Charlotte Baker, Digital Hands | Black Hat USA 2023

This is Textron tv. This is Shear Rubinoff here at Black Hat Coming at You live. I'm here with Charlotte Baker, c e o of Digital Hands.

Charlotte, it's such a pleasure to see you again. So nice to see you. Thanks for having me for this conversation.

Pleasure, Charlotte. So can you please introduce yourself to our audience? Tell them who you are, and besides being c e o, what you do for Digital Hands?

Well, um, my name is Charlotte Baker. I'm the co-founder and c e o of Digital Hands and, uh, love service design in the cybersecurity industry. And, uh, have, uh, run this company for about two decades.

Amazing. So let's dive deeper into that. Please tell us about Digital Hands, the journey of Digital Hands, how long you've been around, and the most important things we should know, really about your company.

Well, as I mentioned, uh, two decades, uh, we're one of the oldest in the industry. Amazing. And, um, we were started, uh, 45 days after September the 11th.

Not the best time to start a company. Wow. Um, for a couple of years, we couldn't give it away.

Um, in the early days we private labeled for large organizations. Mm-hmm. Um, and that was at a time when cybersecurity was really a component of it.

And so back then it was all about software, hardware platforms, uh, keeping them up and running and available for work. Uh, so it was about performance and availability. And over time the industry has morphed and we morphed along with it.

Excellent. So what specifically does Digital Hands do and who are some of your clients who would need to utilize digital hands? So the space that we occupy, I guess you would say is the M S S P space.

Okay. Um, but truly the space that we occupy in the hearts and the minds of our customers is really around, um, effectively staffing for, uh, detection and response and remediation. Uh, so we solved the labor problem and, um, in doing so, we, uh, focus on large enterprises.

Typically, we had been with large enterprises due to our channel partner and private label, uh, partnerships. Mm-hmm. Um, and over time, uh, we have found ways through technology to be able to scale in order to capture market share in the areas where customers may be earlier on in their journey than the larger organizations.

And so over time, you know, you think about who needs us and why, it's people who care about their data. We have a fundamental belief around, uh, organizations have the right to operate their businesses and their enterprises without the fear of extortion, theft, um, and, and, and brand damage. And so we are the specialists that do that.

We go deep and, um, bring the skillset to the table, um, to help in a, in a market where labor is very scant. 4 million worldwide and, um, about 700,000 in, in North America alone of jobs that are going on field unfilled. And so, um, we, we hit that space and always have, we've always been, uh, in the services industry.

Oh, That's very important. They say that there's a lack of talent in order to fill jobs that are needed. But then we talk about very mature companies and companies that may not be as mature, the different levels of companies and their, you know, growth and, and and size and wherever that may be.

And the larger companies or the more mature companies would feel, yes, we're targets, but maybe the less mature companies may feel, well, you know what, there's bigger fish to fry. What do we really need around this? How do we really need to protect ourselves?

We're, you know, there's better companies to target. What would you say to somebody who would say that to you? Everyone's a target.

Yes. Absolutely. Everyone is a target.

Yeah. Um, some of the smaller companies, especially in the supply chain, uh, for the federal government or for larger organizations, our targets as back doors, um, everyone is a target, but everyone does have a different stage of their maturity and understanding. Um, some companies wanna check boxes for compliancy, um, and they think that, you know, cyber's kind of a side benefit to that.

Others are full blown into it. Um, understanding where the attacks are coming from. I think it's interesting that the, originally when we started the company, we were doing private label deals, um, with some of the largest brands, uh, in the cyber tech industry.

Um, then we morphed to, to work for some of the sis and we would always get the very difficult cases. And I would laugh and say, you know, we can do the easy stuff too, you know, but we would get the weird stuff, you know, trying to make, explain Some of the weird stuff. Uh, weird stuff would be trying to make some of the newest technologies work.

And so our sustainable competitive advantage has always been, uh, taking a look at the newer technologies and putting a service wrapper around it. And that would solve the problem both for the people that we private labeled for that didn't wanna spin up a group to support the new technology as well as the customers that were buying the new technology. That said, I don't have the staff that's trained for this.

And so some of the more esoteric brands have, um, actually already been morphed and bought by other larger brands. But usually it was a first to market advantage with a newer technology with some of the first and early adopters of those technologies. Um, over time, you know, I would say that we still do some of the esoteric stuff.

Mm-hmm. Some of the custom and bespoke service design for large organizations. Interesting.

But because we've honed ourselves over two decades on that particular sector, we've been able to take, um, some of the lessons and some of the, the shortcuts and some of the systems and scale them to the point where if an organization is earlier on in their maturity cycle, we have prescriptive packages. So regardless of size, you know, the larger ones will come to us for bespoke operations and integrations, completely integrating our back office with theirs, right. So that we're a very visible extension to them.

Um, others will come and say, uh, I'm a new ciso, or I'm a new director of security and we're starting over again. And we will come to them with a prescribed package that says, you know, here is the minimum required to play and start them off on a cyber journey. That over time, um, morphs and, and uh, increases in its, um, prowess based on budget.

I think that is such a critical element that you're filling. Certainly the less mature companies are able to really know where to start and start off. Right.

And not kind of pushing it to the side and saying, we really don't need this, but they can grow with you. They can grow in their cyber posture within their organizations and their security could grow along with it if they incept it from the beginning. And there's never a late time to start.

Right. Anyone can come at any time. Anyone can come at any time.

