Line Cook to CISO: Eric Freeman on AI, Access Control, and Why Security Is Just Dinner Prep

Host: So I got Eric Freeman, he is currently a CISO at Ryder and, uh, really interesting career. We're gonna talk about a bunch of fun stuff and I really wanted to jump right in, actually. Yesterday you posted on this on LinkedIn around the really cloud mythos and chatgpt5.5 cyber and kind of the whole new world of LLMs getting into cyber security. So, yeah, I want to get your thoughts on first kind of cyber, maybe from the defense side, utilizing from the defense side and then tying it into the kind of the threat landscape, uh, from your end as well.

Eric Freeman: Yeah. So I think what I want to preface with is I am what I like to describe as a guru, general understanding and really useless across the security stack because I've done everything, none of it particularly great, which is why I feel like a little bit of what they say is those who, those who want to teach become teachers, but those who can't teach become gym teachers. I kind of feel that way about security. When it comes to what we're dealing with, dealing with right now with models, I think we have a lot of firepower that we've never had historically speaking. Meaning we have really quick access to inference that gives us the ability to parse through data and make more sense of things than we have historically had before. But without proper context, there's no added value. Um, and I don't think that's too dissimilar like the larger issues that we've had in security for a long time, except with humans. Now it's a computer or compute. And so when I think about vulnerabilities and models, what we're really looking at is a rapid pace of, for lack of a better term, technical diarrhea, um, getting crapped out of these LLMs on findings and vulnerabilities. So what's an example? There's a lot of open source tools like one called Shannon or Pentagi or cai. There's all these open source pen testing tools that people are using for, not just like trying to like ideally find a zero day, but exploit them. And so by using, whether it be Mythos or using GBT55 Extra High or using Kimi K26 or Deep Seq 4, whatever it is, you're able to point these tools at, uh, an endpoint or a target and rapidly try to exploit it because the inference has good understanding based on its historical training set of like coding practices and coding tools, it could take that data, synthesize and access it. So with these models we have a much faster access to vulnerabilities that we ever had before. The thing then becomes as like a ah, person who manages security program. How do we like use that for the inverse? How do we use it to defend better? And so a lot of it comes down to what do we take from like traditional detection standpoints, detection methodology, whether that be shifting left and doing you know, SCA for analyzing your packages to make sure you're not running a vulnerable version of Axios, which has happened a few weeks ago or that you're not running trivia in production because it got compromised. What we're trying to do is think about how can we get that signal faster and using an either a well tuned LLM or using what is traditional detection and response tools and mechanisms but using the LLM to do additional validation. So an example would be we have an alert that one of our engineers shipped a vulnerable version. Let's just use Axios for example. What we then want to do is automate not just via static script but like using an LLM to do an eval against it of uh, okay, that package is vulnerable. What code base is it in then? Is it reachable? So can we kick off a job to determine whether or not that the vulnerability associated with that could be exploitable from the outside in as if I was the attacker and then if so where can we start looking to see where else it exists across the code base? Then can we think about if we were to make a patch, like would that be something that breaks a build or breaks our production environment? And so you're using the LLM to like start operating through this based on the logic and ideally what I believe Gary 10, you know, dubbed as um, thin agents and fat skills, these skills being these tools and this methodology of being able to attack the problem with a known standpoint. So it's a long winded way of saying that we're at a time right now where speed is crazy. I don't think these LLMs are doing anything like super duper novel in the way of like we found we've invented a zero day that's never existed. I think they're finding things faster that have long existed. We just haven't found it because there's now more access to analysis, faster speed and precision.

