Security Sandbox 12.21.22
Ep 21 | 12.21.22

Honest Security - Discussing the Learnings, Mistakes and Inspiration that Inspired Relativity's Security Program

Transcript

Amanda Fennell: Thanks for tuning in. If you enjoy today's episode, please rate and review us wherever you get your podcasts.

Amanda Fennell: Welcome to "Security Sandbox." I'm Amanda Fennell, chief security officer and chief information officer at Relativity, where we help the legal and compliance world solve complex data problems securely. And that takes a lot of creativity. One of the best things about a sandbox is you can explore and try anything. When good tech meets well-trained, empowered employees, your business is more secure. This season, we're exploring ways to elevate the strongest link in your security chain, people, through a creative use of technology, process and training. Grab your shovel, and let's dig in. 

Amanda Fennell: In today's episode, our sandbox goes back to where it all started and where it will end, for an honest conversation on how we built the security program at Relativity, what went right, the mistakes we made, and maybe most importantly, the lessons we learned along the way. Joining me for this talk are two long-time friends and colleagues, Relativity's senior director of engineering, Matt Spurr, and cybersecurity architect and recurring guest, Darian Lewis. So put on your closing time tunes, and let's dive in. 

Amanda Fennell: Before we start, I wanted to take a moment and mention that after 20 episodes and two seasons, it's bittersweet to announce that this will be our last "Security Sandbox" podcast. These past two years have given us the opportunity to take a different look at what makes up a good security program, whether that's passions outside of work or the people at work that keep things moving. And I'm so happy that I've had a platform to speak with many great guests, industry colleagues and Relativians on the importance of building a holistic security program that puts your people at the center of everything. To that point, today's episode features two people who've been at the center of Relativity security and Calder7 since Day 1, Matt and Darian. Gentlemen, welcome. 

Matt Spurr: Hello. 

Darian Lewis: Thank you. 

Amanda Fennell: Hello. Hello. All right. So I think this is the - this great format of an episode where you have no idea what I'm about to ask you. You both just showed up, just like you did, probably, for the first day that we had to work together. You just show up. We had no idea - know what to expect. So that's what we're going to start with. What was Day 1 like for us when we got together? So I'll start with Matt. You and I started working together, and it was not smooth sailing. So from the beginning, what were your reservations? What were you most concerned about that we had to focus on? What were you thinking? Tell me all about it. OK, so Amanda's crazy. 

Matt Spurr: Yeah. So Day 1, I guess, was technically when I interviewed you. 

Amanda Fennell: Yep. 

Matt Spurr: I don't know if we should cover interviews or not, but you could probably learn a few things from how to control an interview from Amanda, from a time period point of view. But we don't have to go there. Probably Day 1 was I got a phone call from you a couple of weeks before you started, basically laying out a plan for we're going to do all of these things from threat intelligence to building a cyber program to ramping up compliance and building - and putting a brand around it. And coming from a world that I think I was sleeping under my desk for the past couple of weeks trying to get a SOC 2 program built, was a little scared. And then I... 

Amanda Fennell: And you... 

Matt Spurr: ...Think we argued about... 

Amanda Fennell: ...Were taking off time. You were taking vacations, like right then, you were like, I'm trying to go out on vacation. 

Matt Spurr: Oh, yeah. I was on, like, a month of PTO in Denver. And I kept getting calls from you, so I think I knew what was in store from that right then. 

Amanda Fennell: Oh, it was - it's hubris, right? I was so sure I had so many great ideas that we should just, like, hit the ground running. And then I got in and then realized how slow everything can move when you don't know the context. Like, I did not know Relativity contexts. And so... 

Matt Spurr: Yeah. 

Amanda Fennell: Yeah, pretty different. 

Matt Spurr: And I think I was trying to figure out when I was going to pick my fight on my opinions about the term cyber. 

Amanda Fennell: Oh, my God. This is a perfect intro for Darian, who was, like, the person who founded our cyber here. So Matt, before you go into what you think cyber is, let's ask Darian first. Darian, you started - what was your first day at Relativity like? And then you two go at it about what cyber means. 

Darian Lewis: Well, I'd like to go back to the interview where I was tortured by Matt Spurr. 

Amanda Fennell: You were. It's true. 

Darian Lewis: It was unnecessarily lengthy and detailed for an interview. It was kind of abusive. 

