Mandiant built its model around breaches being inevitable

Transcript

Transcribed by machine (Whisper) from the episode’s audio, so a word may be off here and there.

1. 35:50

   I want to shift gears now to your philosophies and mindset in building a company. You know, they're different. Yeah, so a couple of things there. Like the first time I built a company was 2004 and I wouldn't have said I was an entrepreneur. I started Mandiant in 04, February, and it was self-funded and profitable. And we were successful because in hindsight, it's like you almost learn nothing at the time.

2. 36:05

   And you look back and go, oh, I did learn right then and there because of the pain, usually. But I look back on Mandiant now, we had a premise nobody actually believed in 04 because our first website said security breaches are inevitable. And nobody believed it. And I don't even know how much I believed it. It's a pretty good tagline. By the way, I'm slightly off. Our first headline was, you cannot solely rely on preventive measures.

3. 36:34

   And that was so boring. That's the same as security breaches are inevitable. Can't rely on defense. Better ring on the security. Yeah, I got it wrong because I'm not a marketing guy. But anyway, so security breaches are inevitable. And the premise was that let's respond to every breach that matters so we have first mover intelligence on how to prevent it happening again. And so the first model of Intel in all of cybersecurity was antivirus.

4. 36:56

   You know, it was like we look for malware. We have signatures for it. And if we miss, David George has to find the malware and submit it to us so we get better. And that's a bad model. My mother's not finding malware on her laptop. You know what I mean? She's just going to eat her laptop a lot. So that model was bad. So we decided a better model because I responded to breaches. And the reason I was responding to them is AV was easily evaded.

5. 37:19

   and so we were like well let's learn all the you know let's second layer av because it stinks and that's what george now of course you know so let's second layer av you still have to have av though i beat it up but the reality is is you still need it um or something that replaces it so the second layer of defense was required so av was imaginal line to here then you extend imaginal line with something that can learn and think and uh so we wanted to do that and i actually look at armin is just the third wave of intel.

6. 37:48

   Like, why are we waiting for a victim and learn from that? That's ridiculous. You've got to find your own problems first. Don't wait for, you know, defense contractor A to be compromising and quickly share the information to make sure it never happens again. And that model still needs to exist for the things that are somehow get there, that beat you. But we got that model now and it's just not good enough.

7. 38:11

   So back to your question, you know, Mandiant was self-funded. There's not a lot. I don't know self-funded companies these days, David. Well, the speed requires that. You've got to be fast. That's the difference. Yeah. You look at, we started Armid and the philosophies were different.