Rob McDonald - Reclaiming Data Sovereignty & True Ownership

(Intro Narrator at 00:00:00) Hello, my friends. Today, Joel is talking to Rob, the Executive Vice President at Virtru, and they discuss how Virtru empowers people to have control over who has access to their data, how it's becoming possible to offer better user experiences without compromising security, and reclaiming the ideals of data sovereignty and true ownership. All of this right here, right now, on the Modern CTO podcast. Here we go.

(Joel Beasley at 00:00:31) This is the Modern CTO podcast. How long have you been on the internet?

(Rob at 00:00:45) I'm 39. So I was born in '82, which is really interesting. I'm in between two generations, right? Generation X and the millennial generation, which allowed me to see a lot of things like pre-cell phone and pre-accessible mobile hardware and things of this nature. And it's given me the ability to both be really interested, but also have learned a lot from the era where there wasn't as much accessible education for everybody. So not to say that made it easier. It just made us think differently. So in my career, I'm kind of like, maybe a topical term here, patient zero in my family for technology, right, in many ways. And in that boundary area where I just got really interested in it early, early, early, like middle school forward. And this is when we're just programming the TI-82 calculators and doing what we can. Getting access to what hardware we could is very inaccessible. Helping my school get grants to get computers. Like, that is kind of my origin story, but what it really allowed me to do is just be really, really interested in seeking out information wherever it is, right? Whether I've been connecting to people over the early internet or local groups. But at that time, it was just really about access to information. And I found that through that early kind of stage of it, I developed a skill for explaining it to people, right? Because I had to, and I realized that I have a bit of an empathy for the end user, right? So at the end of the day, that right there and that empathy for the end user really shaped my career. So I obviously went to university for management information systems, kind of the merger of those two at the time, and kind of jumped headlong into healthcare. So a lot of my early career is healthcare, been a CIO in some acute care hospital spaces, building solutions, really understanding can we bring technology to these people that are actually taking care of people, right? Not viewing it punitively. And I think you'll, maybe this will come out in some of my philosophy, but I've always hated—hated's the strong word—I've always disliked how technology is always so punitive. Like, there's the technology camp, and then there's the user camp, and those are far apart and one throws stones at the other. Like, I always, I just disliked that heavily. So in my formative kind of early years in the healthcare industry, it was, look, I'm here to enable them in whatever way possible because they're the ones that have the core mission of taking care of the patient. And that was really helpful to me, and it made me realize that I wanted to be a part of organizations that really understood that user experience side of it, the empathy side of technology. Because you have all of these IT leaders. You have all of these mission owners. I'll call them mission owners inside of organizations that they understand technology, but they really are there for another business purpose. And the two have to come together to be greater than the sum of the individual parts. That's really a different perspective. And that's kind of how I came up in kind of engineering and then eventually product management and then kind of went to the dark side and took on a role inside the vendor early days here at Virtru because that initial conversation was really combining two of my loves, which is privacy, right? Like enabling collaboration through privacy, not punitively, and the end user empathy, making sure that we understand that they're not there to install security software. The security software and the IT workflow is there to enable the business, and the two have to work together kind of harmoniously, right? So and all along the way, a lot of entrepreneurial adventures like you, where small startups, some consulting businesses along the way, some successful, some really not. A lot of learning, and that's kind of what landed me here today at Virtru and in my current role within Virtru.

(Joel Beasley at 00:05:00) It's kind of freeing when you get comfortable with failure, right?

(Rob at 00:05:04) Oh, you have to, right? Like, I mean, I think you would agree. Right? But this is a really good field to get comfortable at failure because even just implementing an algorithm, how many times am I going to go and compile error, debug, compile, debug? It's like constant small iterative failures. And like, if you emotionally can't respond to that well, this is a really bad track for you.

(Joel Beasley at 00:05:26) Yeah. It's called red, green, refactor. It's not called green, green, green.

(Rob at 00:05:31) Exactly. Exactly. So I think it's a good field for people that kind of get comfortable with failure and see it as a chance at bat, right? So typically, I'm going to try to increase my chances at bat so that I get to an effective solution faster as opposed to trying to design for perfection and then much longer time has passed, and then I drop and it fails, right? That's a terrible cycle. And that used to be the cycle, right? So now failure is a much more accepted term.

(Joel Beasley at 00:06:04) That's how I do my budgeting too at the business as an entrepreneur. Like, I manage my P&L. Like, I want to optimize for continued existence.

(Rob at 00:06:13) Yes. Yes. Exactly. No. I appreciate that.

(Joel Beasley at 00:06:16) Yeah. Yeah.

(Rob at 00:06:16) Exactly. Exactly.

(Joel Beasley at 00:06:18) Dude, this is great. You're smart. I like you.

(Rob at 00:06:20) I don't know about that. I appreciate you saying that, but I think it's a constant learning. You can appreciate what I mean by that, right? Like, always trying to learn.

(Joel Beasley at 00:06:28) It's the persistence, right? Because there's smart people who are successful and there's stupid people who are successful, but the commonality is that they don't give up.

(Rob at 00:06:36) Right. I do think, you know, I'm going to get this wrong, but I'll try to get the intent of it. But it was Buffett that fundamentally said, like, an idiot with a plan is better than one without, right? Something like that. And like, the plan is just resilience and persistence, right? To some degree. But it doesn't mean to latch on to an idea that continually fails. I think that right there in the middle is the hard part. Because sometimes people define persistence as like, well, I'm trying this thing, and I'm just going to keep trying this thing. That I see that all the time, right? Versus persistence in the overall mission vision and changing the experiments to achieve that. I got—that's really high level. Obviously, implementation means different things, but persistence is absolutely important. And I would say I would credit a lot of my career success, however you define success, to me, I define it as I'm still here and being able to contribute as resilient and persistent. I would agree with you.

