Navigating Cybersecurity Challenges: A Conversation with Ted Gutierrez on Bridging OT and IT

Ted Gutierrez (NaN:00NaN) Yeah, my pleasure. Thanks so much. I think I've got to actually thank you for the the, the leniency and the and the patience because I remember I think an asset under sizzle called me right when we were in the middle of the podcast, you were more than gracious with your time. So thank you. Yeah, thank you for the opportunity to be on the show. My name is Ted. I'm a Houstonian.

Ted Gutierrez (NaN:00NaN) I am the leader of a company called Security Gate, which I founded the better part of a decade ago and on the premise that cyber risk assessments, cyber control gaps assessments, threat assessments, they were gonna be a very important component of implementing products and solutions in the critical infrastructure sector. So have a great team based out of Houston, as well as Milan and really excited to talk about a couple of the things that I think maybe haven't been chosen to talk about on your podcast. Thanks for the opportunity.

Ted Gutierrez (NaN:00NaN) Yeah, so I think it's important to understand kind of what my purpose for founding the company, along with my co-founder, Sharisa Sparsa. So I used to be an auditor at Shell, and I actually started in the quality risk management. That moved into risk management, and eventually she was an asset owner, OT budget owner. She did that for a pipeline company, then she did it for an offshore driller.

Ted Gutierrez (NaN:00NaN) And so we came together because she had to certify the world's first rigs at Shell to a known cybersecurity standard. She said, hey, how did it work when you were at Shell? And so we just put our heads together. We recognized that asset owners have a lot on their plate and when they decide that they wanna make an improvement in their overall cybersecurity risk posture, maybe it's a compliance effort, maybe it's a visibility effort, they're generally gonna start asking some questions about known controls.

Ted Gutierrez (NaN:00NaN) manual, archaic, break and open seashells with rocks kind of exercise with Excel. And so we just built a multi-tenant software that can pull all of these so-so's, OT directors, IT directors, vendors. Think of us as some people call us a GRC for OT.

Ted Gutierrez (NaN:00NaN) It's unique, over the course of the last decade, we've had this awesome opportunity to work with companies that are in kind of what I call a base lining stage. They don't really know what they have. Maybe they're doing a lot of M&A, and they just need to figure out what do those facilities have from a controls perspective.

Ted Gutierrez (NaN:00NaN) And then there's other customers that have been accelerating drastically their digitization and the decentralization of the overall risk management process. And so we help in both. And so I always tell people that our business model is we are a licensed software as a service that we sell to enterprises, right? In an annual revenue capacity. That's like the investor answer. But if I was going to tell the average person that doesn't really understand that, I would say we are in the.

Ted Gutierrez (NaN:00NaN) business of marriage counseling for OT and IT. Because right now there's, and this is a huge topic that I don't think, I think some people talk about IT will never converge and we must converge. There's so many sides of the story.

Ted Gutierrez (NaN:00NaN) The truth is, this is an extremely diverse asset owner base, and what I try to do on a regular basis, 80% of my time is just talking to CISOs about their kind of plan and what they're trying to leave behind. What I find is that CISOs that are really, I think, fulfilled in their work,

Ted Gutierrez (NaN:00NaN) CISOs that I think are given accolades by their fellow teammates for their leadership are those that are focused on leaving a legacy Right. And so when I go to work every day, I'm like, how can I visualize something to help them leave that legacy? So I hope that answers your question without being too product centric. I don't want to I don't want to plug the company but You know, I'm in the business on the business side of cyber security personally, so

Ted Gutierrez (NaN:00NaN) Mm-hmm.

Ted Gutierrez (NaN:00NaN) Yeah, I tend to agree. I think that the challenge is, some people say, BLEEP

Ted Gutierrez (NaN:00NaN) it's on the, for some companies, it's on the budget side, right? So the asset owners, the operational players, all the automation players are really the ones driving the budget and maybe they have an experience in cyber security. What I see a lot is budgets are already, the budget approval process, the procurement process, the vendor selection process, the general budgets around cyber security have always kind of fell under IT. So I see that is, people are trying, in my estimate,

Ted Gutierrez (NaN:00NaN) to get OT to kind of follow IT's lead, and that usually means rolling up to a CISO or a CIO on what are we gonna do next. And so there's a very healthy amount of the market, especially your middle market, people that are not your blue chip asset owners that have had budgets forever. A lot of these, what I call new entrants to the market.

Ted Gutierrez (NaN:00NaN) Not only do they not know where to start in, let's say, just in general, protecting some of these facilities that have always been running and now they're concerned about it, they don't actually know how they're going to go about evaluating vendors and even knowing what is next. So I do think that there's a very healthy amount of what do I do next? How do I figure that out?

Ted Gutierrez (NaN:00NaN) But what also complicates that same story is there's so many different frameworks. There's so many different versions of these frameworks regionally. So like what I spend, and I say me, it's not me, it's not me, it's far smarter people on my team. There's a healthy amount of time on the roadmap just making sure that we stay up to the most updated version of CMMC or C2M2 or NIST, all of them, okay? And I think that's a challenge for asset owners too.

Ted Gutierrez (NaN:00NaN) up this whole concept of language, we only talked about budget, right? When you think about the controls, somebody says asset inventory, somebody says vulnerability management, somebody says I saw it yesterday.

Ted Gutierrez (NaN:00NaN) business continuity planning, and somebody else says incident response planning, right? So there are these finite differences in language that to the untrained cyber risk manager, to the younger cyber risk manager will create confusion. And then you have the vendors come in and say, no, we call it incident response. And so I think that there is, we're going through the motions right now where syntax matters. When I...

