Thanks I see.

Thanks for having me today today all talk
about this idea of bridging the gaps or

change research and practice and some of
the lessons we learned from running our

summer program for the first year last
year called cybersecurity factory and so

as an academic I've spent a lot of time
talking with people and thinking about

how to really get my ideas out there so
that the security research I make or

actually the security research I'm doing
is actually making systems more secure

in the real world not in just kind
of in a research environment or

in an academic environment.

I'm going to talk about how in order to
do this some things have to change and

what I believe should change and
why this is a good time.

To start a cyber security company so
who am I am Tyson.

For your PH MIT I'm interested
in doing computer security

mainly applying crypto to big
data systems for the web and for

databases and I'm also a member of rough
draft centers it's a student run V.C.

firm that gives small
amounts of capital to.

A nurse and so I'm pretty involved in
the Boston startup seeing my most of

the cofounder of this program that I'm
going to talk about cybersecurity factory

and pretty excited about online learning
So what is this talk going to be about

it's going to be about kind of a bunch of
beings it's going to be about academia How

are relates to start of venture capital
companies consumers and policymakers

kind of like all combined together and how
they fit into how the pieces fit together.

And I think the main question I'm
going to try to convince you that I

have someone answered is how can we better
connect researchers to everyone else.

So this is kind of we all know this our
future runs on software there's a lot of

software companies coming out their
smartphone there's driverless cars

there's even automatic dating which you
can have this app called Tinder Box in it

automatically turn it based on how someone
looks whether you want to swipe left or

right or whether you're like them or
not so we have all these like

really cool tools and
really cool kind of technical solutions or

technical problems that we're solving
with a bunch of new technology but really

we need to solve the problem of security I
think there's so much people have thought

about new technology for a long time
without thinking about security and

I think the problem is is that a lot of
times it could be comes after the fact and

because of all these hacks that anthem
Home Depot Target eccentrics like pick

a news article in the last six months and
that deals with cybersecurity and

it's about some major hack and so

the idea is that people are starting to
become more convinced that we need to

solve security first before we
think more about technology.

Really if we kind of look at security
research it seems like we're getting there

there's a lot of cool security research
out there who says some selected

research ideas like briefly talk a bit
more about these are ones I think have

some promise in commercial Aisha nation
but they're definitely not limited to the.

So there and could the databases and

do mechanisms program analysis
provably secure software and

really when we have an industry of all
these kind of recent studies that come out

a Rolls are different types of firewalls
are different types of our detection but

I think the problem with with this is that
it seems that we have some outward or

outside perimeter that we're protecting
and preventing someone from penetrating

and actually not clear with
mobile phones Io T. and

kind of all of these devices
that we're having and

with Internet everywhere with
the outside perimeter is anymore.

So the bigger question is how can we take
advantage of making these risk taking

these research ideas into practice and
kind of Aruba morale and

research what the four areas we have
when we have encrypted databases and

this is the idea that we
can perform choir's or

encrypted data without decrypting it and
ideas I store a database and

all I keep is encrypted data I send some
form of specialized quarry there and

when I get the answer back it's
still encrypted and when I D.

cryptic I get kind of the answer to my
query and through all of this the database

only sees encrypted data so if a hacker
was to go in and compromise this database

they were only seeing corrupted data and
nothing else and so kind of this you can

see it kind of this acknowledge being able
to prevent a lot of the House of seeing.

The provably secure systems you
create specification for what.

A functionality of a system should be and
then you can write a program and

prove that the program you wrote is bug
free so whenever you run it you run to

any of the security vulnerabilities
that come as a result of bugs.

The third thing is undo mechanisms
this idea that we can replace software

after discovering
a vulnerability in shorter time

then actually kind of like replaying
the whole system again and

this idea is that assume I have a zero
day I discover there's a zero day and

I patch it up I want to know if someone
else had discovered a zero day.