Host: Super interesting. Yeah, thanks for sharing that. Uh, two things I love to, to go a little bit deeper on first context and understanding context. I think Your post on LinkedIn, uh, alluded to this as well. I'm curious how um, you I ah, know in this world of, of AI, um understanding context, having that experience, bringing that to the table is so important. How do you teach that? What, how are you thinking about that different in the world of AI? Can AI help with teaching your team context and creating getting up to speed? Because I feel like that's like the biggest gap is that experience. Right. And that's where we're seeing not only entry level workers being replaced because they don't have that experience, they don't have that context. And uh, yeah, I'm just curious your thoughts on how do we. How do we, uh. And then it may be in conjunction with speed. Right. Cause you're talking about speed and things are moving so much faster.

Eric Freeman: Yeah.

Host: Uh, any thoughts on maybe those two concepts?

Eric Freeman: Oh my God, so much. Uh, we're smooth brained apes. At the end of the day. We're all just a bunch of animals here. And so I bring it up because use AI. AI is like, I describe it to everyone as like the TI83, meaning when I was in high school, middle school, et cetera, and we had to use this calculator to take the SATs. You know, is that thing just making you completely illiterate math? No. You have to know what you're putting into it to get the most output out of it. I think this goes one step further because it can legitimately solve the problem if you're writing it in a very natural language way, which we as humans have never had the ability to do, is like, how do we explain something? And this thing can interpret that and solve whatever. The larger question is under the hood what I think the difference is when it comes to learning and teaching, you have to think about in terms of like, how do you learn? When I build security teams, one of the most important things I try to take time to do, even though it's particularly hard given the fact that I have to wear so many hats. I try to understand, like, how does, how do the people that I'm hiring learn? Because I'm a believer that when you build a security team or you build teams in general, you have to like, build an environment where people feel comfortable and honest to be able to give you feedback. And also you give them feedback. So it's, it's while, while it may be personal information or something that can be perceived as personal, you have to, uh, you give it so that they can grow. So one is like honesty and trustworthiness. Um, two is I look for people who are like extremely relentless with hard work. Like, I don't care how smart you are. Work ethic to me is like Worth so much more. And that comes from like a cooking background. Before I was insecurity, I was a line cook. I used to work. I, I used to work 16 hours a day, six days a week. And I've had a chip on my shoulder ever since I've been in this industry because I'm not a traditional SWE that I software engineer that like I'm never going to be as smart or as good as anybody else. And so like I just tell people I will outwork them, which has its own set of problems. But like I care about that. And the third thing is I need to understand how people learn. I'm a visual learner. I learn by watching somebody do something X amount of times and I try to get feedback about it and go, there are other people I know that learn by literally reading something. Once they retain the memory and they can go. I know another group of people that need to just like on their own, try something without any directions, bang their head on a wall. I bring this up because like, that is the way to like knowing how to learn. And knowing how someone learns allows you to put them in an environment to be successful. And so if someone knows how they learn, they could take that style and use it with the LLM. So when I try to teach myself new concepts because food is something that's very instinctive to me, I always ask from a Socratic perspective, whatever, whether It's I'm using Opus4.7 or GPT5.5 or I'm using GLM5.1, whatever it may be. I'm always asking it of like, explain this to me in terms of me being a line cook and I'm working inside of like this environment because it's something that like naturally comes to me. And if it's a deeper concept that's unfamiliar, you need to be have a correlative relationship with something that you know and can understand that analogy from that has like a deeper passion interest. Because the reality is what we retain as humans from like a brain perspective needs to be something that like captivates us and gets our blood flowing away that like really honed in. So when it comes to learning, I always tell my team or I try to tell people, think like, try to understand this in terms of not what is the problem you're looking to solve, but what is the way that you can make a analogy that relates to you because that forces you to actually have to think about what the problem is and make that analysis in that relationship. So the example that I will give is we are in the process of building multiple agents internally do various things. I have, we have one currently that does all of our DNR work. Let's call it like soar 2.0. I have a chief of staff that's a, like, a legitimate like agent that is doing everything from tracking call transcripts to creating action items in JIRA end to end. I have it reading uh, JIRA tickets and giving updates. It's looking at GitHub PRs. And so what I'm trying to do is get people to think about like how do we decompose tasks at, how do we leverage an agent to do it. So one of the areas that we're working in right now is how do we get this, let's call it a purple teamer. A purple team or agent to think about how we're going to take vulnerabilities, map that back to how we defend it and give this feedback loop. We already have an agent that's doing the detection and response like analysis from the blue team perspective. So what's that? Purple teamishness. So I have someone on my team that I said hey, I know you love sports. You're a huge, a New England Patriots fan. Talk to me about this in terms of like Drake may trying to drive down the field on a two minute drill. And let's talk about what the plays would be for this agent to like to assess it and then let's go through that as it pertains to. We want to run a vulnerability scan that's going to be in these environments and we're looking for the following signals and we need to have it do a de dupe and a diff meaning if I'm a quarterback and I'm doing a read of the field and I'm doing a check on route number one which is going to be a hook route and that guy's not going to stop short. And I have to think about it in terms of my tight end running a fly route. Like this is what I try to do with people because it's the best way to use it. So again, another long um, winded way of saying you can only learn based on something that like motivates you as a person internally. And you have to, I find, understand inner things that link relationships in a way that you understand to take a concept of something and apply it to something super cool.