Amanda Fennell: Oh, you know why? This is what happens when you say you're bringing in your techie. That's... 

Darian Lewis: Oh, I see. 

Amanda Fennell: ...What happens. That other people inside there think they're going to rake over the coals. Whoever the techie is, they think, oh, you think this person's technical? So Matt was like, cracks knuckles, was ready for it, but... 

Darian Lewis: I took a beat down from Matt, and Jerry didn't help because he just kept piling on. And I'm like, well, OK, Double-teamed in a meeting. That's great. But first day wasn't... 

Matt Spurr: I think... 

Darian Lewis: ...Too bad. 

Matt Spurr: ...For HR purposes, though, I got to clarify, it was not an abusive interview, it was... 

(LAUGHTER) 

Matt Spurr: ...A standard list of questions... 

Darian Lewis: OK, fine... 

Matt Spurr: ...And... 

Darian Lewis: ...Fine, fine, fine. You view it how you want to view it. It was OK. The first day was strange for me because I had gotten a call a few days prior telling me that we needed to spend a couple million dollars on a sim and... 

Amanda Fennell: Oh, we - no, we're not going into mistakes yet. Pull back. Pull back. 

Darian Lewis: OK. OK. But yeah, that was kind of my first day. It was like trial by fire. So it was a good first day. 

Amanda Fennell: And so, Matt, what were your reservations about the term cyber and did it end up living up to your expectations of being the mistake? 

Matt Spurr: I think my reservations - and I still probably hold them a little bit - is the term is a little overly broad in an industry that is needing specifics and is such a cross-disciplinary, cross-functional group that cyber is such a generalist umbrella that I - in hindsight, I think it's an OK term to communicate industry-wide and to non-security professionals, but inside of the security sphere, I think it lacks specificity that is very needed. 

Darian Lewis: You mean like AI? 

Matt Spurr: Yeah, kind of like AI. Great example. 

Amanda Fennell: Great example. What was - what would you have called that team instead? 

Matt Spurr: I think... 

Amanda Fennell: Cyber? 

Matt Spurr: I think early on, I petitioned for corporate security or, like, infrastructure security... 

Amanda Fennell: Yeah. You did. 

Matt Spurr: ...I think is what I campaigned for. 

Amanda Fennell: Yeah, that was vetoed. That's right. You did. 

Matt Spurr: Yeah. 

Amanda Fennell: That's valid. No, we did. I think that - actually, I don't know - I think my problem that you had with it, like, the reason we had friction about it is because you thought it was very showboaty and, like, that it was like we were trying to make something bigger and better than it really was or something. But from my background in government and financial, cyber is like just what you call it, and it was normalized. 

Matt Spurr: Well, I think that's the other fundamental view. I have a bit of an opinion that security is from two different fundamental camps. There's the government camp and then there's the, like, hacker camp or the more offensive camp. And cyber relates more to the government approach, where I think... 

Amanda Fennell: Yeah. 

Matt Spurr: ...I was more from a traditional, like, pen tester app sec approach. So... 

Amanda Fennell: Yeah... 

Matt Spurr: ...The two... 

Amanda Fennell: ...That actually makes sense. 

Matt Spurr: ...Sides don't always see eye to eye. 

Amanda Fennell: What do you think - and I'll ask both of you, so Darian, this is coming to you next - but what do you think whenever we really rolled up sleeves, started to do the work, what was your No. 1 goal that you were like, we have to nail this and figure this out or we're not going to make it? 

Matt Spurr: I think for me, cloud security was probably No. 1 coming from the product view. RelOne was just coming out. We really needed to nail all the postures around, like, if we're going to house such sensitive legal documents for our customers, we need to make sure that we nail the environment that it's going into. And the other one was you came in with an approach to scaling out the team, so it was making sure we had a good team and a team of really skilled professionals. 

Amanda Fennell: Darian, what was your No. 1 goal when you started? Don't get breached, right? 

Darian Lewis: No, it was actually moving left. I was really concerned that when we first started, there wasn't much in the way of predictive analysis of what's out there or where it's coming from. It was much more reactive and that was very concerning to me from the onset. And so we tried to bring, you know, kind of an intelligence basis to what we were doing to try and get left of center as far as possible. And I think we, you know, we still fight that battle every day and we will for the end of time. But yeah, that was kind of my big push was to go as far left as possible. 

Amanda Fennell: And looking at it - since you're already speaking, we'll go for this - what was the biggest mistake we made? 

