Founders on Fire with Emily Hodges & Haydn Brooks of Risk Ledger

Speaker A: Hello, everybody, and welcome to the Tech Trailblazers Founders on Fire podcast. My name is Rose Ross and I'm the founder and chief trailblazer. And I'm delighted to be here today with not one, but two of our winners. Um, and that is, um, Emily Hodges, who's the COO of RiskLedger and runner up in our CXO. But also RiskLedger is our, uh, security trailblazer from last year. And also welcome, welcome to Hayden Brooks, who is co founder and CEO of riskletcher. Welcome. Hello. Hi. Lovely to meet you both.

Speaker B: Hello. Thanks for having us. Heroes.

Speaker C: Heroes.

Speaker A: Well, it's very exciting because obviously security is on everybody's mind at the moment, um, for good reasons and for not always such good reasons. And obviously that's part of the reason why riskledger exists. So it'd be great to kind of get a little bit of background on both of you, you know, how you came to involved and then obviously dive in on what Risk Ledger is all about and why it's, you know, come about and also why it's so successful. So, I don't know. Emily, would you like to go first and just give us a little backgrounder on who you are and where you've come from?

Speaker B: Yeah, of course. So my background is in, uh, originally started out in cybersecurity consulting and actually used to work with Hayden a number of years ago, um, helping clients, all different types of businesses, be more secure through that journey. Um, a huge part about being secure is around getting people to work together, getting people to understand that it's a business problem, it's a people problem. There's a huge amount of tech involved as well, but if you don't solve everything altogether, you're not going to make a difference. Um, and I remember the moment when Hayden was talking me through Risk Ledger and the vision and what he was trying to do with it. And to be very honest, I thought third party risk was a really boring part of cyber, and I didn't really want anything to do with it until we talked through the vision. And I realized that actually it's not about third party risk. It's about getting different organizations who work together. They supply each of the services, they have connections, they share data. It's about getting them to work together to improve security across all organizations, regardless of whether it's a supplier or not. So I thought that sounded pretty exciting. And it was about four years ago that I joined Hayden on the journey.

Speaker A: Fantastic. So, Hayden, where did this all come from? Tell us a little bit about Yourself. And, um, you know, where did the idea come from between you and your co founder?

Speaker C: Yeah, it kind of happened by accident, I think. So, um, my background is fairly similar to Emily. I started off as a security consultant working at big four companies, so KPMG and Deloitte. Um, just because of the type of work you do as a consultant, I ended up kind of spread across different domains of cyber. So a lot of different projects, different domains, but ended up doing a lot of work helping clients understand the risk posed to them from their supply chain. And at the time it was kind of a growing risk. It was one that clients were learning to grapple with and they were starting to experience a lot of different incidents across their supply chain. So no matter how kind of much resource or time they spent securing their own business, they were getting hit constantly by suppliers that they worked with. Um, so set up and helped run the third party risk management processes for a lot of clients across London. Off the back of that, came up with an idea for a system that would help make that easier and more efficient to do and basically do me out of a job, which is kind of the main aim. But by architecting the system in the way that we have, it was about opening up these new capabilities around detection and response. So actually trying to transform the capability for security teams who are only worrying about risk to something that could actually help them defend against active attacks in their supply chain. Yeah, came up with the idea, found a co founder and CTO who was willing to help build, uh, started off in our bedroom kind of in the middle of 2018. Um, raised some money and launched the platform in 2020 and then been growing quite nicely ever since.

Speaker A: Oh, so it's a real HP sort of, um, story then, if you're doing it from home.

Speaker C: And, um, it was two, two desks in my bedroom with a, with a wrist edger sign up on the wall, my co founder arriving every morning and us tracking on.