Host: I love that. I'm going to use that not only for my, my conversations with LLMs and how to, how to extract, how to contextualize for me what they're trying to explain, but also with teams, that's super cool. Obviously. It shows, uh, empathy that you have. You understand them, you're, you're, you've listened to what they're interested in. And then, uh, it's like creating, it's like almost having them tell a story to themselves of, of uh, how to relate and how to contextualize whatever they're talking about. Which I think stories in this world as humans are super powerful. But then also, yeah, like you said, it, it instills, uh, in our brain. I'm curious before we get into. I'd love to talk maybe a little bit later about some, uh, of the agents you're building and all that fun stuff, because I know Ryder is like, you know, an AI native company. And so I know there's a lot of like, security side. That's interesting, I'm sure. Also just your, your overall culture is super interesting from the AI side. But you mentioned being a line cook and actually before I, I got into cybersecurity, I was worked in a restaurant as well, and I, I was on the front of the house. So we were, uh, either enemies or best friends, uh, depending on what restaurant you're in.

Eric Freeman: Um, um.

Host: And, and so, and I went to management, learned tons of skills. I'd love to hear, I still use to this day from that experience. I'd love to hear maybe a little bit about your journey and what, what things that you've learned in those environments do you still lean on as you, as you work in cybersecurity? And, and yeah, yeah.

