Security Confidential S7 E6 Karim Hijazi

Manoj Tandon: Hello everyone, and welcome to another episode of Dark Rhino Security’s Security Confidential. Today we have a superstar guest with us. We’re really honored to have him; he doesn’t need much of an introduction. He is Karim Hijazi. Karim is the founder and CEO of Prevailion. He is the host of the podcast “The Introverted Iconoclast,” which we’ll talk to him a lot more about. He has been in infosec since the 90s, so he has a ton of experience. Former director of intelligence for Mandiant, he’s been on umpteen news outlets; you’ve probably seen him a thousand times. He’s a serial entrepreneur. In fact, his second company, Unveillance, was so effective that they disrupted the malicious operations of the hacker collective Anonymous, who were not too happy about that. But thank you so much for being here. Welcome to the show, Karim.

Karim Hijazi: Thank you for having me, I appreciate it.

Manoj Tandon: We get several entrepreneurs on here, and they’re all characters. I don’t mean that negatively; I’m one myself, so I know that profile well. But there’s always such an interesting story. I look at your background, and you have done everything from government work to consulting to working at some of the most prestigious cybersecurity companies in the world, and then built your own ecosystem. What’s your driver? How did you get into being an entrepreneur? I really want to know that.

Karim Hijazi: Yeah, really good question. Funny enough, I don’t get that question as often as you’d think, not as direct really. It’s interesting because I get a lot of folks that ask very specific, targeted questions like, “Why did you do this specific thing?” or “What drove you to do that?” but not the broad “why.” In fact, that’s a good question because it segues into why I started the podcast and some other things that we’ll talk about. I think there are probably two or three things that are really key to my motivation and drive with this. One of them was watching my father, who was a businessman, do some pretty interesting stuff. What’s fascinating is it wasn’t positive; I was upset with my father. I was upset that he was busy all the time and he was working on things. It was the classic father-son scenario where it’s like, “Can’t you come play ball or fish with me?” “Well, no, I gotta go work.” “Dad?” “Sorry son, can’t do it.” So for a very long time, work and the pursuit of money was not a positive thing in my life growing up. It was the reason for not having the time I would have liked, as I think many people have in their background. What’s ironic is that many years later, when I finally started to come around in my early 20s to saying, “You know, I probably need to make some money; this is kind of silly. I need to go and figure out something,” I did go and re-engage with my father and worked with him briefly. In fact, that’s one of my first pivots into competitive intelligence, otherwise known as corporate spying, with a company that he was working with. So funny enough, it came full circle to that, and there I was, kind of happenstance into that role of what turned into my consultancy. It all sort of spawned from being curious about what my father did. Then, in an even stranger turn of events, my father never wanted me to be entrepreneurial. He’s like, “Look, I worked my butt off to get to a certain level in life so that you don’t have to do this sort of slog.” And I’m like, “But it’s in my genes, for God’s sake! I want to do this kind of thing.” So it was a very interesting, long, involved thing. A lot of it was probably some sort of validation need, having him see me as a viable person similar to him that could go and build something myself. Then once that faded, it became very addictive. As you well know, it’s something that when you get it right and you capture lightning in a bottle maybe once, maybe twice, it’s incredible. There’s nothing like it. I think you’re ruined. You can’t go work for someone else.

Manoj Tandon: That is such a fascinating story. I think it has a lot of similarities to mine and a lot of other entrepreneurs. In fact, while you were speaking, I don’t know if you remember the song “Cat’s in the Cradle.”

Karim Hijazi: Oh man, legendary.

Manoj Tandon: Legendary, right? It totally comes full circle. In the end, the child grows up to be like their parent. I think maybe we’ve lost a little bit of that in this world today.

Karim Hijazi: I would agree, yeah.

Manoj Tandon: I don’t know if that’s a good thing. If children’s number one role models become their parents, in a lot of instances I think that might lead to more good than bad.

Karim Hijazi: I couldn’t agree more. That’s why the answer is a little different than the generic answers of, “Oh, well, I knew I wanted to make a ton of money, and I wanted to be rich, and I had these ideas.” That’s all there, but that’s not the driver. The driver is an emotional driver. The driver is something that gives you some sort of feeling. Like we talked about, you don’t have that feeling until something works. Then when something works, it’s even that much more catapulting into the next phase of things. So per your statement about “Cat’s in the Cradle,” my kids are doing what I did to my dad, which is, “Well, can’t you do this?” I’m like, “No, sorry, I’m busy.” I was doing that for many, many years, and now I’m finally changing that methodology around actually, to be honest. I’m shifting from being so explicitly focused on work to focus on personal well-being and things like that, which is a big thing that gets forgotten about a ton with entrepreneurs as well. That could be a whole show in its own right, by the way.