And in fact, you know, the one philosophy that we have is one size fits one, there is no such thing as one size fits all. Yeah. And so one of the things we bring to the table is the expertise and the skillset to run operations teams to to, to deal with whatever legacy, um, devices and whatever legacy infrastructure you bring to us.

Mm-hmm. And so we do have our favorite picks for, you know, if you're gonna let us subscribe to which technologies to use, we do have our favorites, um, that we, we've honed and we've integrated for, for very, um, fast orchestration and response, but we can take, we call it wio, W I t a walk in take, w i t o walk in takeover. Yes.

And that allows people to bring their legacy, not rip and replace and to integrate with some of the newer technologies. The, the concept, um, of some of the newer, uh, entrance into the space is that they standardize, uh, they let the equipment, they let the software do the work, and then, you know, they're, they're wed to that particular set. Mm-hmm.

Uh, we are the ones that would come in and say, okay, even as a smaller organization, you know, what, what is the bespoke offering that we need to integrate? What do we need to integrate into our systems and into our solutions? And all of these cells are custom scopes of work.

Great. Uh, regardless of the size of the organization. Well, Let's say an organization has some legacy systems and they want to migrate out into newer solutions as well.

Is that something you could help them with and keep that cyber, you know, stuff that they need around it and wrapped around it ongoing while this situation is occurring? Yes. In fact, some organizations, um, some Fortune big ones Yeah.

Have used us exactly for that purpose, right? They have known that they wanted to migrate, they have known that they wanted, for example, a three year contract and then they would take it over in house. And so we look like a transition team in those cases.

Um, and then they bring us back in periodically, uh, to assist. And so, um, the flexibility, I would say is one of the, the, the superpowers that we have. And it's afforded by, again, two decades of doing this very mature systems.

Um, we have twice the tenure of our, our employees as, as the rest of the industry and, uh, have, uh, quite the creative expertise. We actually have a room called What Works. Oh yeah.

Um, we've had it since 2001 and no matter where we've moved, uh, the what works room is where you go in and you take off your functional hats and you whiteboard and you figure out what works for a particular customer. And, um, it results in some pretty, uh, industry, uh, winning, um, strategies that, that get us awards. Well, it sounds like you hit the nail on the head in one of the areas as well as the digital transformation across the organization.

From the C-level perspective, you're talking about operations ongoing, continuous, you can't really slow down then the ciso, the c I o saying updated security and patching and whatever's going on. But how do those go hand in hand when they need to be incentivized the same way? And it sounds like you really provide that service around it to keep operations going, to keep it secure all at once.

And that, I think is something that organizations could look at when they're trying to implement the digital transformation across the organization and have the, the different folks work hand in hand together because people aren't siloed anymore. Different types of roles are not siloed and cannot be in order to have a secure, uh, atmosphere within the organization. So I think that's just an extra layer of something you provide without even saying.

So it's just, uh, it's, it's something very much needed. It that that's very true. And, you know, organizations are morphing at very, uh, fast rates and the days are gone where you would have a, a three year contract and say, this is what we're in and this is only what we're doing.

Yeah. Um, I think the, the most successful partners to organizations in CISOs are the ones that say, okay, here's where you are today. What you're going to need is gonna change over 36 months and let's plan for that now.

Hit the milestones. Make the changes. And the prices are not, uh, on a nickel and dime basis of, you know, that's an hourly rate.

This is an hourly rate. Sure. You look at the partnership, you say, this is how we're in it with you to win.

And, um, you help them through the transition and instead of dealing with multiple contracts and a termination fees and things like that, it's a contract for the digital transformation and for the security maturity journey. And you're in it with your customers. Wow.

That's so important. And I think you really hit the nail on the head in many different areas when it, when it evolves to this specific space. So if you could talk to our audience for a moment and say, here we are, digital hands, this is why you need us.

What would you say in a concise way to our audience they could really understand, you know, from everything you said, why they need to look at digital hands and see that they need to implement your solution? I think looking at digital hands is all about saying, I need something different than what's in the marketplace today. I don't wanna be sold to, um, there's too much technology, uh, chasing the dollars I need to maximize my return on my security investment.

And I'd like to look to digital hands in order to help me look at that strategy. Um, we're not just there to sell services. Uh, we don't have a resale arm.

We don't have a vested interest in selling you software or hardware. And I think as true partners, we bring that business solution to the table where we say, maximum return on your security dollar and what's not needed and, and where are the highest priorities for you. And, um, with no ax to grind as to what the manufacturer or what the solution is or whether or not you keep your solutions or you buy new infrastructure.

Certainly. And I I, I love what you said, there's no one size fits all, you know, a lot of different solutions out there. It's, you gotta fit our profile in order to use us and you really understand the marketplace and understand companies from less mature to more mature.

They have different needs, different budgets and different ways that they also wanna face their global audience, but also internally. So I think that's very critical as well. So anything you want to let our audience know or leave our audience with around, you know, the cybersecurity world as a whole.

You've come from a wealth of knowledge, your career is so impressive and you've really made a mark in the space of cybersecurity. Is there anything you wanna leave our audience with today? I think we've covered most of it in this, this introductory conversation and I really appreciate your time and, um, looking forward to more conversations in the future.

Okay. Thank you Charlotte. And it's my absolute pleasure and I look forward to speaking to you again soon.

And folks at Black Hat, we will continue streaming live shortly. We'll be back with more interviews. Thank you.