Chris Wingfield on the Weaponization of Executive Personal Data

This is Textron tv. Hi everyone. Welcome back here to Textron tv.

I've got a first time guest at a new company to introduce you to here on Textron. Today, I wanna say hi to Chris Wingfield. Chris is senior VP for Innovations at a company called 360 Privacy.

Hey Chris, welcome to Tech Drunk tv. It's great to have you on here. Yeah, thanks Alan.

Appreciate the time. Looking forward to our discussion. Excellent, man.

So, you know, we're gonna talk 360 privacy and what you guys do, but before we do that, I thought we'd spend a minute or two kinda talking about you. Right? Perfect.

SVP of Innovations. That's not a title I hear every day. How'd you get here?

What did, what did, what'd you have to know? Who'd you have to kill? What, you know, how, how, how does that all work?

Yeah. Well, some of that stuff's gonna be secret out, but you know, I'll give you the gist. Uh, so, Okay, Obviously my name's Chris.

My background, um, before 360, I was a digital targeter for the government. Uh, so I was a member of the intelligence community. I was embedded within Special Operations Command.

And what that afforded me really was the best balance between tactical intelligence experience and strategic intelligence. Meaning I was there on the ground doing the intelligence function, but I was also helping meet, you know, strategic national level initiatives. Um, I started on the linguistic side of the house.

I studied various international languages. I then moved over to the signals intelligence side of the house, which is dig digital targeting of anything with a signal. So thank phones, thank radios, things of that nature.

Uh, I spent a lot of time around the world, uh, in that capacity. And then three years ago, uh, got out of the government space, moved back to the Northeast where I'm originally from, and I came to work at 360 Privacy. Um, the innovation piece is interesting, right?

Because I actually started as the director of Cyber Threat Intelligence. The purpose of that was, let me take all of the, the lessons I learned, the experience I had from the intelligence community. I know how to target people.

Let's target ultra high net worth individuals, executives identify points of exploitation so that 360 can provide remediation and mitigation solutions for those points. So really it's to help these executives live a little bit more of a normal life because they're not really afforded that because of their position. Now, because of my background targeting people, I like to stay agile as this is tax surface continues to grow.

So how I would target people continues to change, which means that we have to innovate through that. So having a domain driven design is not engineer driven, it's not product driven, it's domain driven, meaning as the domain changes, we have to change how we attack that problem set. And the stories you could probably tell if you were allowed to tell 'em.

Huh? Yeah, absolutely. I've seen a lot of the World.

Where, where in the northeast are you? Uh, so greater Manhattan area. All right, I was just there this weekend.

I would've loved to grab a couple beers and, and get some, some real skinny, but next time, I'm gonna put you on my list next time. So Chris, let's, let's talk 360. Awesome.

Privacy. Yeah. So 360, uh, had an interesting start.

Uh, you're gonna start seeing a common theme. Um, the CEO and founder was a former member of the special operations community. Um, and you see that throughout the company, really, a lot of the beginning pieces of this company were special operations, community and intelligence community.

Uh, some corporate security individuals that were in charge of the physical security for some of the most prolific, you know, ultra high net worth people in the world that were clients of three sixty's before they came to work for 360 because they believed in what 360 was doing. They believed in the solution. But really how it started was the founder, uh, got out of the special operations community, was looking to do a physical security gig with Digital Flare, is kind of how we talk about it.

Um, but what he found within the country music theme, because the headquarters of 360 is in Nashville, um, he started to see that a lot of these physical threats were coming from a digital space. So what that turned into was, um, one of the most prolific, uh, country music stars, uh, of the last several decades. Unfortunately, you know, his bank account was taken over, his children were receiving text messages from his phone number that was spoofed.

So our CEO at the time, this was before 360, really jumped to see, hey, like can I identify a who this person is? But the most important question was sitting down with the individual to say, how did you do this? Right?

So we found out it was a, you know, 20 something year old young female living in a trailer in the middle, in the mid east somewhere stalk, and that's right, exactly. Uh, somebody that had internet connection and she started to show him, Hey, like I was getting this through these people search sites. I was getting this through Google searches, things of that nature.

So what he realized was, oh, maybe I can provide a solution to this. So he would go, he would delete this data. Two days later, the data was back.

So he realized, oh, this has to be a continuous scanning for this data. And so really that was the beginning. You know how we became 360 privacy today and we went from the country music scene, which we still have a lot of people there, but over to, you know, ultra high net worth individuals.