(Joel Beasley at 00:07:33) Yeah. I always get into that too when people are, like, asking for advice or insight, and I'm like, persistence. But you have to understand some, like, fundamentals, like the scientific method. Because if your persistence against the formula that is going to fail always, then there's that little, that's the spice of life, that magical part where like I can't tell someone exactly how to do it for their business because you have to be living in real time and the variables and you just kind of have to want to wake up every day and figure it out.

(Rob at 00:08:00) Yeah. I think your audience would appreciate this. I don't want to put words in your mouth, and I'd love for you to confirm or completely deny this. But like, I struggle with that. Like, I get into a mode where I'm like, this is it. This is the way I feel in my gut. This is where we're going. But the data doesn't prove that. And I find myself having to step back and go, no, stop for a moment and let's try from the outside. Like, it's a constant battle. I don't know anybody that's perfect at it. I think the key is to surround yourself with a team that's willing to be vulnerable in that question so that you can all come together and agree on an iteration, if you will. I hate—I hate the word pivot. So overloaded these days, but an iteration. And no one is hung out when you have to make that iteration. That's the best possible team composition, whether you're like a two-person shop or you got thousands of employees. It doesn't really matter. The equation is the same.

(Joel Beasley at 00:08:58) Yeah. No. I completely agree. The part that you just mentioned about the right team or putting that team together, that was a part I felt that for a long time. Like I had the drive, I had vision, I could, you know, push things forward and work, you know, infinite hours and like make it happen. But the moment I realized the value of having someone like amazing on your team, and they don't—I thought for a long time that they had to be entrepreneurs because I was just biased to myself and who I am. And so I'm like, how am I going to get another entrepreneur? No. You just have to—I just need more experience. I just need to meet more people and understand the different types of people out there and then how to configure the different types of people to get a great outcome. And then I'm like, what is this? And they're like, it's management. I'm like, oh, I was like, this is leadership. Just configuring the people to get the right outcome. It's beautiful.

(Rob at 00:09:50) Yeah. I think, you know, it's interesting in 2021, what we've seen over the last decade. I'm not going to attribute this. The name escapes me, but, you know, you want to go fast, go alone. You want to go far, go together. You know, we're at a really interesting stage where I don't even know what go alone means anymore, right? So when I say go alone, I'm using tools. I'm using bodies of content online. I feel like everyone's a part of my team even though I might be a solopreneur, right? Where, but I don't know marketing, right? Or something like that, where I may go look at this individual's content and use that content. Well, you've just basically accepted your strength and weaknesses, and you brought on a team member even though they're not on your team. So it's a really interesting time for entrepreneurship and it has been for a long time. This is not new to this year, right. But I totally resonate with what you're saying. It's really hard to collect that team, empower that team, to do the things that you are not necessarily the best at so that that collective sum is better. And I think one of the best things you probably did once you got over the hump is, like, you were able to set an effective vision, right, at the end of the day so that everyone can say, is what I'm working on contributing to that goal? And is that goal contributing to that vision? That connective tissue is critical. It's also one of the hardest things to do, but I'm sure that was part of your journey to some degree when you were starting to build that team.

(Joel Beasley at 00:11:13) Always. And I'm always trying to figure out how to do it better now. Like, for example, we just built this tool, this survey tool. We partner with an organizational psychologist. And now we're doing these surveys where it tells us the strengths and weaknesses of our team as a whole and then individuals. But it's not like we didn't just go pick some methodology off the shelf. We're like, we're just going to run this because a lot of them that we found where it's like, okay, knowing that they communicate this way, that's great. But there's like nothing actionable behind it. It's just like, okay. Bob communicates this way. Sarah communicates—it's like, okay. They're a green thinker. They're a red—it's like, that's great. But I wanted something that because I'm so entrepreneurial and action focused. I'm like, I want something that I want to give my people a survey, and then I want it to give me some sort of action, something useful, like, in relation to that. And so we just built it and started giving it out for free to some of our past guests, like, two weeks ago.

(Rob at 00:12:07) Oh, that's great. And there you are. You're further refining kind of the processes that other people are using, right? This is part of the process.

(Joel Beasley at 00:12:15) I need it to grow my business.

(Rob at 00:12:17) There was a need there that compelled action, right? Exactly. Like, oh, you always got to have that. Yeah. No. I love this conversation. I appreciate you allowing me to take that side channel to talk about entrepreneurship. It's such a passion of mine. So I do think it's relevant as well, though, because if you look at some of the just more traditional or institutional security, infosec, IT world, these principles apply right there as well. And I think we'll get into that today for sure. But you do have this real historical institutional decision-making process, sometimes led by PTSD from not being a part of the budgetary process in the past or not having a seat at the table. So you're just trying to claw and get what you can because you know that you're not necessarily a priority. And so we've seen these cycles over the years where like major breach occurs or major new zero day, and everybody's like, and then the meme comes out where like the CEO is saying, hey, security and IT, do you want to sit at the adult table? Right. You've seen this meme? Like, I'm sure if we've looked at this from like Google Trends or history, it would be like this, right. But you would see it throughout the year. And I appreciate that because it gets a little bit of momentum in that time, but, you know, no one's really thinking about the psychological health of these CPOs, CIOs, and CISOs inside of organizations because when they're in that process, they're making decisions to get what they can, not necessarily optimizing for what's best for the organization at that current time and into the future, right? So if you took a more entrepreneurial approach, you're just always taking a look at your technical stack and saying, is this the right composition for today and tomorrow? Is this right? And just doing that, moving that window, right? If you really were able to do that, I don't necessarily think some of the budgetary decisions would be made the way they are today, and I don't necessarily think some technology would make it into that technical stack. But they're just trying to get what they can. And I'm sensitive to that, having been in that role. And now serving a lot of these individuals within Virtru, we so easily forget about that kind of psychological side and those individuals having to put that together and make decisions on other organizations not necessarily having the priority they should, right? And I really appreciate that. I don't know if you kind of get that from talking to a lot of your guests, but it's something that I think about a lot.

(Joel Beasley at 00:14:50) Yeah. Every organization is incredibly unique, right?

(Rob at 00:14:54) Yes.

