Security Confidential S14 E2 Christian Espinosa

Manoj Tandon: Hello everyone, this is your host, Manoj Tandon. Welcome to another episode of Dark Rhiino Security: Security Confidential. Today, we are honored to have Christian Espinosa join us. Christian has a tremendous background in cybersecurity, but in addition—we’ll talk about that here in a second—he is a best-selling author, a high-performance coach, a powerful keynote speaker, and the founder and CEO of Blue Goat Cyber, an organization designed to combat cyber crime through technical prowess and emotional intelligence. We’ll get into how those two things come together here shortly as well. He’s the best-selling author of “The Smartest Person in the Room.” Christian, thank you for joining the show. I appreciate you taking the time to be with us this afternoon.

Christian Espinosa: Yeah, thank you so much for having me on Security Confidential. I appreciate it.

Manoj Tandon: You know, one place that we always love to start—our audience loves to know a little bit about your origin story because you’ve been in the Air Force and you’ve been a serial entrepreneur. There’s a lot of things here. Can you give us a little bit about your background: how you started and got where you are today?

Christian Espinosa: Yeah, I’ll give a quick synopsis. I grew up—I moved from California to Arkansas when I was 12. It was quite the culture shock. I grew up in extreme poverty with a mother that was addicted to pain meds, so my life was very unstable and chaotic growing up. We lived in a trailer, were on food stamps and welfare and all that, and I craved stability and safety. So, I ended up going to the Air Force Academy. I worked really hard to get out of my environment in Arkansas, and I went to the Air Force Academy, and that gave me stability and safety. After that, I was in the military for like six years, but then I started getting bored with that and realized that I really don’t like safety and stability as much as I thought I did. I thought I wanted it because I didn’t have it growing up, but really, what I’m passionate about is taking risks—like doing entrepreneurship, doing extreme sports, and things that I didn’t have the ability to do during my childhood. So, I decided to start taking risks, and that’s how I ended up starting Blue Goat Cyber and my previous cyber security company that I built and sold. I just decided to start taking the risk and going for the things I wanted to do, and kind of abandon that safety, stability, and comfort zone of what I was living in for a while because I realized it wasn’t for me.

Manoj Tandon: Christian, what was your motivator that got you to break the cycle? Because you hear about a lot of kids who grow up in that kind of environment that have a very troubled adult offering, and you’ve had tremendous success. Was there some catalyst by which that enablement happened, or was it just really inside?

Christian Espinosa: I think for me, I knew inherently that the situation I was in was not a good situation. I mean, my mother, as much as she liked to party and do everything, she wasn’t happy; she was unfulfilled. I knew that there was something more for me. I had to get out of that environment however I could, which is why I focused on academics and got scholarships. It’s also a little bit, I believe, of my competitive nature. A lot of people in my small town in Arkansas expected me to fail because of my environment. You know, we were in the newspaper a lot for my mom getting arrested and stuff. So, I guess at some degree, also, I wanted to show everybody that I’m more than what you think of me and I’m capable of much more than most people at that time were thinking.

Manoj Tandon: Well, Christian, you’re an inspiration. I’m sure a lot of people who are listening are going to find that, and it’s really important. We’re grateful that you’re so open about your story because it is inspirational for other folks who are looking to get into cyber. We have a lot of diverse people that come into it from diverse backgrounds, and what you just told us proves the point: there’s a home for people here in cybersecurity.

So, getting into the U.S. Air Force Academy—I imagine you weren’t there for the cybersecurity program. Were you looking at flying jets, or looking to be an aerospace engineer, mechanical, or what?

Christian Espinosa: Yeah, I saw the movie “Top Gun.” I know it’s Navy, but I became relatively obsessed with becoming a fighter pilot. So, that was the reason I went to the Air Force Academy. It just so happened a couple of years before I graduated they started cutting all the pilot slots. By the time I graduated, I would have had to wait three or four years to even get into pilot training. So, I decided to get out of active duty after six years. But I majored in electrical engineering at the Air Force Academy, and my career was in communications, which ended up doing a lot of cybersecurity in the military under communications because that was my fallback career since the pilot thing didn’t work out.

Manoj Tandon: Hey, I get it. Back in the day, I used to get a lot of calls from kids who were at the Air Force Academy to help them out on various projects. I’m an aerospace engineer by training and I used to work at Cessna Aircraft at one time.