Vantage of it beforehand and so does allow
those kind of people to audit past logs

to see if and hackers actually penetrated
their system and finally this is

an area of research I'm very excited
about this idea of secure web application

secure web application platforms that
is that we have all these cool new web

application framework so you go on Hacker
News you see a new one someone posts so

there's like we have the common
ones like Django which is an M.P.C.

model we have we have media which
allows you to combine client and

server code together but the really isn't
web application platform that allows us

to think about security while actually
doing programming a web application so

there's no reason why this isn't exists I
think it just needs to be formed and so

a lot of it is dealing with how to build
secure web applications that are people to

have provably secure access controls
to do revocation to share data and

to see how this data flows throughout
different applications and

with building web applications from
the ground up with security in mind.

So I've kind of talked a lot of schools
and one of the biggest questions we have

is why can a large company read a paper
and just just implemented Why do

we need startups with one of the barriers
to industry adoption I think there

are two main things and they come from
two different levels there are managers

mentors really need to fight the status
quo they're in charge of making

sure products ship they're in charge of
making sure certain features are met and

security is really not always a feature
that people are very excited about.

And so really if you kind of have security
on the roadmap is something that always

gets pushed away because you are kind of
protecting against a hypothetical attack

and second is programmers kind
of convincing a programmer

that you know security
something important and

pushing up to their managers is very
difficult because a lot of times out of

managed legacy that they
didn't write someone else or.

They're kind of stuck doing
a lot of other features and

a lot of other other priorities really
that make a product look better

rather than making
a product look more secure.

And when we first started this program.

It was a time where all the cyber security
hats were happening and Sam Altman

the the President of what I see tweeted
that he really wanted to see more and more

security stuff to keep he feels like a lot
of the software we have people are very

exposed especially with the amount of
personal information that's out there and.

So we reach out to him and we're saying
we're kind of discussing ideas and he says

I think really think the market will start
just seeing because it seems like people

are came more and more about security so
as a result they will spend more money

about on security and we're talking about
you know there's a lot of these cruel

security ideas that are solving a lot
of the important poems in the space but

really the problem is like how do you
have a startup route to tech transfer and

read one of the big barriers is that
security is no Tendai So what is ten Doug

let's consider this hypothetical
hot new so-called Valley startup

that matches dog owners with each other
in the style of the tinder dating app so

you kind of sure Dogg and then if you like
it you strike right if you don't like

a swipe left this is really cool it's fun
it's slick I can do it one man the bus

it can get traction really fast I can
probably build this app in a day and

then you know a good fellow
hacker news because it's so

easy to use and you know your top there's
no if you can use it's so easy and

so you don't have to change anything about
your life it's kind of low integrated and

makes you happy and yeah this is kind of
like this is not too far fetched from

what's getting funding in Silicon Valley.

But kind of like let's think about
startups that have a little bit deeper

tech and right why security starts are not
as sexy it's because what is a startup

that helps us build secure software
one it's something technically deep.

It probably deals with some
form of encrypt Sharon or

I protection it's
definitely not as like or

as like these flashy pictures you
see on on a tinder dog screen.

Second it has to be verified by experts
like I think just you know spin up.

On a WS instance so there and then kind
of like people can start using this app

tomorrow if I would if they wanted to but
with security subs you kind of as you go

talk to people your security software
has to be trusted as be beautified by

experts in transit so when you go to a
company and you ask them to buy a piece of

security software it requires some
form of infrastructure change and

what you have to go in and
actually have a technical person do.

So well some you need.

Yes.

I will get to that later

yes.

That's also a great question
that I'll get to later

also.

Yeah so I actually get to that later on
also these are great questions you're

predicting when I talk so cool so
listen you need challenge is the concept

is highly technical there's no flashy
demos adoption requires expertise and

or trust and I think this last one is the
most important that really when you solve

a technical security problem it is
an equal really building an actual product

that someone wants to buy and so last year
one of our biggest mentors was just as

the money he was the chief trust officer
Outbacks now is the chief security officer

as A.P.
He makes all the importance of the.

Strategy division decisions for us A P I
He flew out and hung out with our team and

we had this quote that he said
he's like the major problem.

Reason security products fail is because
they're built by security people and

the reason for the reason he said this is
that security people think what they build

these really cool and useful brutes not
what customers need and kind of like give

us some examples of things that kind of
went wrong in our program that and lessons

that we learned as a result and this is
kind of like near the end the program.

