You Get Hacked When You Don't Do These Simple Things! (Don't let your life be ruined...)
What this covers
Founder and CEO of Field Effect Security, Matthew Holland, is one of the world’s leading authorities in cyber security. We chat about exploits, hacking and defending while providing insight on the mind of the attacker, Huawei, Snowden, what you should be asking your cyber security vendor and so much more.
https://twitter.com/notnotaspy
Follow us on Instagram HERE: https://www.instagram.com/farnamstreet/
Subscribe to The Knowledge Project Podcast
Apple Podcasts: https://apple.co/3fz6u4X Spotify: https://spoti.fi/2SSgCvT Google Podcasts: https://bit.ly/2Wjw7iy)
-------- #TheKnowledgeProject #ShaneParrish #MatthewHolland -------- FOLLOW US:
Instagram: https://www.instagram.com/farnamstreet/ Twitter: https://twitter.com/farnamstreet Shane Parrish: https://twitter.com/ShaneAParrish
Source description (no synthesized summary yet).
Matthew Holland argues that the cybersecurity industry is fundamentally broken—vendors sell fragmented solutions with deceptive marketing rather than solving real problems, and companies need holistic, trustworthy security built on understanding attacker methodology rather than checking compliance boxes.
- Cybersecurity vendors operate like unethical used car salesmen, selling individual components (antivirus, firewall, EDR) as separate products when only integrated solutions work
- The industry uses jargon like 'next generation' and 'AI/machine learning' to confuse buyers rather than solve actual threats
- Effective defense requires understanding the complete attack chain from reconnaissance through kernel-level execution, which no single-pillar solution can address
This asset isn't compiled yet
You're seeing its claims, ranked. Compile it to build the argument threads, weight them, and check each claim against your library — the full view.
For a vendor testing regime to work with Huawei, code reviewers would need to review 'millions of lines of source code' with enough sophistication to say 'with confidence yep this looks great,' or use automated tools (extremely challenging), completing review before the vendor releases the next iteration—but the vendor faces pressure to release security fixes quickly, creating a speed-versus-security conflict.
“let's assume you have a crack team of amazing source reviewers that can say with confidence yep this looks great uh or better yet they have a set of automated tools to be able to derive that answer which is challenging probably possible extremely challenging the realistic outcome is the time for say huawei releases a new iteration the time from that release because if they are a vendor that actually believes in securing their product and that new release of the firmware has uh you know fixes time matters you're against the clock”
Holland and business partner released a tool called DenwiPatisev (vista poned in reverse) under a legitimately registered but fake company name to demonstrate that Microsoft's mandatory driver signing in Windows Vista would not stop malware, contrary to the industry's claims that it would be a 'silver bullet'
“there's so much hype around it and the way it was being advertised was it was going to be the silver bullet to stop all malware... we said all right well why don't we just do something kind of funny and um you know show them so what we did was we wrote a tool called uh denwep ativ the name of the company was denwipatsev which is vista poond in reverse um you know got a signing certificate under this fake company uh legitimately registered fake in reality uh and released a tool that would load it was an assigned component that would load an unsigned driver”
Cryptocurrency (especially Bitcoin) facilitates ransomware payments because it provides anonymous, traceable-resistant payment channels, making ransom collection feasible and enabling the ransomware economy
“do you think it would exist without cryptocurrency and anonymous payment forms because it always seems to be at least in the news it's always like you need to pay in bitcoin so i can like run away with this money and yeah i would say definitely be harder because that is definitely a very convenient payment structure to pay to pay with bitcoin”
Only holistic cybersecurity solutions that cover endpoint and network layers can defend against sophisticated attacks, because attackers can bypass any single-pillar solution, and if one layer fails, another should detect the compromise
“we're kind of diving into why this is actually a really hard problem and why any specific pillar doesn't work so if if you only buy a network monitoring solution you won't see really anything that i've described thus far if you buy an endpoint only solution there may be hints of things that have happened depending on the um sophistication of the endpoint solution but as soon as it gets so uh particularly deep in the kernel you're not going to see that so it's a very challenging position that that's why having a holistic approach is so important you need network you need endpoint so if you get by either one of those things the other will pick it up”
A common alternative attack on email accounts is brute-forcing weak passwords (enabled by lack of multi-factor authentication), accessing the inbox to identify customers and financial patterns, and then sending fraudulent payment instruction emails to all customers claiming payment should go to attacker-controlled accounts
“brute force brute forcing passwords works somebody gets in will scope out your inbox and and see what's there who are your customers uh what what's your routine and then they will uh perform perhaps a financial redirection so in that case they would get an idea of what your entire portfolio is and email all of your customers and say um hey here's your new payment instructions and they will have all the outstanding invoices already uh you know listed and ready to go”
NSO Group (Israeli company) sold WhatsApp zero-click exploits that allowed them to compromise phones without any user action—the attacker simply sends malicious content via WhatsApp and the phone is exploited, representing the most dangerous form of compromise
“about a year ago a company out of israel called um nso nso group they got busted for having a whatsapp uh zero zero click mechanism so there's some quick lingo dive here uh one click versus zero click one click is you have to social engineer somebody to the point where they can click on a link and exploit the phone zero click is where there's nothing you can do you are just owned and you have no idea by you don't even see a message like you're just yeah no decision on your part you're sleeping in the middle of the night in this case uh nso group um you know sends you a malicious bit of content via whatsapp assuming they've been able to you know figure out your whatsapp id uh and then exploit your phone”
The strategic problem for allied governments is that adversaries (China, Russia) won't disclose vulnerabilities even if allied governments do, so unilateral disclosure creates asymmetric vulnerability—if you disclose all vulnerabilities and the adversary doesn't, you've only weakened yourself without improving mutual security.