Ted Gutierrez (NaN:00NaN) start talking to relatively kind of baselining organizations that maybe haven't done tons of, maybe they don't know what their top five controls are across the company. It's all about syntax. Like you have to settle in on some level of language and I do agree for OT and for IT, I think that if you can select the right framework or the right frameworks, plural,

Ted Gutierrez (NaN:00NaN) than do so with the idea that you're trying to find common ground on the controls. And I think that's where a lot of people are gonna save time, money, energy. They're gonna actually get better. And a lot of people don't do it. What I find with a minority today is, well, that's the OT group. They have their own budgets and they have their own program and I'm not really a part of those meetings, so we're only gonna focus on this. And if they are saying that, they're

Ted Gutierrez (NaN:00NaN) They're also saying at the same time, we're trying to change that. So we have now a combined meeting. So time will tell. But I mean, for those, that's why I think consultants are in such a, there's a supply demand issue on the consultant side because they need, some people need the handholding and they want that advisory, right?

Ted Gutierrez (NaN:00NaN) Yeah. All right.

Ted Gutierrez (NaN:00NaN) We've got a, so I'm the coach of my son, great example. And as a guy who loves to play with tools and cars and stuff, I totally agree, right? I'm the coach of a bunch of nine year olds in basketball. These kids can barely dribble, okay? We are not, we are not the Harlem Globetrotters, okay? The.

Ted Gutierrez (NaN:00NaN) I'm the assistant coach, okay? The coach is using one of those like NCAA whiteboards with the little pegs and he's like, okay, we gotta run this play. And then he comes to the practices with like this folder of all these things that we're gonna work on. And honestly, they're tactics, right? They're tactics of how do we throw the ball at? Totally important.

Ted Gutierrez (NaN:00NaN) Is it the right time to get that level of capabilities focused on that? I think the easier answer would be, let's just let these kids scrimmage for the next hour. Because what they have to learn to do is move the ball. What they have to learn to do is understand, okay, now we're going this way, now we're going this way. How do we play defense? If you translate that to a cyber risk management program, make it tough because you got global teams. Make it even tougher that those global teams

Ted Gutierrez (NaN:00NaN) Make it even tougher that the automation equipment at different facilities that have been acquired over the course of 30 years are all on different stacks and everything from an infrastructure perspective may not be perfect. You've got vendors telling you they can literally fix all of it if you just come on board with them. I kind of think like the coach.

Ted Gutierrez (NaN:00NaN) The CISO, in some cases it might be the board, it might be the president. If you go and run to try to solutionize your way out of cybersecurity, I think you're gonna spend a lot more resources. I think that if you're like that coach that says, hey, let's pick two controls, let's focus on them and execute them brilliantly, let's get a risk registry of all these other controls and then maybe let's compensate those controls with our processes, maybe insurance, different things like that, then the next year you come back and you add

Ted Gutierrez (NaN:00NaN) the same way that for a small basketball team, maybe we don't do inbound plays at age nine. So, and so like, man, I could talk about this all day long because this is what I'm gonna, I have a very break glass topic at S4 this year about investors and analysts and kind of what I think they're doing to the OT market.

Ted Gutierrez (NaN:00NaN) Bottom line is that this challenge that you and I are talking about is exacerbated with the amount of capital that has been deployed in the last three to four years. So I think it's almost like white noise in a lot of ways to these CISOs and I feel for them because if you really sat CISOs and leaders down who were passionate about solving cybersecurity issues, don't you agree, Aaron, that most of them would be like, yeah?

Ted Gutierrez (NaN:00NaN) If I could cut my roadmap in half, if I could cut all that noise in half and just focus on this, I'll get to the next one next year. I think they do that, but I think there's so many external pressures, including kind of how they're rated at their job, they got to just go with the flow.

Ted Gutierrez (NaN:00NaN) Do you really? Do you really?

Ted Gutierrez (NaN:00NaN) Yeah, I talk a lot about this. I have, for the past two years in Europe, at a conference in September, talked about this. And the NIST implementation tiers are pretty cool. Because the way that I like to look at it is,

Ted Gutierrez (NaN:00NaN) Most people coming from the investor world don't recognize that just because you have a facility out there doesn't mean that it's ultra critical to the business. So you never hear in the Wall Street Journal or, and I'm not picking one new source, just the first that came to mind, but when you see cyber attack happening somewhere, okay, so out of all the facilities or out of all of the...

Ted Gutierrez (NaN:00NaN) different infrastructure, what was it, you know, what actually happened. A lot of these people are taking assets offline just to be, you know, ultra protected. I always ask the following question, have you tiered your facilities? And maybe you used a business impact analysis to do that. Because you're right, not everybody can and should try to reach that high level.

Ted Gutierrez (NaN:00NaN) You know, it's from an auditor perspective, do you have a cyber risk management system that is in a state of constant evolution without management input? That's where everybody really wants to get, is that you've decentralized your cyber risk management program, or somebody says, hey, that guy's not supposed to be in this facility, or this looks odd, right? When you go back to a one, it's like, cyber what? Like, I don't know. So some facilities, maybe they're storage facilities, maybe they just don't have any critical processes.

Ted Gutierrez (NaN:00NaN) That's where they should be a one or maybe a two. But the money makers or the ones that involve some sort of risk to life or ultra downtime that is gonna cost the company on its P&L, that's where the majority of the resource is gonna be. Take it from me as a product CEO who really lives by the land and expand methodology. You go into one facility or one part of the organization, you add value, they talk to their brothers and their sisters and then you start growing, right?