Work he came and visited and gave this
quote I give you a lot of bad news

here's some good news security
spending is growing companies

are estimated spend eighty five billion
dollars in two thousand and sixteen and

they're going to spend ten percent more
every year I think just numbers are going

to go up as we see more hacks as people
try to kind of shift liability and

kind of outsource their security needs and
second V.C.

investment security has increased seventy
four percent to eight hundred million over

the last year and we kind of are seeing
more and more security investments

in venture capital especially with funds
are specifically dedicated to security and

also fund picking up a lot of cool former
security entrepreneurs who are now

becoming partners who see kind of security
is becoming the next big industry.

And also the reason people are going
to spend so much money is that a cost

of a breach is pretty expensive so the
average cost for a data breach for a small

company just to fix up their systems on
this three point eight billion dollars And

this is a million dollars And this doesn't
deal with kind of loss of sales loss of

trust kind of loss of customers or any of
that kind of other penalties they have

to pay and kind of the growth
of the cost per record for

a breach grows from one hundred twenty
three dollars to one hundred seventy

dollars and you can magine like
that seems like a small number.

In isolation but if you think
about it when Target was hacked

nineteen million records were leaked.

Cool so a couple of fun facts
that we learn from the summer for

us is a big gap between academia and
industry so this picture is of such having

a roundtable lunch present there
are a couple of MIT professors the senior

director of security strategy aka my
one the partners at Highland Capital.

A me a couple of our teams and then
a couple rumors from we're more hell which

is a legal forum that deals with when
a company gets hacked the deal with

kind of the ramifications that litigation
is that result and at this Roundtable

we're really talking about you know what
do you think is the hardest part about

starting a company I think it
both broke down to sales but.

But the but the senior director
of security strategy aka my

said really we need more technical people
who are seals and Vince's minded whereas

the MIT professor said no no we should let
the technical people do what they do and

just hired the right sales people and
the problem with what he said and

it got pushback from from the UK my person
is that it's really hard to sell a product

you don't really fundamentally understand
because that's what Rudy need kind of like

technical people to be
more business oriented.

Another fun fact so Delmonte foods chief
information officer reached out to us

saying he wanted to try our
startups acknowledge and actually.

Unexpectedly hip so for those of you don't
know what Del Monte is they're like a big

fruit canning company they kind of
the distribute bananas estimate canned

fruit and they actually use Open Flow
switches to manage their production line

which open flows an open source technology
that allows you to try out new network

protocols and for the L.S.M. to try
out new ways to like streamline their.

Their supply chain and their supply
line and it's really important for

them because.

You know consistency in standards for
those corporations that.

Deal with food and especially with F.D.A.

concerns is like it is a very big deal.

A third fun fact is that dentists
don't really care about HIPAA and

the reason for this is that
the Department of Homeland Security and

the Dental Association eighty
eight they don't audit them and so

they email extra records in your medical
records to people in violation of HIPAA

all the time so they're not the right
customers to sell security software to but

it's also interesting to see that.

The only reason someone would run security
software is to meet compliance if

there isn't then you know they
just ignore security overall.

This kind of goes to what we started last
summer it's called cyber security factory

it's in collaboration with Highland
Capital it's a ten week later summer

program and we give teams twenty
thousand dollars initial startup capital

we give them office space in
Cambridge Massachusetts next to our

very close on a rapid seven a bunch
of big security startups and

we provide them with legal support with
one of our legal sponsors we're still

finalizing this year and then I think
the biggest value add is the network and

so I'll talk a bit more about why
I think network is important.

But it's really focused mentorship we only
have people who have studied Security

start up in the past and around them have
actually seen a stop go from from just

one or two people to I.P.O. And so we have
the founders of him provide that which

provides all the security authentication
software for the hospitals in the in

Massachusetts we have Max Con he does
public key infrastructure ever watch

on Potter networks or recently got
the C.T.O. Vera code as our mentor and

the C.E.O. rabbit seven and
a product rep at seven and they all think

this is kind of a great idea and they're
willing to spend time outside of work.