“the adversaries of uh allied governments aren't going to disclose they're not going to care if they have something they can weaponize they will use it and i think unfortunately that is probably the the tone that is set globally that underpins a lot of these the decision making like if if you're being attacked constantly and having your intellectual your nation's intellectual property stolen i mean you could disclose all the vulnerabilities you have and you know about as a nation it's not going to stop them”
When a user clicks a link in a phishing email, the browser is exploited first, gaining code execution in the browser process; modern browsers have sandboxing, but the attacker must achieve sandbox escape and then privilege escalation to reach kernel-level execution, at which point defenses on the host essentially fail
“the first thing that happens is uh you know the browser would be exploited so whatever browser renders that link the uh a web browser exploit would basically gain code execution and and modern browsers are definitely getting better at per you know protecting against that type of thing... so you know chrome is every browser has a sandbox now... and so is brave and so is like firefox... so so yeah it gains execution inside the browser and then the goal is then to uh gain privilege in the uh in the in the operating system so that could constitute a sandbox escape to get out of that browser sandbox uh a privilege escalation to ideally execute at a higher privilege level to to basically nullify any security on the host and ideally get execution in the operating systems kernel and once you're there um it's largely game over”
Samsung and other Android vendors often fail to include security fixes that exist in the main Android branch in their device builds, meaning a 'latest Samsung phone running Android 11' may not have all of the security fixes that are in the official Android 11 release because vendors accept or reject individual security patches.
“when that is taken in context with um vulnerabilities the fixes may or may not make it in so you could have you know the latest samsung phone running android 11 that doesn't actually have all of the security fixes that the main android branch has right because somebody's accepting or rejecting”
The company Vupin (zero-day marketplace) recently announced they were 'full up' on iOS privilege escalation exploits, meaning they have more iOS privilege escalation zero-days than they can use, which demonstrates that Apple's security model is less secure than commonly believed
“a really scary thing is recently a company called vupin uh that isn't you know they buy zero-day exploits um not sure where they go after that but what they do is i can speculate but uh they buy zero day exploits and where um they they posted something recently where they said we're we're full up on ios privilege escalations um we get enough yeah and if that isn't a wake-up call uh to to apple i don't really know what would be”
Zero-click tools like NSO's WhatsApp exploit were previously only in the hands of governments, but the accessibility and creativity of attack vectors are changing, allowing non-governmental actors to create significant impacts with exploits
“previously like tools like that were only in the hands of governments and they weren't generally targeting individuals or small corporations has that changed i think the accessibility is different there's like an asymmetry to this right like some some person some teenager guy or girl sitting in there garage can literally have a massive disproportionate impact”
The transition of people from government intelligence agencies to private companies is a significant and ongoing trend as agencies become more bureaucratic and constrain talented individuals
“but i mean i think from one one benefit to linchpin from that was definitely it pushed people out the door uh absolutely uh i i think that's a trend that uh that continues uh to this day”
Holland left the intelligence agency (CSE) because he perceived a ceiling on what he could achieve and became frustrated with arbitrary constraints that prevented innovation and technical solutions to operational problems
“the ultimate reason i left was because i saw a limit to what i could grow into and what the vision of the group i was in achieving one like there was a ceiling arbitrarily put on top of that and i'm the type of person that i don't work well when somebody says this is as far as you can go”
Huawei's lower costs are partly because they're 'likely subsidized' by the Chinese government not only in R&D but in overall pricing, making their economics unfair and impossible to compete against when using legitimate pricing and development models.
