Welcome to the Innovation Conversation, a podcast
about innovators, both in business and real life.
Hosted by myself, Ricardo Rescual and Harry McCona.
This podcast is sponsored by OpenExperts .com.
OpenExperts is a place to go if you're looking
to talk with top experts from around the world.
That is Open -Experts .com. This podcast is also
sponsored by StartupNetworks .co .uk. Startup
Networks, it's an online forum where you can
find all the resources you need to learn your
startup. Hi, and welcome to another episode of
the Innovation Conversation. Today we are joined
by Julia and Brendan from MySina. Welcome. Thank
you, Ricardo. Very nice to be here with you.
Thank you indeed, Ricardo. Likewise. It's a pleasure
having you both here. Would you like to tell
our audience a little bit about yourselves and
also what MySina does? So yes, I'm Julia, the
co -founder and co -CEO of Mycena. Mycena revolutionized
cybersecurity by doing encrypted access management.
So in a sense, up until now, 95 % of breaches
have been through logins and there's 24 billion
username and passwords on the dark web to...
to purchase, it's very easy for criminals to
just get into the system, move laterally, find
privilege access, and launch ransomware, supply
chain attacks, interrupt businesses, or even
just stay in networks for espionage. So we stop
all of that by making sure that the employees
never make or know the company's credentials
in the same way that you don't let employees
make the keys to access the office. How exactly
does it work? Do you have a system that automatically
generates passwords? So it's actually in two
parts. The user every morning opens a desktop
or mobile application and he or she goes through
multiple levels of security. So two FA, two security
questions, and then the fortress is open for
the day. then anytime during the day when they
need to find a credential to open a system, they
need to enter a PIN to go to the bronze level
where the lowest sensitivity credentials are
stored. If they want a medium -sensitive credential
from the bronze, they need to put a lock pattern
to get to the silver level. And if they need
the most critical credentials, things like banking
servers, from the silver level, there's another
gate where they need to put a passphrase and
that will take them to the gold level. So that's
how the system is layered so that there's no
single point of failure. And meanwhile, all the
credentials are actually uploaded by the company.
It's not at all up to the employees to create
passwords, no passwords, manipulate passwords.
They just use them like keys. And all they need
to do is to actually click on the right credentials,
like they would put a key in the door. And then
the system gets brought up to them onto the screen.
credentials are being pushed into that page so
that they never see that password and so they
can't read them away and they can't get intercepted.
How did you came up with the idea? Was it the
case that someone hacked you and you know you
guys both got very frustrated with it or you
know what's the story behind it? So the story
behind it is I was struggling with my passwords
since the late 90s. I was still a student at
that time and I just never understood being a
math graduate why people were putting all the
Xs in basket behind a single door. So a single
access whether it's a master password or master
identity using Single sign on, I am open. I just
couldn't wrap my head around it. And so for decades
I was struggling trying to find a solution for
myself. And then on a family trip to Mycena,
the ancient Greek city, I saw how the ancient
Greeks, about 3 ,000 years ago, have actually
protected the cities for centuries through layers
of security. And then, bang, it dropped on me
that there was a mathematical solution there
that could really work. for my problem. And so
it took a couple of years to just make sure that
the math was correct, that there was no other
way of doing it, patent the solution. And then
we went out to develop it. And very quickly,
we started working with real enterprise customers
to really understand their needs and make it
very easy to use, implement, deploy and integrate
with the existing tech stack. And what type of
customers are you getting? Is it industry agnostic
or was it focused on just one type of industry?
So when the product was built, we're working
with clients across 18 sectors, actually, because
people say we really need this. But can you do
this for us? Can you do that for us? And that
actually fed into what the Mycena solution ended
up being, which we launched last summer, the
very sophisticated solution that's completely
industry agnostic. So it works for small organizations,
as well as for very large organizations. We have
an access kit to accelerate deployment. It just
turns out that recently, we've got a lot of requests
from the financial sectors for information demos
and so on. So it looks like we are quite heavily
being drawn towards servicing that industry at
the moment. But if you take a step back for a
moment, I mean, anyone who routinely accesses
internet has got issues cybersecurity issues
and that's both enterprise and private consumers
and in the world today there's more than 300
million enterprises and they're employing more
than three and a half billion end users and at
the same time on the on the on the personal side
you've got more than four and a half billion
private individuals who are routinely accessing
internet. Now all of these people are under threat
from a cyber attack. All of them need protection.