Ted Gutierrez (NaN:00NaN) The problem that I think the OT market has, and I'm gonna dive into this over the course of the next couple months, is that somebody didn't tell investors about how OT doesn't scale like IT, fundamental. Part of it has to do with criticality, part of it has to do with maintenance cycles, part of it has to do with the life cycle of automation equipment, but I think that's one of the reasons that

Ted Gutierrez (NaN:00NaN) the product and the service market is going through, I think it's going through a lot of M&A right now, I think it's going through consolidation right now, I think there's a bunch of layoffs right now. You tie that with the same frustration and turnover at the employee base of the asset owners. And what you have, you got like, you just, I think we're missing the opportunity to mature as a ecosystem of, I don't know, 10,000 people, 50,000 people.

Ted Gutierrez (NaN:00NaN) You're trying to do too much too fast.

Ted Gutierrez (NaN:00NaN) Well, tell salespeople in this market that are selling products and services. We need these folks, okay? But cost of acquisition is extremely high. So I'm a dog guy. Dog cat, got any pets? Okay, so you got two dogs. No, oh, yeah. I had two bearded dragons with my eight-year-old and then one of them ate the other one. It was pretty amazing.

Ted Gutierrez (NaN:00NaN) So check this out like I just like while you were talking I had this visualization When we think about like how many products are in the market and how much noise there is of course everybody thinks they're better than the Next guy let's not foolie. Which is fair. That's called capitalism, and I love it How much dog food are we honestly gonna buy when we walk through that? grocery store line and there is a hundred types of dog food

Ted Gutierrez (NaN:00NaN) It doesn't really matter that there's 100 different new vendors. It doesn't really matter that there's 17 types of bones because our capacity to buy from that industry is that we got two dogs apiece. We're probably going to buy one bag a month. The calculation that I think is really interesting to dive into are the proposed and assumed ACVs. ACV in the startup world is average contract value. Some people call it annual contract value. Same thing.

Ted Gutierrez (NaN:00NaN) I think that people think that the average asset owner is able to deploy this much capital for that product. And where I think we're having a lot of pressure in the market is that this is getting pulled down below expectations, and that's where layoffs happen. Let me ask you a question. You have folks on the show all the time.

Ted Gutierrez (NaN:00NaN) How many people do you think right now, percentage-wise, have deployed highly technical guardian solutions? We can even say it on IT and OT, okay? But in the past five years, they've deployed these without really thinking about how much work it was gonna take to maintain it or even configure it effectively, and then who's the bad guy? The product company, right? Does that happen often in your viewpoint?

Ted Gutierrez (NaN:00NaN) It's funny because, and this is not a knock to the incredible innovation that the industry has had in the past decade. I mean, hats off to some real great stories about asset owners being protected, whether that's with great service or whether that is with great products in the market.

Ted Gutierrez (NaN:00NaN) But I'm a car guy, and in cars and racing, you wanna get around the racetrack as fast as you can. One thing I know, because I'm generally a novice moving into amateur, sometimes too much speed or too big of an engine or too big of a car almost always, always lowers your lap times if you can't handle that car.

Ted Gutierrez (NaN:00NaN) So you gotta start with a slower car. You gotta start with a slower, you can actually gain more speed in a car that doesn't have as much horsepower. The same applies for any sort of program. I don't care if it's a basketball team or if it's a cyber risk management. Now, where I think.

Ted Gutierrez (NaN:00NaN) It's really interesting. I would not say the same about safety. I would not say the same about quality, because there's a certain standard, and if you don't meet it, then you can't do business, right? Do you think cyber has that same standard, or do you think that's the sizzle? I'm just kind of riffing now.

Ted Gutierrez (NaN:00NaN) Yeah, what's interesting is, so I have a unique vantage point of the market, which is a lot of people that I talk to, I talk to because they're at some point of a transition in their maturity program, in the way that they're thinking about cyber. And so they either want to get started and jump start something, or they want to digitize it, they want to accelerate it. And so they often, in some way, shape, or form are running assessments.

Ted Gutierrez (NaN:00NaN) And there's probably 20 different, I don't mean frameworks, there's 20 different types of assessments you can do and then there's 50 plus frameworks you can use to do those. Where was I going with this before I got off? The majority of them, the majority of them when they're in that transitional period, I would be lying if I said 50% or more.

Ted Gutierrez (NaN:00NaN) had previously implemented a really expensive solution, for whatever reason, it didn't match their expectations that they were either promised or they promised themselves, and now they don't know what to do. So the majority of people that are in some sort of transition, okay, and this is a totally different topic, that, I'm not gonna say sours their perspective on the market, but it does incorporate one constant.

Ted Gutierrez (NaN:00NaN) everybody wants to drive efficiency to that next layer of implementation or product purchase. So if somebody's been spending, let's say, $200,000 a year on this given set of controls, if they're not ultra pleased, they're going to want to spend $160,000 the next year, and they're going to change vendors, or they're going to change strategies. So I see that a lot.

Ted Gutierrez (NaN:00NaN) And the reason is because I'm at a juncture where people are trying to digitize, they're trying to change. If everybody that is trying to change is also trying to save more money, then I ask the market, is that because top line budgets are lowering or is it because they're trying to...