Darian Lewis: I think the biggest mistake we made was our choice of sim. We didn't fully understand what our volumes were like. And I don't think we could have gotten any better at the guessing that we did. But at the end of the day, you know, it's price by volume. And so it was a good-enough solution at the time, and it worked for a, you know, worked for a good time. But then after a couple of years, it just became so cost prohibitive. And, you know, in retrospect, if I'd been able to forecast the amounts of log data properly, I think we would probably have made a different choice from the onset. 

Amanda Fennell: Yeah, I think - and I'm sure Matt has an opinion on this, as well, but I think that that was the hardship is that what do you do - what we want for good security is a lot of detection, a lot of monitoring, a lot of ability to know what's going on out there and visibility. And so accruing all of that is great. But over time, it grew so much that you then do the one thing you don't want to do in security, which is go and cull the logs down. And you want to start taking things out. And obviously, debugging is great, but there's a lot of stuff that you start to make those hard choices about well, do we really need that audit log or not, et cetera, because it's expensive. We have an obligation to keep everything encrypted at rest and in-transit and so on, and storage has to be really quick with our SLAs and stuff. So yeah, it was... 

Darian Lewis: There is... 

Amanda Fennell: I would say that was a big one. 

Darian Lewis: ...One more statement I want to make here. And this goes back to Matt's discussion of cyber a minute ago. And so I think there are two things that are working in tandem. And one is, you know, everyone got on the cyber bandwagon and put the word cyber in front of everything so they could charge 10 times the amount of what it's really worth and what it cost the day before it was named cyber whatever. But I will also say that sim vendors and other security vendors in particular are very much still in the market of put everything into your sim. And that's their advice to people - right? - knowing that it's going to balloon like this and become an untenable proposition. All right. Sorry, Matt. Go ahead. 

Matt Spurr: I'm going to go a little bit rosy for a second, where... 

Amanda Fennell: We made no mistakes. 

Darian Lewis: (Laughter). 

Matt Spurr: There's so many - like, hindsight, reviewing decisions is an easy place to be. Sometimes I like to think about what are mistakes that in the moment, given the information, may or may not have been wrong. It's too easy to say now, looking back when you have all the information what may or may not have been right. But in my opinion, one of the things that I didn't give enough credit to early on in building our program was the long-term impacts and repercussions of decisions. So, for example, we came out and built all of these controls, processes, scaled out the team, and our world was focused on how do we build the absolute best security program? 

Matt Spurr: Sometimes I don't think we culturally gave enough credit to how do we build the best business in Relativity and help security support that business? A specific example, I guess, for people would be as we scaled out our software development lifecycle, we were talking about how do we make sure that everything we go to - that we release is as secure as possible and roll it out super quickly so we can give all this great value? And we made a decision to roll with a very manual process where stopping, thinking, not saying, hey, a team of four has to review every single change that a team of 500 has to make. If you stop and think about that, it's never going to scale. So giving more thought to long-term scalability was something that I think we didn't give enough credit to early on. 

Amanda Fennell: Yeah, I think - so I think those are both interesting points. I agree with both of them. I would add on, if I was going to pile on - because don't worry, we're going to go rosy in a moment. But I will say that I look back and think that we over-specialized at times, and we created, like, pillars and sub teams and things like that because it was so successful for cloud. So I remember when you came to me and it was, like, this moment in what is it, like, "It's Always Sunny In Philadelphia?" The guy who's like Yoni, the crazy guy who always has crazy ideas kind of thing. And I remember you coming in and, like, whiteboarding and explaining why we needed cloud security team and how it was going to be built around this guy named Yoni that we thought was great. And, you know, that - like, all these different things you had in mind that were coming in. And so this was an awesome dynamic. 

Amanda Fennell: And at the time, I was like, yeah, that sounds like obviously, we should do that, so let's go for it. And I think that was the part that - going back to our earlier conversation, like, it's the hard part is we had to learn how to trust each other because Darian and I had worked together a couple of places and I brought him in. He was my guy. But with you and I, we had to learn to trust each other. And I do know that sometimes my words don't keep pace with my thoughts. Like, I'll say something, but it also, like, doesn't articulate it as well as I want it to on a technical level. And I know that would frustrate you. So, like, we had to learn to trust each other, that I wasn't, like, full of hot air, that I definitely was trying to execute something really great, and I needed you for it. 