Eric Freeman: Fake it till you make it. That's unfortunate. It's like, what we're all dealing with here. I don't mean that like, in terms of, like, everyone's a fraud, but like, to some extent, like, it's impossible. No one's just born with experience. You learn like, often, unfortunately, by like death by a thousand lashes. And when it came to cooking, one of the things that, like, it's all about repetition and it's all about reps. When you're working on a line and you have to make a pasta dish that is going to include you. Here we go. Um, one of the things I used to make at one of the restaurants I worked at was this thing called Rigatoni El Sugo, where we used to have to come in at 8 o' clock in the morning. I'd have to break down an entire pig. I'd break it down into very specific cuts. The whole thing. I'd get two cans of like massive industrial Paint cans of tomato, two bottles of red wine. I'd have to cut up about 10 onions, three heads of garlic. You do this whole thing, you come in, you have to braise, uh, it down, put it in the oven, let it roast, and then you have your meat sauce for the service to pick up. When it comes to working in a restaurant, believe it or not, most of your day is not dinner service. It's prep in advance of dinner service, where you're working on building process, you're working on building all of the things that you're going to need for the meal so that when it comes to dinner time, what winds up happening is you have a container of the actual sauce. You have put your pasta in a pasta tank and set a timer of nine minutes to make sure it comes out al dente. And that when that comes down and there's about two minutes left before I have to pull the pasta out of the pasta tank, I have to take the meat sauce, I have to put it in a pan, let it reduce, put the pasta in, let it, let it uh, emulsify and really uh, like mix with the sauce so that I can put that on a plate. What the heck does this have to do with security? Security is largely the same. We are all preparing all day long by implementing controls. So I'm trying to implement least privilege access by grouping users into a specific group based on their job, their role, their function, what type of objects they need to have access to. How do we want to build that? Authentication and authorization. What are the checks? So that when dinner service, AKA the incident unfortunately happens, we are prepared to know how to respond. We have a runbook, we have a methodology, we have a way of evaluating that risk and looking through it. So they're both jobs that are frankly way too stressful for no reason because the reality is we're not saving lives. In some instances, if you're working at a hospital, you are like saving a life and you're trying to make sure that like yeah, machines are on to make sure that humans can, can survive. But generally speaking, security is not about saving lives. It is, it is. I can't say that enough because I even get carried away a lot. I'm a very intense, clearly people can tell I'm an intense person with a lot of energy. But they're both intense jobs in high energy, high tense environments where you gotta like just be level headed as much as you can and just say deal with the task at hand one step at a time. Let's think about systems that we can put in place to make things easier for us, but let's go. I got into security because to, uh, not go into too much detail, I taught myself how to use something at the time called Backtrack, which later became Kali Linux, where I was trying to use it as a way of identifying whether or not someone was fraudulently using my signature. I used something called metasploit. I put on a work device at the restaurant at the time. Guy I was working with was a former ccie. He went on the laptop, opened up the terminal, went to go see where the IPs were connected to, saw that it was located in Queens in New York. Said, uh, I only know one person that's based in Queens that works at this restaurant. Knew I worked at the Apple Store in college and said to me, what the hell are you doing? Why are you doing this? But also stop working in a restaurant. I'll help you get a Cisco certification to get your career started. Faked it till I made it. Uh, quit my job, studied for a Cisco cert, got my ccna, and then I networked to a friend of a friend of a friend of a friend of a friend whose mom was doing job placements at the mta, which is the public transport for New York City. Um, and she was like, look, I don't know if anyone's gonna take your resume, because just seeing line cook and CCNA is not really gonna be the most, like, impressive thing for people looking to get into security, where it's, like, very hard to get, like, fine people. I got a phone call the next day from the CISO at the MTA who said, I'd love to meet you. And I was just like, what is this guy thinking? Um, went into the office and he said to me, if you cook, the fact that you just love putting things together and building recipes and menus and whatnot, goes to show that you have creativity. And doing forensic analysis and understanding logs is storytelling. And it's like, very much trying to put together a picture of what happened. And I could see those two things. If you've also gone out of your way to get yourself a ccna, goes to show that you have some grind and work ethic. I'd love to offer you a job. And from there, my general thing that I've just been saying throughout my career is yes. If I don't know something, I'll just say yes and try to figure it out. And if you just do that. Enough. Look, it's easy for me to say this because we're also in a time where like it's very hard to get a job and it's very hard to be a 20 something fresh out of college where everyone is reading about the doom and gloom on the Internet of AI taking jobs and whatnot. But like, I'm a big believer that like you say yes and you try hard and that's why when I meet people who are young and trying to get into like the work, into uh, like full time jobs, I say look for a startup because like you're just going to get hands dirty and everything and you're going to be forced to say yes. And the more environments and tools and technology you learn, the more you're going to understand systems and how they relate to each other. And the truth is with AI everyone's going to be forced to become more of a generalist or have just far more output. And a lot of people are like, well we're always going to need subject matter experts and if you don't have the context, it's impossible to be successful. And I agree with that. But what I'll also say is like the best way to get more context into a problem is actually understand how it's related to the other things. And so as you can see, based on all the conversations we're having, I look at things in terms of like relationships, how things relate to one another and how they correlate is how my brain operates. And that's how I think that humans also largely operate.