Ted Gutierrez (NaN:00NaN) use the same amount of budget across more controls? Or are they actually just trying to save money left and right by getting rid of things? These are the questions that I propose to market leaders, the investors in the market, the product leaders, the VPS sales, the CTOs, the CPOs. The idea that the more that we build as a collective audience or collective worker bees of innovation,

Ted Gutierrez (NaN:00NaN) I don't think there's a one for one ROI on everything that we build. It's almost as if we gotta pace ourselves in this market. We have to stop thinking about what's my roadmap for the next 12 months, and we need to start thinking about what do I want to be true in 10 years? And I think that asset owners respect that perspective, at least the ones that are gonna be most successful are. I think we've run really fast as a group of people.

Ted Gutierrez (NaN:00NaN) including asset owners. And I think right now we're all just kind of like taking our breath. We're on that ruck march with you and we've got 60 pounds on our back where you're like pacing along, you're fine. The rest of the industry is winded. And I think we're seeing that. We're seeing it with layoffs. We're seeing it with stock prices. We're seeing it with M&A. Just a couple of my perspectives.

Ted Gutierrez (NaN:00NaN) Workforce management, automation, digitization, I think there's a lot of product finger pointing. Hey, that solution just doesn't really digitize and automate the way that I had thought it would. I'll be the first to raise my hand and say that some cyber risk assessment programs are so intricately developed manually by ultra smart people.

Ted Gutierrez (NaN:00NaN) You can't have one solution that connects to everything. And if you did, you wouldn't want it to. And that's on the IT side, right? So I think that in a lot of ways, if you're trying to automate, digitize, scale, like all of this, a lot of it is in software, and a lot of it is services, truthfully. I think that the asset owners are seeing that as a miss in the market. I know that because that's where we're, you know.

Ted Gutierrez (NaN:00NaN) I dove into about four years ago this idea of configurability for my own team and it's working because whoever can configure the best recognizes that asset owners all do things differently. If I could tell you the number of NIST CSF or ISO, IEC 624433-2 or maybe ISO.

Ted Gutierrez (NaN:00NaN) that they took the standard or the framework and then they changed it. I think that the digital solution world from a lot of our marketing incumbents, they just can't keep up, especially not in this space. That's where I live, so I will say, from a product perspective, I think that there's a lot of finger point and says that solution didn't do it. It can't keep up with us in our OT methodology. From a guardian solution perspective,

Ted Gutierrez (NaN:00NaN) I don't think there's a lot of product issues. I think there, I think, I don't have probably enough data to put it on a screen, but it's a great thing to start asking folks. I mean, sometimes folks just say, I have heard in the last three months with some really big market players, yeah, we rolled that solution out, it didn't do what they promised. Not pointing any fingers, but that happens.

Ted Gutierrez (NaN:00NaN) What I hear more is the previous CISO had deployed this solution and that was under this sort of risk management methodology and we're not doing that, we're doing this. So I think it's harder to judge whether or not the Guardian's solutions are fulfilling the tasks that they promised. What I can say without doubt is that the price points are not achievable anymore. And.

Ted Gutierrez (NaN:00NaN) that's a different conversation on why we think prices continue to increase. It's the same challenge that I think they have with scale, right? So I think that your general question is like, why are people shifting gears, going to different product types, maybe changing strategies? I think that the underlying challenge is qualified personnel within the industry. It's, I don't know, somebody said this, like I said before you self-diagnosed yourself.

Ted Gutierrez (NaN:00NaN) depressed, make sure you're not surrounded by jerks. But those are not my words, and it's not jerk, it's actually something else. The same thing could be applied to, before we self-diagnose that the last two years of our cyber risk journey were a failure, let's take a look at the team that we had. Let's take a look at the strategy that we had, right? Before we say that we're not a carpenter, did we have a plan when we built that dog house, or did we just start hammering nails? I mean...

Ted Gutierrez (NaN:00NaN) So I don't know, the one thing I can confirm, Aaron, is that there is a shift right now, and it's twofold. There are, let's say, more mature asset owners that have been buying some of these new solutions since 2020 and they are battle scarred, they are hardened. They are not gonna deploy resources infinitely because they're told to, okay?

Ted Gutierrez (NaN:00NaN) But then there's this whole other group of the market segment that really, really screws up the math. And that is new entrants to the market that are a little bit lower on the revenue side. They're smaller cap companies, but they have the same risk. And they're starting to buy these. So, man, some of the data that I'm going to show at S4. Let's just say that.

Ted Gutierrez (NaN:00NaN) Asset owners aren't buying more per unit. The number of asset owners buying is increasing, and it's skewing the belief system of how valuable some of these products are.

Ted Gutierrez (NaN:00NaN) I don't think we have an addressable market size problem. I think we're trying to attack as much of the market as fast as humanly possible, because that's what venture capital does. And when you don't really hit the mark financially, what happens? Who really gets hit when...

Ted Gutierrez (NaN:00NaN) Asset owners don't respond to your marketing and your sales as much. It's employees, it's team members. So now we have a cycling problem with really qualified people in the market. Part of that is capitalism, but part of that is also I think a little economics and assumptions that were a little rich. So we'll see. We'll see. It's definitely a good place to be still.

Ted Gutierrez (NaN:00NaN) Yep. It's a smarter way to do it.

Ted Gutierrez (NaN:00NaN) Yeah, I think we're all learning, right? I mean, as a product CEO myself, ask me if my assumptions have been right in my financial modeling, right? I think we're all learning, right? And I think sometimes you get sunburned and I think sometimes you get a bruise, depending on where you place your bets. I think it's a natural evolution.