“it's cheaper because it's likely subsidized and not only r d but subsidized by the government”
Small companies targeted by ransomware often cannot afford the ransom and must fold or shut down; law enforcement agencies prioritize larger cases and do not track small-business ransomware due to competing demands on resources, leaving victims without recourse.
“it's not even a matter of payment for them in some cases it's life or death for the business because you can effectively turn the business off overnight and just eliminate it especially if you're small and you you don't have these sort of like big bank accounts to pay”
Offensive cybersecurity only exists because humans are generally horrible at writing software; if software security practices were strong, offensive capabilities would be drastically limited
“the first bit only exists because uh humans are generally generally horrible at writing software so that wouldn't exist if people are actually good at security models and implementing software”
Every company should have cybersecurity protection; no company is too small to be off attackers' radar, and Holland has seen two and five-person companies successfully attacked and compromised
“everybody is a target at this point your company is not small enough uh to be off uh an attacker's radar i have seen five person companies uh actually i've seen two person companies uh attacked and hit”
Google's Project Zero (vulnerability research team) was largely staffed with people from intelligence communities who left with chips on their shoulders, representing a specific pool of talent motivated by frustration
“google's project zero is largely built from people who have exited the intelligence in the industry with a chip on their shoulder i don't know if that's worked worked out so well but”
Companies now face legal obligations to report ransomware compromises and resulting customer data breaches, with potential six-figure fines from Canadian regulators pre-COVID-19 if they fail to demonstrate adequate security protections were in place, creating legal liability beyond ransom amounts.
“there are fines i i remember before kovit 19 dropped there was discussions about you know six-figure fines going to canadian companies uh if they are ransomware customer data gets compromised and it has shown that they weren't taking the problem seriously ahead of time so they didn't have the adequate security protections in place”
China and Russia are remarkably aggressive in their cyber operations despite intellectual property concerns, and the 'spray and pray' approach allows them to use the same exploits across many targets without concern about losing capabilities
“different different you know agencies around the world will do different things i mean you look at china and russia they're remarkably aggressive with a lot of i don't say disregard to their own intellectual property and what they're using but they're certainly not quiet about what they're doing it's like spray and pray right”
When an intelligence agency discovers a zero-day vulnerability, they face a strategic choice: either use it operationally (and risk it eventually being discovered and lost) or disclose it (and lose the capability immediately but prevent adversaries from using it)
“so talk me through that though like how do you see that because um allied governments friendly governments whatever you want to call them have exploits that are zero days that they don't release that have huge national security implications like we we've seen some of those become public”
Trust in critical infrastructure vendors like Huawei cannot be rebuilt once broken because an infrastructure vendor with government ties could compromise an entire nation's telecommunications network
“so i don't think there is a framework to build trust i don't think they have earned that trust and given you know if a nation is going to re-kit their entire country with a new type of wireless gear especially with the complexities of 5g you need to trust that vendor you need to be sure that the interests of that vendor are at the very least not opposed to the interests of the country that you're in”
Once an attacker achieves kernel-level code execution on a Windows system, there are essentially no defenses available—they can open back channels to command and control servers or exfiltrate data without detection by standard monitoring solutions
“once you have that you you there really is no barriers to do to doing anything on that host so if you want to open up comms back to mothership you can do that if you want to access a whole bunch of data you can do that”
Modern smartphones (iOS and Android) are personal computers that are now primary targets for attack, and phone exploitation works the same as Windows/Mac exploitation—through browser exploits, sandbox escapes, and privilege escalation
“so the unfortunate answer is the exact same way you'd go after every other type of computer uh ios is just an operating system android is just an operating system there's there's no there's no special features that make it impervious to attack”
Zero-day exploits will always exist because creative attackers are always discovering new ways to bypass mitigations, and no amount of operating system hardening can eliminate this problem entirely
“the zero day problem is is something that's always going to be there i think this is something a lot of vendors don't actually realize that no matter how much you lock down your operating system there's always going to be a creative group out there that does things better that can get around it”
Holland fundamentally disagrees with Edward Snowden's approach and actions, believing Snowden's disclosure of the entire intelligence archive (not just illegal programs) was an unnecessary betrayal of legitimate operations
“what do you think of snowden oh i feel like you're asking questions that has slowly taken years off my life uh so i've been doing that since i met you uh no you're great bud i do not agree with what snowden did in any way and that is that is putting it very very kindly”