Speaker A: Fantastic. Well, that's exciting. So, you know, I mean, obviously you're, you know, raised some money and are doing, for what, I can tell, absolutely brilliantly and got very, very, you know, got very, very good marks in the, in the awards, which is always great because, you know, you are marked by CISOs and CIOs and analysts and other people who really know their stuff. Um, and as you say, you know, both of you said, you know, you've seen what the vision is around supply chain, around risk and how that can be addressed. So what would you say have been your biggest challenges in this Initial, sort of part of the journey. Let's look at the pain and then we can look at the celebration afterwards.

Speaker C: Um, I mean it was all a challenge to be honest. So I think when people kind of describe growing a company and raising money and hiring your first employees and finding an office and winning your first clients and delivering kind of the platform to, to meet client expectations, it can kind of gloss over a lot of the pain that goes on behind the scenes. But yeah, to start with, I had an idea, drew up a pitch deck. The first big challenge was then finding a co founder. So finding someone that I was willing to trust with the idea who could help me build it, who could really kind of make it their own and transform it into a real platform. So that took me about six months I think at the time. Um, at the same time.

Speaker A: How did you go about that? Just out of interest, you know, I mean there's not really sort of like startup bars where you can kind of. Or dating platforms or are there for co founders?

Speaker C: None that I'm aware of. But I literally would flying everything. It was every conversation I had with anyone I'd meet at a party. Um, I was talking about risk ledger. I was going to meetups at the time there was meetups.com where they'd organize like meetups for engineers and stuff like that. And I'd turn up to those pitching the idea. I think how I found my co founder was essentially through serendipity. So we subletted a room in the flat I was in at the time to a mutual friend and then I met my co, my venture co founder through that, that mutual friend. And that seems to be a recurring theme across all the founders I chat to. It's like no matter how hard you go out to look for a co founder, generally the best trade founders drop on your lap at some point. Yeah, at the same time I had uh, so I had some support from Entrepreneur first and uh, Cylon, which were two startup accelerators. So EF is like a program where they bring founders on board and help them partner up with co founders to build companies. And so I got onto that program but didn't take part because I found my co founder before it started. And then Cylon, which was a cyber security specific startup accelerator was running at the time. Uh, and I joined that just after I found my co founder who was at university at the time. So he joined me shortly after that accelerator ended. But that helped provide some support around kind of how to structure a founder's agreement, how to kind of Start building the platform, how to win your first enterprise clients. Um, which was very helpful at the time.

Speaker A: Fantastic. So you know, obviously it's been quite a long journey. You've now got um, you know, an established team. I mean there's quite a lot of you now, isn't there? How large is company or what does it.

Speaker C: I think it changes, changes weekly.

Speaker A: Sorry, how many?

Speaker C: 64.

Speaker A: Oh, 64. Brilliant. There's a song about that. But we won't go down that route. Um, so yeah, so that sort of initial side of it. So you, you've now established it. How did you find the sort of raising money and, and employing people? Because that's, you know, you kind of got that first cornerstone really with your co founder. But you know that's just the beginning really, isn't it?

Speaker C: Yeah. So I suppose in the early days, uh, starting the company, I think I was 25 or 26 at the time, didn't um, have any savings to kind of start it with. So from the get go we knew we had to raise money to hire our first few employees. Yeah, um, once me and my co founder had found each other off the back of Cylon and they did a demo day to a room full of CISOs but also potential investors and we actually found the lead investor for our first round off the back of that demo day. In terms of raising money and hiring your first few employees, I think it was like a healthy dose of naivety that kind of led us to just get through it. Um, we didn't overthink it. There wasn't really much of a plan. It was just let's go out and start having some conversations and, and see what happens. So yeah, ended up putting together our pre seed round that was led by Seed Camp who a really, really good preeed investor. And we also had Episode One Ventures and for um, trying to think of the third VC was Village Label over in the US joined that round. Ah so closed that round and then once it was closed went out to hire our first couple of engineers. Um, and that was yeah equally as hard as finding a co founder. I think um, finding really good first employees is kind of a bit of an art. It's. You're not just looking for an employee, you're looking for somebody who can actually take part in the business and wants to build a business and is willing to put up with a kind of pretty tough work life balance uh, to begin with. So yeah, ended up finding two engineers then over the next few months to then help us build the first version of the platform. During that time, I'd also managed to sell two contracts without actually building the platform to two clients, where we basically sold them a proof of concept on the promise that we would build the platform over the next few months. That then helped us close that investment round because we could show that there was a market ready to go and that people were willing to pay for the tool. Um, and then hired the engineers, built the platform in about three months, and then launched it at the start of 2019.

