#81 Daniel Schiappa, Chief Product Officer at Arctic Wolf: Cybersecurity Unlocked

0:00To use the war analogy in the past, you know, they have tanks, we have tanks, they have planes, we have planes, and now it's a nuclear arms race race, right? It's the amount of catastrophic damage could be much higher when you have this type of power.

0:18We've been lucky enough to get some amazing guests on with cyber security expertise, thought leaders in the space. Quentin Taylor being the most recent example of that. Following the interview with Quentin, which was received really well, we had amazing feedback from that interview. I wanted to get somebody else on to talk about cyber, maybe from a slightly different angle. Arctic Wolf, one of the most progressive thought leaders in the cyberspace, we were lucky enough to get the chief product officer on. His name is Dan Sciapa. Dan, his credentials in this space are extremely impressive. He's worked for the likes of Oracle, Sophos, and notably Microsoft, when he first got into the space back when they were developing one of their original modern security products.

1:02Bill Gates was heavily involved in that project. It was fascinating to talk about that. They received a letter from the British government commending them on their work and just reiterating the importance of excellent cybersecurity. It was a very profound and proud moment for Dan and his team. So we talk about that. We talk about the other companies he's worked for, and discussing the ever-evolving landscape of cybersecurity, the latest trends. And notably, we talk about technology innovation and the impact it's going to have on cybersecurity. Things like blockchain technology, AI, of course, and quantum computing too, which I thought was fascinating.

1:38And Dan's take on quantum was very, very interesting. There was so much to cram in, but I really enjoyed the interview with Dan. Fantastic guy. I think you will too. It's Dan Schiappa.

1:56Dan, lovely to meet you. How are you today? I'm doing wonderful. Thanks for having me. Thank you so much for coming on. I've been really excited about this one. We've had a couple of guests on talking about the subject of cybersecurity. Let's start with this one. What does good leadership mean to you, Dan? Yeah, so I've had the luxury in my career to work for many great leaders and also work for a few bad ones. And so you get an opportunity to kind of really compare the two. And, you know, for me, kind of the style that I've adopted is I think first and foremost, a good leader is a humble leader.

2:29Somebody who understands where their strengths and weaknesses are and how they can build a team around their personal weaknesses. So you have a collection of leaders that work with you to help really build an outstanding team. So I grew up playing a lot of team sports, and I understand that you can't have a team full of goalies and expect to win a football match. So you got to really kind of have the right collection of talent to be able to do that. And so I think building that team is really important. I think leading by example is very important. And I'm a big fan of the structure of, you know, if there's any credit given, it goes to the team.

3:06If there's any blame, it comes to me. And that's kind of my job. And, you know, I look at my organization as I work for them, not they work for me. Like, what can I do to help make them more successful and, you know, remove barriers, provide clarity, whatever that is. And so a leader also makes the team around them feel that they can do more than maybe they actually can. You know, just really kind of build that confidence, build them up, educate them. I talk about with a lot of my young managers who I try and mentor on occasion that there's a time to be Yoda and there's a time to be Darth Vader.

3:44And the Yoda is the default, right? It's the coaching. It's the encouragement. It's the tough love. And there's sometimes in your career you do have to, you know, break out the red lightsaber, but that should be the rare occasion. And I think that's what people look for in leaders, someone who's going to inspire a coach, you know, help grow. And I've had the luxury of people doing that for me so much in my career that I think it's a great thing to pass on to others. Yeah, fantastic answer, by the way. And I love it how you switched into British mode there, talking about goalkeepers and football, not soccer.

4:16I was really impressed with that. So yeah, no, that's fantastic. Thank you so much. I think that I completely agree. There's so much logic in amongst that. So you're obviously in a leadership position now, Dan. I want to delve back into the archives. You obviously grew up in the New York area. You've worked for some of the most influential companies in the world. Can you maybe give the listeners a little bit of an overview of your career and crucially the key milestones which set you on the path that you ended up pursuing? Yeah, I think it probably started back when I was in high school. My father worked for IBM and we bought an IBM PC when they first came out.