Manoj Tandon: It absolutely can, and we’d love to discuss that. We’ve had some very interesting topics in that regard, and it’s a big part of entrepreneurship. It’s one thing to have the knowledge in the area in which you’re pursuing, but I think even bigger than that is dealing with those fears of failure, jumping into the unknown, and betting on yourself. Since we’re there, I gotta ask you: do you have any advice on that for anyone that’s thinking about taking a huge step in that direction?

Karim Hijazi: Well, it’s one of those classic situations where if you have it in you and you’re willing to take the risk, because that’s the part that a lot of folks don’t get past, they think themselves out of the opportunity. I have a friend of mine that I talk about a fair bit on these podcasts that I do, either as a guest or as a host. It’s funny because he’ll call me with an idea that’s good. At least at first glance, it sounds like a good idea, and I’m like, “That’s great, go for it!” He’s like, “Yeah, but what if that happens? And then if that happens, that’ll happen. And then if that happens, then I really can’t do that.” Literally 30 minutes into the conversation, he’s convinced himself out of doing it. It’s sad because he’s done this several times. If he had just pursued it one of those times, who knows? He may have actually gotten the momentum and the inertia to keep it going. I look at this as very personal advice, and this is not any kind of financial advice from me, but I say take the leap because this is experiential at minimum. You have an incredibly interesting experience trying to start companies and driving things forward. If it doesn’t work, it doesn’t work. Most things don’t work in the beginning, as we all know. It takes several attempts to get somewhere. So I couldn’t agree more. If people are listening that are on the precipice of starting, I say jump because it’s terrifying, but that’s where you feel alive frankly. When things do start to work, or the worst that happens is you go back to what you were doing.

Manoj Tandon: That’s right. I mean, if you look at it in that regard, is failure such a bad thing? In fact, can you even succeed without it? I’ve said that many times. I’m sure the listeners are tired of it, but it’s very true. Is it even possible? So tell us about “The Introverted Iconoclast.” First, that’s an interesting name. How did it come about, and what’s your mission there? What are you doing with this thing? What are you trying to do?

Karim Hijazi: The name is indeed a mouthful, but when you peel apart the words, and funny enough, as much as it wouldn’t seem like I am, I am an introverted person. I kind of play an extroverted person on TV, literally like what we’re doing now. I think people have a misperception of introverted people as shy and completely sitting in the corner as wallflowers. There are probably extreme versions of that that may be considered so, but no. I think my version of introversion is two things: it’s being more reserved and more ingesting versus egressing information in many cases. You wouldn’t believe so from my podcast, but that is actually a huge part of an intelligence operation, listening more than you’re speaking in many cases. So that actually came in handy as a character trait with my work. I also don’t particularly like ruffling feathers, which is really a problem because if you’re getting anywhere in the world, you’re going to eventually irritate somebody or something in order to be a changemaker, which is the definition of an iconoclast, at least the modern version of the term.

Manoj Tandon: Right. And you’ve definitely ruffled feathers.

Karim Hijazi: I have. So all my attempts to not do it have failed miserably, and I’ve become more of an extroverted disruptor than an introverted iconoclast. But my intention was to always be someone that was a changemaker, but did it in a very diplomatic and non-wave-making way, which is very hard and almost impossible. So I like the contradiction in terms. It really defined my character and my intention from the beginning of when I started everything I wanted to do. That’s how it came about. So it’s a very long-winded story for the titling of it.

Manoj Tandon: No, but it’s really cool because we would never guess that about you. I can tell you, having seen you on the news so many times, having seen you in so many places, I’m like, “There’s no way!” I would never peg you for an introvert.

Manoj Tandon: It’s very interesting. So, is the show focusing on the nuts and bolts of cyber, or is it not?