Amanda Fennell: But on the other side of it, you had these great ideas like the cloud security team. So we did this, we went with it, it was perfect, and we needed everything that was coming from that team. So then we started making these other teams and we were like, well, let's specialize in this and this and that and make a team for it and do the same thing. And we couldn't reproduce the success that we had. And I think it's probably because the core value was cloud. It was where we needed to put so much of our effort. So I don't know if you feel the same way about that one, Matt. 

Matt Spurr: I would agree, but I might pivot it a bit. I think specialization of talent is fine. I would add on almost the intersection of your and Darian's point, I think we hired specialists and assumed these expensive tools would allow them to scale and build a great program. And in the end, tools are great facilitators for security professionals, but they're not the end all, be all like a lot of their sales pitches determine. You need a lot of smart people really applying great thought, and to do that, you have to be a great fundamentalist, not just a specialist. 

Darian Lewis: Yeah, don't disagree with that assessment at all. I think one of our big failings was not jumping on the automation bandwagon about a year earlier than we did just because, you know, you get all these great tools, and everything is working, and that's fantastic and to Matt's point, we just don't think about how this is going to scale over time. And you just cannot throw an infinite number of people at a security problem. Doesn't work. And over time, everyone starts getting in each other's way. You have these little specialized groups of people that refuse to do the general stuff, or they don't fully understand what context their little world has in the bigger scheme of things, particularly in the business realm, right? 

Darian Lewis: And so we're continually looking at, how does security actually add value to Relativity and to its customers, and what can we do to demonstrate that to them? And I think that gets lost sometimes in security. And it's unfortunate, because we're there to support business, not to, you know, slow it down and stop it. But automation, I think it had been something had we done it a year earlier, we would be much further along than we are. 

Matt Spurr: So, Darian, does that mean you've come closer to my prescription that security engineers need to be able to program? 

Darian Lewis: Yeah. And I don't disagree with that a bit, either. I think every single person in security needs to know at least one scripting language, and they probably should also know one compiled language just to be able to understand what their counterpart in engineering or writing and what that means to them. I mean, you can't even go through the OWASP Top Ten without running across some bugs in coding. So without that skill set, there's no possible way we can do the job that we're supposed to do. 

Amanda Fennell: Well, then, by nature, Matt, have you come a little bit closer to appreciating cyber? 

Matt Spurr: Yeah, I still don't like the word, but the actual, like, fundamental... 

Amanda Fennell: The team? 

Matt Spurr: ...Practices of it? Absolutely. I think in the end, detection, monitoring, figuring out what is and isn't vulnerable and managing those mitigations is the absolute core of what we do. 

Darian Lewis: It took me 10 years to get used to the word cyber and it still upsets me at times, but not as much as AI does. 

Amanda Fennell: Oh, I know, I know. We know. There's a - so I guess - to get a little nostalgic then, and I think the nostalgia for me is that, you know, this episode is our last episode. It's about how we started. It's about some of the mistakes we made. It's about some of the great things that, you know, we also came across and we experienced. I've been privileged and honored to, like, get to become friends with people that I was in the trenches with here. So, Darian, I had become friends with you, but I definitely would say the last five years, we've become a lot closer. And Matt, I didn't even know you existed until that day at the interview, so that was great. 

Matt Spurr: Yeah, me, either. 

Amanda Fennell: And over the years - yeah, didn't know you Existed? (Laughter). 

Matt Spurr: I didn't know you existed. But... 

Amanda Fennell: But this... 

Matt Spurr: ...What is existence of self? That's probably a whole different podcast. 

Amanda Fennell: That's very Nietzsche. Yeah, we're going to go into that one. But - so I think there's - I look back and I remember that experience in the beginning, just thinking I was so happy to be surrounded by so many other people who I knew were so smart, that I knew I was going to learn something from. So it's been this great experience, and I look back and I think there's some undefinable parts. We know that we did something great here. We know that we created something that was really award-winning and all of those different things that we were looking for and checked all the boxes for this great team that had fun while they were doing it. And so I think that's all wonderful. 

Amanda Fennell: But looking back, what is it? I think it's like a Macklemore song or something that's like, I wish I had known - no, it's "The Office." He says, I wish someone had told me that it was the good old days when I was in them. So I think it's a moment of looking back. When did you realize that this was, like, a special team and this - what we were doing was something unique? Was there a moment that hit you that you're like, this is awesome, and I'm really excited about what we're doing here. Mine was probably, by the way, in Poland, like, on one of our trips to Poland. 