Christian Espinosa: Oh, nice.

Manoj Tandon: And we’d always get some calls—this is in the early 90s, right? So we’d get some calls from out there and I got a chance to visit that place once. It’s a beautiful setting, a gorgeous institution. But from your communication work, that’s what got you into cyber then, right? That was your transition into a newfound passion, I guess.

Christian Espinosa: That’s right. I did communications in the military, and one of the things is we have to protect classified networks, so it’s basically cybersecurity. We didn’t quite call it that back then, but then I knew when I got out of the military that cybersecurity was going to be the big thing, the growing field. So I did IT stuff at first, but then I sort of shifted all the way over to cybersecurity a couple of years after I separated from active duty.

Manoj Tandon: In your current company, has your experience with what you had in the military carried over into Blue Goat Cyber in terms of its culture, operations, or any of those things? Was it a beneficial experience in that regard?

Christian Espinosa: Yeah, 100%. I’m a big believer in discipline which, you know, in the military—not everyone’s disciplined, but it’s something I learned in the military. Teamwork as well. The military is big on leadership and leadership development, so I try to apply what I learned from the military and continuously learn how to become a better leader. The other thing is ownership. I’m a big proponent of ownership and taking ownership of your life and your team as well. When it goes back to leadership, I think leadership starts with ourselves. Sometimes we forget that and we try to lead other people, but if we’re not leading ourselves properly, that’s going to be incongruent and people can see through that.

Manoj Tandon: You talk about emotional intelligence quite a bit. How does that work into a cybersecurity operation? Because when we’re thinking cybersecurity, emotional is not something that often comes up in the dialogue, if you will.

Christian Espinosa: Well, I wrote the book “The Smartest Person in the Room” based on my first cybersecurity business. I realized 99% of my problems were because my staff lacked emotional intelligence. They were not because my staff lacked technical skills.

Manoj Tandon: Can you give some examples of that, Christian, please?

Christian Espinosa: Yeah. One of my engineers was explaining, for instance, a penetration test report to a client. He was explaining it super technically, and the client indicated that they were not understanding it. When my engineer was telling me about how this all transpired, he was kind of making fun of the client, saying, “They just don’t get it. They just don’t get what we’re talking about.” For some reason, that struck me very differently, probably because it’s my company and I funded it and I have more on the line. I was looking at it through a different lens, but I decided to fix that. I’m like, well, they need to get it. If they’re not getting it, then they’re not going to become more secure. It’s our job and that engineer’s job to make sure they get it, which means altering how we communicate, having some emotional intelligence to realize that they’re not getting it. Our role is to make sure they understand it and really connecting with the client at a different level, versus trying to pretend we’re intellectually superior to them or trying to intellectually bully people, which I think we see a lot of in cybersecurity.

Manoj Tandon: Yes, we do. We absolutely do, and there is a complete disconnect, especially between the decision-makers and the people who do know what they’re doing. At least that’s been our experience of it, and it’s not a disconnect that’s come about because either party is disinterested in the topic. They don’t have a means of connecting onto the same wavelength to start singing from the same hymnal, if you will. It seems the decision-makers are like, “Throw tech at it,” and the tech guys are, “Yeah, we’ll take more tech,” and we’ll tell you a little bit about what you need and then we’ll go back to our world. The true solution is not found in a lot of cases.

Christian Espinosa: Yeah, and I think that’s a problem with our industry as a whole. We often forget that cybersecurity is a support industry. There would be no cybersecurity if there weren’t other industries, but sometimes we forget that and think of the world from our lens only. The reality is cybersecurity is about reducing risk to an acceptable level for an organization in alignment with their maturity. What we often do is we try to implement everything for an organization instead of doing the things that actually matter. We forget that organizations have a limited budget and we’re there to support the organization. When it comes to what you were talking about before—the miscommunication—this is something that I talk about in my book and I’m a big proponent of: the meaning of communication is the response you get. So, if you’re not getting the budget for cybersecurity, or your client is not understanding what you’re telling them regarding findings of a report or a test, then the ownership shifts back to you to alter how you communicate. We often don’t do that in cybersecurity; we often just blame the other person, like, “They don’t understand what I’m telling them,” or they didn’t get this or that, versus altering how we communicate. I think that’s the reason a lot of people complain they don’t get a budget—they don’t communicate cybersecurity in terms of how it affects the business, what the value proposition is for the business, and what the main things are to do versus trying to do everything. It needs to be communicated more concisely in terms of the audience, and this is often overlooked in cybersecurity.