Intelligence agency employees sacrifice greatly—long hours, broken families, broken relationships—and deserve recognition, not public vilification when programs they worked hard on are exposed
“so the idea that anything that has been deemed illegal you know i'm not in a position to say that's right or wrong but what i can say is the process that those things would have gone through people underestimate the sheer size of the bureaucracy to get anything implemented absolutely crazy so so that whole side of things um uh i find unfortunate um because the the byproduct of that is distrust for agencies that are working extremely hard to keep countries safe and is it is extremely disheartening for those people to you know get dragged through the mud publicly when the public doesn't actually have an awareness as to how much they sacrifice on a day-to-day basis like i couldn't count the number of long nights that i've seen people work um you know it it can break families it can break relationships”
Huawei gained competitive advantage and became a major global telecom vendor remarkably quickly, suspiciously coinciding with Cisco source code leaks in 2003-2004, suggesting they obtained IP through theft rather than independent development
“so we've had many conversations what a chestnut that situation is um so huawei's had a bit of a an interesting uh less than smooth ride uh i i would say they came out of nowhere with all this tech yeah which which miraculously happened right after a cisco leak a giant cisco source code it's a coincidence yeah so i you know there's there's documented ties to uh the chinese federal government with that company existing there is i don't know if they were ever convicted [1:10:06] it was back in 2003 2004 but there was a there was a very clear-cut case that huawei was using conveniently leaked intellectual property”
Many things Snowden exposed were later determined to be illegal, but intelligence agency decisions go through extensive legal review by teams of lawyers who carefully evaluate legality before operations are approved
“regardless of you know at this point there's been things that he brought to light that has been declared illegal the the unfortunate assumption is that agencies security agencies intel agencies are you know these devious groups that are like let's do whatever we can and i don't think the average person actually realizes how difficult that job is how normal the people are who do that job they have families they come in they want to you know solve a mission or solve a problem make things better and the way he went out uh with this giant trove of information which i'm going to come back to completely ignores the the the way that technical implementations get approved it's not like developers are sitting at their desk and say i have this great idea let's go do it and all of a sudden it's running in operations without any um you know accountability or review there is a team of lawyers depending on the size of the country that will look at that and say this is okay this is bad”
Disclosing operational techniques and exploitation methods in the Snowden documents caused real harm by revealing to adversaries how allied intelligence agencies conduct operations, potentially costing lives
“that definitely cost people lives that had a huge impact on people working there yeah and how far back did he set programs how much did you know entire agencies need to go into damage control because some yahoo decided that this thing over here was illegal and then oh ps here's a whole bunch of other interesting stuff unredacted being released”
The cybersecurity industry is fundamentally unethical and resembles a 'used car salesman' strategy where vendors focus on transactional sales rather than actual customer protection and results
“what i see is a sales strategy that is like a warped used car salesman strategy and that's probably an insult to use car salesmen out there because it's it's much worse um that it's it's all about the transaction it's all about you know getting getting that done taking the customer's money and saying good luck and that isn't results we're not responsible for anything”
The 40-100 person range is a critical scaling phase where many companies break because processes that worked at smaller scale hit their limit, and the people who got the company to that point may not be the right people to scale beyond it
“that's the critical phase for a lot of companies like a lot of companies break in this sort of like 40 to 100 people range because you start reaching the ceiling of the processes that you put in place but also the ceiling of the people who've got you here”
The size of the intelligence agency bureaucracy for legal review is 'absolutely crazy'—no developers can just implement ideas; there is extensive bureaucratic oversight
“the idea that anything that has been deemed illegal you know i'm not in a position to say that's right or wrong but what i can say is the process that those things would have gone through people underestimate the sheer size of the bureaucracy to get anything implemented absolutely crazy”
Holland was able to replicate the productivity of an entire intelligence agency wing with one-tenth to one-twentieth the number of people by removing barriers, providing immediate access to tools without bureaucratic requisition processes, and creating an environment where people knew they were valued
“you were able to replicate i mean an entire wing of an agency if you want you want to say that with 1 10th 1 20th the number of people and have higher output how are you able to do that you just same people you just took them out of the environment and what enabled that largely removing barriers”
The defensive side of cybersecurity only exists because the offensive side exists, creating a dependency relationship where vendors can justify selling multiple incompatible defensive tools without actually solving the underlying problem or working well together.
