#271 Damien Lewke: Pro Football to CrowdStrike, Why the Best Cybersecurity Still Fails + Building Nebulock Alone

0:00Hi, I'm Vidit, the founder and host of this podcast, The High Flyers. Hey, I'm Damien, the founder and CEO of Nebulok. Damien, I am pumped to do this. I feel like you might be the perfect guest we've had on the podcast. Like you seem to just have the whole package. So I think if we can unpack some elements of this package today, like from your personality through to your career, through to the company building, we'll do a pretty good job. I'm looking forward to that. I just need to make sure my wife listens to this because that was a... Great recommendation. Thank you. I'm glad. Hey friends, welcome back.

0:36Welcome to the High Flyers podcast, where we do reimagine a high flyer, showcase the brightest and most relatable role models and companies and the journey from sunrise to today. As one of the premier products in our Curiosity Center lineup, providing on-demand intelligence to help you be 1 % better every single day. I'm your host, Virita Aguil, and let's have some fun. Our listeners have called this podcast a meticulously researched biography unveiling the extraordinary lives and decisions of the most remarkable individuals and companies from around the world. We hope you're enjoying our catalog of 200 plus episodes.

1:17Since we launched in 2020, with many of our guests appearing in rare public interviews, it's now time to explore your curiosity. Please enjoy. let's set the scene with some fun facts where were you born and where do you live now i was born in greenwich connecticut and i live in boston massachusetts and work what was your first job and what do you do now that's a funny story so i've got kind of three angles on the first job i played a semi-professional soccer in germany uh for a few years and then after that sold shoes for a time at the Sperry store before really beginning my first job, my career, which was as an operator at Northrop Grumman in the United States Defense Industrial Base.

2:02Which out of those three were like your favorite? I mean, naturally, because we're still in the post-World Cup glow, I'll say soccer. But, you know, it's tough to pick. I actually really enjoyed selling shoes. I met some very interesting characters selling shoes in Los Angeles. I'll put it that way. I bet. I feel like it's the equivalent of like, you know, that sell me this pen concept. Like, sell me the shoe. That probably would have taught you a lot about sales, right? Like, how do you convince someone to buy a pair of shoes? Oh, 100%. I think one of the most notable things was Jonathan Davis from Korn, if anyone's a Korn fan out there, came in.

2:41And that was kind of cool, which is like, how does my middle school angsty self not get starstruck and talk about a size nine gold loops, Barry shoe? So yeah, I learned a lot. Nice. And I want to come back to these stories in a second. Damien, as you know, the purpose of this show is to reimagine the concept of a high flyer. Is there a high flyer you know who you feel hasn't got the recognition they deserve? Yeah, I'd actually call out a Sydney Maroney, Nebulok's head of threat hunting. This isn't a shameless advertisement for Nebulok, but rather she has been an amazing advocate for this incredibly important discipline and security and also independently has built out with a couple of folks, a really large community in threat hunting called the Thor Collective Dispatch.

3:26They've got a podcast, a substank they post religiously, really just amazing work that she's been doing in security and for the threat hunting community writ large for the past few years. Back to the episode in a moment. Something I've heard a lot from business owners and leaders is that speed only matters if you still feel confident in the output. and it's particularly an important point in this world of AI. Zero's answer to that is accountable intelligence. AI that shows you what it's doing and works from your own real data and is designed to keep you in control before anything happens. As Zero puts it, most AI asks you to trust it.

4:09Accountable intelligence shows you why you can and that's how it works with JAX, Zero's in-platform AI finance partner. So whether you're running the business, advising the client or working with your board, Jax ensures that you get the upside of automation without giving up any of the control. If you want to see this practice, head over to xero.com forward slash highflyers for 90 % off your plan for the first six months. Terms apply and go to the website. That's xero.com forward slash highflyers. Now, back to the episode. Super cool. I mean, your team came up so much in my research. It seems like you've picked an all-star team.

4:52So I'm keen to ask you how you've done that because I know you're a very intentional guy. So you've probably found people and maybe you knew someone. Did you know most of these people because you worked with them in your career and they've just followed you in some ways? You know, interestingly enough, I have hired a few folks I've worked with in the past, but no, a lot of these people are net new. Fun fact, actually, Sydney and I first met through Substack where I got my own segment. So from all walks of life, but to combat the next generation of cyber adversaries, you need to assemble the cyber avengers.

5:23And that's what we've got here at Nebulok. Nice. And why don't you just give us a quick overview of Nebulok as well? Yeah. So Nebulok is, we're a hunt first agentic security operations platform. What does that mean in non-cyber techno jargon? we are a proactive by default security system that uses the existing data that you have to surface threats that have otherwise been missed and over the course of our lifetime we've run over 300 million agentic investigations and surfaced over 4 000 incidents that existing security tools had missed amazing i'm actually really i think that was my key takeaway from the prep for this is cyber is such a fascinating space like for whatever reason i have just not spent enough time in cyber like i do a bunch of angel investing i do this i do a whole bunch of stuff and i just have not spent time in cyber and i think you've convinced me that cyber is a space i need to get deeper into so genuinely i'm like hoping this is going to be a learning opportunity for me and the start of my like whatever journey into cyber maybe it's like a bit of investing or featuring more founders in the podcast vidit i'm super biased i fully support this journey into cyber it is uh it's funny it seems esoteric but once we get into it it's actually quite straightforward yeah and it's so relevant right it is deeply relevant and it's one of those things where we don't think about it but but it's happening all around us so that'll be fascinating for you to you to give us some more context on but but let's start with let's start with Damien let's start with the your early journey your sunrise as I call it tell me I mean I've heard some fascinating stories about your early journey but let's start with the upbringing the environment you're in and the influence of family tell me more about that oh yes uh family is everything to me I I know people say that and it might sound trite but to me it is really important so my parents uh last week celebrated 49 years of marriage I don't know how they did it because I really, really tried to push him as a kid.

7:28But in all seriousness, I'm the third of four kids, the second of three boys, very much a middle child. I've got an amazing wife who is extremely patient. And, you know, family's really, really core to how I think about solving problems, which is growing up in a close-knit family. It's all about the unit, the team, and supporting people unconditionally. And I think my parents really instilled in me this idea and importance of like a very hard focused work ethic. The point of, you know, you've been given an opportunity. You should leave this world better than the way that you found it. And the way to do that is by being consistently hardworking.

8:10So family is extremely important to me. We're all very close still. Yeah, I'm a lucky guy. So you grew up in Connecticut, but then German heritage. Is that right? Oh, yeah. Yeah, so that's, it's been an interesting journey. So my dad's German Canadian. So, you know, spend some time in Germany and a lot of time in Western Canada growing up, my parents met in Boston in 1974. I spent ages one to five and 15 to 18 in Germany. And outside of that, I grew up in the Bay Area. So we moved out there for my dad's job when I was a baby. So I have no memory of Connecticut. Right. But now living in Boston, you know, know the northeast united states people i guess i technically am a northeasterner but um most of my formative years were in the bay area um but this is like late 90s early 2000s i remember when facebook was like next to my mom's yoga studio in palo alto and that like silicon valley back then was was a little different right like the same kind of innovation ethos you had venture capital but it was a lot of um i'd say like ambient absorption of being curious and using technology to solve big problems and then yeah once i was 15 i moved back to germany and that was for soccer and i was there till i was 18 and then moved to los angeles and a bunch of other stuff happened after that but early years i would say like bay area is kind of where i grew up and when you say bay area you mean like palo alto which whereabouts yeah uh so technically it's called pertola valley uh if you know the bay well it's ladera um but it's depending on it's an unincorporated part of San Carlos County.