Matt Spurr: I probably have two answers for this. One, I'm going to be a little selfish and say it probably predates you. And... 

Amanda Fennell: There was security before - no, I'm just kidding. Of course. There was. 

Matt Spurr: It was during the program to launch our ISO compliance. And we had a group of people, some of which you mentioned, some are still on the team today. And Conrad and Hector and Prachi and Jessica. And that group - I remember I was a semi-manager but mostly an architect, and it came down to the point of we had a - I think a three-week crunch in order. And I think we still had, like, 15 controls to design and document and get going. And I asked the team, I'm like, hey, you all have lives. You all have commitments. But I think it'd mean a lot to me and this business if we could, like, come together and get this done. And I remember Conrad started Day 1. He's never programed. He was brand-new to the industry. And I'm like, hey, I need these - I think it was like 45 signatures written in the next two weeks. I'm going to sit here and get you all the logs and all the program to write it. 

Matt Spurr: And a team of, like, seven of us just worked and hung out all day, all night to get this done. It was really, really cool to - everybody to - didn't complain, had a lot of fun doing it. And, like, that was really, really special. And then that culture came in. I think you amplified it. You, like, demonstrated a lot, I think, how to lead people-first culture first to me in a way that I hadn't seen before. And probably that Poland trip was there, but I think it was the - honestly, the first time we took a team picture in front of the Calder statue. 

Amanda Fennell: Your face was so grumpy in that picture. 

Matt Spurr: It - that's just what I do. But seeing how big the team got, how we've scaled, how I looked at every single person on the team, and I'm like, all of these people are greatly skilled at they're - like, I want to be in it with every one of these people was really, really cool. And then you made me go to an escape room, which was... 

Amanda Fennell: I did. 

Matt Spurr: ...Less fun, but... 

Amanda Fennell: You hated that. 

Matt Spurr: ...That... 

Amanda Fennell: That's correct. 

Matt Spurr: ...Picture was fun. 

Amanda Fennell: Yeah, I remember that. And I still look at that particular picture and remember, like, what it was like to look at everyone and be like, yeah, everyone on here deserves to be here. And it was an honor with that. So I totally get it. 

Darian Lewis: I was... 

Amanda Fennell: Darian... 

Darian Lewis: ...Totally cheated out of that escape room... 

Amanda Fennell: You were. 

Darian Lewis: ...By Matt's group. 

Matt Spurr: We did win. 

Amanda Fennell: It was fraught. Wait. Matt, you and I were together in that escape room, actually, which... 

Matt Spurr: Yeah. 

Amanda Fennell: ...Everyone thought was, like, a setup, because we always had such conflicting views about everything. And then we - of course, the two conflicting views were going to be the ones that won, like, because we both came at everything from very different perspectives. So... 

Darian Lewis: Totally robbed. 

Amanda Fennell: I know. All right. Darian, what was your moment that you realized something special? 

Darian Lewis: You know, it's interesting 'cause I had one and then I realized that I keep having that same moment over and over again. And I - you'll understand when I tell you. So the first time that I had that realization was with that little incident of a pen tester leaving some crap around. And it didn't trigger until a year later. 

Amanda Fennell: Can we not use the word incident (laughter)? 

Darian Lewis: Sorry, we can. Oh, I'm so sorry 

Amanda Fennell: The adverse event, but yeah. 

Darian Lewis: Yeah. Yes. We had an adverse event that... 

Amanda Fennell: (Laughter). 

Darian Lewis: It triggered a year after a pen tester had left. They just didn't clean up after themselves. And it required six, seven different departments to come together and sit in a room. And that was the first time that I realized that security wasn't viewed by other departments as kind of a joke or a pain in the butt to be avoided, but actually as somebody who could help them. And I got to look at those faces and answer questions and ask some of my own and go through and figure out where the - you know, where the information was coming from and how we got to it. And it just felt like I was part of a cohesive team in the room, right? So I'm part of this company. And we're not in this little box off to the side, but we're actually part of it. And so when I'm participating now cross-department with other departments, I still get that feeling. And it's really nice every time it happens, that you look across from somebody and they actually want to hear what you have to say, and they respect your opinion. And you respect theirs. And it's - I don't know. It's kind of why I do what I do. 