Host: That's super cool. I love that. And I love, I think even for any folks that are young that are listening, um, I think uh, two things that stood out. I think that's really good advice. Number one is that work ethic, right? Willing to be, work hard, willing to push yourself. And then number two is that almost curiosity, but willingness to try new things, willingness to say yes, willingness to get your hands dirty. Because I think that's the only way you're going to evolve with the changing times. Number one, in conjunction with being willing to work hard. Super insightful. You said something earlier where it's like way too cybersecurity is way too stressful. I'm curious, um, why do you think it is? And maybe what's like, what's the number one problem to help the industry solve that? That problem of being way too stressful. I hear a lot the burnout, I mean, it's only getting crazier. Like I mean obviously technology adoption, we're only going to be used more technology over time. So if you think about in five or 10 years. Like, people are gonna be using way more technology than ever, which means cyber security is gonna be that much more important, that much more stressful. So how do we get ahead of this? Um, because it already seems at a breaking point where people are not happy in this career generally. I'm not talking speaking for everyone, but it does seem way too stressful to be sustainable. So I'm curious your thoughts on that.

Eric Freeman: Okay. Um, I have a lot of strong opinions on this. I think first and foremost, because we deal with risk mitigation, our general concept is we are firefighting. Like we, we are there to put out a problem. The only time security people are recognized is when something is not working right, or else we are operating in a corner that's like, as a primitive of a role. We are there to put out fires. And, and if you think about firefighters, you only see them when there's a fire. So when you largely think about the fact that you are dealing with that, it's you're only being brought in when something went wrong. That paired with the fact that you're a risk mitigation tool and not seen as something that's driving revenue or driving adoption. And again, there's like, obviously extenuating circumstances being, I work for the Department of Defense or I work for the doj, or I work in some government agency that's looking to protect some type of environment. Generally speaking, in our society, businesses are there to make money, and you are seen as a cost center because what you're trying to do is protect the asset. You're not necessarily driving revenue often. And so you are typically there to only solve problems. And I don't mean solve problems in, like, everyone's solving problem. We're building products. You're not, uh, really a revenue driver. And it adds stress because essentially you are there to fix incidents or when things break. And if you don't do that, you're often asked, why did you not solve this problem? And what exists? In my current role, I have inherited 10 years of tech debt. Uh, like, I came into a company that has had roughly 10 years of tech debt compounded over time. I bring that up because I only get sleep at night telling myself, if something goes wrong and there's a really, really bad day at my company, I can say I did everything I could given this circumstance, because I take on all of that stress and burden which I do. I will never sleep, and I will literally give myself a heart attack or a stroke. Because you cannot fix every problem. If we take that with the fact that people are largely vibe coding and they're not thinking about the primitives of what that means for vibe coding. Meaning how are we making sure that our code is either forwards compatible or backwards compatible? Are we thinking about reusable patterns? How have we thought about the schema, uh, and whether or not we want to use a preexisting endpoint M or HTP method? All of these things exist because the reality is if the LLM is solving the problem at hand, it's just going tackle that task which often creates a net new thing. We are running against a tidal wave that is non stop always running against you. So it's stressful because often you're trying to control a scenario that you have no control over. And so as any human would. So we immediately feel this like stress fraughtness and this um, this impact that like we, we're up against ourselves and we're up against everything. And the reality is that's not going to change unless there is either a way to turn, you know, some incentive that keeps a business evaluated as an industry standard on what good looks like. I think one thing um, security scorecard did really well was they tried to give companies a rating. And why I think about that is because it's like the equivalent of a credit score for a human. Evaluate people based on what is their credit score and worth investing in. And that's solely based on risk mitigation. If you think about it, your credit score is based on how much you're using on your credit card. You pay things on time, what are you buying for, how often are you taking out a loan? If we had something for security where it was known that like everyone has to be legally held accountable to this, it becomes a different type of thing. Yes, you're still mitigating risk but the reality is businesses are incentivized to work with a secure business because it looks better for optics and is going to say more about your business. And so if there were something in the industry that could be consistent that was like a mandatory requirement, I think it would be different. We know that this exists for finance. Who's to say it should be different for.