9:44So it can be Menlo Park, about a mile off the Stanford campus. Yeah, nice. Wow, that that is so interesting. I'm always curious to that. Did that sort of rub off on you as a kid? Like, did you did you get curious about tech? Oh, yeah. I actually hacked my first system when I was eight. Because we were at the just casually. Well, so it wasn't even that impressive. It was just social engineering. um right so yes the the short answer to your question is yes that kind of innovation economy very much rubbed off on me but you're exposed to technology at such an early age and you know i remember when i think it was 2001 uh my friend showed you know showed showed me that you could click i'm feeling lucky on this thing called google and uh you know we were doing like a planets report and lots changed in 2001 so yeah it was a great time and tell me your parents what do they do for work i've heard your dad was he an executive recruiter yeah he was so uh okay my parents so they're both uh barred lawyers in new york my dad's also barred in california um but he spent the majority of his career as a an executive search consultant so he started out his career as an aerospace lawyer um and then left that to go into executive search and he specialized in CIO searches, which was, I guess, a very useful thing during the dot-com boom, bust, and what happened after.

11:13But yeah, he's been doing searches his whole career. He still kind of works part-time, but he did it like full-time for about 35 years. And my mom was a lawyer. She was general counsel of a shipping firm. I'm very grateful. She actually ended up retiring when she had me at 38. I was kid number three and wanted to spend more time with the family. But she argued in front of the US Supreme Court. she's got away with words and can certainly hold presence uh you know i would say what what i lack in height i make it for in volume and that comes from my mom there's a solid five one uh so yeah i can see where your high i can see where your high performance attitude comes from right i mean these are like two high flyers like complete high flyers they were uh no they still are in their own respective ways my um my dad semi-retired and he actually just did his 30th iron man at 71 wow so they find ways to push themselves even now which i really admire and and when did you i've heard you did your first triathlon when you were nine is that right is that a true story yeah wow your research was excellent for it um yeah my first try when i was nine you succeed my friend And that's like, that's such a blast from Pesci.

12:32I did my first try when I was nine. And growing up, we all did triathlons. So we would do both individual tries and then team tries. So the family would do relay races together. So one person would do the swim, the bike and the run. I specialized in the bike. I don't know what this says about my work ethic, but I felt like it was like maximum output with minimum effort. Because, you know, it's the lowest impact thing that you could do. um but yeah did my first try at nine did tries until i was 16 yeah 16 incredible i did a full marathon in 2018 which is which is scarily almost 10 years ago and i always say i want to do a triathlon but i just cannot find the discipline to run swim and bike like i don't know how you've done that many and your dad have done it because that is incredible uh yeah i mean for what it's worth i've since retired and i too now like marathon running is my big thing um i to me it's the wetsuits this isn't to be disparaging of triathletes but i just like the process of needing to like wetsuit to bike to run that's like so much change so i really admire triathletes um because it takes a lot of time and it takes a lot of effort tell me about i mean just hearing these stories it sounds like i mean the environment that he grew up in sounds like it was very high performance did it feel like that now when you reflect back you know it is interesting growing up it was it was a slightly different childhood and like i loved it um but you know most of my friends were playing like baseball or had video game stations and my dad would be like we're gonna bike i'll use non-imaginary units 110 kilometers round trip to san francisco yeah and i just feel like what why and really what they were the value that they were impressing and i'm so grateful for it now is the importance of discipline i find now as a founder the ability to have discipline and build frameworks that allow me to process whatever's on my mind and i still very much like aspire to exercise every day i now focus on mindfulness as well like there things in terms of consistency and discipline that looking back i'm so grateful for but when i was a kid you know of course i wanted to play star wars battlefront um but instead it was like actually we gotta swim um but now when all is said and done i i am very grateful although i i think battlefront is a great game for what it's worth the first one yeah yeah yeah so i mean tell me with all these with all you've seen all these things as a kid when you got to age 18 so you just about to finish high school if i'd met you at that age what would i have assumed you would have done with your life um that's a good question at age 17 you probably would have been like this guy's gonna go all in and play in the in the bundesliga um and it was funny between 17 and 18 i had a very formative moment so i was uh i was at a point like i was a perfectly average footballer um and you know i i could have explored getting a contract and you know going full-time after high school and not going to uni but i was fortunate enough to um end up getting accepted into and receiving an academic scholarship to to ucla and um i think at at 18 you would have been like he's going to be an entrepreneur, but we don't quite know what yet.

16:07I think that would have been the entrepreneurial spirits kind of always been within me. And my mom loves to tell the story of how when I was 12 or 11, a close friend of mine, I wanted to start a zoo. And the whole idea was I would run the business and this person would be the zookeeper. So that's kind of always been ingrained in my psyche somewhere. So I think people would have been like, either it's going to be a footballer or like, yeah, he's going to go do something, but we don't really know what that Damien Kidd's got going on. Because soccer or football, in some ways the real football, that was the dream, right?

16:41Like you wanted to make it that first. Oh, yeah. I mean, getting to play for a professional team's academy, getting to play with first-team clubs in not the top, but lower divisions in Germany gave me good exposure. And the plan was like, I moved to Germany to live there to go be a professional soccer player. And it was honestly a bit more of like a semi last minute last year there. Like, oh, wait, maybe I should go to school change. So it was a lot. And honestly, I think about it now as an 18 year old, it was a big choice. And I make that choice again and again now knowing how it all turned out.

17:21But yeah, it was a big transition going from I want to be a full time footballer to I'm going to go pursue an education and get a career. Yeah. And even just to go from Germany to UCLA, that's, that's quite a change. The weather is better. Uh, no, I mean, Germany was great. Um, but yes, being three miles from the Santa Monica beach is, uh, not a bad way to spend four years. Yeah. So you studied a bachelor's in economics, I think at, at UCLA career. Did you start post that degree? I guess your career, where did you start yeah so it's funny um i actually started as an astrophysics major and i wanted to do like black hole research realized after a bit that i didn't want to do black hole research or go do a phd so i was like i'm going to study business uh ucla does not have a business degree they have economics and uh if anyone knows the ucla economics program it's one of the top three, or at least it was like top three in the world.

18:23So it's all calculus based. So it's a lot of math. I ended up focusing on adversarial game theory for my undergraduate thesis. And it was the combination of a passion for space and this idea of making decisions in a vacuum that brought me to an internship at Northrop Grumman. And a core part of that internship ended up being identifying and developing a threat model for adversarial behavior? Can we anticipate or understand how an adversary might target this particular system that I was working on? And that kind of catapulted everything. So I began my career at Northrop Grumman. Core focus was really around survivability and cyber resilience of a weapon system that included threat modeling, cyber ops and hunting.