Amanda Fennell: It is a gravitas that, I think, that has been helpful, because I do see that whenever we're interacting with a lot of different departments that, like, we're not there to be, like, no, we're going to block you and because we said so. But it is actually like, well, wait a second. Let's understand why you're saying this wouldn't work and try to figure out how we can get around this or work with this correctly so we can do it securely. But I do like that. I don't know. I would say, like, looking back at a lot of these different moments, probably - it would sound cheesy to say, but the people who we had in the beginning and the people that we have today, those people who were the vets that were here before me and that joined soon after and things like that, I look at them. And I'm just still in awe that everybody's, like - we have such a low attrition rate on that team (laughter). Like, nobody's leaving. Everybody's staying. And everybody's there. And they're happy there. And I'm just - I think that's, like, my proud moment, is that people are still happy. And they're having fun with what they're doing or being challenged with new things. And I feel like that's probably, like, the thing that I find the most exciting that we've accomplished. 

Darian Lewis: You know, it's interesting that you would say that because some of my co-workers... 

Amanda Fennell: Because you're not happy? 

Darian Lewis: No, not at all. Some of my co-workers over the past couple of months, we've had this discussion of, how long do you stay at a job - right? - before you move on in this industry, before you start to actually degrade and - you know? And most of us have the exact same answer. The reason that we're there is because of the other people on the team. We've come to love and appreciate one another - what our strengths are, what our weaknesses are, where people have rough spots and where they don't. But we're just used to it. And we really enjoy working with each other. And I have not seen that kind of camaraderie or, you know, just spirit of being in any other group within relativity so far. Now, it may be that I don't have enough exposure. And, Matt, you can take it from here. 

Amanda Fennell: Matt's nodding. Matt, you're like, it's like that everywhere in Relativity, Darian. 

Matt Spurr: No, I - like, all companies are pockets, right? But, no, I - one of the reasons I came to this company and I'm still with this company is, the people here are special. There's something about either the hiring or the onboarding or the historical context that Andrew and the early crew laid down that remains. And it's very, very strong in security. But it's there in the engineering group that I'm in. I'm sure other groups in Relativity have it as well. It's, I think, what makes it such a great company that releases and solves cool problems. 

Amanda Fennell: It does. I think that's actually probably a good point we should mention, that while Darian is still on the Calder7 team, Matt, you moved on. So you got to a point a couple of years ago that you wanted to do your next thing. I think it was probably either that or kill me and take my role. So it was kind of like, you could do that or you could move on to your next thing. So you decided to go into a track to prepare for, like, a CTO route. You were like, love security, love engineering, so I'm going to try this engineering thing out. And you're happy with engineering. And you loved the CTO route, correct? 

Matt Spurr: (Laughter). 

Amanda Fennell: You have to say, yes. 

Matt Spurr: That's an interesting spot to put me on. 

Amanda Fennell: I know. 

Matt Spurr: Yeah... 

Amanda Fennell: But you miss us, right (laughter)? 

Matt Spurr: I do. So similar conversation that Darian had with his team around, like, when do your skills atrophy? When is it time to move on? I had a lot of conversations with different people in the security space that - they found a ton of success and happiness in their career bouncing back and forth between building product, releasing product for customers and securing product in company. And, personally, I find the most happiness in building and scaling in the 0-1 or kind of 1-10 moments. And what I know my skill sets don't lend themselves to is tuning and optimization. I drive people crazy when I'm in that moment. And so what I felt like was best for the team and best for Relativity was to explore an opportunity that can utilize the build and scale muscle a little bit more. So it was kind of the intersection of those two things. And then the third one is always luck and timing. And it just so happened I got lucky that you sent me on a trip to Australia to talk to customers, and I got to discuss some opportunities. 

Amanda Fennell: OK. Wait. Wait. Whoa. That was a rock, paper, scissors thing. That was not - we literally rock, paper, scissors-ed to see who got to do that trip. And I just lost. So... 

Matt Spurr: I'm better at rock, paper, scissors. So... 

Amanda Fennell: Apparently. 

Matt Spurr: ...That led to a career change. 

Amanda Fennell: Yes. That's awesome. 

Matt Spurr: I'll use that from now on. I got into engineering because I won a game of rock, paper, scissors. 