Outside of work helping these
teens out and kind of like well

talk a little bit more about why they see
this program as being so important so

last year we had two proteins one
was called Aki cripple is called

the rock the boat MIT teams were trying to
branch out this year that's why I'm here

at Georgia Tech kind of talking
more about this this program so

I could quit their idea if they want
to efficiently outsource data security

to the cloud with application to me to
medical records the ideas I have a mobile

phone I store encrypted data on
the cloud how do I find the right data

in an efficient way above a lot deals with
big corporations with small teams and

ideas that they still need security
because they have to follow give

out financial reports every year they have
legal problems and so kind of lawyers and

their marketing and accounting teams need
to transfer documents how do I do that

without using a thumb drive because we all
know thumb drives like are kind of sketchy

like there might be malware or
there might be spyware on and

you know they get corrupted very easily so
kind of how do we do this and

know who has what data and kind of like if
I were to plug in at them drive to make

sure it's actually kind of malware free
document opening is actually not a virus.

A very cool we had last year for
any researchers out there so

he Chris Fletcher was one
of the participants so

MIT Ph You see that he said I thought
was really hard to sell my research kind

of to write a paper to get reviewers agree
but much harder to sell something for

money and convince people to pay for
it and so it kind of shows a kind of

there's some gap between turning
the research idea into a product but.

That we're trying to reduce
the barrier to entry.

And so kind of like the biggest
lessons for teens is that.

People matter and so
I think I'll talk a little bit more in.

The next slide about our value proposition
and what we believe is necessary.

But we think that networking
can really drive innovation so

if you talk to the right people you'll
come with the right pain points and

the right ideas and as a result you'll
be able to create a better product and

when you have a better package and you
go in and to talk to a company it drives

more conversations if you convince
them in something that they want or

need then that's great otherwise you
know you have one conversation and

you're out the door and their time is very
limited because we hear about vendors and

security vendors all the time so the point
is how do I find the right product and

how do I get my foot in the door and

usually it's with warm introductions and
I think the final thing is also key is

finding our target market is crucial
if you don't find the right market for

your product you're going to build
something that no one wants to use so

one of our team started out last year and
they started out trying to commercialize

oblivious RAM and so when they go
on the phone with with the C.T.O.

they had no idea of Bolivia SRAM was
I mean I'm sure most people don't and

they said why do I need this and

we can even do it in Cushing correctly
why do we care about metadata and

kind of like access patterns like we don't
we don't care at all and it causes people

to kind of pivot and so they went back
they talked to their mentors and.

They continued networking of talking
a bunch of people and they went back to

a lot of the customers and said OK here
we have like a web What is your problem

here's like a potential product that we
have that might solve your problem are you

going to use this and the reason for
this is that really really just like

finding the the right having the right
conversations in the right context is

a markets is important because
ultimately so many supply your software.

And so.

Our main value proposition is that we
really create a safe environment for

really try cybersecurity ideas we're
breaking down the barriers to entry for

students to go out and start a security.

We provide a lot of business
help through boot camp with V.C.

partners a top top V.C. from we also
help you build relationships with

top security experts who really believe
that like startups generate innovation and

that's the reason why they're
willing to help out for

a lot of them even companies like
rabbit seven in providing they know

they're not innovating anymore because
they have to answer to shareholders and

answer to the stock market and answer
to kind of their investors and so for

them they see kind of like seem the next
frontiers of security in kind of security

startups and they want to build these
relationships early I think like this is

what's different than any other program
you'll experience is that our mentors

are very active they're very close
relationships with our teams last

year the director of security and security
tragic were like come and visit us every

week and e-mail me regularly teams
have one day turnaround with.

V.P.N. to get all the right introduction
to be able to hop on phone calls and

kind of like it's a great networking
opportunity in the worst case especially

for a start doesn't succeed but Lisa gets
you in the right mindset if you think

about building another security startup
in the future I think like just building

relationships is very important because
you understand where the problems are and

have like Howell and understand different
perspectives from some people who've been

in the industry and seen it since you
know the one nine hundred ninety S.

and seen it evolve.