Manoj Tandon: But, Christian, a lot of the engineering teams—I mean, on a day-to-day basis, they’re not looking at value propositions. They probably don’t know how the business is generating revenue. I don’t mean that in a bad way; it’s just not their job function. So they’re not thinking in those terms of how this potentially impacts our revenue stream, our brand reputation, or anything along those lines. How do you change that? How do you bring that intelligence into that group to get engaged in what they might consider is out of their swim lane?

Christian Espinosa: Yeah. So, I worked on that with my first company; that’s what I wrote my book about. There are seven steps in the book, and each of those steps has some unique things. But I think what’s ultimately important is having some fundamental people skills and distilling that down to some distinct steps. I think where the challenge is often is we use these terms like emotional intelligence, people skills, soft skills—it doesn’t mean anything to a lot of people, especially high IQ or high-tech individuals or highly rationally intelligent individuals. So, we have to put it in specific terms. As an example, if I talk about someone that can build rapport very well with people very quickly—what does that actually mean? That means when they enter a room, they smile, they make eye contact with people, they shake their hand, they compliment them on their shirt or something. There are specific things you can do to achieve something along the lines of people skills, which we often just say, “You need to have rapport.” For someone that’s highly rationally intelligent, they don’t know what to do with that. So, we have to break it down a little bit deeper.

Manoj Tandon: Yeah, and how do you hire for that? I think that’s going to pose a challenge. When you look at the ads for cybersecurity jobs, they’re asking about your certifications, they’re asking about experience—they’re asking about everything but what you just described. And I don’t think even the fancy AI search engines can assess personality, really. Those skills that you’re speaking about—how do you find them short of talking to thousands of people and then saying, “I’m going to cherry-pick out of this,” when none of us have the time to do that often when we’re hiring?

Christian Espinosa: Right. I’m in the process of hiring people now, so I’m kind of going through this process. I don’t care about someone’s college degree or where they got it. I don’t care about their certifications, necessarily. The first thing I look at is if they’re a good cultural fit. This means: do they adhere to my core values? Do they have those people skills? Do they have the right personality for the job? Sometimes I’ll ask them to do a personality assessment exam, such as the Predictive Index or 16Personalities. If they resist doing that, it’s a pretty good sign that they’re probably going to be a problem later on. Only if they pass those things through a couple of people in my company then will I dive into their technical skills. Of course, I’m going to ask a little bit about their technical background, but that is not the main deciding factor for me. I feel like people with the right aptitude can learn the technical stuff, but if they show up with a bad attitude, a lack of people skills, or a desire not to learn those, then they’re not going to be a good fit in my organization. I’ve known this from years and years of hiring people. When I used to hire based on certifications, degrees, technical skills, and all the things that everyone says you should hire based on, I had lots of bad hires that I had to ultimately get rid of. Then I flipped the script and looked for the cultural fit, the people skills, the core value alignment—all that first. Only if they’re a good fit in that area do I look at their technical skills, which are really secondary in my opinion.

Manoj Tandon: Then you joined us because we’re outliers in the industry, I can tell you that. Because I can tell you here at Dark Rhiino, in the early days, we went through a whole bunch of people, and that cultural fit—brilliant engineers, I mean, there have been some people who are no longer with us who were brilliant, and I’m sure they’ve absolutely had great success in other companies. But in a small organization like ours, where you’re wearing multiple hats, that cultural fit, that ability to have empathy for the client, that ability to communicate and bring issues to the table—all those things are soft skills that can make the difference between someone renewing with us or not, or someone being comfortable enough to give us a chance to work with them or not. We’ve seen a correlation to sales. I don’t know—have you done any more quantitative studies on it and seen a change in sales or retention or anything like that by switching to this model of emotional intelligence hiring?

Christian Espinosa: Yes, 100%. In my last business, a lot of our clients would be one-off clients before I got the culture correct and the emotional intelligence. After that, I would say 30% to 40%—probably 35%—of the one-time projects became annual contracts because they wanted to continue working with us because they enjoyed working with us. And that’s really what matters: it matters that they want to work with you, that you make them feel appreciated and understood, versus “We did this great technical job and here’s your report.” There’s a lot more to it than that. That’s the biggest thing I noticed, where more of those people that worked with us once became repeat customers and on annual contracts. I think that and the recurring revenue that resulted helped position my last company in a better spot and able to sell it.