19:11So being able to look at like network hardening, communications, database queries, identifying supply chain compromises, a whole host of other things. That was really where I cut my teeth was at Northrop. And I was fortunate to go to grad school at night, actually at Northrop. And I did a master's in aerospace systems engineering, where I wrote a thesis on pen testing nanosatellites, because at the time, my focus was cyber physical systems and security operations. So that's, that's how that all evolved. So econ directly into like cyber ops and engineering, which was a great transition. I loved it.

19:42can i can i say you've thrown out terms that make no sense to me so i'm hoping you can educate me as we go go through this what he just said sounded incredible but i didn't understand half of that so that was that's good that's good by the way because i i want to learn i don't want to come into this and be like oh i know everything and people that do that so so tell me i heard a story in my research that apparently you discovered your passion for this space when you're an intern at this company. Maybe tell us about, I guess, tell us what was that context? Yeah, so the context was as an intern at Northrop, you get like a project, and my project was to develop a threat model for the particular system that we were securing.

20:27Okay, adversarial game theory, threat model, what does this mean? Let's break it down. So adversarial game theory, the whole idea is in game theory you're you're you're given a scenario and your job is to find the best possible outcome people are familiar with this idea of like the prisoner's dilemma that's like a classic game theory 101 thing and if not it's a conversation for another time anyways how does adversarial game theory apply to this adversarial game theory is i have a series of choices and I'm going up against someone who also has a series of choices. I don't know the choices that they can make.

21:10I only know what I can control. And given what I can control and these unknown choices, how can I get to the best outcome for me? Now, there are a variety of ways that you can apply to say like competitive markets, or you're building a competing piece of software. But how does this apply to my first day on the job being hooked given a threat model? So the whole thing was like, hey, we're building this big system and bad guys are going to target it from a cyber perspective. So your job is to understand what we're building, understand potential threat vectors, and then based on those threat vectors, tie in how they might target us and how we might secure from a cyber perspective, this particular system.

21:51And I was hooked with it. Like day one, you're like, wait a minute, you got bad guys somewhere in the world with an IP connection that can like cause this thing to do X, Y, and Z. That's awesome. And like, it's up to me to figure out like how to do this. And it was cool because cybersecurity was and still is very much like a sociotechnical problem. At the end of the day, it's a person using technology targeting a person using technology. And both sides know things that the other doesn't. And both sides are going to have to make choices that either allow the attacker in or enable the attacker to come in or prevent them from getting what they want.

22:36Tell me also, because this was in 2015, right? Is when you started around that time. 2014, which is 12 years ago now. We're recording this in mid-26. Where was the cyber industry at at that point? Because I think one of the things you said to me the other day when we spoke is AI has just accelerated the good and the bad in a simplistic sense, right? And AI, at least AI in a mainstream way, has been around for maybe three years now, if you think post-Chat GPT. Yep. Tell me about in that 2014-15 period, where was cyber at and how would you contrast that period to now? Cyber was in a fundamentally different state.

23:21I think the explaining this simply what was different about cyber security 12 years ago versus now so aside from the market opportunity let's just talk about like threats and what existed every organization operated in a brick and mortar shop you had like a laptop or a desktop for anybody who remembers desktops with towers if you have a gaming computer you probably still do and then you had a network So most of security was based on network-based security. So like looking at internet traffic coming in and out of a network and then some sort of antivirus that was running on your machine. All right.

24:0012 years later, almost all of our business is done via the internet thanks to SaaS. And you've got these things called large language models that are creating entirely new industries and economies, all of which have nothing to do with a brick and mortar office. Never mind, we had a global pandemic that made most organizations realize you don't have to be in an office to get work done. So like the network perimeter changed. Fundamentally, it is a completely different paradigm. Like the same general principles apply, but the complexity and variety of network topologies and systems is completely different.

24:41it used to be way way easier to do cyber ops 12 years ago compared to what we have to deal with today i'm going to come back to your career moves in a second but are you saying nebula could not have been started back in 2015 no uh same with any ai native company right without ai and agents it's impossible to to exist as a company that said there could have been a version of nebula that would have existed um but i think uh ai has provided a great unlock for a lot of the previous attempts to do what we are doing today i also discovered in my research this concept of you learned that systems fail at the seams between components i should firstly say i don't even know what that means but i i was like that is like a really interesting concept i guess is that what nebulux solving and and by the way we're jumping around here which is fine but would you say is that what nebula is solving today like 14 years after you first discovered that yeah i i would say fundamentally is solving for that problem that real problem is visibility context and then informing action like nebulux exists to solve the first order problem of breaches happening in silence and the way to solve for breaches is to identify gaps between the seams in different products to expose those gaps and then provide people the means to respond to that um yeah so that that's the short way now what does gaps between the seams what does that mean it means that um most cyber security solutions all focus on a particular problem area so i mentioned like like desktops, laptops, and servers, the endpoint.

26:34So an EDR company like CrowdStrike, the network, firewall companies like Palo Alto Networks and Checkpoint, email, so email companies like Sublime. All of those systems are not designed to talk to one another. And even if you find a way to kind of get all that data into one place, there's data loss, there's latency, there are inherent gaps in all of that. And it is those gaps, both in terms of like access to data and then gaps in terms of understanding that data that lead to breaches, that lead to hacks that are widespread and have dramatic consequences for businesses. Take me inside 2016, because I've been told you followed CrowdStrike's role in investigating the 2016 Democratic National Committee's intrusion.

27:26and and apparently that made you realize that these are people solving real problems and then you joined crowd strike i guess question one is that a true story and two how did that play out in practice i mean it's absolutely a true story and how it played out in practice is pretty simple uh yeah true story true story in the context of did that inspire you to double down on cyber oh without a doubt. So, story goes like this. Threat hunting, cyber ops, for a weapon system, my job is to ensure that this system can deliver on its mission so it can function. DNC hack happens, and I go, wait a minute.

28:07You mean that cyber security can impact democratic process? That's a very different problem. And I was like, huh. Who are the guys that did that like that that exposed this and it was this like threat intelligence company that had raised something called a series c that was named crowd strike and i was like what i want to join those guys like i have no concept of what this is but like the fact that they're doing this like that i want to i want to be on that team because i believe in that not that i didn't believe on what i was doing at northrop but like it was so much more personal beyond like okay i need to make a weapon system on hackable this is like wait democratic process like that can be impacted so yeah i had a friend of a friend who worked at crowd strike and i literally like reached out to them and i was like i don't care what job you have available i want to go work for you guys um and it just so happened they were like well like you know engineering cyber operations you know dod and you can talk to people like sure come on over uh it was like i think the total interview process was like four or five days something incredibly quick um and yeah ended up joining crowd strike uh end of 2016 um and the rest is history and to series c so this is a scale up right i think apparently they had 200 or so employees in there yeah i think there are about 200 people 200 people at crowd strike when i joined i think we had 11 people in our sunnyvale office so yeah and crowd strike was the first time you had an international uh transfer right they did they put you in an apac role oh great question so no um the apac role happened because uh when i left crowd strike and joined paladiz networks however i was fortunate to during the course of my time um help build and run an integrations engineering partnership and and go-to-market partnership with SecureWorks, which is the managed threat hunting service that Dell owned at the time.