4:53It dates me. This is back in the early 80s, right? But I just was enamored just immediately. It was magical to me that I could write code and it could do something. It was a combination of science and artistry. And it was just, I was hooked. And so throughout my career, I've always focused on computer science. So from high school, I went to university, studied computer science there. I took a weekend class, believe it or not, on Oracle when I was at the University of Central Florida in Orlando. And, you know, nobody had really heard of Oracle. And it was really a class about relational databases, but they were using Oracle technology.

5:35And so I thought that was pretty interesting. That was the first time I really did anything of that nature. And it was pretty exciting. And it just resonated with me mentally, kind of the relational aspect of data. And so when I graduated and moved on, I had jobs focused on Oracle databases and Oracle technology and building tools and interfaces and designing databases. And I eventually got the chance to work for Oracle. And it was it was a bunch of fun. We were focused on a category that preceded the Internet called interactive television. And it was extraordinarily innovative stuff. I mean, there's still things that we built in the early 90s that don't exist yet today.

6:13It was engineering candy land because as we went in there, there was set-top boxes with no operating systems. We had the right operating systems and publishing platforms and all sorts of stuff. So that was a lot of fun. I moved on from there. My first role in my career where it wasn't technical, I moved into more of a strategic business development type of role. And I had a ton of fun doing it. It was great. It was an opportunity for me to flex a business muscle in addition to my experience with flexing a technical muscle. startup was very successful. I think lasted, you know, three years and we sold it.

6:48And then I did my own startup. After that, I had a startup that a bunch of different divisions of Sony funded. I was a 27 year old CEO and started that company out. We had that for about four years. I sold that. And I look back now at that as who on earth would have given me, given me money. Like I was 27 years old. I mean, I was probably a relatively smart person, but I've never run a sales team before. I look back at some of the decisions I made and embarrassment, how naive I was in the day. But that's some of the ways you learn is by doing. And so I learned in some cases what worked well, but I think you often learn more from what doesn't work well.

7:33And so there's a bunch there. When I started the company, the dot-com craze was still going, and then the bubble burst in the middle. And my company wasn't a dot-com. It was more of a technology infrastructure company. But nonetheless, it impacted the entire investment community, and it was tough. And so you did have to learn to kind of eat what you killed. And there wasn't a lot of investment money falling from the sky anymore, and you had to make a living and make payroll off of the business itself. So that was a great learning experience. So after we sold that company, I went to work for Microsoft.

8:07And this was a great activity for me. My prior company was in digital media. And they initially recruited me to come run the Windows Media division. I just was not interested in doing digital media anymore after the scars and burn marks I had from doing it in the dot-com era. And so they routed me towards cybersecurity. And as an engineer, I thought, well, that's a really exciting place. And so I jumped in and spent eight years at Microsoft, most of that leading cybersecurity there in the Windows security division. I got back to my engineering roots. Towards the end, Microsoft liked to move their executives around and give you different experiences.

8:46So I spent almost two years as the head of corporate development and strategy for one of the, at the time, three P &Ls at Microsoft. It's called the Entertainment and Devices Group. I killed the Zune. So I think a lot of people should thank me for that, but really kind of focusing on that stuff. And that was a lot of fun, but I to get back to being an operator. So I jumped back into an operator role leading mobile applications and advertising group. But at the end of the day, I'm a cyber guy like that got in my bloodstream. And I really, really wanted to go back to cyber. The Windows security group that I led before didn't even exist anymore.

9:24They kind of naively thought they solved that problem. And so I left Microsoft. Yeah, right. That's funny. Windows security, I used to say was an oxymoron when I when I took on that team. But I went to RSA, you know, they're, you know, they're great kind of blue blood security company and spent three years there. And then I made the jump to go to Sophos. And I did this for a variety of reasons. One, just the breadth of the portfolio. Two, it was, you know, known as a very solid security company, but more so it was known as what I would call a spectacularly average security company. Like it was, it was good.