(Joel Beasley at 00:14:54) And but one of the things I was curious about was, like, how do you explain this to people? You may be at a kid's soccer game or something, and they ask you, you know, what does Virtru do? What do they do?

(Rob at 00:15:04) Yeah. No. I appreciate that question. It has only evolved at the edges over the year. The core values are the same, so I really appreciate that. Most organizations, I think, have a trouble staying with their core values over time and decisioning from them. But, effectively, the hypothesis or the thesis goes like this, right? Data is the fundamental common denominator in almost all transactions, whether that's an email to you about a party I want to invite you to on the weekend or an email to the organization that I'm entering into an M&A window with, right?

(Rob at 00:15:39) I'm exchanging data with you, right? And we believe that that data and your ability to selectively control who has access and under what condition is empowering, right, fundamentally. My ability to say I want to really give this to these individuals so that we can do business at the speed of the market without worrying about what's going to happen after this window of importance is over. That is a very empowering concept.

(Rob at 00:16:11) Right? So this is a key philosophy difference from the punitive era where cryptography and some of these solutions, while if, unless you were kind of in the cohort of individuals going to key exchange parties, like, okay. So I'm like a small cohort, right? Unless you were in that group, everyone else is like, view these as kind of punitive-only technologies.

(Rob at 00:16:32) We're imposing this on the user base, not viewing it as a way to give the company more collaborative abilities. So at our core, we are a privacy and data-centric security company built to enable faster and more pervasive collaboration for organizations without having to worry about who has access and under what conditions. And that takes the form of email, files, platform SDKs for your own application. And you can imagine how that can evolve into other product instances. But at our core, that is really what we do.

(Rob at 00:17:08) And of course, from that, compliance, international regulatory requirements, of course, those stem from that core value. But our core value is really that.

(Joel Beasley at 00:17:17) What's your, like, top line of business? Like your largest or second largest line of business?

(Rob at 00:17:22) A little bit of company origin story there will educate, will kind of explain that. When we were first kind of forming, our CTO at that time brought out some core technology to enable what I just said. I want to share to you as quickly as possible without worrying about where that data's got to go to get to you or where it'll go afterwards. And he was at an agency at the time trying to serve this for forward-operated warfighters, right? And then he was very successful and was able to build that specification, what we call our trusted data format or TDF, to bridge from there to commercial product decisions.

(Rob at 00:18:00) Like, right, what's a pervasive communication medium that is not going anywhere and has not historically had this problem solved for? And it was email. That's where we first started, right? Was, can we do an end-to-end data-centric solution that people will actually use and adopt and achieve those core values I just discussed?

(Rob at 00:18:19) So because of that, you know, we really iterated on the user experience trying to get that adoption up there. And because of that, email is one of our larger books of business: email protection, data-centric protection, enabling those communication channels. And we also have file collaboration, file exchange solutions, and an underlying platform that's enabling a lot of amazing things from like container security, multiparty secure analytics, and just enabling tech companies or companies in general to bake our, those values I just indicated, into their own applications. But kind of in that order is the composition of our business. And we have organizations, you know, ranging from small organizations up to multinational enterprises, large organizations, hundreds of thousands of users.

(Joel Beasley at 00:19:02) So, like, how do you explain it to somebody who's, like, just kind of a casual user? Like, is it, like, a really secure, do you have, like, a really secure Dropbox-style thing for corporates? Is it something like that?

(Rob at 00:19:16) Yeah, it's a good question. So, you know, it's really sensitive to the personas involved, right? So, like, if you're a regular end user, you know, the way I think about that is your job may be, let's just, like, use an example. Like, your job may be to work with the public on exchanging their personal information, maybe for health claims or something like that, right? So your job is to do that, right? Your job is not necessarily to remember all the things you have to remember about compliance or regulatory needs or to worry about control of that after the fact.

(Rob at 00:19:48) So I explain it that we are kind of an end-to-end solution that is integrated directly into your experience. So if you're composing an email, we're right there. And when you protect that, when you enable that solution, you never have to worry about it again. And you can see at any moment who has accessed it, when they accessed it. And if you need to revoke it, you can.

(Rob at 00:20:08) But all you really have to do is send an email. Our UX bar is very high, right? Or if you're a data scientist, right, like, if you're in that particular cohort, or a DevOps team that has these same concerns, I really discuss it more from the perspective of enabling it within your existing pipeline, not having to worry about where that data goes into and out of your pipeline.

(Rob at 00:20:35) And because of that, you should be able to gain access to more data to achieve your job. You don't have to worry about all the regulatory or contract requirements, those high bars to get that data into what your core job is, which is getting intelligence from that data, right? So it depends on the persona, but those are two really far ends of the spectrum where I explain two different things, but the fundamental core values are the same.

(Joel Beasley at 00:20:56) So when people are like, your customers are trying to find you, what are they searching for?

(Rob at 00:21:00) It varies, right? So one end of the spectrum: compliance, right? Like, so GDPR, CCPA, HIPAA, PCI, or intellectual property protection where, like, they're really concerned about one pillar there, which is just, am I achieving the always-evolving data protection and privacy standards of my particular industry?

(Rob at 00:21:21) So healthcare, HIPAA, you know, things of this nature, or the global standards for GDPR and now regional with CCPA. Then you shift over into kind of a different tier, which is like highly sensitive transactions. So you can imagine, right, I'm in the middle of an M&A transaction. I'm looking for a way to protect this data during a window of time. I have intellectual property. I'm looking to protect an intellectual property and exchange that. That's another cohort there. And then on the other end of the spectrum, really thinking about, excuse me, ITAR is another compliance regulation that's very specific to us as well. And the far end of the spectrum, it's really about your analytics. Can we do multiparty analytics and things of this nature in a secure way?

(Joel Beasley at 00:22:07) I don't understand that last part, multiparty analytics. What type of analytics?