So somewhere about the program.

Looking for very early teams
there are two to four people and

ideas recommended but it's not
required actually really just want

to strong team of students who are
interested in security and startups and

the reason to me an idea is to actually
have an industry partnership program with

him provide an extremely rapid
seven hours on board two and

you work with someone in the executive
level from that company so

you'll be working with their V.P.
of corporate development and

senior director of security strategy and
provider will be working with their seed.

And up to seven you'll be
working with their V.P.

of Product and their C.E.O. and they're
really excited they know they know about

this program they're very excited about
bringing kind of security innovation and

boosting in the Cambridge area and
just in general.

June twentieth to August twenty seventh
they're kind of flexible based on school

schedules Yes.

We don't take any equity and so
it's given as a convertible note so that

converts in the next round I can like talk
to people more specifically about it but

the idea is you want the most entrepreneur
friendly terms you can possibly get

other than just giving you money directly.

Cool and so just.

To some more notes on the summer
experience it's in Cambridge Massachusetts

it's near some of the top
security companies.

A lot of people know this is going on and
Boston has a pretty up and

coming star obscene and so a lot of people
are connecting excited to meet students

who mean a lot of people who have security
who are security concerns or like work at

big data or if structured companies which
are excited about security innovation and.

People are signed up to kind of
have happy hours at Akamai and

clear sky data there's going to be
a lot of networking with P.C.'s and

mentors and there's going to be a lot of
meetings with customers all last year some

examples of customers people
who met with her fidelity.

And Delmonte foods we also have
the Internet to Intercontinental Exchange

which runs the New York Stock Exchange so

is very excited about about
trying new security software.

Could also killer some just
like logistics some deadlines

we're going to accept on a rolling
basis until April eighth.

The application is very simple it should
take you no more than thirty minutes and

we will notify you within two weeks of a.

Application submission there's
going to be a code at the end that

there they'll be something and then ask
for a code just put in order to underscore

zero three zero four which you see as date
and kind of flag your application for

me to show me that you
showed up to this talk and

kind of like I want to bring up some more
Highlands Ohioans another program for

startups and comes that if you're
interested nine hundred seventy security

that would do something else
that's very soon focus and

they have a great track record of working
with students to understand where

students are coming from and
are interested in and so.

If you're interested in this specific
program non-security program talk to

me afterwards and now I'm open to
any question to use our website and

cybersecurity factory dot com and
you can e-mail us at team at cybersecurity

factory dot com and then you can follow
us on Twitter that cybersex factory and

we'll have kind of a bunch of updates
on new mentor and new industry.

Programs and kind of anything that's
going on between now and the summer cool

thanks.

Yeah.

Sorry.

What do you mean by

convoluted.

Yeah I think I think it's more
complicated than that because.

Because like when you submit a proposal
it assumes that you're like when you

say a proposal to DARPA you kind of like
right up there like we want this very

big big need and then you know you can
do whatever you want was these companies

it it's part of a bigger moving
piece right it's like they have to.

Pieces they have marketing
that business they have

to do with strategy deputy research
allegation answer their investors

like what is the correct security strategy
a lot of times like they don't know and

they either run looking for guidance or
two they have a specific need but

that need is constantly evolving as the
kind of push out new products so I mean I

think like industry moves very fast and
like these companies move very fast so

the problem is like their needs are always
changing and they're looking for kind of

the they themselves don't know what their
exact security need is they have some very

big need but you have to prove to
them within their infrastructure and

product strategy that you know your
security product is very useful so

it's a very different model
I think that companies have

companies are interested in making
money right and like building

products.

I think I don't think I think
it's I think it's two sided and

I think the problem with security people
is that most of the time when they go to

a security startup or build a new company
or software they don't actually know

the needs of their customers and there is
going to offer that to you right like.

Say like Hughes like he's going to get
inundated with e-mails right he wants like

there's a lot of trust issues a lot
of relationships is used because

it's a business and so they only
want to buy software from someone

they know they can trust can stay around
someone they can build a relationship with

there's a lot of kind of like soft
soft skills I don't really exist

when it comes like dealing
with like a proposal right.