“the second bit only exists because the first bit exists so that's the defensive side”
The cybersecurity industry has three distinct pillars: offensive operations (ransomware, state intelligence), defensive operations (antivirus, firewalls, monitoring), and a third category that isn't actually cybersecurity (election interference, social media influence campaigns) that gets mislabeled as security
“there's there's three groups or or pillars of cyber security there's the one there's the offensive side which we've talked about the the ransomware the intelligence agencies... the second bit and by the way the first bit only exists because uh humans are generally generally horrible at writing software... the second bit only exists because the first bit exists so that's the defensive side... the third bit is a category that isn't actually cyber security”
Holland failed a management competition interview because instead of giving the interviewers the answers they wanted to hear (about building teams, requesting funding, partnering with universities), he gave technical solutions to the problems they asked, answering the question directly rather than playing the bureaucratic game.
“somebody would ask you know the interviewer would ask me a question and rather than give them the answer of you know i would build a team to do this i would request funding to do this i would uh you know reach out to universities to you know bring them into the into the fold so you know that's the answers they wanted to hear what i gave them were the technical responses to the questions they were asking”
'Adequate' security is completely subjective, but many companies reference the Gartner quadrant to provide cover for their liability—if they bought the tools Gartner recommended, they have defensible legal position even if breached, making Gartner recommendations function as liability shields rather than security drivers.
“is that back to that gartner i checked the box you can't sort of like fire me so so if i was a uh you know virtual uh cso i i would probably you know reference the gardner quantra to make sure that you know the executive board is covered in regards to liability”
'Next generation' as a marketing term drives Holland 'nuts' because vendors claim to have 'next generation' solutions that are 'the exact same thing' he's seen for 20 years, just with machine learning added, and 'next generation' means nothing if you knew what next generation exploits actually are—a good solution should be 'iterative' and 'engineered to handle the future' without needing a sales tag.
“this is where this whole concept of next generation drives me nuts because people say we have this next generation thing and what i'm seeing right now is the exact same thing i've been seeing 20 years ago regardless of whether it has a machine learning component or not like what does that mean next generation... a good solution should be iterative a good solution should be engineered to handle the future without needing to put a sales tag around a uh you know this is what we have now”
Ransomware is the easiest malware to detect and stop, and Holland finds it remarkable that a ransomware industry exists at all given how simple it is to defend against, suggesting the cybersecurity industry has fundamentally failed at its job
“ransomware in general i don't get how it even exists because it is the most benign is the easiest malware to detect and stop how there's even an industry around that blows my mind”
Apple's approach of increasingly restricting what operators can do on iOS provides an illusion of security, but once an attacker discovers even a single way around the mitigations, they can compromise any iOS device in the world because all devices run identical code
“if you look at apple apple iphone for the past i don't say decade they've been adding an increasing number of security mechanisms into the operating system that largely limit an operator to only being able to do specific things but that is largely crippling from a security standpoint because all you need to do is get around these set of mitigations and you now can own any apple device in the world”
NSO Group claims to have an internal ethics review group to decide which governments they sell to and don't sell to, but Holland doubts the effectiveness because the very existence of such a group indicates ethics weren't part of the founding
“there's there's a lot of articles on them about who they sell to and don't sell to um they have a whole group now our whole internal group within the company that i've read uh dedicated to making sure they make ethical decisions i don't personally trust that they're making it i think why do you need a group to make ethical decisions i mean that's an indication that you know ethics weren't a component in the founding of the company”
Companies often pay ransoms instead of investing in preventive cybersecurity because the immediate financial impact of paying feels more tractable than the upfront cost of hardening systems and hiring security expertise
“i mean that that is a very very basic profile to stop identify um i don't know i might be jaded because i've been doing this for 20 years and in the grand scheme of uh things that i've been a part of uh ransomware is definitely low on the sophistication bar”
Most businesses don't know what cybersecurity solutions they actually need, which is why Field Effect focuses on small-to-medium businesses where they can educate customers about their actual problems rather than selling them pre-packaged solutions
“the second thing is i don't think uh businesses actually necessarily know what they're looking for um yeah like how would you be educated if you're like a law firm an accounting firm you get 100 employees you don't have like a cyber guy or girl and like how do you how do you go about doing that so so i mean that's that's ultimately the the realm that you know field effect sits in the the small to medium business space”
When buying cybersecurity, customers should ask 'How are you protecting my company?' and evaluate answers based on whether they use jargon like 'next generation,' 'seamless,' 'AI,' or 'machine learning'—if a vendor uses any of those words, 'big red flags' should go up because these are meaningless sales terms.