10:01It wasn't great. It was not innovative, but not behind. It was just like right comfortably in the middle. And for me, as somebody who likes to innovate, I thought, well, there's a great opportunity that I can get there and like unleash some innovation and help transform that company into something special. Then I had an opportunity to join Arctic Wolf. And I knew from my time at Sophos how Arctic Wolf was really taking the market by storm because of their unique approach. And so I had an opportunity to join, I would say, relatively early, 1 ,000-ish employees at the time, and help bring them to the next level of where they needed to be, both technically and from a product strategy perspective.

10:43I mean, who's going to turn down that opportunity to latch onto a rocket ship like Arctic Wolf? When I joined, actually, when I was interviewing with people, one of the things that I loved and admired is, you know, I grew up playing team sports all the way through university and the pack, we call it the pack. The atmosphere of the pack is real. The way people rally around each other, support, help each other, just the collegial way we go about things. We do challenge each other, obviously, but we're always there for each other in the end. And just the humility that the CEO and the leadership team has was really impressive.

11:18And it just really resonated with me. So I could be more excited to be here now. Wow. There's a lot to unpick there, Dan. You've had an amazing career quite clearly, but what's he like to work with Bill Gates? Bill's obviously a brilliant guy. He was in this role as chief architect at the time and security was one of his key projects. So I had a project that we launched called Project Zeno after Zeno's paradox, which states you cannot get to your final destination in one iteration. You can only get halfway. And of course, that paradox means you'll never get there. Right. And, and I named it that because Bill would always ask me, when am I going to have an impenetrable windows?

11:55And my answer was always never, you know, we'll always make it harder and harder and harder, but you know, in cybersecurity, nothing is impossible. And it used to frustrate him, but that was the reality. Is that because he was a perfectionist then? Yeah. He just, you know, he was such a purveyor of Microsoft property. He just, he hated that it could be besmirched by some hacker, you know, and, and Microsoft could be infiltrated and have things exfiltrated through their operating system. So it just really kind of ate at him. And that's a great quality to have, right? You don't sleep if you think there's a problem with your marquee product.

12:30And of course, Windows and Office were at that time, the two kind of franchises in the company. So I was able to put together a collection of the biggest security brains in all of Microsoft, including some legends, frankly, people like Butler Lamson, who was an MIT professor and a Microsoft researcher who literally wrote the book of cybersecurity. There's a book called The Orange Book that was written by a bunch of early computer scientists at Digital. And that's like literally the first Bible of cybersecurity. And Butler is one of those authors. And just a bunch of brilliant people. And we went around kind of predicting the future.

13:06So 10 years, which would have been circa 2015. So that tells you how old we are now, but what was the work going to look like in 10 years and how do we protect it? And it was a great project. And I think almost everything that came out of that project has since shipped in Windows. So I do still look at a lot of the progress that Windows made around security with some pride. And it was great. Bill was a strong critic. He was great to work with. What I learned to help get Bill engaged was to hand him the pen every once in a while, Like ask him to tell us what he thought. A lot of people would just present to him and treat him like he was a movie critic.

13:43Like, here's my movie. What do you think? I wanted to treat him like a movie producer and get him involved. And he did. And I think, you know, we formed a good relationship as a result of that. Yeah, for sure. So looking back now, what's the biggest sort of engineering challenge you overcome? What are you most proud of in all this innovation you've been involved with? What's from an engineering standpoint? What's your highlight, Dan? Wow. It's hard to pick just one. It really is. I'll kind of do a top five maybe. I would say, you know, doing the interactive television stuff at Oracle was mind-blowing for me because, you know, Larry Ellison sold this vision to a bunch of telecos and we had no technology.