In that sense and so I think everyone
knows what like some of the problems so

I'd like to figure out their
very specific problems.

You have to kind of spend time with
that C.T.O. or with the company exec.

Yet you also have to know them
charters infrastructure dependent.

Yes.

Yes So I think like for apps like
the launch time can be as quick as kind

of like one to three months if you want
to build a polished app and launch it.

Was I think security starts
take longer usually so so

you can take anywhere from one to five
years even I think the hard part is that.

Building a product and getting customers
is inherently difficult and the reason

kind of are having our program is that we
magine that if you were to just go out and

do this by yourself right now it would
take you kind of like a couple of months

to get some D.C.'s to do some warm intros
and kind of build your network out unless

you have a preexisting network that's
great probably don't need our program but

well times there's the requires
a lot you have to talk to customers

you have to go back to iterate and
then go back again to the customer and

say I CAN YOU WE CAN YOU pilot program for
me for free.

What are your thoughts and kind of like
all these conversations take time because

you have everyone is busy like these
like these people who are C.T.O.

those are V.P. of Engineering they have
to care about a lot of other vendors and

so I would imagine usually try to put
something out takes about about a year and

have like five years for you to really get
any sort of to get kind of a large amount

of traction but usually a lot of people
manage to get traction with a new year if

you can get on get out on the right foot.

Yes.

Yes.

Yes.

So I'm going to preface this
with enterprise companies used

usually move a little bit slower than
consumer companies in terms of or.

Using money.

One has raised about one
hundred thousand dollars.

Follow up so I can crypt has raised one
hundred thousand dollars from up and

the reason they don't want to raise money
is because once you kind of like raise

money you have to give up good deeds
in my growth is very fast and so for

them they're still trying to like
make sure if you take money early.

Your valuation will be lower generally And
so if you wait and

get some customers you'll give up less
of your company when you raise money

especially in Enterprise the valuation
differences are pretty big and

then the other companies are actually
trying to merge with another MIT company

run by a professor and so they actually
have a product but no customers and

our team actually has all the right
customer connections which is very

interesting so.

You and then

you.

Yeah and so the idea is that if you were
a large company you would have to hire

an engineer whose idea is to read this
paper or read these ideas integrated into

into your system but
really I think the problem is.

In our model we're building
a company that's innovative and

that company is kind of selling
the software that does all this stuff for

the manager and programmer so it's like
it's an outside vendor essentially

right it's some software that people use
I mean this is probably not ideal for

someplace like Google which builds
a lot of stuff in-house but not all

companies have the luxury of like having
the most talented engineers to work on

the most important problems like they have
other concerns like our product is it's

not being built correctly and so security
for them is like not even top priority.

Yeah.

Yeah so that's an interesting question and
so the reason actually so company is.

All the right way to frame is
that they actually love to

outsource the security because they're no
longer responsible if they get hacked and

litigation comes they can say I tried
my best hacks are going to happen but

I'm just likely paid consumers as
much because I didn't take and

unnecessary risk right and I tried my best
and I still got hacked by zero day or

something I didn't know is going to
happen and the second the second part of

that question is that how do I convince.

A company to trust me I think I'll
add that goes back to building these

relationships so for example of the C.T.O.
of a big security company or

for someone to a to a V.P.
of Engineering at another company those

two people if I play golf together hang
out together go on the same meetings and

they're like if you trust them and
you spend time with them great I trust you

right I mean there has to be some initial
trust by I think that's why going out in

the cold and doing doing a startup being
conveyed to some of the fire software

is very difficult because no one will
listen to you kind of have to all these

introductions have to be done I think it
was so about having the best product but

having kind of the best relationships Ray
and that's kind of the business side of

things.

It's it's more complicated than
that because it's not so black and

white so when something gets what when the
hack occurs and first of all you have to

figure out who who's actually responsible
and then so there's like there's a lot of

like lawyer stuff on both legal stuff on
both sides and you kind of go through it's

like when you go into a car accident for
example is like who hit who and usually

it's like there's some negotiation that's
done if it's an unclear situation ends up

being seventy thirty it's essentially the
same idea if it's not clear by I think for

companies at least they can tell their
shareholders we use a security vendor

that was trusted and a brand name and
from someone we knew.