Amanda Fennell: You won at - you won the game, but - all right. Well, gentlemen, I think, you know, there's some takeaway I've got that I hope that we get from this episode that people will hear. But I think to start, you need to define what we're doing, what we're here for, what we're trying to accomplish and, probably most importantly, what you call it. Some people may not want to use certain terms, and you have to kind of reconcile that with each other, make sure that you all understand the same things and what you're saying. 

Matt Spurr: There we go. That's my biggest regret. 

Amanda Fennell: For us - that's the biggest regret is you didn't get to get cyber as the term, but - out of there? 

Matt Spurr: No, the name. 

Darian Lewis: Yeah, like event and incident. Some things just rub people the wrong way. What can you say? 

Amanda Fennell: They do. It's very important. I think that there's probably a huge focus that we had about getting as far left as - of the center as possible, and that's always been the way that we focused on it. But then this core value of us that we had this focus on cloud, that was a huge guiding principle, and I think that helped a lot. But overarching from everything that we've said today, the one thing I hope people will probably take away is that it is a culture situation. You have to find the people who are skilled and cultivate them and enjoy working with them. And it has been a joy, actually, working with both of you. And I think that that's been the biggest thing that I can look back at and say was my success was getting to work with people that I really enjoyed working with and having a lot of fun doing what we did. 

Amanda Fennell: All right. So before we go, I'm going to say a final thanks, obviously, to you two for joining this episode. It means a lot to me to, like, bookend this with both of you on here. Also, thanks to Relativity for giving me space to host a podcast. That was probably the craziest thing they ever asked for me. The CyberWire network put us up in the stars, if you will. Our producers, Nicholas and Kail (ph), have been awesome. Our guests, everyone that we've had involved in making the last two years of episodes has been pretty crazy, and I've loved it. 

Amanda Fennell: If you're not sick of me yet, I actually am going to do my own podcast, totally unrelated to security, but it is really forensically minded. But it's going to be called "The Real AF Podcast." It's all about like, forensics and digging into history. I'm going to totally pull both of you on this because we're going to basically take movies and dissect them to say if they were accurate or not, which feels like things that both of you would be enjoying. So stay tuned for any of the movement that we're going to do there. 

Amanda Fennell: But for now, I will probably do my usual for ending on a quote. And I'll say - this is actually one that you'll probably really enjoy, Matt, but it's from Coach Mike K, who always has these really great, you know, quotes about leadership and being on a team. And he said that everybody - people want to be on a team. They want to be a part of something bigger than themselves. And they want to be in a situation where they feel that what they're doing is something for the greater good. And I think that that's what this has been. I feel like all of us felt like we were doing something that was bigger than us. And we were responding to the request from Sieja, who said, build me a fortress. And we did it. And it's been an enjoyable time, but it was an honor to serve on this wall of a fortress with both of you. So thank you both for joining, both being here today, but being a part of Relativity. Thank you. 

Matt Spurr: Thanks, Amanda. Appreciate the leadership and investing in my career over the past - what is it? - four years now, five years? 

Amanda Fennell: Five. It's five years. 

Matt Spurr: Five whole years. It's been a ride and it's helped me a ton. 

Amanda Fennell: And thanks for losing rock, paper, scissors for you. 

Matt Spurr: Yeah. I'm not - I'm just better at that. I'm not going to say thank you for that one. 

Darian Lewis: Thanks for every bus you've ever thrown me under. All of them I've crawled out and been successful from. And so yeah. Trial by fire on Day 1, that was a joy. And it's still a pleasure even today to get those 10-, 11:00 at night calls. 

Amanda Fennell: I know. 

Darian Lewis: But it's been such a joy working with you. 

Amanda Fennell: It's normally like Signal messages, but yeah, that is true. 

Darian Lewis: Yeah. Signal, too. I mean, she lights up my phone every hour. It's great. 

Amanda Fennell: It's awesome. 

Darian Lewis: I - in all seriousness, I really have not stayed at this company as long as I have because of any other reason than it's Amanda. Like she said, we've worked together for years. I have the utmost of trust in her. And I will say that people work at companies, not because of the pay, not because of what they do, but because of who they get to work with. And the older you get, the more you realize that's the case. And so it has truly been a pleasure. And thank you for every day of it. 

Amanda Fennell: Thank you, Darian. Thanks, Matt. 

Amanda Fennell: Thanks for digging into these topics with us today. We hope you got some valuable insights from the episode. Please share your comments. Give us a rating. We'd love to hear from you.