How to Start a Business as a Cyber Security Professional

wonderful this has been a whole lot of fun to watch uh the the magic happen this is a pretty dang cool all right so what we're going to talk about for the next little while is a little bit about business this talk is meant for two types of human beings being wants to start a company and the other kind of human being is someone who wants to understand how business works so we know why we're doing all this security stuff all these security controls what are they doing why are they important to business so at the end of this you'll either be super inspired and you go start your own company or at least you'll know

how to justify some of the stuff we do in security um to other adult human beings so cool let's do it so let's start with the who the hell am i why should you listen slide so i think it's real important to get this out of the way i am ruggedly handsome and i will be quoting my sources that one's my wife she thinks i'm awesome i've done three years as the scholar in residence for cyber security research at clemson university which means i had the opportunity to write a whole bunch of books that my mother bought and nobody else did so fantastic um two years as entrepreneur in residence at clemson university i'm the acting entrepreneur in residence

at the college of charleston that means i show up and i help the mba students uh launch businesses and think through what they are trying to do uh 20 years in cyber security um got started with y2k you are welcome um i take all the credit i deserve i've coached about 100 plus business owners over those last 20 years 17 years as a business owner entrepreneur with over 21 companies launched and 17 turned into giant dumpster fires so good t good on me but here's my favorite thing in 2018 i got to uh now 2019 i got to talk trash to the 2018 nobel peace prize winner on a volleyball court beach volleyball court and he

threatened my life it was a lot of fun but let's do this so why do people start businesses usually it starts with a call to adventure it's a call to something there's some catalyst that has happened that means the normal world is no longer the place you want to be and it's time to move on to something different uh this could be a traumatic life experience it could be just something that pisses you off but usually my experience has been that it's typically something that um causes frustration and so let me walk you through my trigger because when this thing happens it's kind of nice to know that oh maybe i should take this seriously this is an

important trigger important thing so back in the day i worked for ibm i was one of those road warriors who spent three years on the road my best friends were flight attendants and hotel staff and i was doing a contract for lockheed martin the u.s air force we were standing up disaster recovery infrastructure uh further access and identity management environments um which meant i had to go to montgomery alabama quite a bit and i don't know if you've ever been there but that airport when i was there was absolutely horrible it was in the middle of a refurbishing they were rebuilding everything there was no no bars were open no wi-fi no restaurants and i was there for 18

hours and i just sat there um i had a legal pad out and i wrote over and over and over again i'll never do this for anyone else i'll never do this for anyone else that was my triggering point i had to get off the road because when i got home after these three years with ibm every time i got home my golden retriever growled at me and at one point in time the golden retriever was so angry it peed all over one of my couches when i got home just to show me how displeased she was and i have to tell you this if you have decided to live a life where your golden retriever is angry and

hates you then you've made some bad life decisions well i got lucky enough that one of my buddies was a director of cyber security at a large corporation and he was currently contracting with ibm where i was the consultant he said hey why don't you leave ibm start your own business and i gotta win because um i'll you can charge me less than ibm and you'll get a win because you can get off the road and you can stay home for a little while well i thought that was great but there's a problem there's this thing called conflict of interest so i had to go to my manager and i had to say hey um

i'm thinking that i can really take care of our customers better if i had my own company and i wasn't with ibm anymore and i was really prepared for a big fight i was prepared for this guy to say no you're never going to be able to do this the giant ibm monolith is going to crush you and but what he said was whoa cool man i've always wanted to start my own company as well but i've never done it and so we're going to come back to that statement because to me that is the most important thing of this whole story it isn't necessary that i had a trigger but it's that this guy never followed

his trigger so i went through i built a company i called it palmetto security group um about 13 years later a dutch company bought me i went from one employee doing identity and access management to 21 nerds doing identity and access management and i won the game hooray hooray uh way to go adam but again like i said that's not the most important uh point of that whole thing where i want to dive into is i've always wanted to start my own company and i really began to think why in the world didn't he why don't people start companies i know why people do want to start companies these are all the things they say they

