Vinnie Liu, Bishop Fox | RSA Conference 2023

This is texturung TV. Hi everyone. We're back here at RSA.

It's Thursday last day of RSA. Actually, we're down to the final hours here. It's almost two o'clock.

I think things closed at three but we have some great interviews still ready to present to you. Our next one is right here. I want to introduce you to Vinnie Lou from Bishop Fox.

I think I got it, right if any yeah, welcome man. Nice to have you on Tech strong TV. Thanks Alan appreciate it.

So Before we jump into what we kind of wanted to cover. I think we need to give you've never been on Tech strung TV before. Let's let's give people a little sense of you know, your own personal Journey.

Yeah, so, you know kind of working, you know from the beginning a little bit. I've always been you know bit. Let me say good place to start to be.

Yeah, right that good place to start the story. I've been in offensive security my entire career. And before I was even doing it professionally I was I was doing it as a hobby and I've been doing it.

So let's let's stop right here and delve into this. When you say you were doing offensive security as a hobby. That's raccoons.

We're not doing anything silly like that, but What does one do when they do offensive security is a hobby? Um, you know, I was really I was really pretty early in the scene like bbs's scenes fracs very early days. And so there was a lot of learning there was a lot of just understanding what technology was and that's really, you know, when you're a young teenager, that's very exciting and you got a lot of you got a lot of freedom and our community there, you know, I had an interesting path in that I spent a lot of that time of my teenage years doing that spending time online spending time on IRC meeting other people who are interested in security and that led me to After High School join a program at the National Security Agency where we went to work for them essentially and I did that for a couple of years, you know after some time.

I realize I wanted to finish my degree, so I went and finished my degree wound up doing consulting work. Pen testing work on the corporate side as well and eventually wound up starting Bishop Fox when I was 23. Wow, and we've been working we've been doing and I have been doing offensive security for the past.

18 years with Bishop Fox and that's really what we do all we do and what that means. It's it's red teaming. It's tearing apart source code.

It's breaking down products and finding vulnerabilities. And that's what we do and and over those 18 years. We've actually built up one of the largest concentrations of privately held offensive security talent in the world outside of you know, nation states and right.

Yeah, so you're not the NSA but that's fascinating right man, if you don't mind me asking You have obviously in the US where where in the US I actually grew up in, Kentucky. Really? Yes a hot bed of offense.

Yeah, very exactly the great hackers come from Kentucky. Yeah that and thoroughbreds. Okay.

Yeah bourbon. Yeah time it was tobacco and horses, right? Okay.

Yeah, right Bourbon and horse, right? Yeah. There's an argument to be made.

That's a huge Improvement. Yeah. Yeah.

Yeah, but that's a great. What a great great story, man and If you don't mind me asking and if it's classified, we won't touch it. But at what age did you start working for the NSA?

I was 17. I was 17 my parents had to sign a waiver. Because I was still a minor but yeah, I know I get it was eight.

I was really passionate about it. And I think they understood that and so they they Let me go again. If you don't mind me asking did they come to you or you came to them?

Yes, I mean, yeah, it's interesting. So they had this program and we didn't know about each other but kind of my formidable years as a teenager. I spent on IRC and I met a lot of people I met a lot of friends and to this day.

I've never met the gentleman who your life in real life and I but you know, we got to know each other we were friends and he was actually in the Air Force and I'm assuming in some way working with the agency because he was aware of the program and as over the years as I was starting to think about going to college or what I would do when I graduated from my school. He he said look there's this program. I'm gonna put you in touch.

I want I want you to really consider this and that's how I found them or they found me in a way it was somebody who was Building a weird connection with some you know, 16 17 year old. He never met before and well the obviously saw something though, right? It's wonderful, man.

That's great. Thanks, you know I I wasn't always doing this. I I co-founded some security companies and we did some work with some of the agencies including an essay.

I love that age. Yeah, I thought the people there in spite of what you may hear. Yeah.

I always had nothing but respect and they were good customers. So yeah, incredibly Mission driven. Oh, yeah, I mean but tight I mean because we It's 20 years.

