Hello, everybody, and welcome to our fireside chat. Thank you for spending your time with us. I hope Google Next is off to a great start for all of you. I am thrilled to have this session. I'm going to start by introducing you, Michael Fey. Michael Fey is the co-founder and CEO of a very cool startup, Island. So maybe we'll start by tell us a little bit about you and what does Island do.
Sure, well, thanks for having us. Happy to be here and appreciate the partnership. Island, we founded Island almost six years ago. The realization was if we looked at the browser as it became our primary operating system, I mean, all this great tech, we interfaced through that platform and we think about what that platform was targeted for. It really wasn't targeted at the knowledge worker, and we saw the opportunity to look at how we could make the knowledge worker more productive, more capable, more efficient. And then the IT stack that supported them, how do you collapse that, how do you reduce that, how do you build that for the modern age. And then finally embedding cybersecurity into that. And so six years later, we've got about 800 customers, browsers out there, some of the largest logos like Citigroup, B of A, where you go to work.
Yeah, so as you all, it's probably one of the most interesting times to ever be building a startup. Obviously, we have the confluence of a number of big trends playing out. And maybe I'll start by talking for a couple of minutes on the trends as we're seeing them, and then we'll dig into each of them. So right now obviously, we're seeing the mega trend playing out is it's no exaggeration to say AI is going to change the way we live our lives. But in the enterprise market, it's also changing everything. We are going through what we believe is a generational refactoring of every part of the enterprise IT stack. As companies look to be AI native and rethink their business models, their workflows, how work is done in their company. That's obviously also changing cybersecurity, and probably cybersecurity is the most changed part of the enterprise IT landscape, because what you're seeing is AI is causing new adversaries to show up on the threat landscape, new techniques, new attack surfaces, and new methods of defense. And so there's so much change happening. And typically when there's a change like that, there's huge opportunities for startups.
Yes, and so maybe let's start there a little bit to say, OK, if you're a startup you want to do something big. Now, how should you think about your own cybersecurity. Because as a startup you're a small company. If you're a 10 person company, you typically don't have a CISO. You're typically running as fast as possible to build features. Why should you worry about cybersecurity.
Well, the why you should worry is almost the right to exist. At the end of the day, it is an existential crisis. If you were breached, if you were drawn into suspect, that would end your company. Because trust is all a young company can get. It's so hard for an established company to invest in a startup to begin with. Where's the other reference customers. Where can I get confirmation you're going to do right by me. And if in that process, a discovery of a security issue occurs. And that's not just a breach happening, that's the worst case, but everyone's going to red team you. Everyone's going to send your product through something. If in that process, they discover something and they will discover some things, that's not the issue. If they discover things they should have designed this out. You should not have this. This is not the sign of a well-built company. You're dead in the water. And that leaks out and it permeates out. So it is, it's a right to exist. It's a requirement of breathing as a startup, much more than it ever was.
Now, who in a startup should worry about security. You don't have a CISO. You may or may not have a CIO. So whose is it. The engineering team, the CEO, who should worry about it.
Yeah, I mean, every startup is different in the makeup of the founders. But in general and the ones I work with. And then obviously at Island, we were those owners, the founders themselves. And we had to be because it was about the architecture you choose, the product you built, how you handled it, the risk you were willing to take, the things you didn't want to negotiate on. It was strategic level decisions that to this day, we leverage that. If they were made elsewhere, one, we want to own them, we might not fully understand them, and we certainly want to propagate them forward. So I don't know a way a founder isn't the primary owner for a very long time, much like we have to own sales, like, both are very important.
Of all the things that the founders are thinking about it, they want to. You want to move quickly and build the features and compete with or get some traction before any entrenched players sort of wake up to the opportunity. What are the top security areas that you should prioritize while you're building your product.