(Rob at 00:22:11) Yeah, I'd love to talk about this. So this is a newer area. If you think about it like this, in fact, let's just use the, let's use the pandemic as an example, right? It's not maybe the best example, but there's other ones we can go to if this doesn't resonate. Right? The value of being able to respond, and this response is the same when we're talking about, we'll talk about infosec in a bit, just responding to incidents and threats. But effectively imagine, you know, March or February, March 2019, where we're trying to determine what's going on, right? Well, the reality is there's a lot of models for this, but the data wasn't available. How do I get that data, right? Well, what's happening there is all these different cohorts, right? So this academic institution, this government institution, this local state institution, they have to collaborate, right?

(Rob at 00:23:01) But they have to do so in a way that doesn't just violate everyone's data rights, right? How do you do that? How do we work together in a way that allows me, the data owner, to contribute to you, all these parties, my personal information, and trust that everyone's only gonna do with it what they say they're gonna do with it, right, effectively, right? Multiparty analytics effectively says the following, right? I've got multiple parties that want to assert some type of control or access to a cohort of data. This is my personal data, and I want to do so in a way that I can revoke at any time, but at the very least, see what's going on, right, with that data. This is really important. So if you can do that, then you can lower the concern for me, the data owner, for contributing that data. And you give me the power to kind of, like, hit that red button at any point if I want to pull that data back.

(Rob at 00:23:55) But the empowering thing is because when you can do that, all of these parties that we have trusted with knowing what's going on now have access to the data to tell us what to, tell us what they recommend, right? What can we do? What should we do? How do we mitigate this issue faster? That collaboration is not happening effectively today, and the, you know, federal-commercial crossover or within organizations, there's just a bunch of data silos that exist. And there's these long, drawn-out contractual processes to agree on, what are you gonna do with the data when I give it to you? After you're done with it, what are you gonna do with it, right?

(Rob at 00:24:38) These are all just language in a contract. There's no technical enforcement, right? So, you know, confidential, secure, multiparty analytics is really about empowering that world where the data is accessible and people have control and sovereignty over that data even when contributed to other people.

(Joel Beasley at 00:24:58) Did you hear the episode where I interviewed Tim Berners-Lee?

(Rob at 00:25:02) I feel really terrible that I missed that, but, uh, big fan, big fan. Loosely following his work in his new institution. And this, you know, he, I think he looked back on the origin and says, you know, I know now what we can do moving forward, right, which is exciting.

(Joel Beasley at 00:25:22) Well, so what he described when I talked with him, his Solid framework, the description was, like, virtually, oh, my producer just Slacked us. He's like, that's not released yet. You couldn't have listened to it. Yeah. The episode's not even released yet.

(Rob at 00:25:36) Oh, okay. Well, I will be listening to that. Yeah. I thought that I just missed that one. I'm glad that I didn't. Big fan, but, like, you know, he's speaking to the same problems, right? Like, with this big data situation we have today, and the situation fundamentally is there's a promise, and the promise is we're gonna get a lot of intelligence from this data. And in tech, we move very quickly, and we solve the problem without necessarily thinking about the implications of it. And that's okay because those can be disconnected until they need to be connected.

(Rob at 00:26:11) That's how we maintain innovation in many ways. But what if, right, what if we can do so in a way that they don't have to be disconnected and you don't lose the ability to gain access to the data? I think that is a real future and one that I'm very excited about.

(Joel Beasley at 00:26:28) Have you dove deep on the Solid framework?

(Rob at 00:26:30) Early days. I understand the intent and kind of, but not necessarily, like, the mathematical detail of it yet. But I, you know, have been following the initiative, and I expect to dig deeper into that. I've been, so many rabbit holes to go down these days.

(Joel Beasley at 00:26:47) Yeah. So the reason why I think this is a rabbit hole worth exploring is, and I don't know, I don't know what it was early days. All I know is, like, I researched it before he came on the show and they have a business and they've got, you know, employees and people and they're working with governments to help, you know, with this. And, uh, but the concept of, like, the Solid framework with these pods, these, like, personal on-demand storage.

(Rob at 00:27:10) Yeah.

(Joel Beasley at 00:27:10) And the way that he described it in the, and they're building, like, infrastructure and plumbing, right, so people can do this.

(Rob at 00:27:18) Exactly.

(Joel Beasley at 00:27:18) It just sounded so similar to, like, what you guys were doing. I think you could get some inspiration from their framework.

(Rob at 00:27:25) Oh, without a doubt. And I think our core underlying standard and specification, the TDF, like, it is designed to be portable such that when you combine, if you think about data encryption for a moment, encryption is such a generic term, right? But when you think about encryption plus empowering a business workflow, right, it's combining a couple of things. It's combining cryptography in a way that ensures that only authorized parties have access.

(Rob at 00:27:55) But, also, how can I bake into that the intent and that policy so that wherever it goes, it follows it, right? Like, at the end of the day, that is what the TDF does. Underlying all of what we do is, say, when you're composing an email, right, and you're filling out the To, CC, and BCC fields, right, you're building a policy. You're saying these individuals are the only ones that have access. And when you click Send, it doesn't matter where it goes, right? Like, it could go through 30 intermediate MTAs, and none of them have access because that device, that entity, or the human beings along the way can't access it, right?

(Rob at 00:28:34) That is, you know, to his framework, really what needs to happen. You have to come back to me, the owner, and say, I would like access. Are you okay with that? That's a phenomenally empowering thing.

(Rob at 00:28:48) You know, where we focused around user experience was, can, when those requests are coming back, can we make it accessible to the user? I think these are things that are important to answer longer term. So the applications that build on top of our stack and the applications built on his stack, they have to answer those questions, right? So when you come back and you want to request data or you're having exchange with another individual built on that framework, it's the user experience to make it accessible.

(Rob at 00:29:15) Because much like any other infosec solution historically, if it's too noisy or I don't get the notification or the, whatever notification means in that sense, or I don't understand it, then it won't get adopted. And that was really a big part of our origin story was we've had PGP. We've had S/MIME. We've had cryptography a long time, very strong cryptography, right?