Speaker A: Wow. So that was a big leap of faith there. Emily's liking that. So if you need more customers, if we haven't got it yet, could you get a few more that would just buy it anyway or buy into it?

Speaker C: It was naivety and a bit of healthy confidence. I think at the time, looking back, it's. I mean, yeah, the types of clients we were winning early on were not the types of clients that you'd expect a, uh, startup at the time to be able to win. So, yeah, I think it was a bit of bravado, a bit of confidence, and then a great team kind of ready to deliver against what we sold.

Speaker B: Yeah, there's that. Buying into the vision, the mission that, what you're really here to do. And in those very early days, it's buying into how Hayden is thinking about this problem and how he's going to solve it. And that actually, that is what CISOs are buying into. And they're right. And that's where what has kept us grounded as a company. There's so many things that, uh, change as you grow, and there are new challenges. You need to change the way you're doing things. You need to entirely scrap what you did five years ago and do something entirely new. But the thing that has kept us going and grounded and keeps our community of customers really engaged with us is the fact that that mission hasn't changed and isn't changing. We are here to secure the supply chain, and there's a really specific way in which we're doing that, and people believe in that.

Speaker A: M. I mean, do you think. I mean, certainly from. Because you're. Obviously, you've bought into the mission. Emily, what was so compelling for you about it that you thought, you know what, I'm just going to chuck this big four career in, and I'm just going to, you know, hustle along with Hayden, and everybody's going to be, you know, you just have to buy a really big house in that initial phase, don't you? Hayden getting all the employees in.

Speaker C: Luckily, we got free offices with the C camp investments. So, um, yeah, yeah, that helps. That definitely helps from day one. But, um, yeah, I'm interested to hear Emily's answer. It wasn't just my smile that managed to get her to join.

Speaker B: Oh, no, I never believed the smile.

Speaker A: Um, that's the right idea there, Emily. Thankful for that. Um,

Speaker B: um, I mean, it works, it makes sense. The, the really interesting thing for me is around the incentives and aligning incentives. So it's about understanding the reality of people's situation. So in our case, you have a customer, a client who cares about their own security. And they have hundreds, thousands of suppliers that they rely on who present risk to them. But on the other side of that, you have suppliers. And these suppliers are businesses as well. And they need to win business, they need to grow their revenue. That's why they exist. Um, and so often the way that security teams approach this problem is from that client perspective that says, well, if you want to work with me, you have to meet all of these requirements, which makes perfect sense from their perspective. But from that supplier perspective, that might be a small business who they don't have a security team or they don't have the resources to put into that security. So what are they supposed to do if they. They're not able to get the buy in from their execs, from their teams, to put the investment back into security? M so by understanding that motivation of those different teams and aligning a mechanism, a tool, a way in which everybody can get what they need, understanding each of those different incentives M. Then you can really progress things forward. So for the suppliers, it's about making it as easy as possible for them and about positioning them so that they can prove to their execs that by having good security, we have one new customers that helps them grow their business. It helps them put more investment back, uh, into security. And on the other side, the clients, the customers need to get what they need. They need to be able to demonstrate to their boards, to their shareholders, to the regulators that they are doing their due diligence on the suppliers. So you have to do that in a way that gets them what they need. Um, and if you do that in a way where actually you can align the incentives and everybody make it obvious that everybody wins, if everybody can collaborate on improving that security, then you have a win, win situation overall. That's what I think is really smart about it.