want right freedom uh time control really all that stuff but what they're really saying is freedom freedom freedom right they want control over time money and autonomy meaning they have the ability to work on what they want to work when they want to work and they want to make the money they want to make without somebody else telling them what to do right and so when i was with ibm i didn't have any of that and i was very dedicated to the next time i did this when i left ibm i was going to build a company where i had the ability to do this and so did all my employees but why didn't he do it why don't most

of us do it and there's really three key reasons the first is we tell ourselves we don't have the time or we don't have the security financial security support etc etc to go and do something else or we see an opportunity that we are very interested in but we don't know if it's a real one and we really don't know the next steps because business is daunting and most of us have absolutely no idea where to begin and i will tell you that this is super important because you've got to step up and innovate in cyber security and if we depend on the big companies to do it and we don't go and start businesses

then we're not innovating the way we need to to create the kind of solutions that we're going to need for in the future um but here's the thing you don't just quit your day job the worst thing you could possibly do is absolutely is i just looked at the slack and yes i realized that maybe uh newcastle wasn't the right forum for some of my slides here so i apologize but not that much uh but yeah you don't want to just walk away from your uh uh you don't want to just walk away from your day job because it's hard to start a business and it's even harder when you're stressing about money when you don't

have some of those securities so um i had a friend her name was jet and actually her name still is jenny but she has a company called chalk and tablet and what she was really really good at and she was the director of online education for a major university and she was world renowned people would fly her out to conferences she would do all this stuff and i was thrilled for her and i said wow you've just got a promotion more responsibility that didn't give you any more money you must absolutely love this you must love what you do and she said no i hate it i hate working for somebody else but i just don't have the time to go and

start my own thing so i gave her a challenge i said well tell you what you take 30 minutes a night three nights a week for three months and just work on your business a little bit and if at the end of those three months you haven't launched your business and you're able to quit your job because i knew her this isn't a statement for everybody this was just for her particular situation then i'll buy you a 600 bottle of scotch and i will tell you what she did exactly what we talked about she didn't binge watch one episode of whatever show she was watching that night or that season of her life and she launched a

company and at the end of that i didn't have to get her to scotch because she launched and was able to quit her job in a month and a half right so in order to do something like that or even the process if you should we got to answer a couple questions what is a business should i start one and if so how do i go about doing that so that's going to be the meat of what we are going to be talking about so what is a business a business is nothing more than an engine an engine is made up by a whole bunch of parts and the engine is meant to provide energy to some kind of vehicle

to move it forward and so this engine has different parts the first part is all the people that engine is trying to help what problem is trying to solve for those people how what does the solution for that problem look like how do you let people know about it how do you engage with them in the right kind of way how do you make sure that the engine works effectively and then how do you make sure all the things line up together and all this is great and if you have these different processes running then you have an engine that's ready to go but there's still two things missing fuel and oil so the fuel that makes the

engine run is money and the thing that makes the engine run effectively and doesn't lock up are people and so this is everything that you have inside of a company and each and every single one of these parts are the mechanisms that has some kind of control around we call them business processes so cyber security steps in to make sure that the engine runs efficiently and nothing can disrupt it i love cyber security from a business point of view because you can't deploy effective security controls if you don't have an efficiently running operation if you don't have an engine that does what it's supposed to do so here is the math revenue this is how the engine works the

amount of money you make minus the amount of money you spend equals the amount of money left over if you make a hundred dollars and then you spend ninety dollars you have ten left right we get that so you make money by selling a product or service to somebody who needs it and they find value in it you then spend money by producing that product or service and creating the solution that the customer wants and all this is under control by the cfo the chief financial officer controls revenue by assigning quota to the vp of sales and budget controls to your chief operating officer and when something goes wrong this is when the whole thing fails so

let's go back to why cyber security is so important inside of this model is that if a hack happens or some kind of disruption happens you can suffer higher expenses and if you're making 100 but because of the disruption now you're spending 150 the company goes out of business so when people get super excited about cyber security i want you to understand it's a thousand percent because of money it is a thousand percent that if we don't do our jobs right expenses go out of control and the company will suffer so yeah don't screw it up that's all i'm saying okay so what kind of businesses are there well typically when a cyber security professional or