All access typically through digital doors that
need proper security. And Mycena is relevant
to all of those cases. So it's completely broadly
agnostic. All sectors, all enterprises of all
shapes and sizes, both public and private. Ultimately,
that's the end audience, the end market for Mycena.
Interesting. When you go to market with this
solution, do people ever tell you this is exactly
what we're looking for and it's absolutely brilliant
or you get a lot of pushback from the market
overall? Actually, what we get is that people
really get it first. They say, this is a no -brainer.
It should be everywhere. If you start telling
people that In the physical world, you never
let employees make their own keys to access the
office. So why do you let them make the passwords
to access your systems and data, which they can
access from anywhere. People tell us it's an
eye -opener, it's a no -brainer. They never thought
about a problem this way. We are opening the
mind to something that never even considered
before as being possible. And we are completely
changing the cybersecurity from around access
from managing passwords and identities, which
is a big vulnerability to risk management, which
is layering access, making sure that the human
vulnerability layer disappears. And basically
the company with Mycena has full control and
governance over its access just like they would
in a physical building. It makes a lot of sense
actually. I guess like everyone else I also struggle
with a lot of passwords and I also struggle with...
How can I share these passwords without being
a risk for my organization? Because sometimes
you have a shared password, but actually, how
many people have that password? And then you
end up putting a lot of trust on that individual
not to share their password. But at the same
time, the risk for them to share the password
for your business is actually quite high. So
you want to eliminate that. So it makes perfect
sense. You often also get the end users, the
employees are using their passwords from their
personal life for their business access as well.
which is an added layer of risk. But your response
just there, you know, it makes sense. It makes
perfect sense. I mean, that's the reaction that
we get time and time again from customers. I
think with a lot of, you know, some of the greatest
inventions in human history, you know, that's
the sort of after the fact. Yeah, it makes sense.
You know, why didn't someone think of that before?
It always seemed more obvious after the fact.
And the problem, you know, you sort of people
are grappling with, but then something comes
along. And it makes sense. What we make sure
during our R &D development with customers is
that it integrates really well with the environment.
So there's no infrastructure change. And because
it's so easy to deploy and to use for the users.
So for example, the typical user, let's take
a bank employee, for example, they would have,
let's say 30 URLs to open every day. say systems,
internal and external, and they would open a
notepad with all these URLs and another notepad
with the password that they need. So you get
no huge vulnerability in having passwords in
one notepad in the first place, but also the
pain of having to go to the page, find the address,
then go and type your username, your password,
and maybe it's actually not the right password.
So you actually need to try one time, two times,
three times across multiple systems. It's a lot
of waste of time. And for people who don't write
it, they try to remember the 15, 20 passwords
that they may have in their head. And often they
end up not remembering and having to reset the
password, that costs a lot of money. So not only
does MySina eliminate the need for people to
create, type, remember, forget, reset passwords,
but for a company point of view, they can save
up to 50 % of the IT help this cost, just because
people don't have passwords to reset anymore.
And if you think that from a Forrester study,
one password reset can cost 70 US dollars, You're
talking about huge cost savings. Just on that,
we calculated for the FTSE 100 alone that they
are spending close to two billion pounds a year
on password resets. And that's totally unnecessary.
Money down the drain. Yes, some staggering numbers.
And that's just the FTSE 100. It's a bit scary.
It's huge. I remember working for companies that
had double authentication. And every time that
failed, it was such a loss of productivity because
you end up wasting if you're lucky just 10 minutes
but if you're unlucky you waste half a day just
trying to fix that and they need to go and talk
with the IT guy but then the IT is just getting
you know an email from your own personal account
because there's no other way of reaching him
or her like hey can you reset my password yeah
sure but why can't it just becomes an absolute
nightmare. It's interesting if you flag that
you know we've got some customers that have talked
to us about there's a phenomenon called password
burn and that's where the employee deliberately
mistypes their password three times in a row
and then gets locked out of the system. So they
can't work. It's a good way of getting an extra
holiday, right? Indeed. I know I struggle with
that a lot and this makes good sense to have
a different way of doing things. When we talk
about other things that are being implemented
right now like AI and quantum computing, how
much safer is it by using Mycena compared to
traditional ways. So from the threat of AI point
of view, the fact that people don't know the
passwords means that they can't get scammed by
AI fakes and give the passwords away to someone
that they would otherwise trust because you don't
know it, so you can't even give it away to someone
you can trust. And from a quantum point of view,
all our credentials are highly secure, and they
use multiple combinations of encryption. So it's
not straight. You can increase the password length
to 20, 30, 40, 50, infinitely, actually, because
you don't need to know the password. So you can
generate as long a password as you need, which
means that even for quantum computers, it would
take trillions of years to crack a password,
if you're lucky. And then once you've cracked
one, because With Mycena, all your locks have
different keys. You would need to crack 10 ,000
other locks to really have an impact on the enterprise.