Ted Gutierrez (NaN:00NaN) You know, I think a lot of products come into the market. You know, Gartner has, I don't remember what it's called, but a lot of products come into the market. Everybody's super excited about it. And then, and then.

Ted Gutierrez (NaN:00NaN) I can't remember what it's called, but it's this downward swing in supply based on a downward swing in demand because people just kind of get over that. Where we are with various product types, I think there's some really good analysis out there and I think a lot of it has been generally accurate.

Ted Gutierrez (NaN:00NaN) I think we've got to level out. And I think this was happening with the M&A. You see a lot of companies that, if they raised more capital, they're gonna do so at a new valuation, and then to give back the ROI for those investors, they gotta chase an even bigger valuation long term. And I think a lot of companies are saying, okay, we're gonna cash out now because, you know, that, we don't think, maybe we're not positioned for that.

Ted Gutierrez (NaN:00NaN) I really don't think, I think the consolidation of the market is the number one thing that can happen right now to save us all. And that'll keep happening. It's super interesting. I think that if you're a marketing part, if your job is to market the value of a solution and your job is to sell the value of a solution.

Ted Gutierrez (NaN:00NaN) everything's gonna be a nail if you're a hammer, right? So for asset inventory, it's like, you have no idea what's out there. For vulnerability folks, it's like, look at the threats, right?

Ted Gutierrez (NaN:00NaN) If you're a service company, you're like, did you know that there's a $1.8 million open jobs? It's like, who the hell comes up with these numbers, right? I'm bullish on small niche players that really understand their ideal customer profile. And I'm bearish on monster companies, specifically kind of major marketing comments that have had so much market share that they feel like they can just kind of overwhelm the market

Ted Gutierrez (NaN:00NaN) in place. You know, advisory services, I would calculate as extremely important, okay? But I would say implementation players, players that really understand how to get a solution off the ground, those are more niche solution players and I'm bullish on those guys because there's not that many of them. They work regionally, they work sectors, they really understand. I think that...

Ted Gutierrez (NaN:00NaN) One of the core tenants that I take to work every day is if you don't really truly understand the exact customer that you're trying to serve, then you're going to try to serve too many and you're not going to win. Same goes for a sizzle. If you don't know, like who's the actual customer? Is the customer the board? Is the customer compliance? Is the customer the asset owners, non-productive time and safety?

Ted Gutierrez (NaN:00NaN) really good risk management programs, really good product and service companies, I think they answer that question like that. And it permeates across the organization. I don't see it every day. I don't see it on the vendor side and I don't see it on the asset owner side. And it's one of the top questions that I think helps illuminate whether a company in this market dynamics.

Ted Gutierrez (NaN:00NaN) where there's tons of dog food on the aisles, right? Whether we're gonna, whether they're gonna make it or not.

Ted Gutierrez (NaN:00NaN) I think it can apply to anything. I think there's a positive correlation with success in anything that you do, and how specific you can plan out what that looks like. Because if you get a really good plan or what I've always said, and I didn't learn this till probably the last couple of years, but going through the really tough job of planning,

Ted Gutierrez (NaN:00NaN) requires the leader of an organization to actually say no to a lot, a lot, a lot of things. Because when you actually choose the path you're going to go down, knowing and having the confidence that that's the right path is preceded by thinking about all the other paths you could take and actually saying no. So I think that the power of the critical sector cybersecurity leaders

Ted Gutierrez (NaN:00NaN) and it is illuminating right now is their power of no. Maybe I title that presentation that, because that's what it's about. And when assets owners start saying no to things, the product and service companies are like, what do you mean? Especially these big marketing companies are like, what do you mean? And I think that's the power that we must project as asset owners, because there's too much dog food in the aisle, and you only got one dog, so.

Ted Gutierrez (NaN:00NaN) Yeah, it makes sense. I think it makes sense. Yeah.

Ted Gutierrez (NaN:00NaN) Professionally in the cyberspace? I spent a lot of time over the holiday. As a previous soldier walking on roads that I didn't know if there were IEDs left and right, regardless of where geographically we look, I'm concerned about where we are as a globe, okay? I think.

Ted Gutierrez (NaN:00NaN) And where is that gonna take us? A lot of people would say that conflict is a good thing for cyber. Okay, but is it good for humanity? Okay, I think we're balancing right now between, I wrote this in a LinkedIn post and I can't remember what I had said, but I think we're balancing right now as a globe between order and freedom.

Ted Gutierrez (NaN:00NaN) Fundamentally, I think some countries want to be free to think, act, do what they want to do, and others are saying you have to be, you know, there needs to be more order. That balance, I think, is gonna play with the cyber industry a lot. I think that there's no doubt that the addressable market will continue to increase. It will be interesting to see how supply and demand curves feed off that.

Ted Gutierrez (NaN:00NaN) We had a lot of global conflict in early 23 and markets were not moving. So I don't think there's a positive correlation just because there's global chaos or global conflict that everybody's gonna buy more cyber. I don't I don't think so. So you know that's one of the things that I think is concerning. The thing that is encouraging to me is I see the market coming

Ted Gutierrez (NaN:00NaN) I see it coming to an area that I like, and I like talking about the business side of cybersecurity. I'm not a guy that...

Ted Gutierrez (NaN:00NaN) has bought PLCs off of Amazon and set up workstations and critical infrastructure and automation in my living room. It's just not a skill that I have. It's not really, that's not my passion. But how I serve the industry is trying to ask, okay, what are we trying to accomplish here? What are the resources that we have to do it? And so...