(Rob at 00:29:38) But implementation and usability was so low that I could be a CISO or CTO in an organization trying to make a decision. I know, excuse me, I know end-to-end solutions are the best, meaning end-to-end from me, the data owner, to the recipient, the only authorized party. I know that's the best, right? But if I implement the solution, let's say implement PGP, and no one uses it, right?

(Rob at 00:30:06) Because a workforce that has a job to do when faced with an obstacle that is not directly necessary to enabling their job in that moment will bypass that. Like, they're very creative, right? You know it. They're very creative. And you know what? I don't blame them, right? So we really have to solve that.

(Rob at 00:30:24) So if you think about the future, if you think about a lot of, like, modern stacks that are trying to solve the data sovereignty issue, you know, this is the crux. This is part of the crux of it, setting aside some of the really deep in the weeds technical things for scale and things of this nature, but people have to use it and we can't lose sight of it, you know, as a technician, if you will. I like to go down the technical rabbit holes, but we can't lose sight of that user experience piece.

(Joel Beasley at 00:30:53) That's right, because that's your adoption and that's the business model. No one's gonna pay and renew for something that no one uses.

(Rob at 00:30:59) Absolutely. I mean, and then just from a societal perspective, right? Like, setting aside business plans for a moment, right? If, you know, we want to get broad adoption of something with or without monetization, it's the same equation effectively, right? People have to need to use it up to a point such that whether that be a network effect locally or maximally takes place, right? So user experience with or without monetization is still critical in this space.

(Joel Beasley at 00:31:29) Yeah. For me as a user, I'm pretty, um, I'm hard. I'm hard on products.

(Rob at 00:31:34) Yeah. Same here. Same here.

(Joel Beasley at 00:31:35) Because I can switch my profile and my brain. It's like operating system, like, multiple users. I can be the user that's like nontechnical that just wants it easy and that person, like, it's gonna, it's gotta be baked in. You have to bake this into my experience. Like, when I onboard at the company, you have to give me a tool set and whatever security you want me to use needs to happen without me even knowing it.

(Joel Beasley at 00:31:58) I just need to be able to go there or somehow, you know, be very, very easy in the flow of my work where it's just like I hit send, but it confirms that these are the people I'm... Alright, cool. And you would, you know, but don't bury it in the menu somewhere I'm going to have to go select permissions. It would have to be set up in a way that, like, where you don't make me think. I can just continue and interact with these other humans because I'm trying to do a higher level. I'm just thinking of sales right now.

(Joel Beasley at 00:32:22) I'm trying to do, like, a higher level order of operation.

(Rob at 00:32:26) Yeah, so absolutely, right? And doesn't that totally make sense, right?

(Rob at 00:32:30) Because at the end of the day, you can only educate people, and educate, again, it's too strong a word. I'm not trying to say they lack knowledge. I'm saying you're taking them from where they are to where the current technology is or where it will be. People can only go so fast, right? So if I want to impose a tremendous amount of burden on you as a user, the value has to be disproportionately larger than the burden I'm about to impose on you, right? So constantly, we're trying to find the appropriate equilibrium there so that you can get a portion of people to move forward within some kind of smaller group, whether that's a company or a nation or a globe. It doesn't matter, right? At the end of the day, that equation is true. And in our world, so I say our world, just in the world, in the very specific kind of tactical infosec threat mitigation world, historically, I kind of talked earlier about making decisions that kind of pull forward technical solutions just for the sake of it because you're trying to capture budget and you're trying to conserve what you have because you know you may not get exactly what you need, but you've got to have something because you're kind of up against it, right? You don't necessarily think about it the way I just said. Now, that's changing. But why is it changing?

(Rob at 00:33:54) Right? In many ways, it's changing because there's kind of a crossroads of users like yourself. So the growing population of knowledge workers and entrepreneurs and people within organizations that are like, I demand something different, right? And that's great, right? And the threat landscape, those two coming together, right? And kind of the rising tide of the last year, right, breaches and work from home. That nexus is really what I think is unique, and I haven't seen before coming together all at the same time. Like, I've seen components of it, but never at the exact same time, which is why I'm really excited because you're starting to see in many places large ecosystem providers, Microsoft, Google, Amazon, et cetera, start adopting an extensibility mindset so that organizations like ourselves and others can deliver the experience you expect without sacrificing the security. And to be honest with you, clearly, this is important to me, but that's magical, right? That's the combination of where I have just simply more tools as a technical operator to deliver the experience I want. Nothing can be more exciting, you know, in my opinion.

(Joel Beasley at 00:35:15) Tell me about some of these disasters, right? Like, things that happen when people don't encrypt their data.

(Rob at 00:35:21) Yeah, I mean, let's just not even go far back in time, right? Let's talk about SolarWinds for a moment, right? Two perspectives of SolarWinds, right? Two categorical perspectives I think we can talk about. One is the paradigm shift in the way you have to think about attack vectors, and the other being, okay, now it's happened. What can I do, right? That's not the only pillars. I'm just providing, like, two perspectives that I think are worth discussion, right? Maybe we talk about the second one first, right? One is we know over some timeline the likelihood of exfiltration or breach at 100%, right? It is 100%. If I am in existence long enough as an individual or a company, it will happen. That's a powerful statement that I think some leaders background in their mind and ignore and others embrace. And I'm not saying embrace it because, like, you're going to make a lot of changes right now. It's always risk, revenue. It's a combination of all these decisions all the time. I'm sensitive to that. But in this particular situation, and other ones like it, once that data is out, there was no answer. I have no way to come back in and say, where is it? Who's trying to access it? Can I apply control to it?

(Rob at 00:36:44) Because you've contributed to an ecosystem of solutions under a condensed set of vendors, right? Maybe, like, two vendors involved here, really, if you think about it, right? And they didn't have an answer. The data was removed from their control, right? And there was no way to respond to that. So I think if you think about that for a moment, that is frightening, right, for many reasons. But that's what can go wrong. The other perspective, and then we can kind of get into kind of, like, mitigated solutions to that if you want to brainstorm on that a bit.