an i.t professional wants to start their own business they follow into these three different bundles i am awesome i can build it and i know some people i'm awesome it's typically the professional services you know how to do something and you have a skill set you go out and do that that's what i did i knew how to do identity and access management i knew how to run ibm's platforms and i went and charged by the hour to do that i can build it as typically a product in my case i started a couple software companies and we'll get into some of the major dumpster fires where i was like i can build a product or a thing that will

accomplish the stuff that somebody else can buy and i don't have to show up um and then finally i know some people this isn't the master networker this is somebody who builds a cool community or builds folks who can assist each other and that's a little bit more difficult but it's um i guess it's actually easier now um with how the internets are set up but back in my day back in my day uh really it was only option one and option two so here's what i want you to know deep deep deep in your soul how you make your money should be independent of how you spend your time what i mean by that

is that if you are trading an hour of your life every day for a paycheck or for a dollar or for whatever then you're trapped what i love about the engine of business is that if you set up a system a business it will generate wealth for you while you can then go and pursue things that you're truly desperately interested in so i want you guys to be the engineer and not the engine it's completely okay when you get started to be the engine but i want you to be thinking through your lives thinking okay i'm going to build this engine but it's going to run itself and until it runs itself i'm going to have to do some of

the work so this all happens when you leverage the following things the right people process systems and pro solving a problem that people will pay for if you have this then you have a shot at a really really good business so should you start a business right let's say you have all this like hey i'm working with great people we know what we're doing hey i know how to make this a repeatable process man i see a really cool problem that i know how to solve and somebody's asking to give me money they're asking hey solve this problem i'll give you money but should you do it should you absolutely do it uh maybe right so i used to think everyone should

start a business i i thought to myself man it's almost like if you uh if you join crossfit ever you're like you should totally be in crossfit man no this is this is the thing that i learned is that not everyone's programmed this way that actually the the best way to make money sometimes is to absolutely be a highly compensated employee and and it doesn't fit right so most likely no the statistics in my personal experience say that most businesses don't work most of the times we fail and it's a really really hard thing to do but if it works it is so great so great um the amount of freedom you get freedom of

time autonomy control over your money not necessarily that you're making more money than you would as an employee somewhere but having control about how you generate that is just thrilling to me but it all starts with the question hey what is your vision what's the vision for the future the reason why this is important is because remember montgomery alabama i was in a lot of pain in that 18 hour layover and my dog didn't love me and my you know but eventually that stuff gets better so if you're running away from something if the triggering event the mage you want to start your company your business your initiative is the only thing driving you then eventually you're going

to quit you're going to get burnout because you don't have a big enough vision so it's fine to have your catalyst and spine to have your triggering event but what i really want you to know is that if you don't have a clear vision of what you're trying to build and why you're trying to do it it's going to be super hard to stay in the game so we're going to talk a little bit about time and money real quick and then i'm going to get into how you actually go about this so the way most of us make money is in one of these four quadrants you're either an employee you're self-employed you're an investor

and time and money enter into these two things an employee trades time for money i show up i give eight hours a day someone gives me a paycheck i complete tasks the more valuable those tasks are to the engine the higher compensation i have right self-employed they do time and they do um they both they trade both time and money i'm sorry they put they trade time just like an employee does but they take on more responsibility they cover their own taxes they handle their own insurances they have a lot more of the weight so they get higher higher compensation because they're taking on more risks and a business owner builds systems that trades other people's time

for money business owners build systems where employees and self-employed people can be successful in and then an investor is creating time training money for money and money builds off of money i can not help you with that quadrant i have a significant track record that says i am not a solid investor so that means we really have three tracks as a cyber security professional you either follow a technology track an executive track on our entrepreneur track and i'm not i'm here to say that none of these are wrong and all these are fantastic and they can you can achieve your vision and all of them but if you do want to follow the entrepreneurial track