Speaker A: Right. And, um, obviously the landscape in cybersecurity is. I mean, when, when the idea first came about, it wasn't really recognized. I Mean we weren't seeing loads of headlines about, you know, attacks on supply chains. I think, um, you've timed it rather well I would say. Um, and looking forward, obviously saw that this was going to become an even bigger problem. But I think at the beginning of the journey it probably didn't. A lot of people were going, well who cares about that? We've got enough problems internally to worry about, let alone what's going on externally somewhat.

Speaker C: So I'd say when I started my career as a consultant in 2014 and supply chain risk was already fairly well established in certain industries, predominantly financial services and banking. And um, don't quote me on this, but what I've tended to found is, or, uh, tended to find is that essentially the banks tend to be a few years ahead of other industries in terms of getting to grip with risks. Um, so you could kind of see from there that it would grow particularly into critical infrastructure and other industries where they rely heavily on their supply chain. Uh, starting to do that kind of when I came up the idea and kind of founded the company essentially. So I always knew that it was growing and going to become a big thing. And I think the first kind of big publicized supply chain breach would have been Target back in, I want to say 2012. So there have been a couple of quite uh, high profile breaches. Yeah. The other aspect there is that I think where we have timed it rather well, which is kind of linked more to luck than anything else, is I think over the last 20 years we're seeing the geopolitical landscape change and we're seeing um, a shift away from globalization towards more kind of protectionist states and a little bit more kind of adversarial behaviors between states which has led to um, more activity in the cyberspace. And that activity is inherently going to target suppliers and lead to knock on impacts up and down kind of that supply chain. So yeah, I'd say it was a recognized problem when I started the company and it was a growing problem when I started the company. But yes, uh, today I would say it's by far one of the biggest unsolved problems within the security kind of ecosystem.

Speaker A: And I mean the regulatory landscape kind of reflects that as well. I mean we've seen what's been happening with NIST2 and obviously we're hoping that the cybersecurity and resilience bill in the UK and obviously other legislation around the world is, is looking at this. Um, how are you finding that that is now? And I think I get what you're saying. About the financial services, but they've always had to deal with a very, very tight regulatory sort of, lots of people looking at what they're doing and very prescriptive, um, for a lot of aspects. So they've kind of already been used to a lot of this stuff and as you say, kind of maybe the gold standard for a lot of other companies to. I'm not saying perfect because we all know in cyber security there is no perfect. There's always risk. It's just working out where you're able to handle it to the best of your ability. So I mean for you Emily, uh, as someone in this industry, are you seeing the opportunities for the business? Because you obviously look at it from a slightly different perspective from Hayden who's the. Obviously you're both ambassadors, very clearly passionate about what you're doing, but you have to look at some of the other aspects of the business as well as that. How are you finding that this sort of scaling up? You've been there for a while, there's been a lot of changes. What are you seeing as challenges for you, you personally and for the business?

Speaker B: Yeah, um, it's a lot of fun. There's a lot that you need to think about all the time. Like I said earlier, things change. What worked before is not going to work as we go forward. You mentioned earlier around hiring and the people that we have in the business and that is critical to our success and it's something we realized quite early on in those early days. It's a bit of luck. You don't have much resource to deal with. You are uh, kind of figuring it out, um, especially if you're first time founders. But as you grow and scale, you learn along the way and every person in your business is learning along that journey. Um, being able to build a team, a 60 person business is very different to a 10 person business. And being able to bring people into your business that are uh, able to are ah, driven or motivated, are curious, are able to figure out where we need to go and then figure out how to get there and have that autonomy and the support to be able to do that is what drives us forward and that's not easy. There was definitely learned a hell of a lot along the way around how to hire and how to enable our people to operate in that way. Um, but getting that right is what enables the business to scale. And of course as you scale that, you need to continually rethink the structures you have in place. The support networks, you have the tools that people have to be Able to use, how they're going out to market, how they're thinking about our product and figuring out what our customer pain points are and what they're going to need and how we drive all of that towards the mission. Um, but honestly it's the people that are going to get us there.