(Rob at 00:37:20) But the other is, like, the paradigm shift. Like, we bring forward legacy solutions and legacy categories. So I'm not going to talk ill of any category here. Every category of security solution has a place, but I'm just going to mention a few things, right? Not necessarily comparing the two, but, like I say, I'm always going to bring forward antivirus technology, right? I'm going to bring it forward. That takes up x amount of the... I've got so much budget, right? But if you think about this paradigm shift here where, like, none of that mattered, and the thing I'm going to get access to is the data. What of your technology stack did you bring forward addresses that problem, right? Where I'm going to get your data, I've done so via a vector that bypasses 99% of your technical stack today. And then you look at the composition of your technical stack and you ask the question of yourself, how much of this was actually and truly focused on the one common denominator that is true no matter what SaaS vendor I'm using to enable my workforce, and it's the data, right, at the end of the day, right? Those two things are the eye-opening moment, right? In my opinion, everybody's going to have their own opinion about this, of course. Those two perspectives are the kind of eye-opening moment for that particular series of events that are still unfolding, right? This is not over with, right? It's just a level of sophistication that was very eye-opening for the industry. Yeah. How do you think about that? Does that seem to resonate with kind of how you think about it as well? Have you heard that?

(Joel Beasley at 00:38:57) You get to say it a lot, right? So to you, it kind of just becomes this thing that you say and you talk, but man, hearing it for the first time. Yep. It makes the most sense. It's, like, just go... It's like a root cause analysis or, like, a think, you know, first principles concept of physics. It's like, just go to the root and let's just encrypt the root, and somebody even steals it. That's fine as long as this policy can, as long as there's some system that can manage this. And I think that's what you're alluding to with your TDM. Is that what you call it?

(Rob at 00:39:24) TDS. Yeah. TDF. Yeah. Trusted Data Format. Yeah. It's work principles. Like, I think you nailed it. I think, given your background, first principles are core to how you've been successful, kind of going back to I can only imagine you attaching to the real estate industry. And I can only imagine several conversations in that environment where they said to you, oh, I didn't think about it that way. And that's what resulted in your product, right? I can only imagine that's happening now, right? So those first principles are, I think, how we have to increase agility in the security world. That lateral, divergent thinking about what I've done before won't necessarily equal success in the future. It's true in markets. It's true in everything. Almost everything, right? Past performance does not guarantee future performance. And if we were being honest with ourself, past performance, it's trending poorly, right? Because breaches are going this way. Cost for breaches are going this way. And eventually, we're going to reach a crossroads where the ability to subsidize those breaches will not be possible. Right now, I want to get to a solution before that. I want to get to that solution before the pain that gets imposed on everyone can't be subsidized, right? Get to that point where when your credit card is breached, the credit card company comes to you and starts really questioning whether they need to pay you back or not, right? That's a bad, that's a bad place to be in the future. But if you follow the trend, eventually, and now people are going to argue this, but eventually we have to get there because you can't just pay infinite. You can't subsidize value-creating streams forever. It eventually becomes inequitable, right?

(Joel Beasley at 00:41:06) You go out of business.

(Rob at 00:41:07) Go out of business. That's right. You go out of business. So, I mean, in those traps, I think the data-centric approach has never been more accessible than it is today. And if more organizations and individuals and practitioners, and you're seeing this, right? You hear zero trust. You hear these concepts, and data-centric approaches are a clear component of zero trust, a component. It's the framework. It's not a solution. Zero trust, right? But if you think about protecting that itself, and we get more of the practitioners and organizations compelling that plus acceptable user experience, then you start seeing change in the solutions that are offered. Because, again, at the end of the day, to your point, people are providing solutions to sell to organizations, and they want to meet the problem with a solution that's compelling for the user. So we're seeing this trend go up into the right, and we're working tightly with ecosystem partners like Google to say, let's work together, right? They love your products to enable their business. We clearly have a problem with the data leaving ecosystems, and it's not your fault. You're absolutely security professionals. But can we work together to deliver an experience that also gives them the control over the data so that when, not if, that data leaves, they can see it happening, where it's at, and provide some kind of, like, textual control, right? So, like, someone's accessing this in an area that I don't know, automatically revoke that data, right? That's super powerful.

(Joel Beasley at 00:42:42) That's... I'll tell you what, man. I'm so interested. I want to have you on again after you go listen to the interview with Tim Berners-Lee because I'm so curious. Yeah. I think that's the future and you're describing it. I'm curious to know, this Trusted Data Format, is this something that's, like, open source or is it proprietary to your company? Like, can other people implement this concept or no?

(Rob at 00:43:07) So increasingly so. So, like, here's... So this was born in agency. So it's, like, a domain-available specification is open. We're contributing to that specification every day. And as an organization, we're committed to increasingly opening more and more of that ecosystem, right? Over time, in addition to offering our portfolio on top and beside that. I want to be really clear, on top and beside, right? It's a community contribution effort because we feel like this is important. But, yes, you can absolutely expect more of that from us over time.

(Joel Beasley at 00:43:40) That's exciting, man.

(Rob at 00:43:42) No, I... It's very exciting to me. I'm glad I'm not the only one, but I'd love to dig in anywhere you want to dig in, of course, other than these areas. I feel like I've talked a lot here. So...

(Joel Beasley at 00:43:51) No, no. The last technical, nerdy thing before I ask you a couple leadership questions is just the... When I was thinking of the fact that, like, all of our data, we constantly give it away. Like, my data's at my bank. My data's at the social media site servers. My data's at everyone else's servers but mine. I'm trying to... We're going on this ten-week trip, like, on the road. And so we won't have, like, Internet certain days, like, on weekends and stuff. And so I was trying to figure out how to get my media to come with me. And it is, like, impossible without being... without pirating. Like, it is, like, so... I buy movies from Amazon. I've got, like, hundreds of dollars of movies from them. I can't play them offline. Like, I don't have access to them. They can't go into, like, my Plex. Like, I can't get media. And so I'm so frustrated as a consumer that my data that I pay customers for is all in their systems, and it's never in mine. And I don't actually have access to the data I'm paying. It feels weird.