14:23And so I was like, okay, guys, now you got to go build this like really otherly world thing I pitched to everybody. It was amazing. Like we built operating systems, we built publishing platforms, we built application layers, we built video pumps, we it was, it was a it was a ton of fun. And we did stuff, as I mentioned that, you know, even by today's standards, I don't see people doing it. I think at Microsoft, obviously, working on helping to improve the security of Windows was a challenge. It was a kernel that was developed before the internet existed. And now, you know, the attack factors were so different and building out, you know, and improving the protections for what was really the flagship of what everybody in the world used.

15:06You know, I got a letter from the UK government, actually, that said Western civilization depends on your team. And I thought, oh, boy, what a bunch of kooks. And I thought, wait a second, the right, right. Hospitals, universities, militaries, financial companies, you know, trading companies, like everybody used Windows. And if we did not protect it, it would it would be problematic. And then, you know, at Sophos, it was great to build a brand new endpoint with super modern technology, leveraging AI very early. I built a new firewall operating system there. And then at Arctic Wolf, you know, we just innovate like constantly.

15:39It's just a big aspect of what we're doing. To operate at the scale we operate is really, really hard. There's not many companies. There's probably two or three in the world that operate at the scale we operate. And so continuing to do innovation there. I want to maybe ask you about that then because I want to move on to sort of the stuff you're doing now. Talk us through Arctic Wolf. Where did that opportunity come from? What's the purpose of your role? What are you trying to achieve? What problem are you trying to solve, Dan? Yeah, so it's a great question. So if you think about security, it's been primarily focused on single points of observation.

16:14So I either have endpoint security or I have email security or I have network security. And so big ecosystems were built around each of those. And they've advanced. So, you know, you went into Palo Alto, came up with the next generation firewall and Carbon Black and CrowdStrike really pioneered the endpoint detect and respond business. And so each one of them had their own wave of innovation. The one product that was supposed to be the panacea of the security operations center was the SIM, the Security Incident Event Management. And it was supposed to correlate all your logs and be able to tell you if something's going wrong in your system.

16:52And the way I describe it is a lot of people say security is like looking for a needle in a haystack. No, it's not. Finding a needle in a haystack is easy. I can write an ML algorithm to look at the needle, look at the hay, and separate them. Right. It's security is really about finding a needle in a pile of needles, which needle in this pile really matters. And that's where SIMS didn't do a good job. Like they were constantly under attack or they were missing everything. It was like one or the other. There was no kind of common ground. So it was either incredibly noisy or it wasn't noisy enough.

17:23Arctic Wolf decided, hey, we got to we got to fix that problem. And so they fix it in a variety of ways. And that mission from day one carries on to today, which is we're going to build a security platform, a security operations cloud, we call it. We are going to collect signal from whatever the customers have. We're not going to go in and say, you must use our product, our technology. We collect that signal in through a massive, massive platform. So we do about four and a half trillion security observations a week, well over 600 billion every single day. And we have to take that signal and we have to reduce that signal and eliminate the noise.

18:01Then once we eliminate the noise, we have to look across that ecosystem and find things that other people can't find. And then we have to deliver that experience back to customers who range from, I don't know anything about security, just help me, to I'm super sophisticated, I just don't have the scale, help me. We have to handle that whole spectrum of customers. And so we have something we call our concierge security team. And they interface directly with our customer. They help them on board through what we call a security journey. They're understanding the environments of their customers. They're helping set up good security posture from the get go.

18:35And then when we do discover something and it's, it's, it's, you know, it's not super common. So to be honest with you, if you look at a SIM, according to a Forrester report recently, get about 11 ,000 alerts a week on average through a SIM. Our customers get 10. So we're really reducing it down to the things that matter. So, you know, between one and two a day and our concierge will come out as a ticket and technology will be reported to the customer. But our concierge will also be there like, here's what we recommend. Here's how we can help. Here's what you should do. And so they're there to help those customers who need that help through it.