Speaker A: Fantastic. Fantastic. And how about for you Hayden, what's your sort of challenges over the next sort of 12 to 24 months?

Speaker C: Yeah, good question. So, uh, I would say it kind of splits into two. So one would be on the go to market side. It's making sure that we are kind of hitting the market as hard as we can and getting our message across and even if people aren't buying the platform, but like almost portraying kind of why we're building the platform the way we are and really trying to change kind of the behavior of uh, security teams running third party risk and supply chain security for the better. Um, and then linked to that would almost uh, be kind of the product development side. So making sure that we are putting our best foot forward when we're building new products and making sure that we're shipping products quickly and that it's of high quality. Um, as well. Um, and then the second part of that would be linked with what Emily said. It's basically just making sure that the company internally is ready for the next six to 12 months and trying to stay ahead of whatever challenges we're experiencing now. Making sure that we're setting up for the challenges of the future so that we can overcome them kind of when we come across them.

Speaker B: Ah.

Speaker C: So yeah, I mean specific things on the radar would be, um, kind of, yeah, product development, international expansion, a lot of hiring, uh, a lot of internal kind of capability development, a lot of training of the different teams, making sure everybody's still aligned behind the same vision and the same mission. Yeah. And then doing everything I can to support them, basically.

Speaker A: M. Well, international expansion is an interesting area. Where are you starting to make inroads?

Speaker C: Yeah, so you're looking at kind of Northern Europe and Scandinavia. And so because we're a supply chain business, I would say we, we managed to win clients from internationally fairly early on. And we have a ton of clients all over the world, but predominantly we've been very UK focused and we've been more opportunistic whenever clients have popped up kind of around the world now kind of shifting focus onto Northern Europe, the DAC region, Scandinavia and then also the U.S. uh, which is by far kind of the biggest market as well.

Speaker A: Hm. So are you going to be hitting Black Hat.

Speaker C: Like, I will be there.

Speaker A: Yes.

Speaker B: Yeah.

Speaker C: Uh, been to the US Three times this year already. I'll be at Black Hats in, uh, a couple of weeks, and then I think I'm in the state of Maryland in, uh, September as well.

Speaker A: I m mean, are you starting to get feet on the ground in those regions?

Speaker C: Is that looking to do that? So part of. I think what we've tried to see building the company is we've always tried to be quite intentional with what we're doing. So instead of kind of raising massive investment rounds and then just spending the money on a load of things and having to close a load of those initiatives down, it's always been very much. Let's kind of, um, approach things very intentionally. Let's actually see what works, what doesn't, and then invest in the stuff that works. And that's not the same set of principles we're following in the U.S. it's, um, let's kind of have some conversations with U.S. prospects. Let's figure out actually the parts of the market that's resonating with us the most. Um, and let's double down kind of there. So I would say we're in that learning phase before then, looking to, uh, hire and grow.

Speaker A: Fantastic. So, I mean, obviously we're delighted that you won the tech trailblazers, and obviously people are really important. Do you see those types of things as being helpful motivators for, you know, the mission, where you're getting a sort of external, independent recognition for what you're doing?

Speaker C: Yeah, for sure. I'd say it's kind of good validation for what we're doing, and it obviously helps build the brand, build the exposure, and it definitely does give employees recognition for all the work and great work they've done. I would say, like, motivation for me is a bit of a funny one. Like, motivation comes and goes, but it's very much like the discipline behind showing up and really moving towards that mission. We've really tried to kind of hire for and instill in the employees. But, yeah, I mean, there was a. We had a good night out after we found out we won the award and, um, very well received at the all hands.

Speaker A: Oh, good. Well, that's all good stuff. That's all good stuff. So what's next? Can you talk a little bit about future plans or will you have to sort of. This tape will self destruct and 30 seconds do it. That's all right. You can tell me. I won't tell anyone.

Speaker B: Honest.

