:12I mean, some of the biggest countries and most powerful countries in the world. And I think if that isn't a wake-up call for people around the world and governments around the world with the advent of AI, I don't know what it is. Thank you so much for your time. That is a very powerful and important conversation for so many people and I applaud the work you're doing. Good luck. Well, thank you. Thank you for having me on today. So what do I think about that conversation? I mean, I think the biggest thing is that we all need to do something about it. In fact, as soon as I finish talking to you, I'm going to go straight next door and speak to the team on this show to say, have we got everything in place that we need?

42:48I guess the biggest headline really is that you can have everything in place, but if individuals in your team make one mistake, if they click on one wrong thing, then suddenly all of your preparation, all of your cybersecurity can count for absolutely nothing. I suppose the scariest thing that we discuss is that entire nations are backing their cyber terrorists. They're either doing it themselves or they're actively funding their cyber terrorists. Or when they know that people are cyber terrorists, they're not arresting them. They're not prosecuting them. And I do wonder what the future looks like if you've got entire nations that are kind of committed to waging a war against each other in this way.

43:25And actually, Danny said a couple of times, didn't he, that, you know, a traditional war is when you've got troops on the ground. But this is the new frontier. This is the new war and it's happening all around us. I mean, every 11 seconds, someone in the United States is getting cyber attacked. And I guess really that's why he's managed to create such a valuable business. And also, by the way, huge credit to Danny for building a business valued at over 1.5 billion just recently. In some ways, it's kind of a shame, right? Because if we weren't all so vulnerable, he wouldn't have such an important business.

43:55but it's just a reminder that the number one thing that can take down a business is a cyber attack. And what about all of my friends that I spoke to and said to them, what do you think can kill your business? And none of them mentioned a cyber attack. So I think if we take one thing away from this conversation, it's that this can happen to anyone. It's also important to remember that anyone in your team at any time, if they do the wrong thing, can take you down. But also the fact that this is not a threat that's going away. This is a threat that is just continuing to increase. And what did he tell us?

44:25It's tens of billions of pounds is the value of being a cyber terrorist every single year. So keep your eyes peeled. And Danny, can I just say huge thanks to coming on and sharing so much with us. Oh, and for you that have enjoyed this episode, not only should you react to the things that you've heard, I would absolutely suggest that you send this conversation on to the people in your network who you think could benefit from it. And for more great conversations like this, please just hit the follow button. We love as many people as possible following us on the room where it happened. It means we can keep doing the show, we can grow the show, and we can have even more valuable conversations like this one with Danny Jenkins.

45:02So stay safe from those cyber terrorists, and I'll see you again soon.