19:07And then technology helps the customers that that don't necessarily need that human being. And so we have the ability to take a very sophisticated, one of the largest security operations in the world and bring it to very small customers who don't understand security to very large customers who just don't want to have a SOC or don't have the bandwidth of security talent to operate their SOC. I know you guys host the Cybersecurity Awareness Summit. What can attendees expect to gain from that event then? And what else do you do on the education piece? Yeah, there's multiple different steps to it.

19:40Like the first one is making sure that your training is relevant and time sensitive. So what that means is like, for example, just a week ago, there was these big attacks on two casinos in Las Vegas, MGM and Caesars, where they actually ransomed some of the operating aspects of the casino. And, you know, if you think about it, it's like an Ocean's 14 movie, right? Where the hackers want to go. When was that? When was that done? That was just a week or so ago. And within two days, we had training out about that and the techniques they used to circumvent the human aspect of it. And so you have to have timely training that's really on top of what's happening in real time in the security landscape.

20:23The other piece that we do is we make it short, educational, and entertaining. Nobody wants to drone through a 30-minute security training session when they got work to do. So we really focus on real quick entertaining. You know, we have, you know, Hollywood quality productions, you know, many of the people work for many of the famous Hollywood studios produce our work. So it's really high quality. And it's, it's, it's very educational. And some, some of them finish with a quiz that helps the companies audit, you know, how successful that campaign was, and some are just informational. That's it.

20:55It's timely, you know, it's got to be relevant, it's got to be short, and it's got to be entertaining. Yeah, yeah, sure. Are you seeing anything on a global level that you're quite concerned about now? This is going to be really difficult to defend against. What keeps you up at night? I think what keeps me up at night is the state sponsor people enabling the people who are hacking in their bedroom. That's what keeps me up at night, right? And so what we're seeing today is ransomware is still the king of the hacking world because it's become a business, right? It used to be, you know, back when I took on Windows security, it was, you know, the Melissa Sasser blaster worms that someone created just to be disruptive, right?

21:34And now you've got multi-billion dollar businesses that are run like businesses that are around commercial hacking. And what worries me is we've already seen things like malware as a service and ransomware as a service where you have hackers basically building technology platforms for other hackers to take that technology and go perpetrate attacks. So they pay a license fee to these platforms and then they go perpetrate the attacks. And so you're enabling less sophisticated people to go be malicious actors. That's just going to really expand further when you bring AI into it. Right now, you know, the attackers are starting to use AI aggressively, gen AI aggressively to attack.

22:16And it's not just computers. It's over the phone. It's through video. Like there's been some, you read about some of these amazing vishing attacks where it's either, you know, coming over voice on your phone. We see attacks on text. We see attacks on Slack and Teams and communication like that. And so the thing that worries me about AI is you can create now a, you know, back in the day, you had to have some command and control. I get a footprint inside an organization. I create a communication path to my kind of hacking center. and then I can bring other payloads down. I can exfiltrate things.

22:53I could have a human being help me recon and traverse across the network. I'll be able to do that with AI and not need command and control, not need another human being. I could launch the AI and all of a sudden, money is where I need it to be. That's pretty terrifying. And not terrifying from a defense perspective. I think we've always, as an industry, successfully kind of kept pace to some degree with the attackers, that they can enable an army of people who don't have technical expertise to go be bad actors. That's the part that frightens me. So the scale of defending against attackers, just the multitude of people who can do it, it's going to go up exponentially.

23:34That's the part that worries me. Yeah, I suppose. I mean, if AI can be used by the belligerents, it can also be used by the sort of defenders as well, can't it? So I think it's going to become an arms race essentially eventually, isn't it? I mean. It is. And my kind of analogy is it's always been an arms race. I think, you know, we were using conventional arms to use the war analogy in the past. You know, they have tanks, we have tanks, they have planes, we have planes. And now it's a nuclear arms race, right? It's the amount of catastrophic damage could be much higher when you have this type of power.