Speaker C: Happy to. Happy to talk about It So I think predominantly a lot of my thoughts are around how we take our platform right now to the next level. M. So part of kind of us building the platform was to solve a problem for our clients now which was third party risk and supply chain risk and do that in quite a different way to how it's been done before. But there's almost then um, a next step or a next stage to the platform where we start to open up these new capabilities for security teams that they've not necessarily had before for around being able to detect attacks in their supply chain and respond to them. And so we've got a lot of plans in that space, a lot of ideas. We're starting to prototype out some new products uh, to test just that with some of our clients right now. And I mean the, the opportunity there would be that, that we can go to clients and say look, we can do what, what you're currently doing, third party risk very, very well. And there's a great business case to, to join our platform for that reason alone. But actually as far as I can tell, we're the only platform with a mission to solve this problem. And this is how we're. So it's evolving um, the company more in that direction and moving more towards this vision we have around increasing collaboration, getting security teams to work better together and really trying to solve the problem of uh, incidents happening in the supply chain. If anybody has any different thoughts on that one.

Speaker B: Not anymore. I think yeah. The way we're developing our product is what's going to lead our uh, business in that direction. And because our product works a little bit like a kind um, of a marketplace dynamic where we have both clients and suppliers, it means that there are 10, 11,000 organizations on there using it which means we have a huge opportunity to understand them, understand their feedback, understand how they're using our product, what they're struggling with, what they're, what the other opportunities are. Um, which means there's some very, very cool things we can do within our products. One of the things we're looking at this year is of course looking at how we use AI to make, to, to make things much more uh, streamlined for the way in which clients use it. It's not just using AI because we have to and for the sake of it, because it's the new shiny thing. But actually there's a huge opportunity around, around how clients review their suppliers and taking away some of that manual legwork so they can focus on the higher value tasks. Like what does the risk mean, what does the contextual element here, how can I work with this supplier to help improve that risk rather than spending so much, so many hours in just summarizing and figuring out reporting on that risk?

Speaker A: Yeah, well, you stole my thunder a little bit because I was going to say we're just going to close off with the two letters that have been completely dominating the world. Certainly in cyber, um, it's amazing how many cyber companies have suddenly become AI companies. Um, are you also seeing that on the threat side? I mean, everybody's talking about. I mean, it's, it's two sides to it, isn't it? Because obviously, you know, the threat actors are going to use it. The bad actors, um, are going to look at that as a tool and obviously that speeds up their ability. It scales up their ability to, you know, launch tax. But there's also the flip side to it because the defenders can also use AI. So what are your thoughts?

Speaker B: Yeah, yeah, no, of course it does. It makes a difference, um, from m all angles. The thing that I think we have to be really careful of as a security industry is that we don't let our natural tendency towards risk aversion prevent us from leveraging it. There's a lot of conversations we have, uh, around how you use AI securely, which are absolutely the right conversations to be having. What we also see sometimes though, is organizations saying, well, it's too new, it's too scary, we don't know how to secure it, so we're just going to prevent it. And nobody internally is allowed to use AI. That's where you see the real problems and that's where it gets scary. Because you're right, the attackers don't care. If you've got policies say, don't say I, they're going to use it. So we need to make sure as an industry, we're enabling people to innovate using the latest technology, whether that's AI or something else, not preventing it.

Speaker A: Yeah, definitely. Well, I'm, um, you know, delighted that you've both been able to join me. It's been an absolute pleasure, um, looking very much forward to hearing how the future for, uh, Risk Ledger comes together. And I'm sure that, um, you'll be. Well, we'll be keeping an eye on what you guys are up to. Thanks. So that was the tech trailblazers, uh, Founders on Fire podcast. Delighted to have been joined here by Emily Hodges, the COO of Risk Ledger and co founder and CEO, uh, Hayden Brooks from RiskLedger. Great conversation on supply chain AI building scaling businesses, much appreciated. Thank you very much.

Speaker B: Thank you.