Host: Super interesting. Yeah. And I've worked, I've worked a lot in highly regulated industries and it's almost, and uh, comparing them to non highly regulated, it's, it's interesting because the number one thing a lot of times they say CISOs, uh, in that space talk about is their um, their number one thing. They're, they, they're, they're measured on is regulatory compliance, not necessarily security. Right. Because security is nimbulous. And so it's almost like, oh, yeah, hey, as long as our audits and our examiners say we're okay, I can sleep well at night. And to your point, I think that's actually, um, you know, you should go further obviously, and make sure it's, you know, you're actually secure. But it gives you um, some sort of standard, right, to know that yet you're, you're doing everything you can. Um, I love that. That's super interesting. I love to hear is there um, so obviously working in an AI native company. I actually have not talk to anyone on the show that has worked, um, or LED security and native company. I love to any, anything there that's unique that I'm sure compared to other industries you've worked in, that's unique that you can share as far as like the threat landscape or how you think about security and maybe even some positives, right. Like, are people more aware of cyber security? Is technology more. Is cybersecurity more invested in than other industries? Any thoughts there? Like, what's unique about doing security in AI native company?

Eric Freeman: While I'm both the best person to ask for this, I'm also the worst because I've worked largely in industries that are emerging in real time. I worked in blockchain for a long time when I was starting up. I'm not necessarily like the earliest person in AI, but I'm still kind of here in a place where it's like emerging and it's still like a rapidly growing industry. What I'll say is there's always going to be the threats unique to the business that are unique to the landscape. And when I was in blockchain, web3, crypto, whatever you want to call it, it was smart contracts. When can a smart contract be exploited? Is that going to lead to some type of like money being lost? It was during the ICO boom. Every single ICO was getting popped because People had a WordPress page with default credentials and they changed the wallet address for where money was being raised and funded. Basic security concept, but just apply to a different paradigm when it comes to what we're dealing with internally. I think there's like a few different areas. One is how do we think about agents? How do we think about agents being hardened and protected when it comes to access control to it and you're giving access from the inference to the tool, how do we think about what that relationship is and what's the impact of it, um, we think about the LLM itself. We have a LLM that we've built internally at Rider. It's part of our own internal model called Palmyra. How is that being trained? Is that being trained in an area with, you know, confidential compute? What are the GPUs look like? Is there any type of risk to the GPUs and how they're being built or created? When it comes to the actual inference, what type of guardrails are we thinking about and have we implemented to make sure that there's no biohazardous type of training that goes into it? How is the data being trained from a poisoning perspective? So there's things that we think about from the LLM. I think the thing that I will always tell people is security. Security. New technology comes in, everyone freaks out. They're always like, what is this? What is this? It's typically a bunch of new jargon that's unique to the industry. I hear about prompt injection all the goddamn time. And I always tell people, prompt injection is no different than like social engineering. A human, you're just like trying to sneak specific things into a prompt. Do you get an output that's unintended? How is that any different than me lying to you to try and get like your ah, Social Security number in some specific way? I think of, I think a prompt injection of like Oz, the mentalist of like trying to like do people and like manipulate them into saying something and then being like, look, you thought of the thing. I have the thing that you thought of. I have the three of spades which is magically in your pocket. Like people are going to have a lot of feedback on that comment, I'm sure, but it's really no different than that. I bring that up because agents are no different than just uh, a script with more dynamicness to it and using a human's credentials. So yeah, it can go wild. Yeah, it can hallucinate. How is that any different than an end user making a mistake and fat fingering like a database that gets dropped or deleted? It's, it's really not that different. So then it's like, okay, how does the model then get to apply to least privilege or role based access control? And that's where I kind of always tell people when I think about my mental model for security, I break down security into two buckets. That title one core theme, which is there's bad business logic that leads to some mass problem. Either a workflow from a human being to another human being, a process breakdown. It could be code that winds up saying hey, we wanted to create a coupon code or a way of giving out coupons that accidentally became an infinite money printer for some reason because the logic was poorly coded or there's misconfiguration. I've left this port open, exposed to the entire Internet. Uh, we left SSH open to the entire Internet. SMB's open to the entire Internet. That's a misconfiguration. The reality is both these things tie back to how do I abuse that for more access and deal with role based access control. And that is the mental model I'm always thinking of. When you're trying to abuse an LLM to give you an output, you're just trying to get access to more information or something internal related to either another person's tenant or data being shared in the platform or another relationship as it pertains to someone else using it. So I always tell myself access control is what matters. When an attacker, you know, let's use the Axios vulnerability as an example. Axios got popped and it became an info stealer immediately. Meaning attackers want to use that to get more data on keys, tokens, et cetera they can use to get access pivot and go further. It is all about access control and I think we have to simplify it. I'm sure there's going to be someone who's a software engineer at either Facebook, Amazon, Netflix or Google that's going to come back with some wide extrapolated thing of Eric. Well, you're not wrong because of idempotency and blah blah blah. And the reality is stop boiling the ocean to prove you're right. Because the reality is we need to be kinder to each other and realize without working together and thinking about the fact that like these things all are related about access control. We're just, we're finding negative, we're fighting, we're fighting against each other for no reason.