(Rob at 00:44:48) Yeah, it... Well, I think I love this topic. At your core as a human being, it feels weird, right? If so, set aside technology for a moment, right? So, like, historical kind of genetic predisposition of, like, generational ownership, right? Like, I have this coffee cup here. It's in my hand. I know it's mine, right? So when you transition to digital assets, we moved away for sake of innovation. Don't get me wrong, right? I absolutely love to stream my videos on Amazon. It is amazing, right? But, you know, it has swung really far in a direction that I think is making more and more people think about it. And I think, you know, the vocal minority kind of shifts history in many ways as long as they're committed to that future.

(Rob at 00:45:41) So I think you see a lot of conversation in the public today around, well, what does privacy mean, right? And ownership mean? And ownership mean? And a lot of people are like, well, I don't really... I'm not too concerned about these organizations having my data. They serve me amazing ads, and I love that, right? So great. I'm not, so I don't fall into that camp where I'm, like, no, you can't have that. Like, no. That's delivering value to you. But what you said is the actual inflection moment in most people I speak to, right, which is, what does your video library look like? You're like, ah, I've collected, like, 300 videos that I purchased on Amazon Video, and then I have a conversation about, like, where are they at? Like, how do you define having that, right?

(Rob at 00:46:29) And then they start thinking about, well, I just... I go in my Roku. I'm like, oh, right. But disconnect your Roku, right? Or, like, violate some Amazon rule, right? I'm not speaking... You love Amazon, right? Like, at any moment, they can take that digital asset offline and ownership becomes very akin to your bank not letting you withdraw funds after hours, right? It really is parallel to all these conversations we're having around sovereignty. And there's no real fundamental reason from a technical perspective for that to be true. What we're witnessing is more individuals like yourself really thinking about that data ownership sovereignty question and demanding the ability to have the accessibility, the true ownership, being able to, quote unquote, put their hands on these assets to some degree, but also still willing to pay for the value that these platforms are providing. I don't imagine a world where you're saying that I want to be able to take that to this device here, but I don't want to pay you anymore, Amazon. You're not saying that, right? You're just saying I bought that, and I would like to use it in a location that I like to frequent using a device or a player that should totally be okay to play a video, right? So I think, you know, where a lot of the concern was historically was around, like, some of these organizations, and you're seeing the fight today between ads and Apple taking more privacy-centric approaches, the monetization path, and then defending their moats, right? Well, that's just a change. It's just innovation. You've got a bunch of smart people in these companies that will find a way to continue to monetize the amazing service they have while still giving you access and ownership of the data that you have purchased. That future is totally possible, and we're starting to see that come through.

(Joel Beasley at 00:48:22) That's why I'm so patient with it. Yeah.

(Rob at 00:48:24) It's like I

(Joel Beasley at 00:48:24) was getting frustrated, and then I'll get frustrated that, you know, I'm frustrated that I've spent this money on these videos that I cannot watch in a player of my choosing and I can download them, but I have to play through Amazon's player and I have to redownload them every 30 days or something of that nature. So if I go on a two-month road trip, all of a sudden content planning has become a thing when I already spent $15 on the movie.

(Rob at 00:48:48) That's right.

(Joel Beasley at 00:48:48) Like, why can't I just pull it down to my—I bought—I found all this out after I bought this four terabyte little drive, you know. And I was all excited. I'm like, alright, I'm gonna pull my stuff on it. And then I start figuring out to actually do it and I realized I can't.

(Joel Beasley at 00:49:02) And so I start posting in Reddit and people are like, you can't ask questions like that, you know. And then I get some people that were really nice and DM'd me and they're like, sorry, man. The only options are to download it and let it expire and play your Netflix stuff through whatever allotment that they'll—they don't let you download everything.

(Rob at 00:49:21) Right.

(Joel Beasley at 00:49:21) But whatever allotment that they'll have and your Amazon whatever allotment. But if you go over here

(Rob at 00:49:26) Yeah.

(Joel Beasley at 00:49:26) You can get everything for free and you can one-click download everything. I'm like, I want to pay for the stuff and I don't want to do the pirating thing, you know. I want to pay—I already, not only do I want to pay, but I've already paid. I've already paid the $15. I have some DVDs at home.

(Joel Beasley at 00:49:42) That path is pretty straightforward. You know? But anyways, I get frustrated and I step back and I realize, okay, a couple things are gonna happen. Number one, my boy Elon Musk is working on that Starlink.

(Joel Beasley at 00:49:54) So I'll be able to stream this wherever. I can be in the woods and stream it, and this whole thing becomes a non-issue because I'll always be able to stream.

(Rob at 00:50:00) Yeah.

(Joel Beasley at 00:50:00) Or number two, you know, I'll just have to be creative. Go to the dollar bin at Walmart and then just copy my physical DVDs onto my backup system, and I'll be able to watch them whenever I want.

(Rob at 00:50:13) Yeah. I mean, you've heard this before, so I'm not gonna say anything now that's amazing. But this is the digital real estate era, right, where we're defining what that means, where those boundaries are, and how to define them. Right? And while in that particular situation, you have options. Right? Like, Starlink's going up. I could stream it all the time. But what about health care? Right?

(Rob at 00:50:35) You have the same camps in health care today. You have the camps where it's like, give me all your data. I know best for you. And then you have the tech startups, the health startups are saying interoperability, data portability. They're saying the things that are truly empowering of the patients.

(Rob at 00:50:51) I'm not gonna say any names in either camp because I don't want to—you know, everybody's really trying to strive for patient care, so they just have different philosophies. But never before, right, has a patient today had both at the exact same time more access, direct access because of the internet and because of engagement and mobile platforms, direct access to broad specialties to improve their health outcomes and health span. Never before. And at the same time, not be able to access them because my data sits over here. How do I get it to you?

(Rob at 00:51:26) I'm gonna call them. They're like, can I send you a fax? And then I just lose desire to be awake that day because if someone said fax to me, I just forget the whole thing. Right? It's frustrating.