So that makes the business of bridging through
logins completely economically unviable for criminals.
So they would actually move to another trade.
One of the beauties of the technology is the
fact that people never know passwords. And when
people never know passwords, you can have a unique
key for every single access point. And with that,
you containerize risk to the individual digital
room. the specific system or database. So you've
got segmentation to the maximum. And from a risk
management standpoint, it's the best of worlds,
as opposed to what you have today, where all
of the existing access management solutions run
on the basis of single sign -on master entry
points. And that, from a risk management standpoint,
is virtually the worst of all worlds. Because
if somebody fishes or intercepts that key, and
enters, they have the freedom of the city. They
can go and roam everywhere and anywhere, up and
down a supply chain. This is one of the main
drivers of the scale of systemic risk that is
building in the world today. It's frightening
the daylights out of the insurance industry,
and the insurance industry are really under threat.
Lloyd's of London, I think, about a month and
a half ago. published their outlook for the year
ahead. And the two big topics were natural catastrophes,
climate related events, and cyber cat. And I
think in that presentation, they spent more time
talking about cyber cat, you know, cyber catastrophe.
These systemic risks, lawyers of London have
now published a report in October of last year
where they said one single breach, one entry,
because of single sign on and this consolidation
of risk behind single entry points could lead
to three and a half trillion dollar catastrophe
event bigger than anything the world has ever
seen. So the risks are tremendous and the beauty
of my senior is with one unique and powerful
key and nobody knows it, and that segmentation
to every digital door, every access point, that
containerization of risk completely eliminates
that systemic risk. Makes sense. It's something
that I think a lot of people are thinking more
and more, which is the way we do things right
now. It's obviously very inefficient, but at
the same time, when we start thinking about AI
quantum computing, is this really that safe?
because the way you just described it actually
it isn't and the risk is gigantic right so it
makes perfect sense and how are you finding like
when you go over and talk with investors are
they super receptive to the idea they get it
straight away how are you finding that that process
because i know you're still fundraising so how
is that going on overall don't tell me all the
specifics just tell me the overall So everybody
gets the logic that we put forward and everybody
thinks that all companies should be already using
it and so on. The question is how do you make
this adopted widely by all these different industries?
Think of healthcare, for example. The maturity
of healthcare technology is still very low. Who
do you talk to to really implement something
like that in the healthcare industry? Think about
United Healthcare in the US. That one bridge
of change IT system has cost them over a billion
dollars. where people couldn't get a prescription
and other incidents where all the patients' data
were leaked. These are the most private. When
you're sitting on huge troves of information,
like patients' data, and you still let employees
make their own case to access the data, you're
putting a lot of risks on the individual for
not disclosing that password to the rest of the
world, really. And there's a chance that that
password is already leaked because there's 24
billion passwords in a dark web to start with.
Any company who does not want to be on that list
now and forever should be using encrypted access
management system so that the employees are not
vulnerable to being hacked. Interesting. And
so what do your growth plans look like? I'm sure
you want to conquer the world because it seems
I have a perfect solution for a lot of industries
and solves a lot of really big problems Yeah,
I wouldn't I wouldn't you know use the phrase
conquer the world I would use the phrase more
about our mission is is is to put an end to cybercrime
and you know when 95 % of all breaches are a
consequence of that human factor the fact that
people know passwords or use their identity to
access and the problems being amplified through
single sign -on solutions. We take all of that
away and it's that mission to tackle that fundamental
root cause problem 95 % and solve that is what
drives us. That's the mission. But yes, you know,
when you take a step back and look at that mission
and the scope and scale, and I mentioned earlier,
you know, over 300 million companies in the world,
you know, three and a half billion employees,
four and a half billion private end consumers.
I mean, you're talking about a huge problem.
Cybercrime today costs the world approaching
$10 trillion a year. If it was a country, it
would be about the second or third largest country
in the world. It's a massive, massive problem,
and it's getting bigger and bigger, and we can
make a big impact on that. So on the question
of how do we protect the world, is probably the
right word, we're actually getting a lot of people
who want to join the adventure, whether it's
distributors, partners, inferences in the industry.