“right off the bat i would say how are you protecting my company just tell me how you're protecting my company like full stop what happens when something goes wrong and and you'll probably get a whole bunch of you know sales jargon what's the difference between a good answer and a bad answer to that question oh god if somebody uses the word next generation seamless um yeah we'll stop everything yeah ai we've got machine learning any of that if any of that comes up big red flags”
Holland's personal take is that Huawei should not be allowed in any critical infrastructure 'or do you think it should be not allowed in any infrastructure your personal take oh my personal take i i i'm again i'm i'm completely fine with the ban'—though he notes Huawei is still allowed in Canadian peripheral components but not critical components, which he considers 'silly' because you don't want to be held hostage.
“i think it's not allowed in the critical components of canadian telcos but it's allowed in the periphery but that's like silly when you think about it right because you don't want to ever be held hostage to somebody who can who can turn that off”
The UK's 'accredited lab' approach to Huawei—where they would review code to allow limited deployment—would fail in practice because once code is released, zero-days would be deployed immediately before the review process could complete
“i remember when the brits did this whole thing like we're going to set up this accredited lab we're going to test it so we're going to allow british telecom to use it but we'll test everything that's deployed i remember just like that would fall apart in a second because the minute there's a zero day you're going to deploy it right away especially if it's leaked on the internet and then you've deployed code that you haven't code reviewed”
Post-Snowden, government intelligence agencies tightened hiring and vetting processes, inadvertently creating a 'stormtrooper problem' where only conventional, rule-following candidates are hired, reducing cognitive diversity and innovation
“what happened in the immediate aftermath of that was they locked down the process by which people get hired so like i don't think you or i would make it through today from start to finish because of our backgrounds and sort of different quirks of our personality and so what happens is like post node and you end up hiring i call it the stormtrooper problem which is like you end up basically hiring the same type of person right there they're sort of like never had a problem in their life they get straight a's they do all the right things they tie their shoelaces the right way and they come into the organization and they get promoted and the process for promotion now is sort of like here are the 10 things you need to do to get promoted”
When agencies refuse to grant employees their promised sabbatical/leave benefits, it doesn't keep people there—instead it 'pushes them in the door and motivates them' because 'chips on shoulders man there's something to the motivation that comes from that that just drives people.'
“does that ever make somebody stay or does it like push them at the door faster pushes them in the door and motivates them yeah chips on shoulders man there's something to the motivation that comes from that that just drives people”
Ransomware negotiators operate like hostage negotiators in movies, a 'weird sub industry' that has emerged because ransomware is now an accepted and normalized business model for criminal groups and some companies choose to pay rather than prevent.
“this weird i guess sub industry has emerged from ransomware actually being a thing and being accepted where companies will actually act as negotiators so if you think back to those really cool movies where you know there's a really cool ransom sorry hostage negotiator uh trying to talk somebody out of the scenario that exists for ransomware”
Holland assumes 'every intelligence agency worth their salt in the world' has unredacted copies of the Snowden documents, meaning the redactions on publicly-released documents provided minimal actual security—the redaction process is largely theater because serious adversaries have the full archives.
“to the best of my knowledge wikileaks doesn't receive redacted versions of things uh so i mean that's that's largely my opinion on him if he's so you don't think he should be pardoned a little part of me will die if he's pardoned”
Holland benefited from the post-Snowden tightening of government hiring because Linchpin and Field Effect specifically recruited misfits—people who didn't fit conventional government career paths but had exceptional technical skills
“so i remember when that started happening i was like oh man this is like great news for matt because you're hiring in a way the misfits of the the industry right the people who don't want to go to meetings the people who don't want to fill out the forms to go travel the people who just want to be able to do their job”
Holland started Field Effect Security after exiting Linchpin with enough money to walk away for the rest of his life, but chose instead to risk all the money on the company because he is fundamentally a serial entrepreneur who enjoys solving hard problems and believed the cybersecurity industry is 'unethical' and broken in ways he could fix.
