From Cybersecurity to Cancer Care with Jim Foote

Jim Foote: Don't be afraid of failure and I hate the word "failure," but if you're not failing, you're not pushing the limits of your own abilities and the limits of technology. And if you're going to fail, fail forward.

David Moulton: Welcome to "Threat Vector." The Palo Alto Networks podcast where we discuss pressing cybersecurity threats, cyber resilience, and uncover insights into the latest industry trends. I'm your host, David Moulton, Director of Thought Leadership for Unit 42. [ Music ] In today's episode, I'm going to be talking with Jim Foote, the CEO of First Ascent Biomedical. Jim and I will discuss his current mission at First Ascent, and some of the inspiring work his company is leading using their MLAI platform to rapidly identify therapeutic solutions for cancer patients where the options for standard care have been exhausted. We'll also discuss how Jim's background in security informs his work in the medical field. Jim uses the lessons learned as a CISO from deploying and using cutting-edge technology to fighting cyber criminals and his fight against cancer, and reached out to see if he would be willing to share his story about the shift from CISO to CEO with the "Threat Vector" audience. I'll have a link to the IT Brew article in the show notes. [ Music ] Jim thanks for joining me on "Threat Vector."

Jim Foote: Oh, thank you for having me.

David Moulton: So, your transition from CISO to leading an organization using AI to fight cancer is quite dramatic. Talk to our audience about what drove you to make the shift.

Jim Foote: Yeah, you know, the reality is that we've all been affected by cancer in one way or another and most of us remember exactly where we were and what we were doing when we heard that word for the first time. And for me, it was October 19th, 10 in the morning when my phone rang and I heard those words at the other end of the phone, "cancer." And as much as I wanted them to be about me, they weren't, they were about my son Trey. Instantly I was thrust into that world of cancer, again, much like, you know, as a CISO when the phone rings and all of a sudden you find out you're under attack, and we went into attack mode. And we started trying to resolve this problem, and like every other patient we thought we were going to beat it. After 8 months of grueling chemotherapy, you know, the doctors came back and said, you know, your son's cancer has returned and then they asked me what I wanted to do next. And I was surprised because I'm not a doctor. I'm a CISO, and but I knew it was a solvable problem, and so I did the research, obviously I couldn't solve this problem in time to save my son, but I knew it was a solvable problem and that's really why we started the company.

David Moulton: And before I get into talking to you about that transition from CISO to CEO, I sat down and I'll say read your company's article that you had in April in "Nature" magazine. And the reason I say read is I might have had some-some assistance from a GPT to unpack it. It's a bit-a bit deep for a simple guy like me, but your article discusses the feasibility and clinical impact of what's called "functional precision medicine," so FPM in treating pediatric patients that have relapsed or have refractory cancers. So, can you talk to our audience a little bit about what functional precision medicine is and in simple terms and how that differs from traditional cancer treatments?

Jim Foote: Yeah, so what functional precision medicine basically means is, in treating a patient with cancer, all of the data and the treatment protocol is based on the individual; it's based on you. So, David let me give you an example of how cancer is treated today for the most part. It's called "the standard of care." And what it's really based on is if you look at you and I, you know, we're different ages, we're different nationalities, but if we got the same cancer we would be treated almost exactly the same. It's a recipe book; it's called "The Standard of Care." And it would vary a little bit based on our age and our weight, but-but the treatment plan would be almost exactly the same; the same drugs, the same regiment, the same. But look at us. We are completely different people; we're biologically different. We look different and we're biologically different. And what functional precision medicine does is it says, let's take and treat you based on you, your biology and create an individualized plan versus a plan based on a whole bunch of people that hopefully look like me.

David Moulton: So, I'm immediately drawn to this idea that in security we may have a playbook, but based on our threat intel, our environment that we're protecting where the most important data or asset for the business is we would shift that playbook and you might start with something that's a standard of care, but you optimize towards what you're trying to protect. But you're telling me that, for the most part, you go in and they go "How old are you? How much do you weigh?" And dial up and down a couple of variables rather than say, customize that playbook specifically for me," is that right?