(Rob at 00:51:37) But it's actually, for some people, the difference between them getting to a health solution or having a really poor health outcome. And this is the part I spoke to—kind of empowering the end users. I said in the beginning, the thing that fires me up the most. Right? It's your data. It's your health data. Right? You want to monetize it? Do you want to have access to it? Do you want to deliver intelligence to me?

(Rob at 00:52:02) Yes. Value. At the end of the day, value is the currency by which I'm willing to exchange my USD, fiat with you so that we can trade services. Right? In my particular case, you're gonna help my health. Right? That's the thing, the value, not you just storing my data. So I believe firmly that these particular industries where there's a lot of acuity around the issue, right, is going to meet this digital real estate world we live in today and the technology out of it to pave a new future. So that, for example, you know, think about—I'll talk generically around technologies like Ethereum and blockchain where that data is yours. It exists in a state that's verifiable, and you can authorize access to parties.

(Rob at 00:52:53) Transport that into health care, right, where my digital asset is my health record. And at any given point in time wherever I go, whether that's a primary care physician or a specialist or a functional medicine doctor, whatever, right, they should be able to gain access to that without any kind of physical intermediary. Right? I shouldn't have to phone someone. I shouldn't have to have them fax it or print it or bring it over.

(Rob at 00:53:21) Right? That is insane. Not insane in people are doing bad things. It's just it's an era. It's a time where we don't have to do that. So I think there's a continuum. Right? Some things like you and I just discussed, we're very frustrated about that video access, but we can put up with it for a longer period of time. Let's stack rank our priorities and think about things like—where now we have health care. There's demanding needs.

(Rob at 00:53:45) Maybe we can't wait, and we shouldn't wait, and we should demand more of the industry. And we're certainly thinking about that at Virtru. Right? We're working with a number of health care organizations enabling these type of things so that they can share way more freely, and it's happening. We're seeing it happen.

(Rob at 00:53:59) We're one solution. We're one part of the framework overall, but we are thinking about these exact problems.

(Joel Beasley at 00:54:06) That's exciting. And every time I get upset or frustrated, I go start researching it, and I always find out there's people way smarter than me already working on it for years. So that makes me feel comfortable.

(Rob at 00:54:17) Yeah. Well, don't you love being a part of the community, right, that's thinking about these things? And that's what gets me up every day. Right? Exactly.

(Joel Beasley at 00:54:25) Dude, I love it. Alright. Last question for you here as we wrap up. What are you learning from a leadership perspective right now? What are you learning as a leader?

(Rob at 00:54:33) Yeah. So I will tell you, I've always, you know, just throughout my career, really appreciated decentralization. Right? Not having to bring people to a location, work from home. It's always been something that I've always appreciated and to varying degrees of success in various places.

(Rob at 00:54:52) But I will tell you the last year and a half has allowed—is, you know, force is the wrong word. Right? We want to bring this forward, which is empowerment is key. Alignment of your key goals and vision and empowering your team. Like, you're there to give—you're there as a leader not to instruct or tell. Right? You're there to say, is what we're doing—the goals—clear, and do you have what you need fundamentally to achieve? I'm there to unblock the obstacles necessary for the team because I'm not solving everything. Right? There's no heroics in team innovation.

(Rob at 00:55:32) Right? There is simply leaders that are willing to empower the team that they genuinely believe are going to achieve the goals. Right? That is absolutely key. So in this era we live in today, which I hope to some degree we bring values out of this work from home environment instead of just forcing something back into it now that we are opening back up, is just more empathy at the end of the day.

(Rob at 00:55:56) Right? So everyone—you've heard the saying. Right? Like, you know, everyone you see is going through something you don't know about at the end of the day. Really having empathetic leadership in the future, I think, is really important.

(Rob at 00:56:08) It doesn't necessarily mean, you know, people kind of fundamentally don't understand the definitions of these things. Right? Doesn't mean necessarily that I have been through everything you've gone through. Right? But from an alignment perspective, understanding that I've given the team what, to the best of my ability, what they need to achieve the goal, and then understanding as a human being that you may or are going through something, providing that space for them to be able to convey that and taking an adjusted view of that performance is important.

(Rob at 00:56:40) Right. There is no black box here. This is not a one or zero. Right. And as a leader, I think those lessons of which we've used for a long time, you know, to a degree, it just takes a new priority, right, today.

(Rob at 00:56:54) And you see it. You see it in organizations today that are innovating at a faster pace than others. You're seeing the things I just said being made a priority inside organizations to achieve the outcomes organizationally they want to.

(Joel Beasley at 00:57:06) I love it. I love it. And what's the call to action as we wrap up? How can people learn more about Virtru?

(Rob at 00:57:13) Yeah. Well, I mean, so first off, our website, we have a developer platform, virtru.com. You can get to it all from there. Definitely come check us out. Check out our blog that's linked there as well.

(Rob at 00:57:23) You can certainly reach out to me directly, which we can include that in some of the notes afterward. But the call to action is to really think about what we talked about in the beginning, which is rethinking that historical decision for your technical stack and asking yourself, is this addressing the problems of today and tomorrow in an effective way, separating yourself from the budgetary pressures and the prioritization pressures that you're under from an InfoSec perspective. Those are going to exist. It's a balance always in organizations between profit and investment in the organization. Of course, that's true, but I urge everyone to really rethink that.

(Rob at 00:58:03) And if you do, I feel strongly that you will come to the conclusion to some degree or somewhere on the gradient that the data is the common denominator and that the way to future proof and decrease the overall budgetary burden long term is to start adopting data-centric approaches to your protection, both proactive and from a reactive mitigated perspective. A data-centric approach is really the solution that gives you some more future proofing.

(Joel Beasley at 00:58:31) Thank you so much for listening. And if you found this episode useful, please share it with a friend or colleague who you think would get value from it. And if you have topics that you'd like to hear discussed on the podcast, either add me on LinkedIn or send me an email [email protected]. Every time I get an email or LinkedIn message, it absolutely makes my day and inspires me to keep going.