“i really enjoy solving hard problems and the the current state of the cyber security industry to say it's a hard problem is an understatement um it is a an unethical show i would say and it it really bothers me uh where it's at so i think there's a there's a large part of me that wants to fix that um there's also the aspect of i'm like ultimately a serial entrepreneur”
When there are problems with cybersecurity, the system should provide guided, specific actions rather than links to external resources or requiring users to google and understand security concepts independently
“it is just here's the goal here's the problem solve it let me know what you need... it's a guided approach to this is specifically what you need to do let's flip that around and uh what people don't often see which you can add uniquely is sort of what's the mind of the attacker”
Companies should not hesitate to seek cybersecurity help from vendors like Field Effect, just as they wouldn't hesitate to see a doctor about health problems, despite the natural human aversion to bad news
“i would say uh you know if you are a company uh looking for help uh it can be a challenging thing i i think it's uh it's that going to the doctor scenario when you have a pain you don't want to necessarily find out what it is because you know people are naturally averse to bad news you can't be like that with cyber security if you don't have a cyber security vendor if you don't have a company helping you out with that problem um get on it”
The biggest ideas—that humans are terrible at software security, that defensive solutions require holistic approaches, that organizational bureaucracy stifles talent—are created by the constant tension between what works technically and what works organizationally
“i've been doing this for 15 years almost as an entrepreneur in you know two companies and i've gotten to witness people going go through that unleashing process and it is really cool to see um how you know one month after they're they're just blown away with what they are now afforded to do and what what what you know i'm not saying don't do this it is just here's the goal here's the problem solve it let me know what you need we'll catch up every once in a while”
Holland went through an evolution where he initially blamed others for not understanding his vision, but eventually realized 'it's me, I'm the problem here,' leading to an appreciation of why he didn't fit and making his transition away easy without animosity.
“you go through this evolution of like what's wrong with everybody why is nobody on board with this and then uh the realization that oh it's it's me i'm the problem here and then the the appreciation of okay okay understanding why that is”
Holland considers 'execution' to be something that 'does not necessarily come naturally to a lot of people,' making it critical to understand 'what execution looks like in each particular problem or a given company,' and his company is 'absolutely doing amazing' at execution.
“execution is not necessarily something that comes naturally to a lot of people and and for me right now like one of my one of my biggest concerns as we approach 100 as we go through kovid 19 i mean when this kobit 19 started there was you know a decision to be made to go aggressive or yeah or cower i guess from the scenario and you know in my opinion it was very clear we go aggressive because you know our competitors are probably going to be category b and damage control so yeah um so you can get ahead yeah so so execution is is a big part of that”
Trust in cybersecurity vendor relationships is built over time through demonstrating genuine commitment to fixing customer problems, not through rapid sales or flashy interfaces that customers don't understand
“i mean i i think trust takes time you don't just uh magically get trust right out of the gate and i think that is a that is something we put a lot of time into building we take time to create a customer relationship uh ask customers what their needs are what are their problems and then um you know tell us about your network how can we help you um and you know early on in that process i think it becomes clear that we're not just out trying to sell software”
Canada's employee leave policies (one-year leave of absence or five-year sabbatical options) are used as tools against employees rather than supporting them—if employees exercise the options, agencies weaponize it against them by refusing to honor the leave
“in canada people typically join join the company with you know one year leave of absence or a five-year sabbatical component and i always i always laugh about that because yeah i mean nobody's ever going back well yeah so yeah so from a risk standpoint uh that makes sense so i never i never argue with that uh but from a practical standpoint uh nobody's ever gone back and it's become something that i've seen weaponized against the employee um you know oh you're you're going to this company we're not going to give you your one year uh leave of absence and it's like okay that is extremely bad decision”
To scale beyond 100 people, Field Effect ensures everyone understands company direction, maintains honest communication about internal and external goals, and prioritizes execution—turning ideas into reality rather than remaining at the idea stage
“i i think the the first component is is making sure that everybody is going in in the same direction um the you know you you have to be very straightforward frank honest uh when you know looking internally but also what the company goals are and everybody needs to know what the company goals are i don't think that you know execution is not necessarily something that comes naturally to a lot of people and and for me right now like one of my one of my biggest concerns as we approach 100 as we go through kovid 19 i mean when this kobit 19 started there was you know a decision to be made to go aggressive or yeah or or cower i guess from the scenario and you know in my opinion it was very clear we go aggressive because you know our competitors are probably going to be category b and damage control”
When Holland left Linchpin and CSE, colleagues at CSE explicitly predicted he would fail and eventually return to government work; Holland views this as skepticism justified by the novelty of departing, not by fundamental doubts about his capability.