Yeah, well, one's really, really obvious, which is what data you take on, what data from the customer do you bring into your environment. A lot of mistakes early startups will make is more data is better. Why not. We'll filter it out later. We'll figure out exactly what we're going to build. But the reality is, every time you take a piece of sensitive data on, you've increased your risk and your pain. And if the risk doesn't scare you, the pain should. When a customer starts to analyze, like in our case, having built a browser itself, we could see everything. First thing a customer says to us is what do you do with my data. You keep it, Mr. Customer. All of a sudden knives are down, swords are down. Oh it's ours, you don't take it back. OK, we need to confirm that. But that's great. If I start pulling back critical data now, I have to go through their data audits. I have to live up to their security standards. And there's no way 100, a 200, a 500 person company can live up to JPMC standards like you just don't have the means. They have more people in security than you have in your whole company. You have to appreciate that. So I think that's a fundamental requirement.
And then you on that one please. And then we'll come back to the rest of this, because there's going to be a temptation to say, look, but the more data I get, the more I can mine it, the more I can. And so there's that tension of but don't we want that data.
So it's not a question of whether you want it or not. It's just when do you take it. The customers aren't sitting there governing. Oh you didn't pull this extra piece of data. Now you can't have it. It's that relationship just out of the gate. Limit it. And if you do take a lot of data, that's fine. Cleanse it. Anonymize the customer. Remove the PII data. Remove the elements that are going to be your nightmare later. And it's so funny. People skip that because of speed. Well, wait till you go through your audits. Wait till you have to go back. You have crushed your speed to an absolute minimum. You can run fast when your data's not risky. When your data is risky, everything you do moves to a crawl.
Got it. So first point thoughtful about what data are you take on. And when you take it on, how long you keep it and. So what else would you prioritize.
The second one is first, understand you're not a big company. The bulk of the cyber tools in the cyber requests and the requirements of what a Fortune 5,000 feels is a fundamental list. It's not your list. You are not a heterogeneous environment with legacy items and new items and multi national requirements. I mean, many of the things aren't even your problem. GDPR, where are you selling. It may not even be something you need to think about right now. So thinking about that and limiting that scope. And when you do that, the scope gets very simple. Where are we doing work. And more than likely your Cloud centric. So it's about your relationship from your device to the Cloud. We don't need the backhaul. We don't need a bunch of DLP. We don't need a lot of things. We need single sign on MFA. We need to be able to validate the identity and then have a data barrier, data barrier saying that we can with honest, trust with the customer. Your data doesn't leave this domain. Here's where it sits. It doesn't move. Our code doesn't move out of that. It is such a simpler world and you have to use that for your own advantage. Otherwise, you can't keep up. So having that decision of what a viable Workspace is and doing it well will set you up very nicely.
Got it. OK, so now you're in an unusual position in the sense that you're a co-founder, you're technical and you're the CEO. But for many companies here say you are the co-founder who's the head of engineering. And you think, OK, I've got the basic security blocks that I want to put into place. These are important. How do you make the case to a CEO that this is something worth spending on when obviously there's so many other things you could be spending on.
I think it's actually pretty simple in the early days because you have to choose these tools anyways. You have to choose how are we going to develop, how are we going to store this. How are we going to do that. If those decisions were made with security in mind, you're not going to the CEO saying, I need a big budget. I need to modify this as you create it, the instance as you built your methodology, it was just part of it. I can't even tell you what we spend on cybersecurity in the early days, because it was just built into the basic enablement of the company. Now, I was thinking, when you were asking that if you really are one of these founders, that maybe are legal, you're building a legal company and you're brilliant on legal and you've never touched it. How do you get to that space. I think that's what security advisories are for when go out and get an advisor, give them some shares, bring them into the fold and have them help you through that. If it's not your core instinct, it is a little bit of advice will save you so much money long term and make you way nimbler.
That's great. All right. So you've put together then the core security architecture for your company. How do you govern it. How do you who's responsible for security. How do you report on it. Do you take it to your board early on. How do you think about managing it going forward.