I was thinking about, in particular, the financial
services industry, because we are not based in
London and meeting a lot of people here. A lot
of people know that this is a critical issue
and that they want to help join, use the influence,
connect us with the right people. And we're getting
a lot of meetings. Hopefully we'll be able to
crack one sector first and then the rest will
follow. Yeah, it just makes good sense to me,
to be honest, because I have... no work in financial
institutions, I know how complicated it is all
the passwords and I know how big of a risk it
is. So having something that overcomes that challenge
and also offers me a lot more guarantees as you
know as a business owner as well just makes good
business sense to be honest it's perfect and
I'm guilty of that of having the same passport
across multiple completely different things which
I shouldn't but that's kind of how I operate
but on that note actually what is not talked
enough is that Once a company gets breached,
because people are using, as you said, the same
password across a professional personal life,
that has a big impact on their personal lives
because all the accounts on the personal side
can get breached as well, putting their identity
at risk. And that's something that people don't
talk about. The responsibility of the company
to actually protect the employee as well from
the risks of cyber breaches in their personal
lives. Yeah, it makes it makes for good sense.
I mean, the way the way for example, I operate
is there's different risk passwords, and there's
the ones that very high risk and those are unique
access. So they're not shared with anyone only
I know them. And then there's the ones which
are more like the Netflix password. A lot of
people know my Netflix password. That's more
and it's when it comes to social engineering
people can probably think maybe use the same
password for something else Because it just follows
a logic obviously I don't because I understand
how you do that But then I guess a lot of people
don't don't do that to just you know, that's
right use I don't know their kids names or the
favorite pets or something like that So you already
better than a majority of people but even the
password which is very high risk Which you keep
for yourself if someone throws a fake page at
you and you think it's actually the genuine page
You can type it in and then that's good without
even you knowing actually that fishing is always
a risk. You know, I think most people are not
that aware of what fishing looks like, because
you always get this really nice email here, click
the link, or it's from the bank, you need to
call us right straight away. Do I? I'm not so
sure. And again, the fact that people know their
passwords and the number one threat vector is
phishing and followed by social engineering.
I actually read a report this morning from ICO.
the information, none are here in the UK. And
they were stating that 91 % of enterprises in
the UK last year all suffered phishing attacks.
I mean, phishing, it's the number one threat
vector. And 95 % of all data breaches, again,
relate to passwords. Cyber criminals don't have
some sort of master capability beavering away
in the basement in the dark with a hoodie on,
trying to decrypt or somehow find... some entry
point. Their craft is theft. They steal keys
and open doors with the keys they've stolen.
That's it. It's in the digital space, but that's
their craft. It's theft. Theft of keys. So you're
trying to tell me that that email I got last
week from the Nigerian space program where an
astronaut was lost in space, and they only needed
me to transfer $100 and I'll get a couple million
in gold bars. That's completely fake. You got
food for thought then. Well, with AI, soon you
won't be able to spot, you know, splattered,
plastered in your face scams, it's going to be
much more subtle. And it's already becoming a
lot more subtle and not like a voice AI pretending
to be someone who's related to you in distress.
We've seen that a lot in the news. And, and all
the that TFO who transferred is at $100 million,
Hong Kong dollars, I think, to after a zoom call
with nine other AI, which That is a really technique
though, if you think about it, that's a lot of
you got to give credit to the thief though. That's
that's quite hard to do, I guess. No, the latest
one I've heard about was someone there was a
big scam here. I guess in Portugal and Europe
where you get a text on your phone saying, Hi,
it's your dad or it's your mom. I need I need
some money or something like that. Can you please
send it straight away because I'm in trouble
and then people just send it straight away. They
wouldn't even question who it is. Hmm. And so
I was like to ask a little bit of a personal
question, which is, you know, what makes you
wake up in the morning and feeling inspired?
What's that one thing like what gives you inspiration
to build all this and also what keeps you pushing
forward when they know times get rough? Well,
you know, it's a roller coaster journey for sure.
Working in cyber security is not the easiest
of industries. But I think the fact that we have
this technology, which solves such a big problem
in the current world, if we can eliminate cyber
crime and do that. in an easy manner for the
user. So we do the hard work so that other people
can understand cybersecurity and do it properly.
I think that's in itself, you know, it's a great
mission to wake up to and to keep going. And
what about good books? What's the book you're
reading right now? And you actually recommend
people favorite book is just in case you're using
the author's name as a password, but like the
latest book you read. Excluding business books.
