Changing Security for the Next Century

**Disclaimer** Views and opinions expressed here are my own and do not represent any organization I am affiliated with including my current or past employers.

Five-ish years ago I posted "Security. Needs. Change. (IMHO)" and for better or worse, inventoried my many dislikes of certain patterns and behaviors I observed and experienced working in cybersecurity.

Since that time:

• I became so disillusioned with the pessimism in cybersecurity I left it and transitioned into general Corp Dev / Corp Strategy, spent my time analyzing business models, financial performance, optimizing R&D allocation, etc.
• Missed the technical puzzle and challenge of cybersecurity and went straight back into it to bootstrap a security program from 0 to 1 at a Series A startup.
• Spent hundreds of hours meeting founders in a variety of contexts to understand what problems people are solving and how people were thinking about those problems, mental models, motivations, values, etc.
• Considered a couple different next steps, maybe I go venture full-time, maybe I go back into product, maybe a co-founder, maybe something else altogether.
• Ended up very much enjoying problem solving with some of these founders, co-conspirating with some, advising some, or just enjoying thoughtful and intense conversations.

During that time, I kept asking myself a series of questions, all loosely around what do I really want to solve, what do I want to work on, how do I want to spend my time, who do I want to spend my time with professionally.

I ended up going in circles looking for my north star. I ended up on: I want to live in a world where companies can answer the question of "are we secure" confidently. I want us to solve the problem. It's an insane north star and it's the only one that feels so true to everything I believe and value.

I allocate my time accordingly, always looking to gravitate towards those who I share values, interests, and motivations with and am fortunate to have found a lot of community this way over the past few years.

In this process I've landed on a sort of part-roadmap, part-blueprint, part-plan, you can take it literally, metaphorically, but it's a set of logical evolutions that will span many years and decades regardless of changes in the format and the medium, so much of our fundamental compute architecture and concepts remain the same (see below). These are my "crazy ideas", it's also what I can't stop thinking about. It's not about any "hot category" or magic quadrants or troughs of disillusionment, it's just about solving the problem, with the fullness of time, imagine what we can do, when we can give ourselves innovation we don't have today to get there. We can do anything.

The reality that there are hurdles and obstacles is no reason to stop us from innovating and I'm confident as there are so many out there working on so many parts of the security problem to get there.

Secure the Company

The ultimate security architecture - everything connects to it, so you don’t have to connect to everything -> solves the integration problem (abstraction, universal, efficiency gap, this is the robot to get a fighting chance against the “kaiju”)?-> automate at least 50% of today’s security problems -> connect to ~99% of everything - platform agnostic, cloud agnostic, language agnostic -> do the best with what we have today

Secure the Architecture

The ultimate OS for security - the abstraction, orchestration, and data layer for security -> solves the gap, we don’t need an AWS for security, where it all comes together -> combines collaboration, operations, productivity, and anything else together -> reimagine work in security altogether for a new generation (take abstraction to logical extreme, leverage the ultimate security architecture)?-> make it secure, build natively a security OS VM that is distributed, say EVM but for security - democratize security -> not limited to technology we have today

Secure the World

The next frontier - a secure OS, we cannot secure the world the way we got here, we need to reimagine what an OS can/needs to be, we need to reimagine the entire model and stack. Need to give people a secure OS, built on part 1 and 2, then the secure OS can run on everything everywhere - this is the next era we need, to move beyond derivatives of the same (Windows, Linux, etc.)

If you're solving part of this problem and we're not already collaborating, I'd love to hear about what you're working on, what's keeping you up at night, what you can't stop thinking about, and how we can work together.

Thank you to the countless individuals who were generous with their time to connect, learn, and work together and thanks in advance for all those to come.