Yeah you obviously have to have a plan and there has to be a governance model. And as soon as you're big enough, there needs to be an owner. The saying if everybody owns it, nobody does is really true in cybersecurity. Who really cares about it. So you need to have that. You need to build your incident plan. You need to map where your data lives. You need to have controls in place. And you do need to report on it the same way as you have to report on resiliency. Both of those can get lost in the shuffle, especially with non-technical founders. When you go to the board, though, they're going to evaluate you early on. Is this your area of expertise. Do you have this covered. If you do, it will be a minor conversation at the board moving forward. If you don't, it will be a perpetual check in with the board to make sure you didn't drop the ball. And it is amazing. I'm on a couple different boards where because of those early days and lack of vision, it is forever a board inspection point and I have others where they were ahead of it when the board asked questions like, oh yeah, we built this, we're doing this and it gets set to the we trust you just show us the governance model as you go.
That's great. Now, I've heard you say publicly that cybersecurity and cyber defense has never been stronger than before, and yet it's never been more challenging than before. Yeah so talk to me a bit about what do you mean by that.
Well, I think we have a control for everything. If you hit RSA was a couple weeks ago or months ago I don't maybe last week, I don't it was recent, man, that show floor had, what, 5,000 vendors. There is a vendor for every problem you could possibly have. And that is almost. The problem is, how do I especially as a young company, navigate through this madness and do what's required. And then we start to have holes in the gaps right between the different tools and what they report. And the data is overwhelming. Simplifying our environment is really, really important. Luckily, in a startup world it starts very simple. And then you build out from there but choosing wisely how you do that. And I think AI creates a fundamental opportunity to change the way we do all of this. And right now.
Yeah I want to pick on something you said a little while ago because I think it's really important, especially today, which is we talked about trust and how important the reason security is important to a startup is you're building trust and you don't have this history. And so if you fumble it at the beginning, it's kind of gone. So let's talk about have the marketing co-founder. And then is there a way for startups, even if their core business isn't security, to start to think about building in a trust message. If you're a startup or a marketing startup or a how should they think about building trust into their message, even if they're not a security company.
I think that security by design, whether you're marketing, individual or not should be able to speak to why you made the decisions you did. So as a customer speaks about where their data lives, how it works, you will say our job was to do these things. So we chose this methodology. We have these architectures in place to do that. That helps a little. But staying one step ahead don't go get your SOC 2 when you're asked for it. You have it in advance. Don't come up with a data protection strategy when asked for it. Have it in advance. The speed at which you answer those questions. One of the things that I always had prepared for is we had almost what was it, 500 questions we could get asked in a first meeting. Wow all of them document it. We literally sit there in the first meeting, and I'd check off which ones were asked, and then an email would follow. You followed this. Here's the documented plan for this. Here's the documented plan for that. If you wait days for that, weeks for that, looks like you built it. If you wait seconds, everyone knows you're living it, and having that available to you allows somebody who maybe doesn't have their finger on the pulse of that particular area, like cybersecurity, to show that it is important in their company, and it is well thought out and somebody is the gatekeeper.
Got it. So let's keep going on the idea that cybersecurity is stronger than it's ever been, in the sense that if you've talked a little bit about areas that startups should think about in terms of security, even up upfront. Yeah so maybe it's time to plug Island, but also other vendors. If you had to pick the short list of vendors that you would say, look, almost every startup should look at. Either you can say category or vendor, but this should be in your essential toolkit.
Yeah, I think especially when we're talking startups right now, I think a secure Workspace is important. At Island, we deliver it via browser and extension or desktop service, and what that allows us to do is to create a data barrier around the critical items, so we can treat that laptop as a danger zone. But now you're writing code inside of that, nothing can penetrate you. Now you're working with customer data. Inside of that, nothing can occur, and we can delete and remove the residual effects of that. So it stays slim. And the core concept isn't you'll never get breached. Not a single company in here can withstand an enemy nation state attack. It will happen. What is the blast radius that occurs if you get on my laptop as CEO at Island, you get nothing. You literally get nothing from me. You might read an email or two. Congratulations I'm very boring. It's not going to be interesting, but it is not on ramp to our customer data, to our code, to those elements. That blast radius is absolutely essential in the process.
