Live on Stage: TechCrunch’s Found Podcast

Foreign [Music] You're the last of the Great Pretenders Here you are you're actually here for The third day well done can we form a Fan club or something Um it's been fantastic to have TechCrunch disrupt here in uh San Francisco and this is the last day and This is you are now on security so I Hope you're feeling very secure Um this you're going to hear from Hackers Frontline Defenders security Researchers drawing on their first-hand Knowledge and experience with about the Most critical threats online today You'll hear about ransomware and the Global efforts to undermine encryption Don't worry about the issues about uh Transcription if you if you're missing Anything there's an Otter app which you Can get hold of which is live Translating and transcribing everything That you hear on stage today Um so have a wonderful day Um let me introduce our first panel I'm Very excited to have uh the found Podcast which is going to be recorded Live so wherever you're sitting now That's where you'll be in history Um uh the podcast is going to be Recorded with that our guest today Window Snyder who's founded CEO of Thistle Technologies we're going to hear

How she built her company runs her team Raises money the highs of loads of Entrepreneurship and joining her will be Dominic Midori Davis and Becca scootak Please give him a round of applause Everybody [Applause] [Music] Oh Hello and welcome to the live recording Of found at TechCrunch disrupt found is Tech wrenches podcast where we bring you These stories behind the startups from The folks that are building them and Today I'm joined as always by The Fabulous my co-host Dominic Midori Davis Dom how's your disrupt Ben not bad what About for you it's been great I've been Loving all of the panels I've also been Loving all of your outfits like you've Been wearing this whole time and Dom Tell us a little bit about what we're Doing today oh yes we are interviewing The amazing window Snyder here from Thistle Technologies and for those of You who might not know Um to give you some background she has Like an insanely amazing career in Security let's see I'm going to read off The rap sheet yes okay the senior Security or security strategist at Microsoft where she's credited with Pushing to take cyber security seriously Um building it into Windows software

Directly she managed the security and Privacy team at Apple and was Instrumental in lobbying Apple to Encrypt all of its devices she also Served as security officer for companies Including fastly and was Chief software Security at Intel Amazing window thank you so much for Being here today how has disrupt been Treating you it's been great it's been Great what's been your favorite part I Met a robot dog and that was a dog Really awesome robot dog that sounds Pretty good my goodness well hopefully Maybe we can try to top that with what We're doing today but we're here to talk About thistle Technologies and maybe That's a good place to start maybe if You want to just tell us a little bit About the company absolutely so epistle Technologies we're building security Infrastructure for device makers and the Idea is to take these security Capabilities that are hard to do right Really easy to get wrong and I Generalize them across lots of different Kinds of devices to make it really easy For device developers to incorporate it Into their projects And I know Dom read off a lot of your Past work and sort of maybe the journey That led you to the company but maybe to Hear it a bit in your own words how did You get interested in the cyber security

Space to begin with So uh When I was at University I was studying Math and computer science and I was Really excited about Cryptography and which led to an Interest in cryptanalysis and at the Same time I Was introduced to multi multi-user Operating systems and I was wondering What's keeping my data separate from Everyone else's what's keeping my Process space separate from the kernel And back in those days this is the mid 90s the ants are maybe even the early 90s the answer was not very much and so Between those two interests I it kind of Led me to building tools to demonstrate How to undermine these Security mechanisms within the system And met some other folks who had similar Interests and the Boston The Boston Community had a very robust Hacker community so it wasn't long Before I started meeting other people With similar interests and um This is long before we had a security Industry or there were no books to go Read on this topic it was absolutely the Wild west but you know a lot of those Folks are still in my world today They're still working in security and Leveraging the the the things we Discovered developed identified back in

Those days to build more robust systems Today And our colleague Lorenzo did an amazing Profile on you and you spoke a little Bit about how you were exposed to coding And computer science kind of at a really Early age what impacted that early Exposure have on you and your career oh Absolutely I remember my mom sitting at The dining table she was a programmer She started off as a tester she became a Programmer and she would be sitting at The dining room table uh with uh these Stacks of green bar and she was a Programmer who worked in Cobalt and she Would be debugging with a pencil at the Table her programs which were these These stacks of green bar continuous Feed sheets and you're trying to you Know tell me I was interested in like What does this do what does that do and She would tell me but I also remember You know if she left it like stacked in The corner I would like pick up one end And then spin around and like make a Dress out of it it was uh I was I was I was fascinated by but also It's you know a huge ream of paper kids Love that Um but then she also bought a ti-99 4A And it came with a book uh TI basic and I would copy in those programs and then Change things to see what would happen And that was that was a lot of fun