Jim Foote: Yes. Yeah, that's correct. So, you know, again in cybersecurity we have run books, right? We have run books for every scenario.

David Moulton: Yeah.

Jim Foote: But it's just a generalized guideline. You have to be able to, you know, in incident response, you have to be able to pivot based on the threat. And cancer, again, they stick with the standard of care which is they don't generally deviate from the playbook. And then when, you know, what that results in in America in 2024, 1 in 3 cancer patients will still die. And-and again, while we can move the needle by altering the playbook over time with lots and lots and lots of people, there hasn't been really any, you know, quantum leap forward in the standard of care.

David Moulton: So, you've mentioned that you see a correlation between how cyber criminals and cancers behave, and you said that your experience as a cyber-defender informed your thinking in the fight against cancer. Can you talk a little bit more about that approach? I know you've touched on it, but I want to go a little deeper.

Jim Foote: When you think about the parallels, you know, you think about the characteristics of a cyber-attack or a cybercriminal, they want to evade detection. Often times they're within your network for weeks or months; you don't even know it, because they want to evade detection. They constantly evolve and want to traverse through your network and really make their ways to the crown jewels. And they'll take everything from you. When you contrast that to cancer, it's exactly the same way. It continually evolves, it wants to evade detection, and it will take everything from you at the-in the end.

David Moulton: In the study, it mentioned that you provided an actionable treatment option within a clinically relevant timeframe. Can you talk to the audience a little bit what that means for patients and their families, and how could this impact their experience with cancer treatment?

Jim Foote: Yeah, so we know statistically that for every day or for every 30 days you delay cancer treatment, you're mortality goes up by 10%. What clinically actionable means is that we can-we can take a biopsy, we can return results that will actually benefit the patient and we can do that in less than 10 days, and so that's what's considered a clinically actionable timeframe; to be able to alter that standard of care based on guidance that in information that our tool provides.

David Moulton: So, speed is always the ultimate feature in conversations in security. I think what I'm hearing is that speed is the ultimate feature in cancer care.

Jim Foote: Yes. Speed is, you know, the one thing that you can't get more of is time. And, you know, and what's interesting David is, you know, again having been on the patient's side and now having to deliver a technology like this into the industry, I understand both halves. You know, when you're a patient or you're a parent and all you can see is that clock ticking and all you can think about is that cancer rapidly dividing, rapidly growing, potentially metastasizing and circulating within the body, and you want to attack it with everything that you've got, you know, imagine being in the middle of a cyber-incident and having to wait 10 days for Palo Alto's team to deliver some forensics information or to deliver an EDR tool that would help them better contain the situation. That's the same mentality you have to have when you're fighting cancer. It's got to be that sense of urgency, but more importantly, that sense of urgency what if the clinical efficacy that will give you the precision that you need to ultimately fight this pho. [ Music ]

David Moulton: So Jim, you've got this extensive background in cybersecurity and that's influenced your approach to leading this AI-driven biotechnology company. Are there any particular principles or practices from your IT security days that you find particularly valuable in your current role as the CEO?

Jim Foote: A CISO is always looking for we're problem-solvers, you know, and if we do our jobs perfectly, nobody knows we exist. My goal here, is leading this company, is to assemble the right team to bring the right technology together and to be able to solve this problem of cancer in a way that's going to benefit every patient whose cancer has returned. A good CISO is never the smartest one in the room, but they bring the right people with the right skills and the right technology together to solve some of these complex problems, and that's really been my mindset, is to really, you know, bring the best in biology and the best in technology and the best in Artificial Intelligence and let's bring us altogether and solve this problem.

David Moulton: As you made your shift from leading security to leading a company, who did you lean on for support?