Ted Gutierrez (NaN:00NaN) where the industry is moving today, man, it's in my wheelhouse. So, you know, I'm really looking forward to more CISOs talking about the business side of cybersecurity and my core belief system, and I say this in the business of Cyber Series, is there aren't enough resources out there across time, across your team, across budgets. But the threats, the risks, the...

Ted Gutierrez (NaN:00NaN) Business impacts of those risks they still exist and I think they're growing so at some point You know leaders who deploy resources

Ted Gutierrez (NaN:00NaN) should be thinking about the business side of their job, and they are. And so I think that's a positive. And I think over the course of the next decade, we'll see more non-technical leaders understanding cyber. I don't think we're gonna stop hearing about the threats and all the marketing, right? Which is fine. But I do think that we're moving as an industry towards a more sustainable state of cybersecurity, similar to what we've seen in the safety industry, similar to what we've seen in the legal industry, similar to what we've seen in the...

Ted Gutierrez (NaN:00NaN) privacy industries that support these big companies. So cyber is a business problem now. It wasn't, let's say, in every boardroom 10 years ago. And so I think that's a positive. So that's my, I'm concerned about where the globe is going, but I'm also confident in the people that are charged with protecting it.

Ted Gutierrez (NaN:00NaN) Call to action. My name is Ted. Last name is Gutierrez. That's with a G. You can find me on LinkedIn. I've got a podcast that I call the Business of Cyber series. It's every Tuesday at 10 a.m. Central Time. And we talk about the business side of cyber. So I love LinkedIn. I love what we're doing as a community on LinkedIn. The most awesome thing you can do is connect with me, follow me, like a piece of content, because what it does is it helps me understand what does the market really want. That's my job.

Ted Gutierrez (NaN:00NaN) of those people and putting out content like you are, Aaron, it's important to get feedback. So that's how you can find me. Appreciate the opportunity, Aaron. Let's go build great companies and help asset owners and just keep working.

Ted Gutierrez (NaN:00NaN) My pleasure.

Aaron Crow (NaN:00NaN) Ted, sir, thank you for taking the time for me. We've, we've had to reschedule this a few times, but that's what happens. Uh, holidays and business and things come up customers first, obviously. So I appreciate you being flexible and, and coming back to me, getting on the podcast. So why don't you introduce yourself, tell us who you are and what it is that you guys do.

Aaron Crow (NaN:00NaN) Yeah, man. So really high level. What is it that you guys do in these assets? Man, how do you help people with doing assessments and really diving into where they are and understanding where they are? Where do I need to go from a, from a third party perspective?

Aaron Crow (NaN:00NaN) Hehe hehehe

Aaron Crow (NaN:00NaN) Well, and, and you know, it's so important and you hit on something that's and not really a product conversation, but there's something there, right? So, so I have an IT background, I have an OT background. I spent a lot of time as an asset owner. You know, I've worked at the big four, you know, I've been in a lot of different and in a lot of different seats at that table. Right. So I've seen that perspective of coming in as the IT guy coming in as the, as the OTS at owner, like as a consultant from a third party coming in and advising.

Aaron Crow (NaN:00NaN) And I've seen all of those different use cases, the different problems, the different concerns. And I think that's helped me obviously to be able to communicate and be able to drive that conversation differently than sometimes those individuals are. Some of the problem that, um, a lot of the S these folks are in is a, they don't know where they are. Um, they don't know, um, how to communicate these really complex problems, but both directions. So.

Aaron Crow (NaN:00NaN) OT has problems, they have their risks, they have their, you know, how are they going to secure these things, you know, what is the operational, all of those types of things. And it's really hard to translate, even though they have the same tech, very similar tech stack in OT and IT, especially nowadays, it's still a different, it's a conversation problem. And a lot of times, in my experience, IT and OT are talking past each other. Like, they're on the same team, they have similar goals, but they talk past each other because they...

Aaron Crow (NaN:00NaN) They don't understand their, so having tools that can help them communicate is super powerful. That's why frameworks, that's why NIST CSF, that's why all of these things exist to help you have a standard language. So understanding that helps asset owners and IT people and CISOs to understand where they are and be able to communicate to the board, to the OT guy, to the IT guy, where am I at and where do I need to get to? Where are my risks? Where are the places that we need to focus?

Aaron Crow (NaN:00NaN) based on where we are and where we want to go.

Aaron Crow (NaN:00NaN) Yeah, and it's huge because I've been part of these things and this is another thing we've talked about before, but I've been part of these as an advisory role and in a lot of different capacities where a lot of these folks start out with choosing a product. They're choosing vendor A, they're choosing product B, they're choosing all this stuff. They don't have a plan, they don't have a program, they don't have a roadmap, they haven't gone through controls, they haven't done any of these things, but they're saying, hey,

Aaron Crow (NaN:00NaN) I need product A because that's what everybody is using in OT or that that's what everybody's using in power utilities. Like without not dropping names, everybody can think of what those, those vendors are and I'm not saying those vendors are bad or good. That's not the point. It's like, you know, that's not necessarily solving your problem. Like it's hard to, you know, it's like going to, going to Home Depot and, and you, you want to do some work at your house, but you don't know what work you're going to do and then you start buying tools.