Really interesting and yeah that's how I Started to learn programming and it Sounds like your mother probably had a Pretty big influence on your career and Maybe if you want to talk about that and Sort of what about what she taught you Sort of inspired you to get to where you Are now Yeah she actually uh really wanted me to Learn how to program computers and at The time I kind of you know as kids do I Was kind of like no that's not for me I Wanted I was I was very interested in The humanities I was very I wanted to be A writer I really liked performing I um I loved literature and I thought you Know this was this was boring this was Uninteresting but she really thought That it was kind of like a second Language that it would be useful in any Whatever you want to go do with your Life that would be a useful skill to Have and the way I try to explain it to My kids now is kind of the way that she Explained it to me that you can learn How to use computers And then you'd be constrained by the Things that the computers already know How to do or how other people have set Up the environment for you or you can Learn how to program computers and then You tell the computers what to do and And then the possibilities of course are Endless and so that was

Um kind of in the back of my head as I Was as I was growing up that this is That this is always a possibility that For whatever I wanted to do that this is Going to be something that I would Um Value What was it like navigating learning About or teaching yourself like how to Code and the world of computers and all These things back in an era where that Information wasn't as accessible as it Is now because you kind of mentioned how Like you couldn't I guess you couldn't Just Google something back then no you Definitely could not I had that one book TI basic which the covered programming Basic but that was very limiting but um I used to make little quizzes for the Neighborhood kids like that was my idea Of creating games and then in school we Had access to these Apple twos and I Remember there's this game that had Um like these it was it was all asking It had pipes and you were driving a a Car through a road that was constructed Of of ASCII pipes and so you're trying To navigate and not hit the barriers you Hit the barriers the game ends and um You could actually go in and edit it and So I learned I could edit the check that Determined whether or not you hit one of These barriers and then it's covered I Could oh get to the end of the game and

Win By by eliminating the check for it so This is this is my first experience with Like any sort of hack that you know once You are uh once you know how things work You can change how they work and you Know maybe to your advantage now winning This way is not very compelling but Um that was you know an area where where I was I was starting to realize like What the what the value of being able to Uh understand how everything worked Would Would open different uh opportunities And fast forwarding to when you decided To launch your company most curious Because you did have this long career in The space prior to that you worked Multiple different companies held Multiple different roles and what made You decide to take the plunge to become An entrepreneur yourself So I actually started companies in Between as one of the founders at Marisano which was later sold to NCC Group I I did a consulting company Um A long a long time ago even before Um it was it was something that always Made sense to me as kind of like I want To do this but also having been early on At fastly haven't been early on at Mozilla I love that environment and I've Found myself going back and forth

Between big companies and and startups Startups because of course you get to Have a huge impact in in in in the Organization and uh potentially leverage That well beyond the organization and Then large companies again because they Have all the resources that you need in Order to get something done so um there Was always that that that that kind of Back and forth for me but this company It was because I had Recently been the the CSO at At square and Um prior to that fastly the the chief Software security officer at Intel and I Was getting this industry scale Perspective of the device space and how All this work that we had done in the Security industry just for general Purpose operating systems had not really Made their way over to devices and so I Had this growing unease about how Insecurity devices were and the deeper I Looked the worse it got and so Um I realized that the way that we Couldn't write around you know decades For the devices space to catch up Because that was going to that was going To be the painful Road Um and the other way that things change In security is when it gets easy enough To be able to incorporate it because It's not like we don't know what to do We know how to make these systems more

Resilient but doing the work is hard it Takes a lot of time it requires a Specialized skill set that not every Development organization has so what Would it take to make it easy for the Devices space to catch up to the degree Of security resilience that was not just Appropriate for today the threats that We see today but these devices have Incredibly long lives they're deployed And they're in the field for a long time Like you buy a car you drive it for 10 Years you sell it someone else drives it For 10 years and someone else drives Over 10 that car's on the road for a Really long time how long is the MRI in Place at the county hospital or those Systems that control Power and Water or Telecom those those are in place for Decades so getting to a place where We've got the security resilience we Need for today is not enough we also Need to make sure that we've got the Capability that allows us to maintain Security resilience long term because These devices are in place for so long So Making it easy to incorporate those Robust security capabilities into Devices uh seem to me to be the best way To make a significant impact on what I Saw as the largest security problem out There Why are a lot of these devices so

Unsecure Well again it's hard to do well it takes A lot of time it takes the right Security engineering skill set which not Every organization has on board and also There's a gap between even if you do Make space and make the effort to create The security Functionality building a security Capability to from a functional Perspective is really different than Building it to a to resilience so for Example if your security feature is Encrypt the thing you encrypt the thing Another thing is encrypted and you think You're done but Building it so that someone cannot Easily undermine your security mechanism The reason you're encrypting the thing Is a whole other skill set right you're Thinking about how are the keys Generated and what's your source of Randomness and where the keys stored and How it's accessed like it's a set of Security considerations that go well Beyond the spec of you know I encrypted The thing and the thing is done it's a Completely different skill set so uh Making space for both building the Feature but also the developing the Capability within the engineering Organization that allows you to build it To resilience is incredibly difficult And for having worked on and built a lot