I could probably talk about it almost but you know, we were selling to a lot of agencies a lot of air bases in Colorado. That weren't on the map. You know.

Yeah, and and we were secure facility. Yeah that's on you know. There are a lot of idiots we dealt with in the arm, especially on especially on the dod side.

Yeah. You know, we we helped secure like the largest kind of private Network in the continental US. For well, it's One Armed Force but they have to Pieces.

Yeah, that's what I'm good. I'm picking up all your friends. Yeah.

A bigger bunch of buffoons. I've never met in my life. I used to boggled by mine how we weren't.

First of all how we relied on them for war fight. I guess they were good warfighters, but how that Network. Wasn't swiss cheese.

Yeah, I I you know, I it was like boggling what went on there, but that being said very different at the NSA. So that's great now. I think for most of our audience out here when we when we think about.

Offensive security. We think about things like penetration testing. Yeah.

social engineering stuff like that. We don't think of like Well, we maybe we do recently right you hear Mossad stories and and the the iPhone cracking and all of this stuff. Yeah.

That's not let's just be clear. And by the way, when you talk to our audience, right? It's on this camera.

That's not what you guys so you guys are doing more of the traditional fantastic and social engineering kind of stuff with an eye towards helping companies hard in there. Network after infrastructure they're out. Yeah, I would I would frame it this way and that our technical capability is pretty deep.

There's a significant portion of our Packers are our researchers or our testers that come from government intelligence like myself, right or You know wrote tools that other people use even to this day, right? Like, you know, I was I was a, you know, early contributor to Medicine. Interpreter module's exploits for meta split back when it was written in Pearl.

Right like real real. Yeah, okay, um other folks that that, you know wrote a lot of the scanning engines and testing tools, you know, that that people still use today and on the agency and Military side a lot of folks that wrote some of the crazy Attacks and exploits that you've definitely read about at some point but we use it in a way that's very different is we're not trying to build implants for an iPhone to spy on a dissident or whatever like that that is just for us for boating right I think coming out of the agency and coming out of the NSA and and and and the military and other related organizations. You do come out with a sense of purpose in a sense of mission and our organization is incredibly so like that's why we've been around for 18 years.

com. Absolutely. Maybe not today maybe but at some point you're gonna have to explain to me the Genesis.

Absolutely. Okay. Well, we'll make a date.

All right. Let's talk about news though here at RSA if it's okay. Sure.

What do we got? You know, I think I think on from our front just kind of talking about Bishop Fox. We recently announced our expansion into the UK and that's really exciting for us because we've predominantly been serving Enterprise customers that were us-based or multinational or headquartered in the US but we've always had relationships and deep long-standing friendships with not only are our fellow Bishop Fox employees that are in the EU and in the UK and internationally, but now we get to now we get to really push into that market and actually expand, you know, the impact of what we're doing to that to that region as well and the UK is what we hope will be the beginning of a larger growth effort into Europe.

Well, you know, I mean it's post-brexit obviously now, right because at one point it was very easy to say I'm gonna go to the UK and that's my EU right beachhead, right? It still is an EU Beach head whether they're in the EU or not. It's incredibly easy to hop.

From UK into France Germany Netherlands Belgium. Yeah. Nordic countries, what have you So I would assume that it it's not just UK right?

It was yeah, so for us it's sort of You know, we're going to iteratively kind of expand our presence there. We felt like the UK was the one where we had strongest relationships. We have a lot of special relationship exactly, you know, so here there it makes fun of sense.

Yeah. It was just a lot more convenient when it was you. It was a lot more convenient.

Yeah. I mean, you know, we have we actually have a EU headquarters in Barcelona that I just oh that's and that's where that is how we employ Talent from Europe. That's how we engage with European customers, but for our go to market motion the UK was the one that kind of naturally made the most you think there's more business there.

So look if I had the choice, I'd go to Barcelona too. Yeah. Over London's weather.

Oh look at that you You know real presence a real office employees the whole. Yeah office. We're still working on but you know, I think oh, there's no world.