you have to be careful and you have to have that clear vision because that clear vision will tell you which one of these engines uh which one of these uh vehicles you're trying to build if you are trying to have uh um a dump truck vehicle but you build an engine for like the clown car the truck's not going to move you have to think about what you're building so that you can reverse engineer the engine well let me give you a quick uh debrief on that if you know that you're trying to build a vehicle that is going to accomplish a certain thing but the business which is the engine that drives the vehicle

is set up for the wrong kind of entity or the wrong kind of mission the whole thing crashes and burns and it just doesn't work so let's assume that let's let's assume that uh we you've decided yep gonna start a business done and done okay great here are the four phases of launching a business you ideate some kind of idea you then test it by asking people to give you money or give you uh feedback or to use your product or service you get that information and then you build the actual product or service and then you've made it to the starting line right and that's kind of cool let's look through that ideation process

this starts with you defining what you're trying to accomplish generating a bunch of ideas collecting those ideas analyzing them and throwing out the ones that you don't want and then acting so when you define you need extreme clarity this is when we go back to the the vehicle if you don't know where you're going you don't know why you're going to get there it's very very difficult to decide which idea is important and which ideas you should follow so then you generate a whole bunch of ideas and this is fun this is brainstorming with a purpose it's completely cool uh you you have a whole lot of ideas you throw it out there no one's

wrong blah blah blah then you collect those ideas and you realize that some of them are actually not aligned with the goal and you begin to organize them and then you analyze them and you begin to pick out the ones that you want right i i love this whole thing here with neo and all these ideas are coming at them and you have to slow down to go fast at this point in the process you have such like energy and you're super excited because you have all these great ideas and man we can do this we can do that but if you don't slow it down and become very very clear about what you want to

do you'll become overwhelmed and you actually won't get anything done and then you act you pick one you pick one thing that you're going to do and then you move forward with it you build your plan and then you move into that next stage so you're going to pick one of these massive ideas and you're going to boom move on and here's how you organize it this is called a lean business canvas most people uh think you have to write a complicated business model or a complicated business plan 25 pages financial projections absolutely not you pick one of those ideas and then you answer these questions you say you know hey what's my customer what are they up to

who how do i help them uh what's the problem i'm solving boom boom boom goes all the way through right and if you look at this this is the these are the nine business systems that we talked about with the engine it's just now you have an in an organized way so you begin to write down the business idea what problem am i solving what solution am i providing to solve that problem what are they doing to already solve that problem who am i helping why is my solution unique and helpful and by the way you can use this exact same thing when you're trying to scope projects uh it doesn't have to necessarily be a

business it can be what problem am i solving today at work but uh this is the tool that we use with our uh the guys that we mentor is how do you organize and test all of these different systems and you end up putting this on a whiteboard and this is what it looks like a bunch of sticky notes um so it's pretty cool and by the way after you answered all this you have everything you need to go out and test and you do that in three ways you do a problem interview to say here are the things i think are wrong customer abc do you believe that these are actual problems then you ask hey i got some data back

from these guys and then we go back and say hey i think i fixed this what do you think so let's look at this uh problem interview the fastest way to understand if you have a real business is to go talk to a hundred people who you think might have this problem and you say hey this is the problem um i know that you're currently doing xyz uh do you really believe that this is solving your pain and what triggers that pain what will happen is that you'll come in with some ideas you'll say here are the top three things i think are the problem and they're going to tell you yes or no they're either going to say absolutely

you hit it on the head or no you have no idea what you're talking about and after 100 conversations you're going to have a really really good idea of is this something or is this not something and this is when you go do your data you go back and you collect all the stuff okay do i see any trends do i see something interesting and then you create this report and you create a document based off of those hundred interviews and you go back to those other people and you share the data with them one of the reasons they're going to give you all this information is because you say hey look i'm going to

talk to a hundred cisos about this interesting problem that i see and i think there's a problem that isn't being addressed if i do this and you share your knowledge with me i'll bring you back the report and share what the other 99 ciso said right and they love that stuff they love that uh and you go back and say hey i talked to 100 other cisos or i talked to 100 other you know business owners or whatever and this is what they said i think that if i do xyz i can solve this problem how much would you pay to make that happen and if they give you money oh you did it you're