30:15So there was this CrowdStrike and Dell partnership. And that took me all over the world, including Australia. And I really liked it out there. And, you know, I was out there for work and, you know, got invited to have a couple of conversations with folks at the Palo Alto Network's office. And they basically gave me an offer I couldn't refuse, which was to be, you know, a major SE, so a major sales engineer at the age of 26, which does not happen often. And live in Manly, which again is a hard thing to pass up for anybody who knows Sydney. So yeah, I did. I almost, I almost wore, I'm wearing a Nebula shirt.

30:52I almost wore my four pines shirt. Which is a beer brand. Yeah. And it's, it's a great brewery and just like a delicious restaurant. It's right on the East Esplanade in Manly. family but yeah yeah so crowd strike it was first in sunnyvale then a global role and then ended up going out to apac with uh with palo i should say for folks wondering why we're talking about australia is because i i am australian and i grew up here and you've lived here and you like it here actually a great story was when you and i met you said where in sydney did i grow up and i told you the suburb and you like knew the cafes in the suburb which i thought was incredible because most people are like oh cool that's a nice part of the world whereas you and i think that kind of speaks to your personality where you just have this understanding of different parts of society which i which i really like even though you're so deep in the cyberspace maybe it goes back to again childhood right but before we go into your next transition i just want to take stocks at this point you're what five six years into your career so you've had these two companies you've been at because a lot of people say these experiences have helped you build nebulac so i want to unpack what were the particularly the technical skills in terms of industry experience that you built at these two companies that set the foundations for the next step in your career yeah so i would say um it's kind of a core key takeaway from uh northrop and crowdstrike and actually the two end up, I always say this to folks, if you want to understand my mindset with cyber and why I care the way that I do is when you start in the USDOD doing nation state cyber defense, it's like stopping nation states from hacking critical systems and then immediately go into a growth stage company that's focused on stopping the breach and bad actors.

32:47That is how I approach security. This is a real problem that needs to be solved. Having been on incident response calls and done these situations where you hear people on their worst day, like what you do matters. So key takeaways, Northrop was all about like operations, understanding the operator flow, because that's what I was. CrowdStrike was the value of a platform and a core ethos and seeing what scale really starts to look like, right? Joining a company, sub 20 million in ARR and watching it grow into and past a public company with hundreds of millions in ARR taught me a lot, right? One platform, one core capability that unlocks multiple paths to market and solves multiple problems was really, really key.

33:35So to me, it was understanding what growth at scale looked like at CrowdStrike. And Palo Alto was all about customer empathy, right? Doing the technical sales piece, being in data centers, plugging stuff in, sitting with network engineers and security folks and understanding how that aligned. So the technical skills, to your point, cyber operations, threat hunting in the DOD, CrowdStrike was all about like integrations and data at scale. And then Palo Alto was like and translating all of that experience into something that could work with a customer. And at this point, I'm always like, I'd love you to reflect.

34:13Did you have any interest in being a founder or an entrepreneur? Or were you pretty set on the company path and being in these jobs? Yeah. I had a pretty great life that I really enjoyed. Yeah. But I ended up deciding to apply to grad school instead of, you know, take a promotion or I had a couple offers to join. I think one was a company or employee one at a startup. And the reason was quite simple. The first sentence of my MIT application reads, I aspire to start the next great cybersecurity company. so during COVID I had a chance to really think through what I wanted to do and how I wanted to give back and I decided instead of just being a company man that it was time to at least start to do the research and dig into where I'd want to go uh and I could only do that doing research at graduate school so you're telling me being in Sydney is the reason you're a founder now you just exactly i blame sydney actually well you and i talked about it i i like i tell my wife this all the time like kind of grateful i didn't spend an extra year in sydney because if i had i think i never would have left like the australian way of life sydney australia has such a soft spot in my heart um yeah but so so how how did you leave then what what was the push to leave or the pull yeah the poll um at the time there was some really interesting natural language processing research that i was looking at um i've always been interested in adversarial activity so adversarial game theory and then you started to see the emergence of like gans in ml um and when you think about adversarial networks i was like that's really cool and i think there's like more to be done there but like i can't do that working full-time uh at palo to networks right that's not like fair to myself or palo alto because i want to do right by my employer um so i i just came to the conclusion i was like i need to like take a break from work and like focus on school um and focus on doing deep research and and that was the drive so yeah it was like uh it was like an august day in 2020 where i was like i think i need to go to grad school and i took one shot i i made a deal with myself in it so i was like hey uh i'll either like evaluate like upwards mobility and a promotion of palata networks i'll maybe join like this startup is employee number one or if i get into mit because no one gets in mit i'll go to mit and uh jokes on me the admissions department said yes so the rest is history and i left sydney to move to the equally beautiful beach town of boston um and for those of you who haven't been to boston don't go to our beaches i say this as a bostonian they are not the same as sydney's the water is very different as is the quality of sand i'm glad you've you've admitted that and not try to convince me that that boston like i always find it funny when people try and do this it's like even you talked about the bay area like you speak to people out of california and they're like have you been surfing in california i go okay maybe it's interesting but surely it's not australia yeah i'd be like it's freezing back to wetsuits and triathlons yeah anytime anytime you need like a squid lid like these like hoodies that you put on yeah just to like not suffer from hypothermia i i don't think the two can be compared that's that's one person's opinion but I think most people will agree with me there.

38:06I want to come to this MIT work you did because I think this was in many ways the foundation for Nebulok, right? But before I do that, what did you learn from the APAC region that you've taken into Nebulok as well? Like, are there any clear differences between how the US region or the Americas region and the asia pacific region looks at cyber security and like even the customers uh is apac more conservative or forward-leaning compared to america it's interesting um and you can compare this to present day as well with nebula like we probably chat to these folks right yeah so i i would say like the interesting with apac is and i can really only speak to my experience in australia I love the people of Australia.

39:02And what I'm about to say is no bearing on my thoughts of the Australian nation, but rather the technology that I saw. There's a really high alpha between maturity and conservatism. So you'd either be working with a company that is like gung ho, leaning full forward. Right. We want to do at the time it was like SDWAN, so software defined wide area networks. Right. We want to like put everything into the cloud in 20, 2020. or you had folks who were like, I will never touch this. We will never build an AWS. So I think the biggest difference that I saw in JPEG is you had a much more pronounced chasm between tech adopters and tech laggards versus I'd say in the States, it's a bit more of a mix.

39:48You have more like a cumulative distributed function of like some tech forwarders, a lot of folks who are kind of like waiting to see what their buddies do and then tech laggards. I think the bell curve would be extremely sloped on both sides in JPEG. That was my experience. Interesting. Okay, MIT. So 2021, this is COVID. The world is about to potentially end. And you moved to Boston, like you said. Just give me an overview of what you studied and what you discovered. Because a lot of people said in my research that that confirmed to you that you should go build your own company, right? even though you had a job i think you worked at attic wolf after mit and then started maybe like yeah so tell me maybe maybe that connects the three of those things connect yeah um so i focused my research uh in a lab called c-sales so mit c-sales are computer science and ai lab um i did my master's in engineering there and really like the core focus of my thesis was around natural language processing algorithms and then applying that to both inform instant response and secure data transfer.