Of these capabilities into the Windows Operating system into iOS and Os 10. it Is incredibly uh Time intensive resource intensive so Yeah I wanted to make sure that we could Build those capabilities generalize Across lots of different devices and Make it easy for folks to incorporate it Into their devices And thinking back to when you did take The plunge to launch this little Technologies What was the timing like and sort of why Was that the right time to sort of leave What you were doing and start something New Well it probably wasn't the right time It was right like in the middle of the Uh the pandemic and Um it was uh It felt like an insane time to go go do Something new but it also felt like this Was the right time in terms of the the Problem was painful enough that it felt Like That The industries that made devices had High security requirements so like Industrial manufacturing and Automotive Aviation Space Power and Water Telecom All those Industries I mentioned before Medical devices financial transaction Systems they recognize that they have High security requirements

Um but they also need to have enough of An incentive to make that investment in In improving the security of these Devices So it's both seeing that there's a Growing number of uh attacks on these Systems and a lot of security Researchers who are invested in Demonstrating vulnerability on these Systems so that we as an industry Recognize there's a problem recognize The impact of these problems Um so those those kinds of things were Were developing at the same time for me Personally I was Uh Trying to figure out what what Um How to make a a significant impact on Something I thought was going to be the Most significant security problem out There so those kinds of things converged From me I was like this is the right Time uh I've got the right skill set for This I want to make a meaningful impact on This problem And I imagine because of you know your Amazing career fundraising was probably Easy but also during the pandemic it was Probably how was fundraising nothing's Easy no I don't think final reason is Easy for anyone um I hate people saying Like oh in 2001 or 2021 you could have

Stumbled into the wrong conference room And like walked out with a term sheet Like that was not how it was for me Um but fortunately I I did have uh you Know an amazing uh introduction to True Ventures and they've been an amazing Partner Um so I would say like Convincing folks that this is a big Problem that was not hard convincing Folks that I had the right skill set That was required to go and do this that Was not hard Um but demonstrating that this is a Problem that the rest of the industry Recognizes that they're going to want to Leverage these capabilities in order to Improve the security of their products That's been the place where I needed to You know help folks recognize that that The industry is ready for for this and So that's been Um uh the challenge but it gets easier And easier every day as Um as well first of all as the company Gets larger and second of all as the uh The the industry demonstrates Daily how important it is this Capability for these kinds of devices And you've worked at companies of all Different sizes and as you mentioned a Little bit earlier obviously working at A startup is very different than working Out one of those larger companies that

Has resources and sort of other things Available what's one thing you learned Working at say apple or Microsoft or one Of those big companies with a lot of Resources that you hope to sort of Implement with Bissell Technologies Absolutely so one of the things that I learned at Apple is how important it Is for things to be easy And how to make things easy and easy is Hard easy is the hardest thing you have No idea how much work goes into making Something easy until you attempt to do It yourself and so Um All these security capabilities that we Incorporated into Apple devices are Incredibly sophisticated But require very little user interaction Or very little user Um investment right they just kind of Happen underneath the surface and so Trying to figure out how to do that for Developers how to make it easy to Incorporate uh you know these these Security capabilities it's a huge Challenge Um but it's been something that is is is Core to what we're doing that we want to Make it Uh well easy in order to bring these Really sophisticated capabilities into The product so that's something I Brought along with me and then from

Fastly Their developer Community is the reason That fastly is so successful that the Um Being able to support developers and Solve a problem for them make it easy For them to to get their job done to Solve a a problem for them that's been Another thing we want to we want to Build that developer Community we want To solve a real problem for developers We want to make it easy for them to both Test their devices and also incorporate These capabilities and build a developer Community that supports each other and Gives us the feedback we need in order To continue to deliver a great Experience for them Mm-hmm and what's a challenge you've Come across so far in building thistle Technologies that you feel like you've Really been able to overcome and can Look back on when you sort of hit those Hurdles down the line Well go to market is a bit of a Challenge especially for devices because In any space even if folks need this They don't necessarily you know you do Necessarily encounter them at the exact Right moment when when they need it so We're having a conversation they're like This is fantastic we love this let's go Talk about this in nine months I'm like Okay we'll talk to you in nine months