Karim Hijazi: No, I’m not actually, which is interesting. The origins of the podcast, believe it or not, do not start glamorous, but they end up a little bit more so. Originally, like anyone else, I started to see that podcasting was becoming a really powerful medium for delivering information or marketing a company, a product, or a person. I called my marketing team and talked to my CTO at the time and said, “Start a podcast for the company. Just go figure it out.” I didn’t know anything; I didn’t listen to podcasts, quite frankly. This is kind of funny. I was like, “Go do it,” and they didn’t do it. Back to startup life, where you usually do everything at some point because no one else can do it. I asked them again, they didn’t do it, and I was like, “Okay, fine. This can’t be that difficult.” So I did the typical podcast thing: I got all the equipment in the world that you don’t need for a podcast. It was fun buying it. I had the switches and dials and mixing boards, and I was like, “What the hell am I gonna do with this?” I was playing producer, which I should not be doing because I’m not a producer. You don’t need all that for a one-person situation. I didn’t have the Joe Rogan experience in front of me with a bunch of guests sitting at the table. But what was interesting was I did the classic thing: even as a seasoned entrepreneur, I got all set up, and then I stared at the empty mic and I didn’t have anything to say. Then I started to figure out, “Okay, let me start talking about some things.” I did a couple of recordings that were nuts-and-bolts recordings. They were not technical, but they were boring. They were just nothing you wouldn’t hear elsewhere and nothing you wouldn’t hear in my interviews with media, which have to be pretty structured and scripted in some cases. I was like, “Why would I want to put something out like this that you could probably just catch me on Google or YouTube doing?” That’s when it occurred to me that I always wanted to do some sort of memoir of what has happened, which we’ll talk about through this episode. I thought this was a good medium, so let me try that out. Literally the first four or five episodes of this podcast were basically a recollection and storytelling of my career and how I got to where I was in short form. Little vignettes of what happened, everything from jumping from a bartending job to being a corporate spy inadvertently, not even intending to get into that world, then turning into a counterintelligence pro and then moving into cybersecurity. I did it over the course of four or five episodes, and I was hooked on my own podcast. I got excited. It’s very cool, and that’s how it all came into being.

Karim Hijazi: To answer your question a little bit more deeply about where it’s going and what its purpose is, I think it’s still coming into focus because I did move into interviewing folks similar to what you’re doing. I get some really interesting people. They’re not necessarily cybersecurity people. I think I’ve had maybe two cybersecurity people in the entire span of this podcast. One is Arsalan Khan from White Ops Security and now Tenable, a really amazing guy if you ever get a chance to talk to him, and then Rob Lee from Dragos. We’ve had laughter yoga coaches, a brand manager from Procter & Gamble, and New York Times bestselling authors. While they may not directly be in cybersecurity, there are concepts that they’re putting forth that are absolutely relevant when you look at counterintelligence and you look at understanding your adversary, getting into their mind, and creating defense in depth. Those are broad-brush conversations; they’re not pure nuts and bolts. I think there’s a lot about mindset in many ways. If the mindset doesn’t exist, the execution is going to be pretty mediocre. We see a lot of that out there in the industry.

Manoj Tandon: Yes, very much so. Please do that. I think that’s fantastic. I’m going to tune in, I’m going to subscribe, and see what’s going on. Quite frankly, the other thing is that there are so many cybersecurity podcasts out there, and in many ways, it’s such a dry topic. It’s the one thing I’ve been brainstorming with Emily and with some of our other marketing team members: we got to get this to a place where people are going to want to tune in. I think that for the 50 or 60-year-olds, unless they’re truly interested in this, we’ve lost them. But I’d like to get the younger people to listen in and develop that mindset. If they develop that mindset, it’s going to naturally lead to a safer world, maybe not a perfect world, but a safer world.

Karim Hijazi: I think to your point on cybersecurity podcasts, there’s a dichotomy because cybersecurity is probably the most sexy, glamorous rock-star part of technology collectively. It’s just more interesting stuff. However, you still have to get to a subset of it that is a little bit of, I’ll be candid, where I think I live, because I don’t have a boring day in my world, as we’ll talk about. Those are the stories that are more like what people think it’s like from Hollywood, as it’s conveyed to the masses, and certainly in more recent times where headline news has made it a common, known issue. Finally, it’s coming to that point where people are starting to go, “Yeah, that’s scary.” The fear factor brings excitement with it as well. It’s terrifying, but also exciting. There are not that many of us in that world. Then you further dissect it between government and private sector, and you reduce it down even more to maybe just a few folks that really have an interesting life on a day-to-day basis. So you’re right. It’s unfortunately not as common to find folks that have these types of stories and certainly have them manifest in the form of a podcast. There’ll be some for everyone’s flavor profiles depending on what they like.

Manoj Tandon: Very cool. So tell us the story. You were mentioned in the book “We Are Anonymous.” What led to that? What’s the backstory on this?