And we made our best effort and

rather than we did nothing
at all in the first place

right.

So.

Yeah I think I think people understand
that you're probably going to get hacked

and the question is is the reason
relationships are important is that.

A lot of these companies when they
reached out to us last year to actually

try our software the reason
they want to try startups

is that they know that there are some when
you when you know you don't have a big

you're not a big corporation and you're
not going to try if I talk to some always.

Talking I can get to the C.T.O. or can
get to someone who gives me an answer and

I think you build a reputation
from the ground up there's no like

a quick way to suddenly have a reputation
and I think I think a lot of it is about

you know people understand that they were
if you get hacked you know they won't kind

of like put it against you but it's like
what you do as a response right it's like

can I reach you to do instant
response can you detect this hack and

could you like respond to it before I even
know that I can even happen can you kind

of like do all these things for me without
me actually having to worry about right

a lot of these companies want to worry
less about security but also like trust

the right people with security and some of
their own engineers many of the time and

so the way you develop a reputation
is like building these relationships

with people to say hey you know you
can trust me if something bad happens

I'll take care of you right it's it's

kind of like you know having a doctor is
like a doctor misses something you know

it's going to happen but the point is like
what does he do to forewarn etc etc and

kind of like how do you get to the point
where the even let you in the door and

kind of like gives you
that responsibility is

through all the through
relationship building you know

working.

Yes that's a good question.

Yeah so I think to a number of
ways you can convince them one

chances are they're in an industry or
someone else that's a competitor or

something build something similar
to them has been hacked and

so you can tell them like this person has
been hacked in the past the reason they've

been hacked is that they have
a bigger more pressure than you but

one day if you want to get to that market
share you're going to become the target so

might as well prepare now when you
have less code that's one approach

the second approach is that a lot of
these companies use the same vendors so.

Not every company is Google
like some companies like buy

a lot of enterprise software that's
why enterprise software exists that.

Database is.

They use like SAS they use they use Also
they use a bunch of SAS products and

you convince them hey.

You know someone else who is
using this product I hacked

last week you didn't hear about it
because we solve the problem but

we just wanted to let you know
that you're also vulnerable

either you can fix yourself with
a product that's better and fix it for

you.

Yeah that's like I think
like most research.

Yeah so.

Yeah so there's a lot of one I think

the original idea that motivated this is
my co-founder gene and was going to be

a professor at CMU she does a lot of she
built a secure programming language and

ideas that you would have your
you just write your program and

you would write one line like this you
just tag or data and ideas that you can

manage the policies on the side or
in a separate kind of separately and so

you just write your program say like this
data is like a certain type of data and so

later on you can say like this person's I
want to access this A There are not that

data and you kind of wrote a really cool
integration with Django for this and so

she went out and asked people like how do
I commercialize this programming language

and people like you know no one's going to
use it like no one cares about programming

languages and I.

Know a lot of people using about people
why would I don't use a new programming

language I should learn
something new why do I care and

so I told him I was like Go talk to
people a different way to say OK

say use Django aready I have a piece
say I have hypothetically P.

Software that can just do all this for
you and make it more secure and

people are more amenable to that for
example even though it's all the same idea

you just there's just a layer in the
middle that said like I have some way of

translating Django into dislike new form
of Django and that's for example that was

something like that when she would have
known if she didn't go on as someone

this idea of encrypted databases so for
a lot of people there I could I care about

performance like how do I build
a encrypted data base your idea seems cool

and there's like a lot of like in your
research you make all these assumptions.

And you go bad I don't like them or

if they like don't fit in my model it's
like how do you kind of like go and

talk to someone say I look you have
a kind of real you have to reframe

the conversation and these are like good
ideas that could be used in practice and

the problem is like people shooting
down before you can get a chance like

reason with the mob out of like
what is a good way of doing.

Of doing and I for example like a lot
of the oblivious REM ideas part is like

you know I don't care I came in doing
corruption like why would I want all of us

ram.

Cool.

Right.