But nine months is not ideal for a a Seed stage startup so trying to figure Out like how to find Folks at the right Time how to Um uh make sure we're delivering Something that they need has was a a Challenge that we had early on but Um Recognizing that first of all they they Were excited about it was was a really Compelling Um uh point but trying to figure out how To get in at the right time was Difficult so we decided to go Uh Hardware first so instead of uh let's Say going through a specific industry Where they may or may not have Um I think they would have like let's say Like a single industry like industrial Manufacturing they are all using Different Hardware platforms so even Though we can really easily Port what We're doing to lots of different kinds Of Hardware platforms that's a kind of Big step for them to take that in in Indeed we want this capability but also We are willing to take uh you know wait For you to move it over to Port it over To to our platform that's a little bit Of a bit of a leap that they have to Take whereas going Hardware first Um through our partnership with infinity And we're able to build specifically to

This uh this chip the infinite in the Infinean um Optical trust M and the Folks who are using this Chip have Already made a decision to incorporate Some security capabilities because That's why you buy this chip and then Being able to deliver a software Capability that's that works for them Off the shelf with a kit with the part That they've already incorporated into Their project means that it's really Easy for them to then then say okay well We this is on our roadmap and you're Cutting out a significant amount of Developer time for us that's a really Easy Um Transition compared to all the steps You'd have to make otherwise if it's if It's not already on your on your on your On your platform And how big is your team right now we're Uh six people six six people yeah oh my Goodness how would you describe your Leadership style I would say there's a lot of trust Involved I mean we're all very senior Folks Um there's there's a lot of autonomy and There has to be because we're a really Small team that making sure that folks Have what they need in order to be Successful and then letting them be Successful like I'm trying to remove

Obstacles for them I'm trying to give Them the resources that they need but They're all very senior folks so they Operate with a lot of autonomy and and I Trust that they are Able to do what they need to do that They have ownership of for certain Components that they make technical Decisions Within their within their sphere and uh You know it's it's working well for us I Feel like we've got an amazing team Um this is I mean some of the the folks That I get to work with I'm just so Amazed that they decided to get in the Boat with me on this journey and it's Um it's been an amazing experience yeah And kind of kind of on that um is there Any particular way in which you mapped Out the company culture you wanted to Have and Foster and to keep employees Motivated yeah Um I would describe this as respect it's Kind of the other that Um We don't Send mail after work hours we don't have Meetings late or early someone says I Need this time blocked out because I do Pick up we respect it Um and I think I've been in especially Startups where it's been kind of grind All the time like you know 50 60 70

Hours Um it's it's soul-crushing and it's not Sustainable and I know that this is a Long road so making sure that is Building a company that was going to be Able to sustain the work that we needed Meant that we were creating a culture Where we we we weekends our weekends and Uh Evenings are are not for work it's a It's demonstrating that I have respect For you that I'm not trying to engage With you at six o'clock seven o'clock in The evening Um and so that's that's something that We've really held as a a critical Boundary and I feel like it's been a key Part of our success And something I'm always curious about Is sort of more of the personal Journey Involved with being an entrepreneur Obviously working and building a startup Is so much different on a personal level And sort of the toll it takes on a Person than it is working at a company That has systems you don't have to wear 10 000 hats when you are working at a Big company with a specific role in a Way that startups you do and how has it Been building thistle Technologies for You more on that personal side It's been really Gratifying to see that like uh something You build come together it starts off as

An idea and maybe you it comes it keeps Coming back up so that for me it's like I had this idea but I kept coming back Back to the foreground and as I saw more And more about the devices space it it Developed a sense of Urgency around it and then I started Talking to a bunch of developers and Saying like hey uh is this something That would help you with this something That you'd value Um and then talking to investors about What I thought the industry needed and How I wanted to go about it and then Talking to Engineers about joining the Company and getting folks on board and Seeing what they got excited about Um like the the Journey of turning it From something that that you recognize As a problem to an idea to manifesting It in in the world to an actual product Um that actually Is solving a problem for a customer that That has been incredibly satisfying and Uh you know every you own every role you Own every hat until you manage to you Know hire someone and hand it off Um so it's uh it's incredibly stressful And you spend a lot more a lot more time Doing things that you don't realize Are going to occupy all of your time Like fundraising Um but it's so gratifying to have it Exist in the world

Um what was previously Just a a pain point and then an idea and Now an actual company and a product I think we just have time for one last Quick question but what are you most Excited about for the future of this Little Technologies I'm excited for uh Getting our product into into developer Hands getting more and more feedback and Refining the product finding more ways To to make these security Capabilities easier bringing more and More security capabilities to these Device makers so that we can build Security resilience across lots of Different kinds of devices and make it So easy that it becomes The default the default to have this Kind of security capabilities in your Products It pretty much puts us at time so Everyone joined me in thanking Windows Netter for joining us today [Applause]