Uh, you know, we have some Fortune 10 companies, uh, up to the Fortune 2000 companies, a lot of celebrities, a lot of professional athletes. And really the whole purpose of it is purpose. We look at you as this is your attack surface.

So 360 is an attack surface reduction company. So if you take you Alan, right, like through through a Google search, maybe I can find some PII of Alan. So now this is part of your attack surface and there's people search sites that have data about you.

There's dark web data. Well, the beauty of what we do is we try to look at each of those as one holistic issue. And if we can start reducing that, we make you a harder target.

We make you harder to find, is what I tell clients is you're always one Google search away from someone turning a digital threat into a physical threat. And so 360 wants to reduce that visibility so that what they see on Google is your LinkedIn, your company, the podcasts that you do, the webinars that you do, but they don't want, you don't need to see your physical address, your phone number, your relatives and things of that nature. We live in interesting times though, right?

We do. I mean, I think everyone out here watching has probably gotten at least three letters in the mail this past year that they were the victims of a breach. Their PII was stored at Take Your Pick company.

I mean, I know personally, you know, there's things like Life Flock and I, I used something with Experian where they're always telling me, you know, where I am on these people finder sites and trying to, and you it is, it's a whack-a-mole game. The people finders a whack-a-mole man. But more ominous was, you know, I got, I remember, so I have a boat and the place I bought the boat from was a data breach.

And they sent me a scary email that, I mean they got ev they took social security numbers, addresses, everything, and they were nice enough to offer me a year of credit monitoring goes, that's good, whatever. That was really nice. Um, that was nice of them, right?

And um, so I mean for so many of us, not even, you know, VIP people we're up the creek or not the Paddle. We are all just one search away from, from Rub. Now some of us have more to lose than others, but you know, Chris, another lesson I learned in, I've been in security 25 plus years.

Another lesson I learned in security is unfortunately people don't get religion until, until you know something bad happens. Right? Then all of a sudden they're big believers.

That's they're big believers. That's right. Um, so yeah, it's kind of chicken and eggy kind of stuff.

360 privacy. Do most of your customers come to you after they maybe have had an incident? Or are they being proactive now?

'cause people are smarter. So I'd say it, it was a mix, right? I'd say in early 20 24, 20 23, late 2022, a lot of it was probably post-incident Alan, right?

Like, but I do believe now that because you know, if somebody goes to Google right now and you search just first name, last name, city State, and then just type the words home address, you're gonna start seeing white pages and bin verified and re and all these people search sites come up. So I believe that the situational awareness level has raised so much to where now people are more proactively reaching out about solutions, um, reputationally, right? Like if you have people in the Fortune 10 to the Fortune 2000, all of a sudden if you're a good solution, people are gonna say, Hey, like use 360 privacy for this because it's all about a risk-based approach, right Alan?

'cause you said, you know, everybody has something else to lose, right? A thousand dollars from an ultra high net worth executive isn't that much, but a thousand dollars from an everyday person may be a huge impact to their daily life. And what I tell clients is, you know, just because you're not on social media, like the largest data brokers or the credit bureaus and everybody has credit scores, so we're all affected by this problem.

And 360 tries to look at this as a multi-layered approach of, you know, I can't go to a credential data set like Axio or LexisNexis and tell them I want you to delete my data, but I can go there and say, I want you to opt me out of the sale of that information. Right? So what that does is hopefully will slow down that, you know, trickle downstream to these people's search sites.

So you want to hit it from the top of the funnel. You want to hit as many people search sites as you can. But honestly, visibility is the most important part.

Allen. Like if somebody could find you on Google or a Bing search, it doesn't matter if I removed you from 10 million websites. 'cause if you're still coming up on Google only takes one.

It only takes one. That's right. So the problem said is very optimal, is very agile.

We have to continue to evolve with space to stay relevant and to keep people safe. Sure. So Chris, one of the, you know, in my time in security, as I said, 25 plus years, one of the big things certainly over the last 10 to 15 years has been, uh, a little bit of a change in focus.

A little bit of a change in emphasis from pure prevention to response, right? So I'm not saying don't try to prevent these things, right? You play the whack-a-mole game, you do what you can to minimize your, your attack surface, as you said, your profile online.

But stuff happens. Does 360 privacy help once that stuff has happened? How do and if so, how?

Yeah, that's, that's a great question. So, you know, I like it is a whack-a-mole game, but unfortunately some of these moles could be remediated and a lot of them can only be mitigated, right? Because say like national public data breach in August 272 million unique social security numbers, right?