there until somebody agrees that your idea is something they would pay for you shouldn't build a thing you shouldn't deploy your your a lot of us are tank careers a lot of us like to put products together um and i get that and you should do it if you enjoy it but you just need to know that whatever you're building is probably going to change by the time you get those first 10 customers to pay you and the neat thing is is out of those 100 10 will say yes right just statistics but we've heard about a minimum viable product right actually before we jump into that let's look at this the reason why 10 are going to say yes out of 100 is

this adoption curve um there are about 15 percent of the population that you talk to are going to want to buy your stuff just because it's super cool and they want to be disruptive but the vast majority are not they're going to agree that there's a problem but they will not want to adopt your new solution this is one of the things that's very very frustrating for innovators and inventors is that you create something cool everybody agrees it's cool and then nobody buys you know well why didn't anyone buy my stuff well it's not that there's anything wrong with your stuff it's that there is a adoption curve and if the folks at the front don't

take on the innovators and the early adopters if they don't adopt your stuff then nothing's going to happen but they they need to be the trend centers to create the social proof so the earlier majority late majority and laggers will eventually move into that but let's get back to this so the minimum viable product is not the top right okay we're gonna we say we're gonna be building a vehicle here and it's not just a tire and then boom boom boom what it is is what is the cheapest thing i could possibly make the simplest thing i could possibly make to solve the problem and so for this particular slide if the problem was i need transportation

because the ground is too hot and i don't want to walk on the ground or the floor is lava whatever right if you start with the big picture in mind and you create an mvp that is a just the different parts of a bigger problem you're not actually testing anything you have to start with the skateboard to the scooter to the bicycle to the motorcycle i know because i did this wrong i created a company called atlas vault atlas vault did cyber security compliance inside of complex supply chains so we had a wonderful thing i put 650 000 my own dollars into it hooray and then nobody bought after a year and a half of effort

and i just it's just a damn dumpster fire we threw everything away i'm out 650k i took investment from other people and they're out money and it was a giant waste of time because it took us 18 months to build the car what i should have done is taken a couple of uh weeks to build a skateboard to test to see if this was actually going to produce something so after you get your guys your first 10 customers you do the you deliver the solution this is just showing up doing the work getting feedback from what they say the work is and then asking for referrals and at this stage most of the times people just don't do

it most of the time people stay in the lab until the thing is perfect but until you get feedback you won't know how to take it to the next step so i'm here to encourage you that the number one reason you're going to be successful delivering your first solution to your first 10 customers is that you are going to care about the customer i cannot tell you how many times i screwed things up that because the customer liked me and i had these things called social skills uh they just let me do it they they forgive me they said come back we got this keep going and they're actually going to root for you people love rooting for the underdog

and when you get your early adopters and your first 10 customers they are going to be invested in you and they're going to want you to succeed so congratulations you made it to startup you are awesome you have a company that's doing a thing you've talked to a hundred people you've shared your vision some of them decided to buy and now you the you've caught the the car and it's absolutely running so um this stuff can get somewhat complicated uh i know so um what i've done is i've been requested to create a workshop for this kind of stuff and i'm uh from the last besides we did this talk at and um what i'm going to do is give you guys

a free code to go and take this stuff for free um we're not i'm not gonna charge for any of this stuff uh if you want to figure out and have a framework of going through and testing a business idea i've got an online class i'm just gonna give that away to the to you guys so i don't have that code created yet but i will get it to ben and get it to the rest of the folks but i'm going to encourage you to take a chance build your own company do what you can do because we need you to innovate we need you to get out there if we depend on large corporations and governments to create

solutions to these problems it's just not going to happen because we need folks who are visionaries we need folks who are are wanting autonomy freedom and control to get out there and do this stuff so i'm hoping you are inspired i'm hoping that you are going to go do something and if you aren't that's okay too i love you anyway