You can include business books as well. That's
completely fine. Yeah, I'm actually reading about
20 books at the same time at the moment on different
subjects. Some of them, you know, that I've already
read some of them new. Yes. And I can I can tell
you. So there are obviously a lot of business
books. But there's also a book on Leonardo da
Vinci, which is his legacy, and encompasses all
of his discoveries in optics, in flying, in water,
in weapon making. Very, very interesting for
an innovator to actually read that. I'm revisiting
the innovators as well, like Walter Isaacson.
And a few others on business and marketing. You
know, when times are really, really small on
the personal level, but when things get really,
really rough, what's the one thing that pops
in the back of your mind? You know, that great
message, that one that says, I got this, so I
can still do this or, you know, screw you, I'm
still going to go ahead with this because I'm
incredibly stubborn. Like, what's the one thing
that pops in your mind? I think it's a support
network that we have, you know, the family, the
friends, all the people around you who encourage
you. I think, you know, if people didn't believe
in you, I think it would be really tough. But
in our case, and everybody thinks that this is
brilliant, what we've done is brilliant. And
I think when the times get tough, you know, you
have to remind yourself that you should be proud
about what we've done, about the mission. And
this is going to be, the solution can really
transform the world. So, you know, it's really
worth Um, the, uh, the efforts and, uh, and all
the drive, um, you know, we, we also driven by
the people pushing us. Yeah. And I would perhaps
just add that, you know, there's nothing unusual
about that. So I think, um, rising the journey
that you're on rather than the moment in time
or the content of the moment. Um, and, and not
losing sight of your journey, your trajectory,
the path, you know, both with the business with,
with. you know, whatever it is that you're working
on technologically, commercially, um, but also
your life journey and the things that you really
deep down care about, you know, your own personal
sort of values and frameworks for life. Um, you
know, not losing sight of that, uh, I think really
helps and sort of anchoring on that, you know,
and, and a lot of these experiences, the highs,
the lows, particularly the lows, when things
get tough, like you say, um, you know, it's,
it's not unusual. If you, if you jumped in that
deep lake, you know, there's going to be highs
and lows, you know, so a lot of these experiences,
so recognizing that and just saying, you know,
you know, yeah, I shouldn't be surprised that
things are tough. I've got to keep pushing through
persistence, you know, persistence, belief in
what you're doing and don't give up. So in terms
of state sponsored attacks, how would Mainzina
help? So what we've heard at the many governments,
the UK, the US, France, saying that nation states
have actually sponsored criminals to get into
critical infrastructure systems, including water,
energy, and waste, and all sorts of societal
critical sectors, and maintaining persistent
access, so unauthorized persistent access. My
scene now, if you change all the locks within
the systems of the critical infrastructure, you
would be able to kick away all of those malicious
actors straight away because they don't have
the keys anymore. And because no one else, no
one knows the keys. So they certainly wouldn't
have them. Interesting. So if you belong to some
type of government, just be on the lookout. Definitely
a very good solution because I think that's a
big problem. I spoke with a lot of people very
much into AI and they told me that their biggest
risk and then they keep them up at night is the
fact that you can have state sponsor attacks
on a lot of things. So by having your solution
implemented, you won't have that risk anymore,
which is pretty good. People can sleep. Actually,
regarding AI, because of the information that
they use, that they harvest, the trove of information
that's sitting on to train the AI models, the
LLMs, you would really push for more security
on who has access to those AIs. And at the moment,
I'm sorry, it's the employees who actually make
the... make the keys to access all of those data,
which makes it pretty scary for the rest of us.
A lot of people are actually using the copilots
and other AI, putting company information thinking
that they're safe, but they're not. 95 % of breaches
are logins. Anybody who's sitting on any sensitive
information, critical infrastructure, healthcare,
banking, AI, should definitely make sure that
they control the locks and keys. If people want
to reach out to you, how can they do so? Well,
they can send us an email, I suppose. And we'll
pick it up. So if it's a business related, would
it be contact at mysina .co. Mysina I -C -E -N
-A. Thank you. Wonderful. Thank you so much for
your time. I really appreciate it. It's been
a pleasure having you here. Thank you so much,
Ricardo. Thanks very much. All right. This podcast
is also sponsored by startupnetworks .co .uk.
Startup Networks, it's an online forum where
you can find all the resources you need to run
your startup. From grants to investors to tips
and tricks on how to be successful in your startup.
This podcast is sponsored by openexperts .com.
OpenExperts is the place to go if you're looking
to talk with top experts from around the world.
That is open -experts .com.