41:04So really what I was looking at in the context of my research was like, how can NLP be applied to unstructured data sets to determine what bad actor activity might be and then applying that to what at the time I built was like a cloud control and resiliency framework that we would use for large banking institutions to determine risk exposure and active intrusion. And then I worked on a program and a team called SCRAM. SCRAM is an acronym. And the actual system itself basically is a way of using fully homomorphic encryption to allow any organization who has access to it to do things like run dynamic risk assessments, share data with their peers completely anonymously and do so securely.

41:53So that was the focus of my research. I also spent a summer at Lincoln Labs working with a government sponsor out of Fort Meade and DARPA. There I worked on the offensive side of security. So really looking at like exploit development to target cyber physical systems. So really just like build exploits and rust was what I did. But my research at MIT was really focused around like how can we use ai to aid network defenders but then also i deliberately did offensive work to think about okay this is like a bit in the weeds so rust is a mem is memory hardened c that's a gross oversimplification for my rust fans out there i do apologize but like the reason you write an exploit in rust is so that like the the kill switch that we found in WannaCry, you can't find.

42:45And my research really got me thinking about like, okay, with new attack capabilities, and AI being used to help inform network defenders, what does the world look like in two, three, five, 10 years. At the same time, I also helped kind of revitalize and co-lead a club here at MIT. We called it the Global Security Tech Club, basically was a defense technology club that combined both the Graduate School of Engineering, where I was, and our business school at MIT Sloan. We put on this tech and national security conference with Harvard. That was also really important to me because I ended up like starting and building out this whole like startup innovation contest so it allowed me to do this research that was nebulaka jason while also build relationships with founders um i realized that was like a five minute explanation your question did it but i love my time at mit and learned a lot while i was there no i love it i i think this is important because i don't want to just scratch the surface i think this context matters a lot the obvious question damien is why not start your own company post that now in hindsight why go and build more experience and get another job and maybe there's a good reason to that there was i mean i was approached by several vcs to incubate while i was at mit um in fact i've met vcs in boston who after the fact were like we've been tracking you since then um which was cool i don't know i had no idea oh i'll put it that way i was living in a share house with four, four of my, four of my good friends.

44:28Uh, and that house is for sure a fire risk, but, uh, anyways, we survived and, uh, yeah. So VCs did come up to me to incubate, you know, a variety of funds. And I ended up saying no, because what I wanted to do was translate the research that I'd done at MIT into practice. And I got the opportunity to do that by running the AI threat intelligence detection, engineering and security research product teams for Arctic Wolf, which is a very large managed detection response provider. We're talking hundreds of millions in ARR, 10 ,000 customers. And basically what I did, so the team I led, built the detection systems for our 1 ,200 person SOC.

45:10So a SOC is a security operations center. So basically my team was, our mandate was taking the data at scale that we had, determining what was bad and then building the like and then providing those outputs to a team of over a thousand men and women to deliver the managed security service that my company did and to me coming out of mit i was like this is a great way to apply this research in practice and then nebulock happened can i just say i love these cyber security names like crowd strike and arctic wolf like they i feel like they almost made meant to like scare you yeah 100 they're like very intense you know but you chose you chose nebula which is like a nice warm fuzzy name at least perceptively i don't even know what it means but it sounds warm and fuzzy oh yeah well the the the name is uh i can explain that very quickly yeah so uh long story short threat hunting and threat hunting is all about defining and hardening what's nebulous and to do so to define it you got to lock it down so i took nebulous and nebula and lock down and i made nebula lock um the longer answer is i'm a huge space nerd i love like the dune series i grew up on the original star trek series star wars like warhammer 40k you want a nerd about like space saged anything like i will gladly do it um so i also just really like space that was the other part that was behind very cool look i like it yeah i like it so let's go into nebula so mid 24 i think is when you went and did that all in around that time right yep yeah and we're now in mid 26 so two years yep to a little over two years so i founded it in mid 24 uh yeah we're a little over two years old now first time solo founder um yeah it's been a great journey we're we're a lot more than one people today which is pretty exciting let's start with the solo founder because that i think solo founder is actually great i'm a solo founder of my own business and i think sometimes it helps you run at speed because you can just make a decision and you own it but perceptively if you speak to most folks they'd be like oh why are you a solo founder why don't have someone else to de-risk the business right which i don't think is true you talk about space you look at elon he's a solo founder of what 10 different companies i mean yeah i don't think that is the right model but i think like what you're doing tell me about like was that an intentional choice to be a solo founder it was um because you're a pretty compelling guy like again in the research people said like people want to work with you we talked at the start about the people you've hired right so you probably would have had opportunities to bring on a co-founder i'm assuming you know it's interesting i think time time was and is of the essence uh the reality was um there was no one within my network whom i trusted deeply enough who was more technical than me who understood this problem who i want to who would make a good partner in building this business.

48:33And the more existential problem was not how many founders do you have, but more like this is like the threats that we're dealing with today are happening right now. And like, what's more important that we execute on the vision or, you know, I kind of wait to see who else might fall into my orbit and then go do it. So no, I mean, like I am, I quit my job outright. I did not have like a perfect plan. I was like, I'm going to quit my job. I'm going to think about this problem and along the way uh you know i met the folks at decibel who read my 30 page manifesto on why nebulok must exist and ended up uh preceding us um and we met a few folks along the way as well on the pre-seed journey but yeah this was like a really core piece was um just understanding that the problem needed to be there and you know as a solo founder the end of the day like speed of execution is not a mode speed of iteration is and if you just have to make a decision and you have to make a call it allows you to iterate much faster and be more nimble which i think is the ultimate way to de-risk your business in an ai native age i i totally agree i find the whole perception that exists about solar founders a bit baffling frankly because there's enough success stories to confirm that the solar founder route works agreed tell me nebula again in my research folks that so you raised just you announced your series a I think three months ago, right?

50:00We're recording this at the end of July. So I think in April, May, when you and I first connected, a lot of you investors that I spoke to said when you first started out, you as in Nebuluck was an autonomous threat hunting product. But then now you're thinking broader as a hunt first security platform. Again, these are areas that I'm not an expert at. So you will need to give me the fodder and I will double click. Yeah. So I think like our thesis in a nutshell, for 20 years, cybersecurity has been inherently reactive. We wait for a vendor or somebody to alert us that something has happened and we react to that.

50:44The fundamental way that we are different is we are proactive by design. So we, instead of waiting for alert to trip off to do something, are constantly, continuously looking at data, asking questions of it to find bad things that have otherwise been missed. Let's break this down. So like autonomous threat hunting platform. So the core problem was when I started Nebulok, bad guys are going to use agentic systems to automate hacking at scale. Really obvious today, not obvious two years ago. let me tell you that much. The second core component was I had seen how even with the best products, the CrowdStrikes, the Palo Alto's Splunks of the world, customers still got breached and they got breached not because they didn't have the best tools, but because like hacks happen because there's what we call signal, like low or no signal.