Manoj Tandon: What resistance did you run into from the market and how did you overcome it in your current company and your past company? I’m asking more out of curiosity about some of the resisting factors from people who are looking to buy cyber, which is still a very technocentric sale. You seem like you have a different approach to it, Christian.

Christian Espinosa: Yeah, I don’t know if we got a lot of resistance from the end customer when we changed our attitude and emphasized our culture. One of the things I’m not a proponent of—and there’s some resistance around this—is that there’s a lot of these 20-point checklists or 50-point checklists. Certain cybersecurity professionals think every organization, no matter the size or the maturity, should just do everything on that checklist. I am not a proponent of that, and I get pushback on that from the market because I’m like, the checklist should be organized by risk. If you can only afford to do the eight things on this checklist 100%, that’s better than doing all 50 things 5%. Let’s focus on these eight things, get these done, and ignore the rest. Whereas in industry, a lot of people want every single box checked, and I don’t think that’s realistic for small to medium-sized businesses. We have to understand they don’t have an unlimited cybersecurity budget; they don’t have the resources and they don’t have the know-how. It’s just not feasible based on where they are in their journey as a business. We often ignore that, and there’s a lot of pushback in the industry about my approach to that because I’m not a proponent of these massive frameworks with all these checklists.

Manoj Tandon: Well, we have a lot of frameworks. We can throw a lot of frameworks your way, and there’s a lot of ways to quantify risk too. But what you’re saying rings very true, and it’s a great example of where less is more. We were talking pre-show—the SANS Top 10. I’m like, forget the Top 10, man. Just can you do the top three? Can you get the top three? If you can do that, you might be better off than 90% of the people out there, because you’d be surprised how many people don’t get that. How do we change—go ahead, sorry, Christian.

Christian Espinosa: Oh, I was going to say it’s interesting. I used to give the analogy that in cybersecurity, we want to teach people right off the bat how to slam dunk, not how to learn how to dribble first. We try to do everything, but we end up doing nothing, and we wonder why we’re hacked, basically.

Manoj Tandon: You made a comment about extreme sports earlier. Basketball, which I hope is not an extreme sport—how has your involvement with extreme sports translated into your work in cyber?

Christian Espinosa: I would say two ways. Number one is risk. I do a lot of risky extreme sports. I skydive, I climb mountains, and I do Ironman triathlons, which is not as risky as the other two. Risk and maturity: I would say those are the two main things, and those tie directly into cybersecurity. With skydiving as an example, a lot of people think it’s a risky activity. It is, but you can do a lot of things to reduce the risk: by being trained properly, by having a reserve parachute, and an automatic activation device—if you’re knocked unconscious, it automatically deploys your reserve parachute. Wearing a helmet, jumping with the right people, jumping at the right altitude, deploying your parachute at the right altitude. You can do things to reduce the risk. In anything I do that’s extreme that involves a team, there’s a maturity factor as well. With skydiving, you have to have a certain type of license in order to do certain types of jumps, from certain altitudes, over water, or over certain hazards. There’s a maturity factor there as well. We’re looking at risk and maturity, which are really two things we should look at in cybersecurity. Same thing with mountaineering: there are certain risks, but with a team, you’re not going to be invited to go climb a difficult mountain if you’ve not already proven yourself. Cybersecurity is all about reducing the risk to an acceptable level based on the organization’s maturity. That’s the part that’s often forgotten. At maturity, a small business is going to have a different cybersecurity program—very different than an enterprise-level business. But we often try to implement enterprise-level things in a small business, which is not feasible from a cost perspective and it doesn’t make any sense. Those couple of things I learned from extreme sports are directly applicable to cybersecurity.

Manoj Tandon: Yeah, and it’s a way of assessing risk. When I heard you speak about making your outcome more successful, like with parachuting, you’re setting yourself up for success—having that automatic device, having the right people around you, and wearing a helmet. There are equivalents and corollaries when you’re looking at risk in your organization. The way you evaluate risk, I would imagine, is not the same for a company that’s running 20 stores versus someone that’s got a really small operation, versus someone that is doing government work in the defense industry. Even though they’re a small business, there are different risk evaluation models, so it’s not a one-size-fits-all approach.