Aaron Crow (NaN:00NaN) Well, I'm probably gonna need a drill. I'm gonna need, you know, an impact wrench and all this kind of stuff, but you're gonna pour concrete. Like, do you actually need the impact? Do you actually need, you know, are you buying the tools that are gonna fix the problem that you're trying to solve when you don't even know what the problem that you're trying to solve is yet, but you're already buying toolkits, which some of them may work, some of them may not, but maybe they're not the right tools because you haven't gotten clear on what you need to do and what problems, what risks that you have in your environment.

Aaron Crow (NaN:00NaN) Right. Yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Right.

Aaron Crow (NaN:00NaN) Right. Yeah. Well, and their fear of obviously we see all these things in the news now where, you know, O. T. environments are being hacked and there's malware and all of this stuff that's happening. So their fear of doing nothing and in their mind or at least not doing nothing, doing enough. They're they're trying to push that ball forward faster than maybe they are like they're the nine year olds and they think they have to compete with, you know, the Dallas Mavericks or the Houston Rockets. Right.

Aaron Crow (NaN:00NaN) They're just not in the same league. They're not there yet. Like it's better to crawl before you walk, before you run. Like you can't just, you know, I, I rock every day. And when I started out this, I, I started out with a Jan sport backpack and 10 pounds in my, in my rucksack, right? Every day, like three miles a day. But when I started, it was 10 pounds, right? And now I do 60 pounds, but I didn't just pick up 60 pounds and start going because I would have, it would have been hard. It would have been

Aaron Crow (NaN:00NaN) I probably wouldn't have been successful. I probably still wouldn't be doing it. I might hurt myself, a lot of those things, but it's just like with anything, you have to crawl before you run, right? You have to start where you are. And when I've done a lot of these assessments, manual on spreadsheets for the past 15 plus years, most of the time when I go in and talk to these people, they think that success, if you use the NIST framework and the maturity level, zero to five or whatever, right? They all think that five is the goal.

Aaron Crow (NaN:00NaN) And I have to coach them and say, look, five is not the goal. You can't be a five in all categories. And then this framework, like you cannot be a five maturity in all control frameworks, right? You just, it's not reasonable. You don't have an unlimited amount of budget unless you have a open check and it just can continue to write money. It doesn't make sense. Like that's not the goal. Success can be a two success could be a one. I'm going to mitigate that control. What this, and this.

Aaron Crow (NaN:00NaN) Five is not the answer, but most people are scared to not have five as a goal, thinking that they're gonna be judged. Well, that should be my goal, and that's what I'm gonna be judged against. But that's not what success looks like.

Aaron Crow (NaN:00NaN) Yeah. And, and you see that with, there's been a lot of purchases, you know, Splunk and Cisco and, and Rockwell buying products and, and the commoditization of these products in this space has driven price down, but it's also, you know, it's pushing it out. So you see, you know, other products that are out there. Again, I don't want to name products necessarily, but you see them out there and like, well, if you're a power utility, you have to have this. Okay. But do I need that to your point?

Aaron Crow (NaN:00NaN) Do I need that at all of my assets? Because I have this asset that only comes online once a year, it only comes here in peak time. I only have it there for a backup unit. It doesn't make money except one or two days out of the year. And if I add another 50K, hell, if I had $10,000 of O&M on top of what's already there, I'm not making money on it. So does it really make sense for me to put all of this thing, should I do the same cyber?

Aaron Crow (NaN:00NaN) you know, foundational stuff at every facility. And again, I a hundred percent agree with you. This is exactly what I did as an asset owner. We, we, we basically classified all of our assets first, which is the most important to the business. And then we started looking at the systems at those assets. And then we had a, we had a response when we went through controls, we were selecting this control based on the importance of the facility to the business.

Aaron Crow (NaN:00NaN) a business risk like to the bottom line, you know, et cetera, before we ever started assigning technical controls to it, right? I wasn't going to spend $100,000 on a year on this facility that didn't make that much. Like why would I do? I'm just going into debt for no reason. Like I can do controls in a different way. Whereas my diamonds in my fleet, obviously I spend more money there because if they go down, it hurts my bottom line a lot more than the others.

Aaron Crow (NaN:00NaN) Two dogs and a bearded dragon.

Aaron Crow (NaN:00NaN) Yeah. Oh, nice. We only have one. So I got it for my nine year old for Christmas this year.

Aaron Crow (NaN:00NaN) Right. Yep.

Aaron Crow (NaN:00NaN) happens a lot, you know, one of the larger programs I did and not too far in the past, that was one of the big pieces. Like there was this huge capital budget to deploy technology, but then luckily I'd seen, I had the foresight to really push this, but we had this whole conversation around transfer to ownership. Who is going to take this baton after I install it? And why did I have that foresight? It's not because I'm brilliant, it's because I'd seen it firsthand. When I was an asset owner,

Aaron Crow (NaN:00NaN) I deployed a whole bunch of technology and nobody was there to take it and make the value out of it. So they weren't getting the benefit that they were expecting because they weren't focused on it. I had my entire team focused on deploying at these new power plants and deploying this technology at these power plants and substations, but nobody was behind me getting the value out of the products that I just did, right? I tuned it up the first time, but nobody was maintaining the maintenance of the vehicle after the fact.

Aaron Crow (NaN:00NaN) Sure. Yeah.