51:40Because bad guys are designed when they want to hack you, they're going to try and blend in to get what they want and then get out of dodge. So the question was, how do we traditionally find this behavior, this like bad activity in data? That was threat hunting. That was what I began my career in. The problem is, is that does not scale if it's human driven. And 99.9 % of organizations can't afford these kinds of people because there aren't that many of them around. So the whole idea was, can I democratize this very elite skill set to every organization, regardless of size, skill set or budget?

52:18And that's what the autonomous threat hunting platform was. It was a platform that was continuously looking across your data and finding bad actors and activity that otherwise have been missed across your existing security investments. And that was the that was the beginning of Nebulok. Let's go deeper into threat hunting. So I want to break this down into a few areas. Let's talk a bit about the tech and then maybe talk about the team and then even talk about sales. Like you've done a great job at enterprise sales, right? Like a lot of your customers are big, big Fortune 100 companies that are really hard to get them to sign deals with a startup, but you've nailed that.

52:54On the tech, so this whole concept of threat hunting, in my research, so there's a concept of AI SOC, security operations center and then yeah i discovered there's like the different tiers right tier one two three analysts apparently and then tier three is threat hunting again this is all new to me but i love this discovery process in my research apparently this used to take a lot of resource to do the threat hunting tier three because it was very human focused right and your point is ai has democratized it but also accelerated what you can achieve is that is that right that is that is um so let's talk about what threat hunting is because so there are um i'd say like there are ai sock vendors and we are certainly not one of them we we very much play into what we would call the the next gen sim so security incident event management or like security operations data lake like that's much more where we play um and i'll talk about the difference between the two.

53:55But fundamentally, I think threat hunting, threat hunting is a structured approach to identifying, convicting and attributing anomalous behavior within an enterprise environment. That is threat hunting. Threat hunting is not I ask an agent a question, and it gives me an answer and I've threat hunted. And I think that's a classic misconception that I see in the market it today where people say, oh, we do threat hunting too. And they show an agent called threat hunter and you ask it a question and it gives you an answer and you feel like you threat hunted. That's not. Threat hunting is like a framework driven approach to gathering evidence, generating hypotheses.

54:40So, okay, given the context of my organization, how might we be hacked? What might that look like? Testing those hypotheses and coming back to you with an output. And then that output should inform something that we would call an incident response. So again, we identified, convicted and attributed that like something bad is happening. So what do we do about it? Or it inspires a detection. So detections are either queries or little models that you can write or YAML files that you can generate. It just depends. But detections are basically like a way to proactively identify if whatever behavior or event or thing you're concerned about is happening in your environment, if that's seen, it'll flag that like that's what good threat hunting should do is it informs an incident response, or it informs a good detection to write.

55:30And then there's another component called the detection engineering lifecycle that happens after that. But yeah, threat hunting, structured framework around behavior. And this is both reactive and proactive, right? So again, maybe to connect this to like in a customer context, if I am a big enterprise, I you want me to use nebula for both i've faced a threat and i'm trying to react to it but also how do i prevent a threat in the future yes um really it's but it's to to really get you on the foot front it's yes but it's really to get you on the front foot and get you to be proactive by default so instead of what every other tool does which is it waits for an alert to fire and then does something.

56:17Instead, it's always looking at the raw data, the telemetry, and surfacing things that otherwise might have been missed. So the output of the continuous hunting we do is what we call a finding. And a finding ends up informing whatever instant response needs to be done or suggesting these detections. So the difference is by touching the data and constantly asking questions of the data, instead of collecting the data, looking at it, and then when you have time either reacting to an alert you received or pushing a question because you have one that's the fundamental difference between proactivity and reactivity got it got it and if i mean i've been asking this to like some of the founders have come on the pod recently like we had jesse from decagon who doing like cool stuff and i said to him even lagora who came on recently i said in very different spaces i said if the ai is democratizing software how do you continue to differentiate yourself because that probably means the barrier to entry for new folks to come into this space from a technology perspective is very high right like someone can sit in their bedroom and vibe code or i think you talk about vibe hunting yes software tool and and put it out into the world so how do you continue to stay ahead of your own competition yeah um well Fundamentally, it's all around our two core moats.

57:37So first key piece is in a world where software can be commoditized, it's all about the human experience and human experience in their minds that applies to the agents you build. So our agents are built by some of the best threat hunting and detection engineers in the world. So Sydney Maroney, our high flyer, was the lead hunter at Splunk who were the gold standard. She literally wrote the framework on threat hunting, along with a few other great people, including Dave Bianco, who's another godfather of this entire career path. They're the folks that do the RLHF on our agents. They're the folks who build the agentic chain of thought.

58:18So our agentic system thinks and acts like they do. But our core differentiation really is around our context graph. It's the fact that we've got access to over two years of building this data set of running these hundreds of millions of investigations. And the output of that is 2 ,000 plus proprietary detections that we have. And then across our broader customer base, without needing to do anything, you have access to this network effect benefit as a part of Nebulok. So that core component that we've been doing and focusing on for years really allows us to set ourselves apart. Because you're right, you can vibe code something, you can try and build data pipelines and put stuff somewhere.

59:00But being able to get the agents to really perform like a human operator, and then being able to give them the right data and context to do their work, that's the really hard part in an AI native company. To connect this to enterprise, I think a couple of observations I've noticed in both the US and in like the APAC region, the two markets I spent a lot of time in is I've never seen this level of enterprise adoption of software. I think there's a huge amount of curiosity and AI has made it mainstream and created FOMO. But then trust is still just as important, right? I mean, cyber is all about trust, but even enterprise sales, as you know well, is all about trust.

59:38I feel like that's been your differentiator. Like you can choose to mention some of the customers if you want, but in my research, folks said you've signed on some really big customers how did you build that trust early on like of course you've been in the industry and maybe you had the personal relationships but how do you earn the trust from a nebulac perspective with these big enterprise clients at the end of the day it's it's people to people um what we've been really intentional about doing is bringing in amazing operators into Nebulok that build a product and a platform that is designed to really bring out the best in security operations teams.

1:00:25And my story and my experience aside, I'm so proud of the team that we've built. And really a lot of it has been like talking to and listening to customers with empathy. When I started this company, I interviewed 90 customers in 90 days before I wrote a single line of code to understand the thesis, to fine tune the architecture, to challenge my assumptions. I've spoken to hundreds of customers now. And not only did that inform what we should build, but because we have these like amazing experts here, what we've been able to do is like actually build something that solves the problem instead of something that sounds cool but doesn't work effectively.

1:01:02And that's been like a core reason, which is like the what we call the operator experience is I'm biased, but is incredible, right? We deploy and scale effortlessly. We've done 46 ,000 machines in 20 minutes, no downtime or lag. We've done 14 ,000 machines and identities across four different providers in under six minutes. like from an it transformation perspective or security operations perspective that just doesn't happen that happens because we were really intentional about what we built and how we built it tell me about if you had to use an example let's say i'm working at a big bank or a big retailer in the u.s and again people said in the research you've built a really good process of discovery calls where you're really good at discovering information and i think that is the differentiator in this AI world, right?