Like, can we remove that data from dark web after it? It's like absolutely not, right? But are there actual tangible mitigation steps that we can take to better protect a principle, right?

And that's where 360 is different. We're not so much a consumer level option. We're much more, you know, white glove concierge level option.

Because after that happened, within 24 hours, we reached out to over 700 clients to say, Hey, this is what happened. This was the data and this is actually the tangible steps you can take. We got on calls, we shared our screen because some of our clients, they don't know what a credit freeze is, right?

So let's walk you through that. Well, I'm buying real estate right now, or, you know, I can't freeze my credit because of X, Y, or Z. No problem.

Secondary option. Let's set up a fraud alert. So then we at least start adding layers of protection.

So the answer to your question now is yes, because I can never get you to a zero. And if somebody promises that you're gonna be a zero in the digital landscape in 2025, like it's completely erroneous because it's evolving so quickly. These data brokers repopulate data every single day, right?

And then the next data breach happens, all of a sudden your social security number is out there. So it's all about remediating what we can, mitigating everything else and just making you as hard a target as possible. 'cause Alan, if you have an LLC with your home address and your name on it, 360, can't change that for you.

But we know lawyers and we know how to help you and we can guide you through a process to put that into a blind trust. You know, there's a lot of different ways that we can mitigate issues from that. It's all about, uh, cutting the connections between different data points.

Because as long as we can start start making those harder targets, the lower level threat actors are not gonna be able to connect those pieces. Absolutely, man, I, I would love to see us move, just move away from social security numbers as a personal identifier to tell you the truth. 'cause I, I do think at this point in the game, that's pretty useless with, with all of the I agree breaches that we've had there.

I don't know if you want to talk about this, Chris, but like what is a, a white glove concierge kind of service like this cost, uh, uh, an individual or an organization? Yeah, Yeah, that's fine. I mean, obviously depending on the size of the contract and the quantity, obviously there's gonna be discounts of volume.

But typically our base package is $5,250 a year. Uh, that's an annual subscription. Um, and a lot of that is just to say, you know, the work that goes into it because you're speaking to people that have done this, right?

And like, that's why I'm very big on the domain driven approach to, you know, product and engineering because this isn't people or engineers that saw a problem, don't understand the core of the issue and just try to create automation around it. Because to automate something, we need to understand how to make it in the first place and then replicate that through a manual to automated framework. And so you're dealing with people that have targeted before they understand how people are being targeted and then the network space to make sure that goes there.

So really it's the daily cadence. You look at consumer level options, they're typically going every month, every quarter. Issues with that is, you know, last month we had a data broker dump every profile 360 had ever removed from our entire database, right?

For all of our clients. We picked it up immediately and we deleted those immediately, right? Like that was our whole game plan.

But if you're on a, a monthly even, you know, that may be out there for 29 days. And that one website had all the city and states you've ever lived in all your relative names and your first, middle, last full name, right? So, and this is on a free data broker.

This wasn't behind a paywall, et cetera. So it's all about understanding the game. These data brokers, people search sites specifically, they're gonna pop up every day arguably, right?

And they may be downstream of another one, but that doesn't mean that if you removed from upstream that it removed from downstream. There's just a lot to that concierge level. Oh, there's certainly, and, and I, and look, the fact of the matter is doing that is probably beyond the scope of what most people are comfortable being able to do, right?

That's right. And it is what it is. Chris, I don't think we mentioned the website for 360 Privacy.

Yep. io. Yep.

IO fantastic. I All right. Hey Chris, thanks for coming on here and telling us about this.

I, I, you know, this is a problem. Yeah. It's, you know, my father-in-law rest his soul.

He always used to say, rich report, it's nice to have money. And you know, if you're a high worth individual or someone with the, the means you, you become a bigger target. There's a bigger target on your back is the fact.

And if you, you know, you, you can engage a company like 360 privacy, but quite frankly, at five KA year or thereabouts, you know, there's a lot of people who might want to consider that going beyond, you know, the consumer level LifeLocks and, and stuff like that. Um, keep up the great work, man. We'd love to have you on and, you know, and hear it's kinda real life stories of what's going on out there.

'cause this is a, it's, it's a crazy world we live in, man. Just crazy. It's, yeah.

Thanks for having me on a, I appreciate it. My pleasure. Chris Wingfield, senior VP Innovations at 360 Privacy here on Techstrong tv.

We're gonna take a break. We'll be back with more.