“there was definitely skepticism as to whether i could succeed which um it's i'm fine with that i mean you know clearly at the time my business partner and i were the first ones to kind of make that jump and do that together and there's a lot of skepticism as to whether we should be allowed to do that whether we um are able to do that”
Gartner Magic Quadrant is an imperfect guidance tool because it looks backward at what existed and succeeded, not forward at emerging categories, so vendors are often ahead of Gartner's categorization
“there are a few problems with that the gardener quadrant system is often outdated we we were for example field effect was marketing a managed detect and response service well before it was defined in gartner and ironically at the time we had a hard time you know gaining traction because that's always looking at like existing sort of technology and threats and looking backwards saying like oh these people accomplish this but not looking forward in terms of where the industry's going”
Attackers constantly balance risk of losing capabilities against the effort to develop new ones, and this cost-benefit calculation drives how aggressive and operational they are willing to be
“as an attacker it is a um it is a continuous balance between risk uh and losing a capability and this is what does that mean and i'm speaking from um you know back when i uh you know was at cse uh it means that you know when i said earlier that on the you know that first pillar of cyber security you want to call it a pillar there's an economy behind it so there's a cost to building uh capabilities to to go after a particular target if you lose that capability that immediately is an expectation of okay find a new one and it's difficult there's there's cost of that there's labor”
Attackers typically begin by profiling targets through online services, email addresses, and social media presence, then launch social engineering campaigns via email or phone with links/attachments designed to get users to click and trigger exploitation
“initially an attacker is going to profile the target and that can look like different things so if you know the the target has online services they'll probe those services to see what's there uh are there any email addresses on your website that are really easy to uh you know identify what type of social media presence is there um you know and that ultimately will lead into typically a social engineering campaign uh either in the form of you know an email that is received that looks really normal that you want to trust and hopefully will get you to click on something or double-click in an attachment”
Ransomware attacks typically encrypt files on a workstation, potentially delete backups across network shares, copy sensitive data for extortion threats, and then demand payment to decrypt—the attack vector requires endpoint-level capabilities that network monitoring alone cannot detect
“if you attack uh an individual you would uh you know potentially encrypt their personal photos um credit card information maybe other personal compromising information and then say give me x amount of money or i'm going to i'm going to you know expose all your photos or i'm going to delete it all when it comes to businesses it's more of going after intellectual property where if a particular workstation gets compromised ransomware runs on that workstation encrypts everything potentially deletes deletes everything at the time uh typically making a copy of it because there's value in that and then we'll go through all the network shares and do the same thing”
Holland and the host worked together at an intelligence agency starting around 1999-2000, and after September 11th, 2001, their small team worked non-stop for effectively seven years with no vacations other than random Mondays, dealing with the most insane period of time where everything they did had significant national consequences.
“i've known you since what 1999 we met two thousand around that... world we used to work together at the intelligence agency... september 11th happens the world forever changes our team works non-stop for effectively seven years like i don't remember any of us having vacation from 2001 to 2008 other than like a random monday or something”
For high-value targets like Boeing or General Electric seeking to steal IP, attackers use zero-day exploits and custom development to gain access to systems, versus commodity attacks used against small businesses
“somebody like boeing or general electric or sort of cisco who would have a lot more valuable ip and probably worth a zero day or sort of like developing a custom exploit”
Holland's wife has been 'a huge part' of his success as an entrepreneur, with Holland joking that if you could 'sample what makes her run' and create a vaccine to inoculate the world, you would have world peace, and that anybody who knows her would agree she is phenomenal.
“she's amazing um i i i don't think i i could ever thank her enough... if you if you could if you could sample what makes her run you know who she is and somehow create like a vaccine and inoculate the world like you would have world peace”
Holland chose to be aggressive during COVID-19 while competitors were in damage control, positioning Field Effect advantageously while others contracted
“when this kobit 19 started there was you know a decision to be made to go aggressive or yeah or or cower i guess from the scenario and you know in my opinion it was very clear we go aggressive because you know our competitors are probably going to be category b and damage control so yeah um so you can get ahead”
Matthew Holland has been the person that three-letter agencies in the western world call when they have problems they cannot solve
“matt's been the guy that every three-letter agency in the western world has called when they have a problem that they can't solve”
Holland's kids compare him to Elon Musk, saying Holland will do 'more' than Elon, which Holland finds difficult to respond to but appreciates the sentiment
“my kids call you uncle matt but they also uh whenever elon musk comes out they say we know somebody is going to do more than elon sort of like and they're pointing to you”