Christian Espinosa: Yeah, 100%. I think we try to do a one-size-fits-all approach, like, “Let’s implement this particular framework for every organization we deal with.” But that framework may not be applicable.

Manoj Tandon: How much of that is really just stemming from the fact that people, especially the folks that are running these businesses, just don’t have a rudimentary understanding of cybersecurity? So what they’re trying to do is the right thing as best as they can. The technical people that they’re hiring don’t speak the language in which they think. So they’re like, “Well, let’s have a checklist then.” Industries are creating these frameworks, but in the end, it’s still not making anybody any safer, per se.

Christian Espinosa: I agree. I think as a business owner, you’ve got to take some responsibility for understanding cybersecurity, just like I’m a business owner—I know accounting, I know sales, and I know marketing. I have to learn these things in order to grow my business. Cybersecurity is another area that as an owner, I think you need to take some ownership over. Not to a really detailed level, but enough to make informed decisions. I think what happens is most people associate cybersecurity—at least from my experience when we deal with small to medium-sized businesses—with technology, like a firewall, a spam filter, or things like that. Those certainly help, but those are a small component of overall cybersecurity. I think if you start looking at what’s really going to reduce the risk for your organization, and you know what the threat is—which could be someone doing some sort of business email compromise or trying to get you to wire money to a different account—then the firewall is not going to help. You have to look at what are the actual threats to my business. Just like if I build a business in New Orleans, I might assume it’s going to flood at some point, so I need to make sure I’m aware of that risk and have the right controls in place. We need to look at the actual cybersecurity risk to our industry and our business as well, and then make the appropriate decisions. It’s not always technology; sometimes it’s a process, sometimes it’s training your staff. Technology is just actually a small subset of it.

Manoj Tandon: So, where does a business owner begin then? How would you advise folks at a 50-person, 100-person company, or even a 200-person company? Where do they begin this exercise if they’re going to take a serious step towards being safer?

Christian Espinosa: I think it’s important to understand what data you have that somebody might want, and then the vector someone could use to get it. And then also: what are common attacks in your industry, like a business email compromise or accounts payable schemes? If you’re a small business that does research and development, you probably have intellectual property, so that’s going to be the thing you need to protect the most. If you’re a business that works in the supply chain for the government, you may have controlled unclassified information, and that’s what we need to protect the most. One way to protect that stuff easier is to minimize the number of systems that data is on. That’s the simplest thing, and then you only have to protect a limited number of systems. We have to look a little more holistically than just implementing all these controls. I’m a big believer that if I’ve got intellectual property, for example, I need to control where that is. If it’s only on these four computers, I can protect those four computers much better than I can protect all 200 computers of my organization. That’s one of the first steps which is often overlooked because we end up with data all over the place, and then we try to protect it all over the place, which is not the smartest way of approaching it in my opinion.

Manoj Tandon: Yeah, I think most people don’t go through that exercise. They’re like, “Well, let’s make an assessment of our asset base and where the data lies and where it’s stored.” That’s paramount, and that doesn’t require any tech—that’s people getting together in a boardroom and just hashing things out: where do the vulnerabilities lie, and what’s really worth protecting? Now, you’re going to get—one of the things we’ve heard time and time again, it’s a story that just keeps on going, is that small business owners are like, “Well, I ship pipes. Who cares? Nobody wants to get in.” But you might be shipping pipes to organizations that they do want to get into. Right? As one example. Or you might be procuring restricted materials because you’re doing cooling systems for the nuclear industry. I’m just making these hypotheticals up. It’s just the generalization that, as a small business, we typically don’t have anyone who wants to knock on our door. I think that myth continues to propagate out there.

Christian Espinosa: It does. A couple of things—one, I like to say is: “Know thyself,” which you were talking about with your data. You need to know yourself first, and then you need to know the enemy. We’re really at a cyber war, and just because you’re a small business doesn’t mean you’re not going to be a target. It actually means you’re more likely to be a target because cyber criminals know you don’t have the resources to defend your environment. Things like ransomware and other types of malware propagate not by somebody behind a keyboard; they’re automatically propagating to see who has a weakness. Then they take advantage of that weakness and encrypt all your data. The cyber criminals don’t care if they get the money from a 400-person company or a 50-person company; it’s just money to them and their system is set up to facilitate that. We need to know ourselves and know what we’re up against. With small businesses, I’ve read a lot of studies on it because I’m passionate about protecting them. I think they’re vital to the economy. But over 60% of small businesses go out of business after a cyberattack. They simply can’t recover because they don’t have the budget, the overhead, or the reserves to continue on. As an entrepreneur, you put all that sweat, blood, and tears into your organization. You want it to succeed, and the last thing you’d want is a cyberattack to take you out of business.