1:01:51Again, back to the barriers to entry being very low, but I'd say the barriers to scale the company are actually very high now because there's so much noise. Let's just use a case study. If you were reaching out to me, one, how would you reach out to me? Is it a lot of cold emailing, cold calling, or are you doing warm intros? And then when you're going to call with me or you meet me in person, what are the questions you ask that build you enough information that, hey, we can actually help this customer solve their problems. Yeah. I mean, on the customer side, right, we are very grateful to be partnering with, you know, a few Fortune 500s as customers.

1:02:28We work with some folks in the Fortune 100, but then all the way down to like growth stage companies like Cribble, who's an amazing customer of ours, or Bing Capital is a great private equity, you know, on the bank financial services side and they've been really helpful too because discovery is constant and as you work with new and different organizations they prioritize different things i call this out because uh i met mark sutton who's the seesaw bane during early product discovery um and warm intros are always best but the best way to do it is like at the end of any conversation say hey i really enjoy this do you know anybody who also might enjoy a conversation like this or would you be open to introducing me to somebody.

1:03:08More often than not, provided you were present, transparent, and actively listen, people are willing to do that, but you have to be genuine. So if you and I were going to meet today, ideally it would be a warm intro and ideally from a customer, right? I've done plenty of cold emails, don't get me wrong, but the interview would go like this um i will assume nothing about your persona so we'll just make one up for you you're a cso at a global 1000 bank we'd sit down and first of all i'd spend the first like 15 20 minutes actually just trying to get to know you um because many folks are burned by founders who just come in and do aggressive discovery and it matters like i i do want to get to know you but it because you have experienced and lived things that i haven't um i believe i may be able to solve a problem for you, but like, it's important to get context on who you are.

1:04:05Because at the end of the day, it's people and people. And then really would be, first of all, understanding your approach and thoughts around security, what security operations means to you, how you define these topics in your head, what vision you have for your organization, how that reflects to your program. Then more tactically, like how does that boil down into priorities? How do you prioritize it? How do you empower your team how does empowerment and team apply to budget like that would be the discovery process but it's not just like hey i'm damien we've built uh what we believe sim should have always been poc you know like that's that's not gonna work um but instead it's so much more important to understand like what motivates you and and and and how how what we are doing could it support that mission and you know what it may not in which case that's okay great i'll save us both some time and i will just spend time getting to know you and i genuinely have done this and there are folks where we're not a fit who i still speak to all the time because i'm always happy to trade thoughts on agentic adversaries and the threat landscaper at large but yeah that's why i approached the discovery process i mean in my experience i've been running my business for seven years i found some of the biggest high trust moments have been when someone rejects us oh and it's how we respond to that right because i'm sure both you and i have this we both at least i do i've got a chip on my shoulder where if someone rejects me i take that very personally and i'm like okay i will use that as fuel to prove to you that you made a mistake but but as you know the way you respond to that makes a huge difference because people remember that and how you made them feel so i've realized that has been a big trust moment and then two is feedback so i'm actually curious to ask you like in the two-year journey i mean every startup has knocks every day right but you are succeeding i feel like you have more wins than losses which is what you want it to be are there any knocks along the way that you can talk about that that you reflected on that you think in hindsight now were really useful in the nebulock journey yeah um there are a couple so i mean this was less a knock but more like a great output of the 90 and 90 which was i had made a core architectural assumption that was wrong about access to data and if i had not done customer discovery i would have been in a much tougher spot um another knock uh we were going to do a poc with one company and it was a great logo we were really excited it was bound to happen and then process got in the way.

1:06:46And unfortunately, our champion ended up leaving the company. And because I was single threaded, we lost it. We lost the opportunity. It didn't, nothing happened. And that was a really important knock for me as a founder because it showed me that you have to multi-thread opportunities and deals. And if you aren't engaged across multiple parts of the organization um you're gonna be a really tough spot that was like a really important knock and a really important lesson to learn um yeah that was a big one it was a bummer to miss out on it but we'll get him next time let's connect this to hiring because you i think hiring is critical right we talked about earlier you talked about sydney and you talked about the high flyer role again you i think even just recently you hired a couple of folks that when i was talking to like mark as well he said he's like wow how did damien lock this person is so early in their journey what is that process like for you again over your career have you discovered because i think one of the things founders go through and i hear about all the time is they look for profiles and resumes but sometimes that person doesn't work out but it seems like you seem to have got the right balance of personality but also experience given how technical use spaces what does that unlock like if i came to you as a new founder and i said damien i'm getting really good enterprise success i've been doing founder sales myself i think now's the time i need to bring on like execs or not even execs like folks that have some level of seniority and some experience what would be your advice to me oh um i think i'd really boil it down to three things number one is what's your hiring process and let's talk about it because you You need to be really, really diligent about your hiring process.

1:08:42Specifically, I think references and back channels is one of the most useful things that you can do. Can I double click on that? Like, how are you doing that? Because I think this is underrated. People like. Like, again, let's just use me. Let's use me. Let's use me as a GDP. So if you were hiring me and we've done the interviews and I've told you all the right things and you're like, yep, he's the guy. how would you do those references after the interview process or even during the interview process i'd say that's the trick is you do it during the interview process so this is where i i realize i'm very fortunate that my dad did his executive search so we've always had like a very rigorous hiring process and it's part of why like our employer retention is so high like we are really thoughtful and it's funny um i'll share one anecdote just so you're aware like i I do stand by this.

1:09:31As a founder, my job is primarily sales. I sell the opportunity to new hires, growth to investors and value to customers. But the second and arguably more important part of my job is to build a culture where people feel seen, heard, and empowered to do their best work. And so much of our recruitment process is around optimizing for people who, when empowered, will thrive, who can perform in ambiguity, and who are comfortable like stepping out into the unknown. And like that is so much harder to find than people think. On the references piece, you always want to back channel and you want to back channel throughout the process.

1:10:11This is not one or two. You want to do several back channels to make sure that you have a complete understanding of who this person is and who they are and why you're bringing them in. the same way that i always offer and we do like i have had customers of mine speak with higher uh leadership hires because it's you know it's one thing for them to talk to investors and that's great but it's like no hear from the customer their experience with me and with this business um the other can i ask how you sorry can i ask how you do that because in my experience reference checks is a broken process because incentivize for that person to speak well even if they've not had a good experience right because everyone wants optionality unless they've been a criminal or they've done something really bad people are less likely to get information but it's as you would know and i'm curious how you do this it's the way you ask the question right and how do they how do you discover what they haven't told you or you get a nugget and double click on it can i actually ask you what are the questions you ask again if you reached out to me and you were wanting to reference to someone who reported to me a couple years ago one how would you get in touch with me like would you just cold email me because also like getting a hold of the person can be hard but two what questions would you ask me to incentivize me to tell you the truth yeah i mean first of all you always have to use your network uh eventually like a cold email or linkedin does work but i think using your network is important and i'm fortunate in this sense where security is large but small like yeah i've been doing this a long time and like most people either there are a few degrees of separation but you can get to the reference you want um So it's funny, right?