It's yeah, you know, that's not the prerequisite. It's really being able to deliver and have the ability to engage with our customers in that in that region actually. Um, well I would say that the other thing that really stands out to me is I feel like the conference has been kind of a different level this year.

The number of people the excitement the buzz is definitely back it's back. It's absolutely yeah. It is bad.

I don't know what you hear last year. I was I was little everyone was still a little on edge rightfully. So I brought 12 people from my team out here six of them had covid when we went home.

So wow. Yeah. Yeah it was rightly.

So I you know, I I thought long and hard about this year. Yeah, but I'm glad we came and It is I I think there's a few reasons for the one is yes covid's in there. Wherever you I came from Amsterdam here from kubecon.

Oh wow, and keep calm was sold out with a 2000 person waiting list because they Captain are you saying the same level of elevation other conferences? Yeah. Yeah.

Well, you can't do this one. Yeah. Okay.

Okay others not as much but these two certainly I think another reason is that security is just you know, I've been security 25 plus years. Yeah, and we always thought it was important. We always said it was yeah, but it really is important.

No, no, not everybody also or is willing to say, yeah. I think it's important. Yeah, and that and that's great.

and the other thing is You know security relatively speaking is kind of insulated from economic. Uncertainty. Yeah, right because Good Times bad times.

You need to be doing security. Yeah, and and so I think in a in a choppy economy people will gravitate to this because they're still gonna have budget right we're gonna have projects. And we always need new security innovation.

Right? I mean, I think the demand is definitely still there. What I would say is like when I talked to a lot of other CEOs and bankers and you know investors and things like that, we know the demand is still there.

We know the market still has a lot of room to grow. Yup. But what a lot of people are thinking about is okay.

How do I how do I navigate and how do I adapt to the situation and it's a lot of that and and you know my own personal opinion. Is that still got a grind you still gotta grind it doesn't change that. I yeah, it's a grind.

Yeah you guys this is the Yeah, I've been through. Multiple Cycles. Yeah, and this is this is this is life, right?

You got to grind you those down times and ride them up, you know last 25 years. You gotta be able to ride the roller coaster three of them. Yeah at least like that.

Yeah, the real question is how long is it? So things start turning up depending who you talk to? They're turning up already.

They're turning up this summer. They're yeah turn up till January. Who knows?

Well, I don't think Janet Yellen knows or Jerome Powell. So I'm not gonna make an auditions. Yeah.

Well you can do is you grind you grind through them. What can you control? That's all you right.

That's exactly it. Hey, what else do we have coming out of Bishop Fox anything else exciting? Well, I would say that one of the things that has been really exciting is our recent fundraising, you know, it's not maybe it's maybe six months or so since we kind of with rounded out our Series be but what's interesting about that is we have been able to develop a technology platform that allows our testers to scale.

We think of it as an Iron Man suit for our testing and offensive Security Services to be able to deliver a continuous. highly Tech enabled offensive security solution for our customers and it's the it's an exceptionally well in the Enterprise, especially with financial institutions because they're seeing the results from it and I'm really excited to see how we continue to develop that over the next 12 months and you know, you know, it's interesting about it is look a lot of offensive security firms are And I don't mean to derogatorily but their body shots. Oh, absolutely.

Oh, yeah and VCS. Don't dig that model, right because they're not gonna get the 10x they're looking for when we try to raise our series a we got a lot of like no thanks a lot of doors slammed in our face because we were proposing to be a consulting company that was gonna develop technology and they'd seen a lot of the dead bodies trying to walk through that Minefield already and just when you have the technology develop into a different one, it's a different company exactly. See that model too.

Yeah, so that's great. That's a testament to to your success. Keep grinding.

That's exactly it. Hey, if you're gonna remember just one thing keep grinding, right and that's great advice. I don't care what business you're in it.

It's true. Especially younger people out there who you know, you don't start off not everyone graduates college and starts their own firm as president. You got to keep grinding.

Vinny thank you so much man. Thank you coming out of me on that's the block with best of continued luck and success with Bishop Fox. We're gonna take a break.

I think we've got maybe just one more interview and then we're gonna wrap up today. Thanks a lot everyone. Have a great day.