Karim Hijazi: Oh man. Thank you, Parmy Olson, I love you dearly for writing that book. So this goes back a ways, around 2008 or 2009. I was involved in some work that had to do with pursuing botnets back then. For those that don’t know, botnets are computer networks that have been ad-hoced together by adversaries. They’ve deployed malware onto machines through a variety of methods, and those machines become zombies. They all speak to a command-and-control environment that the adversary controls, and they essentially build an army of zombified machines out there to do their bidding. Back then, it was less about information gathering and more about denial-of-service attacks, which is essentially having all these machines call onto some central point, some server somewhere, to shut it down. Today, that capability still absolutely exists. They’ve just added to the toolkits they’re now able to use these botnets for. That led to the founding of my company called Unveillance, which resulted in getting acquired by Mandiant. Leading up to that event, I got Unveillance starting and going in a really good way. I spearheaded an offensive effort. I’m very careful with the way I frame those words because the minute I say “offensive” within the community, people freak out. Offensive implies that you’re hacking back in an environment where it’s either nation-state or cybercriminal, and sometimes you don’t know what the target is that you’re responding against. It could be an innocent party.

Manoj Tandon: Oh, I’m sorry. Is it really hacking back, or is it getting proactive? Because when you look at even the SANS Institute, they put out the scale of cybersecurity, and the last block on that is proactive aggression.

Karim Hijazi: It’s both. Again, this is the problem with our industry and lexicon. People get wrapped around the axle on words. My version of what I consider what I do is proactive. Yes, it’s impacting infrastructure of the adversaries, but it’s done in a very specialized way. This leads me to the story. We were taking down infrastructure, namely command-and-control environments of bad guys, indiscriminately in 2011 when the company was in full motion. The whole gaggle of them that we were impacting, whether they were nation-state actors or cybercriminals, were not happy with us. It just so happened that we took down part of the infrastructure that LulzSec had set up to attack some of these environments. In doing so, all of a sudden their systems went offline and they were like, “Wait, what?” They went digging around to see what happened and realized that it was us that did it. We didn’t even know we took their stuff down. We were just indiscriminately going after what we do on a daily basis. We drew their fire essentially and ended up in this online fight between my team and them. Again, we were small enough to where we didn’t have a PR team that said, “Don’t reply.” The big guys never did; they just dealt with it and moved on because it’s kind of like, “Don’t give it any energy.” But we were also tenacious enough to say, “No, don’t mess with us either.” Just because they thought they were black hats didn’t mean we weren’t as formidable as they were. It ended up being this verbal pissing contest over encrypted chat channels that were recorded and that Parmy got ahold of for the book. I worked in symphony with law enforcement and the intelligence community to ultimately identify the folks. They went down for coming after us. They picked on the wrong group.

Manoj Tandon: That is insane. So when you say they picked on the wrong group, this was not just some Twitter back-and-forth. You guys were actually in the trenches going after infrastructure and operations.

Karim Hijazi:
Yeah, and that’s the thing people don’t fully appreciate. Back then, the lines between private sector intelligence work, cybercrime disruption, and law enforcement cooperation were much blurrier than they are now. Today there’s a lot more structure around it, but at that time it was very Wild West. You had a bunch of really talented people that understood networks, malware, command-and-control infrastructures, DNS, sinkholing, and all these concepts, and there weren’t many organizations doing it at scale. So when we started aggressively taking down infrastructure, people noticed very quickly. What was fascinating is that the adversaries themselves started recognizing us as a threat. That’s when things got surreal. You’re sitting there reading encrypted chats where they’re actively discussing you, trying to figure out who you are, what your capabilities are, whether you’re government-affiliated, whether you’re contractors, whether you’re criminals yourselves. It became this bizarre cat-and-mouse game.

Manoj Tandon: So at that point, were you concerned about personal safety? Because these weren’t exactly harmless people.

Karim Hijazi:
Oh, absolutely. There were moments where it got uncomfortable. There were doxing attempts, threats, harassment campaigns, all the classic things you’d expect. But I think the thing that grounded us was understanding that most of these people operate from fear and intimidation. If they can scare you into stopping, they don’t actually have to beat you technically. Now, that said, there are absolutely dangerous actors in this world. Some are nation-state affiliated, some are organized crime groups, and some are just highly capable individuals with a grudge. So you don’t take it lightly. You operationalize your own security. You become careful about what information is public, how you travel, what infrastructure you use personally, and even how you communicate. I always joke that once you really get into intelligence and counterintelligence work, you stop looking at the internet the same way ever again.

Manoj Tandon: I can imagine. It’s almost like once you see behind the curtain, you can’t unsee it.

Karim Hijazi:
Exactly. That’s probably one of the biggest psychological shifts that happens in this industry when you get deep enough into it. Most people still look at the internet as this utility. It’s like electricity to them. It’s just there. They don’t think about the underlying infrastructure, who controls it, who’s manipulating it, who’s monitoring it, who’s attacking it, or how vulnerable it all really is. When you spend enough time tracking adversaries, you realize how incredibly fragile many systems are and how much of society is built on trust assumptions that are honestly terrifying.