Manoj Tandon: Absolutely. And there’s another interesting statistic that goes with that, Christian: people who rely on cybersecurity insurance for the payout. I was surprised to learn it, but apparently, the payout from cybersecurity companies only happens about 30% of the time.

Christian Espinosa: Of course. What insurance company wants to pay if they can avoid it? Right now, we have a lot of clients that are having difficulty getting cyber insurance because the insurance companies have levied a lot of requirements now before they will even insure you, such as multi-factor authentication, encryption of data at rest and in transit, and secure backups. All these things are now in place. On top of that, there’s a movement in the insurance industry to not pay because they claim it’s an “act of war.” If a criminal in another nation attacked your company and took you offline, they’re going to try to say it’s an act of war, which is a clause in most insurance that says they won’t pay for the destruction of your environment, data, or business.

Manoj Tandon: There was a major case in the federal court system that was brought by Merck—one of the plaintiffs, I believe. It was to do with the fact that they had a breach from an operation they had in Ukraine which shut them down, and their insurance company decided not to pay it. The claim was that it’s an act of war. But from what I understand, the insurance company did pay out something and the court never rendered a final verdict on whether that is to be considered an act of war or not. There was some weakness in the position of the insurance company that, I guess, a settlement was had. I’m going to read that case after we get off here because now I’m interested. But yeah, you’re absolutely right. Merck is an empire. If you’re a small to medium business, you’re not going to fight; you don’t have the resources to fight your insurer.

Christian Espinosa: That’s right. Especially when your operations are halted because you’ve got ransomware and you can’t generate revenue.

Manoj Tandon: Where does AI play into the future here with defending these businesses? What’s changing? What’s your vision?

Christian Espinosa: I think this year is the last year to learn AI before you become obsolete, personally. I think every business should be figuring out how to integrate AI into their workflow, into their cyber defense, and into anything in their business, really. I think this is the year it’ll separate the people that adopt AI versus the people that don’t. As far as AI and cybersecurity, it’s a double-edged sword. The cyber criminals are using AI, and we’re using AI to try to defend the attacks, and they’re using AI to try to circumvent the AI we’re using. So it’s really AI against AI to some degree. The interesting thing is I’ve done a lot of tests with AI: I’ll have AI write an article, and then I have another AI see if it can detect if AI wrote it. It can. But then I tell the original AI to write the article like a human, using perplexity and burstiness—that’s how humans talk—to avoid AI detection. Then the AI rewrites the article, I put it back up for the other AI to look at it, and it thinks a human wrote it. It’s like we’re trying to program the AI to outsmart the other one. That’s where we’re evolving with cybersecurity: can I outsmart the defense AI with offensive AI?

Manoj Tandon: So, who is the better robot strategist? Is that who’s going to win the game here—robot versus robot?

Christian Espinosa: Well, somebody has to program the robot. It’s about prompt generation, how we feed the knowledge to the robot, and what we tell it to do and how to respond. So yeah, it’s about programming the AI to some degree.

Manoj Tandon: You know, if you look at there have been a lot of—they continue to be—people who exploit vulnerabilities and technical systems. But when you look at the evolution of attacks in the industry and these business email compromise or social engineering attacks, they are getting increasingly sophisticated. There was, I know, across my newsfeed a couple weeks back, there was a fellow in Hong Kong, a banker, who transferred $1104 million based on a conversation he had with deep fakes—a conference call he had with deep fakes.

Christian Espinosa: Wow.

Manoj Tandon: And you can’t make this stuff up. It happened. So think how good the programmers of that AI were, that they programmed deep fake senior managers in his organization that told this fellow to transfer $1104 million out of the organization and he did it. So again, that’s not always a technical solution, right? Like we talking—that would have a procedural solution, like if someone asks you to transfer a certain amount of money you have to physically get some signature or something to prevent that.

Christian Espinosa: Yes.