Jim Foote: You know, that's a great question. There is a number of areas, again, you know, you think about as a CISO, you, you know, you move into a new company; what do you have to do? You have to understand landscape quickly. You have to understand the weaknesses. You have to understand the strengths. And then you have to, you know, try to assemble a team and attack a problem. We've built an amazing board of advisors that are made up of medical doctors; insurance executives; serial entrepreneurs; people that have taken, you know, the head of our board of advisors actually took Cambridge technology partnership, again, another tech company and grew it to a multibillion dollar company before they exited. And so, when I entered this world I realized that I needed, again, to surround myself with experts. I've never started a cancer company before, but I needed experts in the medical industry, in the insurance industry, in pharmaceuticals, and in startups, because ultimately, you know, there are so many gatekeepers to bring in a technology like ours into the industry that I had to-I had to make sure that I saw every aspect and could anticipate any resistance that we would have in bringing something like this to market. You know, in the end, the biggest difference between what I did as a security officer and what I'm doing now is, is these decisions are literally life and death. If we make a mistake somebody could potentially not respond properly to their cancer treatment. You know, as a security officer, you know, ultimately the fate of companies, you know, are at hand and if you have physical security as part of your responsibility which we did at ADP, you know, yes you are protecting people's lives, but in my career as a security officer, nobody died. And that's I think the biggest difference here is, you have to understand you're literally working with people's lives; these are moms and dads and husbands and children and, you know, we never want to lose sight. It's more than just a, you know, a clump of cells that sit in a Petri dish that we're testing drugs on.

David Moulton: Jim, you've mentioned what sounds like an incredible lineup on your board of advisors. Those are the folks that can mentor and advise you, and I'm curious, how their advice has shaped your approach to leadership in this new field?

Jim Foote: They've really given me, you know, perspectives from their individual lenses that they look through so that, you know, again, it's all about information, distilling it quickly so that you can make good decisions that will absolutely change or shape the direction of the company. And so, by having that, you know, that diverse board from multiple aspects of industry, they really have helped me, you know, shape and guide the strategy of how we can accelerate the company and how we can do it appropriately. You know, one of the things that is a deterrent, believe it or not, and it's actually a deterrent in cybersecurity, is there are all kinds of companies out there that make false claims. You know, I mean how many companies out there that say, you know, if you buy this widget you'll never have a cyber-breech. You know, and then and, again, Palo Alto fights that every day, right? There is no evidence to support those claims, but there's lots of noise in that channel, and it's the same thing with, you know, cancer treatment and this is where it does actually a pretty big disservice, is there's lots of companies out there that are saying, you know, we've got the cure for cancer or, you know; there was one story and, again, this is the stuff that breaks my heart, you know, an osteosarcoma patient worksheet buying mangosteeen juice at a 100 dollars a bottle and he was drinking a bottle a day, because somebody said it's full of antioxidants, it's magical juice from the rain forest and it will cure your cancer. And he was spending that money and he ultimately died from cancer.

David Moulton: Yeah.

Jim Foote: And so, you know, what our board of advisors has really helped guide us in, is to how to separate ourselves from that noise, you know, and again, that's why it was produce the evidence, get published in a top tier journal, and then ultimately that's where, you know, you rise above the noise because now you have the evidence and it's independently validated and it's published by a top tier journal and that's, you know, again, that's how you separate yourself from the noise and fortunately that, you know, again, that's part of the guidance that this advisory team that we've got has really helped us, you know, take these steps so that we don't-that we don't get too far out in front of ourselves and to really do things in a sequenced way to help us always stay, you know, above the noise; if that makes sense.

David Moulton: It does. I think having that a level of passion and focus on what you're doing drives you and then.

Jim Foote: Right.

David Moulton: You want to go out and tell the world about it, but it is helpful to pause and to come back and say, "Are we sure?" "Did we validate?" And, can we get somebody else to come in and take a look at the work we've done and make sure that our bias or excitement is worth being excited about? And if it is, then that amplifies you and accelerates you rather than becoming the, you know, the juice fraudster that's out there.

Jim Foote: That's right.

David Moulton: Maybe believing.

Jim Foote: Selling snake oil.

David Moulton: Yeah, believing that it's useful, but in reality it isn't or fraudulently selling it, you know, because you're coldhearted-coldhearted individual. What advice would you give to IT leaders that are considering a similar shift? You know, maybe they want to move to a different industry or into a leadership role; how should they approach that and navigate it?