Manoj Tandon: That’s both fascinating and horrifying at the same time.

Karim Hijazi:
It is. But I also don’t want people walking away from this conversation paranoid. That’s important too. One of the problems with cybersecurity messaging is that we often create paralysis through fear. People hear all these stories and think, “Well, everything’s compromised anyway, so why bother?” That’s the wrong takeaway. The takeaway should be awareness. Understand the environment you’re operating in. Understand that attackers are opportunistic most of the time. They’re looking for the easiest target, the easiest path, the least resistant organization. Cybersecurity isn’t about becoming invincible. It’s about making yourself a harder target and reducing risk intelligently.

Manoj Tandon: That’s such an important distinction because there’s this mythical idea that we can somehow achieve perfect security.

Karim Hijazi:
Perfect security doesn’t exist. If someone in this industry tells you otherwise, run. Everything is a risk equation. Everything. The question is: how difficult are you making it for the adversary, and how quickly can you detect and respond if something goes wrong? The organizations that survive incidents well are not necessarily the ones that never get breached. They’re the ones that have resilience, visibility, response capability, and leadership that can function under pressure.

Manoj Tandon: You know, that brings up something interesting. You’ve worked with governments, intelligence operations, private sector companies, and startups. Who’s actually doing this well?

Karim Hijazi:
Honestly? Very few. And I don’t mean that negatively. It’s just that this is an incredibly difficult problem space. Most organizations are still very reactive. They buy products hoping products will solve strategic problems. They think cybersecurity is about tools when it’s really about operational maturity, visibility, intelligence, and people. I’ve seen organizations with every shiny security product imaginable still get completely wrecked because nobody knew how to operationalize the data coming out of those tools. Then I’ve seen smaller organizations with far fewer resources do remarkably well because they had discipline, process, and strong leadership.

Manoj Tandon: So where do you think the industry is heading? Are we improving?

Karim Hijazi:
I think we’re simultaneously improving and getting worse at the same time. The defenders are absolutely getting more sophisticated. Detection capabilities are better. Threat intelligence is better. Collaboration is improving. Governments are taking it more seriously. Boards are finally waking up to the fact that cyber risk is business risk. But the attackers are evolving just as fast. The barrier to entry for cybercrime has collapsed. You don’t need to be some elite hacker anymore. You can buy ransomware kits, phishing kits, malware-as-a-service, initial access brokers—it’s an entire economy now. So we’re entering this strange phase where cybercrime is industrialized. And then layer artificial intelligence on top of that.

Manoj Tandon: That’s exactly where I was going next. Everybody is talking about AI right now. What concerns you most?

Karim Hijazi:
Scale. AI changes the scale of everything. Social engineering becomes more convincing. Phishing becomes personalized at scale. Reconnaissance becomes automated. Malware development accelerates. Deepfakes become believable. Historically, attackers were constrained by manpower and time. AI starts removing some of those constraints. But—and this is important—the defenders also gain advantages from AI. So again, it becomes an arms race. The organizations that win are going to be the ones that adapt culturally the fastest, not just technologically.

Manoj Tandon: That’s such a critical point because culture keeps coming up over and over again in these conversations.

Karim Hijazi:
Because culture is everything. You can tell within five minutes whether an organization has a healthy security culture or not. Do people communicate? Do teams collaborate? Is security isolated? Are executives engaged? Are engineers empowered? Are people punished for reporting mistakes or encouraged to surface issues quickly? Those things matter more than people realize. A toxic culture will undermine even the best technical security program eventually.

Manoj Tandon: I completely agree. Karim, this has been absolutely fascinating. I feel like we could probably do five episodes and still not cover all of this.

Karim Hijazi:
[Laughter] Probably true.

Manoj Tandon: Before we wrap up, where can people find your podcast and your work?

Karim Hijazi:
The easiest place is probably LinkedIn. I’m pretty active there. The podcast, The Introverted Iconoclast, is available pretty much everywhere podcasts are distributed. And of course, Prevailion’s website has information about the company and what we’re doing around cyber intelligence and adversary infrastructure monitoring.

Manoj Tandon: Fantastic. Karim, thank you so much for taking the time to do this. This was truly an incredible conversation.

Karim Hijazi:
Thank you for having me. I really enjoyed it.

Manoj Tandon: Likewise. And don’t be a stranger—we definitely want to have you back.

Karim Hijazi:
Absolutely. Anytime.