What you should avoid backhauling your stuff. You don't need things like SaaS based web filtering. You don't need to backhaul. You don't need VDI, you don't need big DLP programs. None of those things are required because you don't have the complexity needed for those. Your world is simple. Salesforce data stays in Salesforce. Your sales reps don't need to export it. That's not how they're living. Development occurs in a couple of IDEs. It goes a specific path. You don't need to enable the world where when you become the size say, a Citigroup, there's probably one of everything. And you do have to fundamentally re-architect how you do things. That ability to be specific about how your world works, that is your security moat, that is your protective layer, it understanding that allows you to close so much so even vulnerability management, if you have 10 things that represent your environment, it's easy to stay on top of them. So it's not a hard path if you've defined your world and you made it clearly, I mean, an Island still to this day will let you buy your own laptop. We just send you a link to a browser and you're off and going nothing on it. That's it. We get you your identity stack, we give you that. And that's all we need to do to conduct business for the DOD.
Love that. All right. Let's keep building on that idea, which is one of the challenges for many organizations is not just hackers, but shadow IT, shadow AI, even. So say you're the CEO of a startup. Maybe somebody here you walk in and you're head of marketing is like, guys, this is great. I have this amazing tool, Open Claw. It's free. I've got all these skills that I can use to do great marketing for us. What is the problem with shadow AI for startups. Everybody's scrappy. Everybody wants to save money.
Yeah, you get a lot of these free tools. Well, I mean, we saw recently where an entire startup's codebase is out there. It's hard to be unique and differentiating when everything's out there. I do think shadow IT is a very scary scenario and it's accidental. We love Gemini. I think it's great. Which Gemini am I using the corporate one or the one I was using at home. I forgot which one I'm in. So you do have to have a bit of a governance model. And what often founders do and people that care about security do that kills them is they deploy a heavy handed model that lowers productivity, security. It's not security versus risk. That's not at a startup where it is. That's where your banks are. That's where large retailers are where we're at is security versus productivity. If your security doesn't impede my productivity, I'll play along. I'll work in your world. But my deadlines matter more than your security. So if your security is slowing me down inherently as that developer that cares as that guy that's coding all night. I'm going to go around it because I know how I can use my own tools. I can use my own AI. So it really is about working with them, monitoring the estate enough that you can see when people are out of that path, not to go block it. To understand why I thought I set you up with the tools you needed. You didn't. Great what else do I have to bring you. And I think that's what shadow IT in the early days is later. It is about redirecting work. I'm in Box. Not OneDrive. One drive was a corporate standard. OK, get to the corporate standard. Why you choose one over the other. That's not going to work. We're coding in this environment. Not that standardization matters, but early on it's what do you need to get your job done and how do I enable that for you. And how do we bring it in an appropriate way. And it will all come out at the end of the day, you will have a customer that cares, they will dive into your environment, and they will see how the data flows and where things live. And at that point it's make or break time for your company. Too late to do it.
Yeah you're right. I mean, one of the things we've seen very clearly is that the adversaries are all over shadow AI that when we VirusTotal from Google partnered with OpenAI, we found over 800 skills that were just straight up malware. Yeah in fact, several weeks in a row, the top downloaded skill was malware. And so, it's been discovered it's a known vector into your company. All right. Let's pivot into a different area, which is with all this change in cybersecurity, there are probably some companies here that are looking at cybersecurity and thinking, is this an opportunity for me to do a company in this area. But the other side of that argument is some people are saying, oh no, the models are going to just eat the whole area, and there are entire segments of security that people are wondering if they're going to exist. How do you look at this landscape and say, where do you think the winners are. What are the areas that you think are.