Aaron Crow (NaN:00NaN) You know, I don't think that, right? I think unfortunately that people are wanting the higher horsepower because they think that makes them better, right? They think that the best technology is going to solve the problem. And whether it's, again, to your point, I think there's amazing technology out there. I've worked as a vendor, I've implemented pretty much every OT product in the marketplace or at least a high percentage of them, and they're all great. They all have use cases and benefits. But again,

Aaron Crow (NaN:00NaN) It's I use this analogy all the time, right? It's I can go by, I can have all the best woodworking tools in the world in my garage, but it is not going to build any furniture for me. I have to take those tools and get the wood and, and build a design and take it and turn, use those tools to do the thing that they do really well, but I still have to wield them. And if nobody is wielding those tools, they're going to sit there and do nothing. It is not going to provide any value.

Aaron Crow (NaN:00NaN) The assessments working with folks. Yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Right. Yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) So how much of that do you see, and I have a perspective, I wanna get your perspective on it, how much of that do you see that the asset owner or the CISO is blaming, really looks that year after they've implemented or two years or whatever, whatever that junction is, they're looking at that and they see it as a failure, but they blame the product or the implementation or the vendor versus how, my point around this is,

Aaron Crow (NaN:00NaN) I think you can take an inferior product if you spend the most time with it and actually devote the effort to it. It would be, you would get just as much use or maybe more than trying to switch it out for the newest, latest, greatest bells and whistles, et cetera. In my experience, it's usually not the functionality that's the problem. It's poor implementation or at least poor use. Again, it's not the tools in my garage building the wood that's the problem. It's me not using them correctly.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Right. Yeah.

Aaron Crow (NaN:00NaN) Right.

Aaron Crow (NaN:00NaN) and how big the market is.

Aaron Crow (NaN:00NaN) Well, when you've seen that hugely, you've seen it hugely, and especially in the last hell, 18 months, 12 months, whatever, you see these very large organizations from from, you know, Google, Facebook, you know, the big four consulting firms, you know, all of these things, this huge expectation of how big this OT cyber market is and the lack of personnel and I don't think they're wrong in that I think there's a lack of skills in the space. Yet

Aaron Crow (NaN:00NaN) We see massive layoffs. We see, you know, big four firms laying off thousands, tens of thousands of people. You see smaller vendors laying people off left and right. And it just happens. And again, some of that is because the market is slower than they expected. They thought that they were gonna be able to make a bigger impact in the market that they were. Maybe they're trying to get into a new market that they're not currently in and it's not going fast enough. There's a lot of factors that can cause that. But to your point, a lot of this is being

Aaron Crow (NaN:00NaN) built up because of inflated expectations, inflated cost points, inflated the amount of buyers, how much they're willing to spend, how fast they're willing to spend it, and the scope that they're willing to test it out in. They expect them to just deploy it everywhere, when a lot of these, in my experience, especially in the past two years, more and more folks are saying, I wanna do this slowly. I wanna do this at one or two facilities. I wanna start it out small and grow this thing. Some of that's maturity.

Aaron Crow (NaN:00NaN) Right. Yeah.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Yeah. Well, and it's so ironic, right? Is it's the same thing as it is. And you can break this problem statement down to very something, very simple. It's, it's like, you know, the dog food, like, what do I need? What does my dog need and getting clarity on what I'm looking for? Right. And it's that same thing. If I need to lose weight, I can't just say, Hey, I'm going to start working out. Like, what is my goal? And how am I going to get there? Um, if I, if I want to, you know, buy a new car, like what kind of cars am I looking for? Like I'm not.

Aaron Crow (NaN:00NaN) I don't want a minivan. I'm looking for a truck. Well, I shouldn't be going to the Audi dealership and looking at the S5s because that's not going to check the box for the things that I need. They're sexy, they're fun, they're amazing to drive, but it's not gonna meet the criteria of what I really need. And unless I get really clear, I'm gonna spend a whole bunch of time and there's a lot of good products out there, but they may or may not fit the bill for what I'm looking for. Spending time just focusing on who is my customer, what are my primary risks, what are the things that I want to focus on?

Aaron Crow (NaN:00NaN) and drive this thing towards is hugely impactful in deciding what are the right products and people and people process and technology. All those things can fill in those voids, but you've got to start with where do I want to go and where am I at today?

Aaron Crow (NaN:00NaN) It is.

Aaron Crow (NaN:00NaN) Yeah. Yep.

Aaron Crow (NaN:00NaN) 100%. So all this said, all we talked through, next five to 10 years, what is the one thing or a couple of things that you're looking at that maybe is concerning coming up over the horizon? Hey, we better do something or there's some concern. And maybe what's something that you're excited about that you see that's beneficial that you're excited to see coming up on this cyberspace.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm-hmm.

Aaron Crow (NaN:00NaN) Mm hmm. All right.

Aaron Crow (NaN:00NaN) Right. Yeah.

Aaron Crow (NaN:00NaN) Yeah, that's good. That's a good place to be. I agree with you. Um, uh, on both of those fronts, uh, I've been very fortunate to meet some amazing people in this space and, and work with, with many of them as well, mentors and mentees and, and all that, I'm, I'm extremely, uh, encouraged at the people that I meet and, and podcasts that I get to sit across from in at conferences and having a drink and a coffee or a beer or whatever that may look like. And.

Aaron Crow (NaN:00NaN) the conversations and the grit that they're willing to do and put in and go above and beyond. It's empowering to see and I love it. So how do people find you, get a hold of you, if they wanna engage with you guys, give us your call to action.

Aaron Crow (NaN:00NaN) Absolutely. I appreciate it, man. Thank you. Thank you for coming. And I'm glad we're able to get the schedule figured out and knock this one out. So thanks a lot. And I'll put all the, all the details and stuff in the show notes. So thanks again, man.

Transcript lightly edited for readability.