Security You Should Know

The episode delivers moderate substance on the specific problem of proving recoverability and Gambit's positioning, but pads significantly with CEO pitch language, repetitive framing of the same concept across multiple speakers, and broad statements about AI and disruption that add little concrete insight. The discussion of 'minimally viable company' mapping and backup validation is useful, but the conversation circles back repeatedly without diving deeper into novel mechanics or surprising findings.

“85% correct out of the box. It's a combination of what you've already done and what we learn about you publicly.”

“we are fundamentally telling you what are the business capabilities that matter most to you, those corresponding business systems? We're relating the digital estate back to those”

The core insight - that proving recoverability is expensive and often untested - is well-established in DR/BC circles. The framework of mapping business capabilities to recovery objectives and validating across hybrid backup platforms is sensible but not particularly contrarian or first-principles. The episode does not challenge conventional wisdom; it packages existing DR problems with a vendor solution using familiar resilience vocabulary.

“trust but verify model that didn't work for long in the vulnerability management space. And we eventually had to right that wrong. Now's the time to fundamentally right that wrong from a security perspective.”

“change, innovation and threats are now moving at the pace of AI”

The guest lineup includes Adam Palmer (CISO at First Hawaiian Bank, a regulated institution) and Howard Holton (former CEO of Gigaom, with direct recovery disaster experience), both of whom bring real operational context. Curtis Simpson (CSO at Gambit) is a vendor representative and thus inherently less objective, though his background in mainframe environments adds some credibility. The mix of a practicing CISO and an experienced CIO/CTO perspective is solid but not exceptional - no Fortune 100 CISOs or operators managing multi-billion-dollar recovery scenarios.

“Adam Palmer, CISO at First Hawaiian Bank”

“Howard Holton, the former CEO over at gigaom”

The episode lacks concrete data, named customer examples, actual metrics, or timelines. While Curtis mentions 'a Finserve company' spending 'thousands of hours' on immutability validation, there are no named companies, no specific RTO/RPO targets, no dollar figures for recovery costs, and no benchmarking data. The '85% correct out of the box' claim is the closest to a metric but lacks context on what accuracy means or how it was measured. Most claims are illustrative rather than evidentiary.

“we actually chatted with a Finserve company just the other day who's spending thousands of hours a year just validating immutability.”

“85% correct out of the box.”

Howard and Adam ask reasonably pointed follow-up questions about unique capability differentiation, scope of the 'minimally viable company' mapping, human input versus automation, and board-level reporting. However, Curtis's responses are polished pitch-speak that often deflect or broaden rather than answer directly. The host does not press back on vague claims (e.g., 'AI-augmented hackers'), avoids asking about competitive comparisons, and does not challenge Curtis to define failure modes or limitations rigorously. The conversation is professional but lacks productive tension.

“Can you help me understand what unique decision or capability your tool is offering that my existing tools don't already provide? Collectively?”

“how much of that is human input, how much of that is signal, what is the kind of automation, what's the lift expected from the team, and then how much do you stand behind the accuracy of it when something happens?”