Do you think the SolarWinds breach will have a significant or lasting impact on how IT approaches supply chain risk management?

Every security leader, let's say they had a $130 million budget and SolarWinds happens. They go back to the CFO and the executive leadership team, and they're going to say, "Hey, listen. This is a new emerging thing, supply-chain risk." Is the CFO going to give them more money? I would say no. They would say, "Hey, you have a ton of money, go figure out how to do that." And then the CISO has to then say, "I'm going to spend less on this to go focus on that." I just don't see the actual prioritization happening, unless the organization reallocates new funding for it.

Or the business changes priority on what it wants to get accomplished. If it's fundamental to the business, if reputational damage is fundamental to the business, then the business is going to do what it needs to do to protect its reputation. If it means they have to slow down some of their efforts to try and get a handle on it, they will. There might not be additional funding, but there will definitely be reprioritization. But I think, in the long run, what's going to happen out of this is, the scrutiny on the vendors is going to go up. It's going to cost the young startups that want to establish themselves into the industry, the cost of acquiring business is going to go up.  I once worked with a young endpoint solution startup. They really were good at what they were doing. We said, "Okay, let's go do a site visit of your offices, let's see what's going on." This is a company that already had 60 logos to it, and some big financials on top of that. But we went there and they didn’t even have basic AV in place, forget firewalls and basic governance processes. I think the free lunch that startups had of, "Let's just get the logos in. Let's not worry about the infrastructure and security, governance etc." might be under a little bit of scrutiny now.

We had a similar experience with a startup where, the kind of operational controls they had did not even meet due diligence requirements. Let's say they have soft tools and all the relevant standards. There's another component that we have to think about, in terms of how effective they are operationally and if they have the right safeguards in place. We ended up declining them and choosing somebody else just because they lacked very basic controls. And I think this is where the checkbox thing really is overkill sometimes. You have so many things that you are kind of ticking over but when it comes to the heart of it, you don't really have the right measures in place. And that's a risk that we have to focus on.

Yeah, and/or they have a dialogue because they didn't know and maybe the CIO wasn't fully cognizant. So the other thing becomes, where's the CIO in this equation? Particularly if it was across their entire environment or even just critical components of their environment... I agree with you, Anthony. I have those types of dialogues all the time. Now, the thing that you talked about on the financial side of it, that's kind of interesting. If I'm losing money... It's fairly easy to spend money to get a return if you can see that I spend $100 and I save $1000 in losses. I've been in the retail environment and managed many department stores. I managed to maximize net income by losing 2%. Two percent bad debt is how I maximized the PNL. Acceptable, 2%. I would play with the credit controls daily, to maximize. If we were light on revenue and bad debt was a little low, I let credit flow. And then I'd deal with the bad debt later and then tighten things down. It was this constant thing to maximize net income.

That's exactly it. When I was at Capital One, Capital One had it's cyber breach and all that stuff and I had left shortly before. And I ran operations and intelligence there. Capital One, as an example, wrote off $2 billion in loss annually. Two billion dollars just, "Hey, we don't care. People just aren't going to pay. Whatever." And it was a hard line requirement in the board charter that if it was not a $350 million impact, if an event didn't cross $350 million of impact, the board didn't want to hear about it.

Yes, it wasn't material.