Host: Super cool. We only got about five minutes left. Now I got two more questions I want to hit number the first question is, kind of ties in a little bit with, with a couple things we talked about which is building uh, really a security culture and working with folks that are non security folks. So like executives board, obviously that's kind of one area but then the rest of the organization, how do you think about building that culture and getting that buy in? As I was on Reddit yesterday and then somebody asked what's the hardest thing about CyberSecurity? And literally 80% of the comments were working with people Working with non security people. So I'm just curious your thoughts on, on that whole area.

Eric Freeman: So there's kind of two ways of thinking about this problem. There's if you're at a company that has a large engineering org and that's the product. If you work in SaaS, tech, et cetera, there's how do you solve the engineering culture problem with security and then there's a uh, how do you solve the business problem? The business problem is often. I hate that this is the case because I often think it's security theater but is compliance because the compliance controls do have positive intent. It's just been completely gamified in a horrible way in my opinion. And I know Vanta and Drata and all these tools are great at what they do but it's become very much a checkbox exercise and a little bit of ah, a um, a way of getting a gold star for not really much. But I bring that up because businesses use that to enable sales and by saying we need to have MFA across the board stop that allows end users to have some type of friction in a workflow in case they get fished. So like I think those help because people who don't work in technical roles typically get spooked and they want to do the right thing. Now when it comes to engineering it's a different problem because you have people that understand technology, they understand the workflows, they understand the ins and outs of what's happening on a day to day. And when it comes to culture around that I have found the only way to be successful is think about developer ergonomics. There's a great term in the security industry that sometimes makes me go crazy called paved roads where it's how do we pave a road that a developer adopts that has security controls built into it and has the right intention. I'd want to go one step further and say we need to build developer tools that eliminate foot guns and allow them to have the paved road. Because the reason why is a uh, developer is incentivized to move faster, ship code, get new product out there and get product to option and repeat the flywheel. I have found that if you build either a CLI tool that allows them to be able to get access to a secret or a token that they need for an automation without giving them broad access to every single secret or token or giving the ability to have some type of way of rotating a key so that they can move faster but they do it without having the risk of saying I can access everything You've made not only their workflow better, but you've built security into it. And so when I think about culture, it has to be about what is the way you're enabling someone with your own personal incentive that gets them what they need to move quicker, while you're getting what you need to protect the business. And I found that that is the best way because if you get them something to move quicker, you can remove all the access in the world and they can still do their job and they could do it faster than they could previously. That, to me, is where the sweet spot of security is when it comes to building an engineering culture. On my team specifically, I look, I am. I, uh, always tell people I'm professionally unprofessional. And what I mean by that is I try to keep things really light, free, open, et cetera. I crack a lot of jokes. I try to keep things very loose. I want my team to feel open with me. I want them to feel like they can be vulnerable with me. That's on them if they want to be. But if you build that cohesiveness of, hey, we're all in the trenches together and you also work with them and you're not just like, I'm a business information security officer who checks a box. But like, you're not afraid to literally write code or you're not afraid to do a threat hunt or look at data. People respect that because they see that you're willing to put in the same sweat, sweat equity is them. And they see that you're not afraid to like fall on the sword. That's loyalty that goes really far with people. And so I try to just look at things in terms of like, what, you know, what is the type of boss that I would want and how would I want.