Manoj Tandon: Yes, but in this—look, when we have traded security for convenience, we have, right? Anytime that battle has come up, convenience has won. But there’s certain areas where, you know, maybe the old-fashioned way is not a bad idea. As you rightly pointed out, if you’re transferring $1104 million—to me, that’s a lot of money. And I realized this is apparently a mega, mega bank, you know, they’re a money center, so $25 million to them was probably, “Ah, okay, we do a lot of these.” But have some controls in, you know?

I can’t tell you the number of SMB clients we’ve had where they almost ended up transferring the funds not because somebody broke in and took advantage of a vulnerability. The bad actors cased them out, built a profile, learned how their operations work and then started crafting what looked like very legitimate emails with attached purchase order forms, you know, with the right signatures.

Christian Espinosa: Yes.

Manoj Tandon: And, you know, in one instance it was literally what you stated. The controller walked into the CEO’s office and said, “Hey look, I’ll transfer the money this evening. I’ll get the $500,000 out. I just haven’t had a chance to do it.” And his CEO was like, “What are you talking about?” He said, “Well, you asked. There’s a purchase order on my desk with your signature on it for a half a million dollars.”

Christian Espinosa: Wow.

Manoj Tandon: Yeah, you know, and so that’s the level of sophistication for things like that. The MGM attack with Okta, right? I mean, on the help desk.

Christian Espinosa: Yeah, that was socially engineered.

Manoj Tandon: And MGM’s got every control there is in the book, you would think. So but yeah, that—I mean, the whole scenario you just went through with AI, it can do that a lot more effectively, a lot quicker, at a larger scale. Especially if there’s someone like you that knows how to set the prompts up so that it looks like it’s a human.

Christian Espinosa: Well, I’m an ethical hacker, though, so I’m supposed to be stopping the bad guys.

Manoj Tandon: I know, I know, but there’s—you know, the bad guys are quite intelligent. That’s the one thing that differentiates us in the cyber industry: they’re not your street thugs. These people have very high IQs and are pretty good at what they do.

Yeah, hey, we’re coming up on the hour here, Christian. I wanted to give a chance for you to plug anything you’d like to and let our audience and talk about whatever it is that you want, whatever you’d like our audience to know about your company, about anything, how to reach out to you, all that good stuff, any appearances, whatever.

Christian Espinosa: Yeah, I think I’ll give a plug for my latest book. I know we talked about my first book, The Smartest Person in the Room. Here’s my latest book. It’s The In-Between: Life in the Micro. I just published this, I think, in December. So that book has nothing to do with cyber security. It’s about living in the moment with intentionality. But anyone that finds themselves on a path where they wonder if they’re on the right path or they’re not feeling fulfilled, I think, or their relationships are suffering, I think it’s a good book to check out.

The other thing—I live in Phoenix and we’ve been talking about cyber security quite a bit. In Phoenix there’s Waymo. I don’t know if you heard the brand Waymo. It’s autonomous cars and I take them all the time and I always think about the cyber security implications of autonomous cars. And it’s interesting because they’re only in three cities—they’re here, I think San Francisco and Austin—but pretty soon we’ll be living in a world where most everything is autonomous and cyber attacks are going to be much more serious because if someone attacks my car and speeds up 100 and runs into a semi truck then I can die obviously. So it’s becoming more than stealing your PHI or credit card information, right?

Yeah, as far as where to find me, you can find me on my company website, Blue Goat Cyber. We primarily specialize in medical device cyber security, so securing medical devices such as surgical robots, drug infusion pumps, pacemakers, things like that from hackers. And yeah, if you ever are into F1, I’ll be at the Formula 1 race in Abu Dhabi this year, so maybe I’ll see you there. I like Formula 1, more risky activities.

Manoj Tandon: We had another business partner that actually went to it a couple years ago. He had an invite from a company. I’ve never been, but from what he told me it was a really, really good time.

Christian Espinosa: Yeah.

Manoj Tandon: He had a very, very good time. And if people—is there any way that they can request a signed copy of the book?

Christian Espinosa: Yeah, for sure. They can reach me through my personal website, christianespinosa.com, and let me know you want a signed copy. I’ll be happy to send you a signed copy there.

Manoj Tandon: There you go. Thank you, Christian. I mean, you’ve been fantastic. I think we only scratched the surface of what this conversation could be, but appreciate your thoughts and your insights into what is a very important topic.

Christian Espinosa: Yeah, well thanks for having me on. I appreciate it. I’m glad we’re able to work out the schedule.