1:11:51Like what questions do you ask? Again, it really depends on like, what's the problem you're trying to solve? If you're hiring a great engineer, it's how do they deal with ambiguity? Tell me about like where they really accelerate, what their superpower is, if there were areas to improve what it might be. Like there's no like silver bullet. It's much more, instead of asking really focused questions, I find open-ended questions are far more valuable. and then do what my first grade teacher said, like you got two ears and one mouth. You just listen.

1:12:28Because I think another piece that gets lost during the hiring process is if you're starting to have misgivings early, that's your answer. References really should just be confirming what you already know to be true. And if they aren't, I would encourage you to take a step back and think about the process and the candidate why you're at where you're at there's actually some great resources online about the questions to ask and i i find those amazing i think some of the even some of the vcs have done because they do it for a living too i mean they probably did that with the investment in you so yeah it's a topic that i find deeply interesting because that's kind of an element of what i do in this job right in this job as a podcaster it's just like how can i ask you questions to like elicit candor and i think in a reference process that is the hardest thing right is how do you elicit candor in a way that they feel safe and it doesn't affect their career 100 um i could not agree with you more yeah and often they can become future hires too i mean i've heard so many stories of i'm like how did you meet they're like oh we met in a reference check process and now i work in that company

1:13:36now i'm wondering if we've i'm not sure uh yeah but but it builds a relationship right yeah well that's actually okay that's another thing you're asking about reference checks a reference check is an interview at the same time off sheet or on sheet because like they all know like folks all know each other like they're it's also an interview for you how you conduct yourself in that is going to reflect a lot on not just the candor you receive but also the feedback they provide to whomever you're reference checking exactly so don't forget to treat that like an interview exactly and a start of a relationship right because then they start following your journey and particularly for a startup they're like cool what are you doing and then i'm becoming a customer too so i think there's a lot of like compounding opportunities i'm conscious of time so i want to move to rapidify sprint before i do is there anything i haven't asked on nebula that you want to touch on yeah i think um you touched on this like ai sock space um very quickly.

1:14:31So like I said, we are very much what we would call like a hunt first, agendic security operations platform, we play in this like next gen sim. And I think there's a bit of a conflation when people hear about AI and security operations, they think about the AI sock and AI sock solves a very important problem, which really is replacing managed detection and response products. So it's reactive, it receives alerts, but it you know, instead of paying for like an article, if you buy AI SOC. Whereas we align much more into the next-gen sim space, which is for in-house security teams that do security operations that want to get more out of the people that they have, who want to empower and enable their generalists to do things like threat hunting and detection engineering at scale.

1:15:14That's what we do. And that key piece is instead of reacting and waiting for alerts from third-party tools, we're constantly proactive. We're accessing the raw telemetry. And by being telemetry first not alert first it allows us to deliver a different kind of value to security operations from the fortune 100 to our smallest customer which is an 85 person passwordless company uh and everything in between super cool super cool and i'm excited back to the conversation earlier about how you expand to new markets maybe you're already doing that but i think that'll be really cool is if you can go back and open an office in apac which i'm sure you'll do at some point right that's the game circle that'll be a full circle yeah and then you can come back to manly and spend time at the beach oh one day my friend that's the game plan that is the game plan yeah but but i must say i think just on a macro point like the space that you're in and i mean pala alto networks like you like i love following the ceo nikesh like he's almost become I'm a celebrity CEO.

1:16:14Like I think people like him, people like you have even democratized like the intimidation that comes with cyber. Like for someone like me who is a complete amateur in the space to like go deeper into it back to the start of this conversation where the research for this and the prep for this has converted me into like a fan of cyber. And I think that is like half the game, right? Is like how do you get more people to come in and then hopefully join companies like yours or buy your products and continue to accelerate. Yeah, 100%. Yeah. Should we move to rapid-fire sprint? Hit me. Yeah, rapid-fire sprint with you is a scary term because you would probably out-sprint me any day, any night, right?

1:16:58I've been on long distances. I'm not that quick. Yeah, yeah, sure, sure. Whatever. Whatever you say, Damien. Is there one non-work investment, ideally of time and energy that you consider the best in your life is there a course or a holiday or a hobby yeah uh for me it's running i run a thousand miles every year the real reason i do it is because it's an exercise in consistency i live in boston which has four very real seasons it will get down to feels like minus 35 celsius in the winter and the importance is can you get out there every other day and do 12 Ks, no matter how you feel. Uh, it's active meditation for me and it really helps, uh, helps me with deep thinking.

1:17:40So yeah, that's a core hobby for me. Very good. Is there one thing you want to learn in the next six months in a work context or generally in life? Yeah. Um, I really, you know, I mentioned mindfulness, uh, but doing a lot of guided meditations. I'd love to dig into like transcendental meditation. It's like the quiet meditation um just seems really interesting so yeah would love to dig into that i i agree my i can't turn my brain off so if you can get that out let me know like at night i just like cannot turn my brain off i i got you and it like took me a long time to get there and like guided stuff works the whole idea of sitting in silence i give myself like 18 seconds before i'm like i'm bored so yeah yeah my challenge is also my phone like maybe you have this like i love what i do you love what you do i'm constantly checking my emails and like messages and social media like particularly with customers i'm like cool have they come back to us have they said yes to this have they responded to that and that can become a real drag on the brain i completely agree not healthy at all so i think running and like for me it's the gym like that helps massively is there one interview question you love asking prospective candidates in a hiring process yeah um it really is like tell me about uh tell me about something you're extremely proud of that you've done in the last three years and then tell me about a time that you failed in the last three years what you learned about it and how that applied to what you do today very specific really nice like i know yeah but it's good it's good last two one pet peeve oh uh pet peeve um being shushed or as in if you're their fingers if you're talking too much and someone says stop you know i think as a kid it was shushing um i think if i were to run this answer back um so if i were to run this answer back because that's like a true personal pet peeve um pet peeve would be when people snap to get other people's attention you know never hurts to use words instead of uh a snap we all have the time to say excuse me yeah yeah particularly like at a restaurant or something right where you're like oh my gosh and they're like that i'm thinking of a of an incident last weekend where i it took a lot of self-control to not to be like excuse me please yeah use your words this person is working hard i mean this changes this takes threat hunting to a whole new whole new concept yeah like genuinely genuinely yeah yeah no i i i agree and last one i ask every guess if you could recommend one question i should ask the next guest you don't know the next guest but anything i should include in my notes um what is one popular opinion in the world of ai that you're absolutely certain is wrong yep great question i feel like we touched on some aspects of that in this conversation but i think asking that pointedly is a is a good one damien my man we have made it thank you so much and and yeah huge congrats on what you're doing and and i I just love the variety of life experiences you've had.

1:20:44I think that's what fascinates me the most. So excited for you and chat soon. Yeah, thank you, Vidit. I really appreciate the time. We will chat soon. Have a good one, my man. That's a wrap. So if something in this episode sparked a thought, send it to a friend or colleague. And if you're curious about partnering with us at the Curiosity Center, whether it's this podcast, to our reports, events, and more, and join the ranks of existing commercial partners including Google, KPMG, Vanta, the University of Melbourne, and others, my details and the show notes. Until next time, I'm Vidya Tagawail, and this is the High Flies Podcast.