Host: Last question. M. In our prep call, you talked about the industry selling based upon fear and how things are bought and sold. And you talk about three camps. Can you talk to me about those three camps of buyers?

Eric Freeman: Yeah. So, um, when it comes to security, I believe there's three camps. There's the. I'm a software engineer who's become a security person and I'm going to want to build everything no matter what. And this is how I think about the problem. There's the middle ground security engineer, which works at a lot of companies that isn't necessarily in like Silicon Valley, San Francisco area, which is. I'm a security engineer who's a generalist. I often get outputs from tools and I typically lob it over the fence. But I know a little bit about scripting to automate a problem and they're more generalist, they're not deep, deep software engineers, but they have a good understanding of a lot of things. And then there's the third camp of um, I am a compliance business information security officer and I'm the person that is going to do and outsource whatever I can because I just need to make sure the business has all of their compliance needs met. Security sells based on fear because the reality is two of those camps to buy tools based on UIs because they're not as deeply technical when it comes to understanding how to use, how to write code, how to interact with APIs to understand like how a uh, terminal is used. They buy based on UX and leverage that US UX experience because they care about reporting and outputs. There's the third camp which is how are we building something that like really services and automates something end to end. And so I bring this up because if you really distill down the industry, this is what I've seen across the board. I am by no means saying this is the only way to look at it or that I'm even right, but this is like the three camps I've seen. And I bring it up because the camp of the software engineer often wants to build their own tool, maintain internally and that ego gets involved. The middle camp is going to pick when do we build versus buy and how are we thinking about it? And uh, the, the business information security officer is often either looking to outsource or get a tool to help automate things end to end. And I bring this up because the reality is two of those camps still mean that you can sell based on fear of um, you're going to get hacked, you're going to get breached. It's the way to protect yourself. Hey, we have an automated AI pen testing platform that's going to help you identify every vulnerability under the sun. And why wait now when you can be able to make sure that you have identified every single attack path in real time. And this is the way to do it, we're going to export logs to this. The truth of the matter is like these tools are all irrelevant if you're able to shift left as hard as possible and have every control implemented. And so people sell based on fear because the reality is in a firefighting environment you have to be afraid that you're going to be afraid that a problem's going to happen and you have

Host: to camp super interesting. I know we're up on time here. You covered a lot of ground. Super fun conversation. Thanks for coming on. How can folks find you online?

Eric Freeman: Go M to LinkedIn. I'm also recently after destroying my social media about 10 years ago, I'm back on Twitter and probably doing a little bit too much shit posting, if I'm being honest. Um, but in general, you can reach out to me on LinkedIn. I'm pretty easy to get in touch. I'm a busy person, but I'm easy to get in touch with. And um, I don't bite. I'm a big loud guy, but you can just reach out to me directly.

Host: I'll put your links in the comments. Thanks again for coming on. Thanks everyone for listening and we'll catch you next time. Thanks. Eric.