Jim Foote: You know, one of the things and, again, you know David you talked-you touched a little bit on it; mentorship is incredibly important in every walk of our life. We need to be giving back as mentors, but we also have to surround ourselves with really good mentors. I would, you know, the advice that I would give any-any IT professional, any security professional, any-anybody out there, is don't let anybody tell you there is something you can't do. Solving problems is solving problems and it doesn't matter if, you know; I have a Ph.D. in microbiology, which I do not, but it's about, you know, surrounding yourself with the right team and solving problems. And then I think the third piece of advice that I would give everybody is, every time you step up to the plate, swing for the fences. You may not always hit a homerun, but you should expect to hit a homerun every time you step up to the plate. And, you know, quite frankly, that's how I got my board of advisors. You know, I had an opportunity to meet Bill Seibel who is a serial entrepreneur, an author, again, Group Cambridge Technology partnership and when I saw that I had an opportunity to meet with him, I swung for the fences. And fortunately for me, you know, he was passionate about what we're doing and, you know, and opened up every aspect of his experience to help us along. And I think the third thing that or the fourth thing that I would-that I would share is, don't be afraid of failure. And I hate the word "failure," but it's if you're, you know, if you are not failing, you're not pushing the limits of your own abilities in the limits of technology. So, you-if you're going to fail, fail forward. You know, again, it's like an incidence response process; there's always a retrospective, right?

David Moulton: Right.

Jim Foote: And it's the same thing, it's you know if you try something and it didn't work, do the retrospective and comeback and do it again differently. Learn from that and push the limits of your technology and your own abilities to advance these companies and you can do amazing things and you can do anything that you want to do. [ Music ]

David Moulton: Jim, your company uses AI to match patients with effective treatments and broadly, AI's playing a bigger and bigger role in so many industries. As a CEO and former CISO, I'm curious how you see the role of cybersecurity evolving in the AI era?

Jim Foote: Yes, I mean it, you know, again, AI is-it isn't the panacea, but it is the ability to examine massive amounts of information quickly.

David Moulton: Right.

Jim Foote: And correlate it in a way and present it back to a human that ultimately can help us make better decisions faster, you know? You know, you mentioned, you know, taking the "Nature" medicine article and running it through ChatGPT and you had a confidence factor, right? You know, AI will allow us to, you know, examine petabytes of information quickly, and do that correlation, but ultimately, you know, it's the person behind that data that ultimately has to make the decision and sometimes that decision is based on data. I mean, you know, when I look at how I made some of my decisions on as a CISO, they were either based on data, based on, you know, prior precedence, or based on, and this is my least favorable one, but my gut tells me this is where we got to go, right?

David Moulton: Yep.

Jim Foote: And so, I think data-I think AI will help transform all industries including the medical industry, because it helps us synthesize mass amounts of data that helps support, you know, better decision-making faster.

David Moulton: That's really encouraging Jim. So, let's go ahead and wrap up here; what's the most important thing somebody should remember from this conversation?

Jim Foote: You know, a couple of things; one, you know, my hope is to better inform people about cancer and how cancer is being treated, because until you enter into that world, you really don't realize that this industry is the industry that's the next one ready for digital transformation, but we have to do it safely and we have to do it with evidence. So, I would say the, you know, be informed because your doctor is just a human just like you and I, and so, you know, play an active role in your health care working collaboratively with your doctor. I would say to an IT or security professional, problem-solving is problem-solving. We all solve complex problems. Don't limit-don't limit the, you know, your view of solving a complex problem even something like cancer, because you don't feel like you have the experience or the background. You may not, but you know how to solve problems and surround yourself with good people who compliment you and can help you solve problems. And I think the third is, is don't limit yourself based on fear. Every time you step up to the plate, swing for the fences, you're capable of doing anything that you put your mind to. I mean, I look at myself and I'm like, you know, 15 years ago I didn't know anything about cancer and now I'm, you know, leading a company fortunately that is full of experts that know a lot about cancer. So, you know, I kind of say I'm the poster child for "You can do anything" if, you know, if, you know, an old CISO like me could help, you know, bring this next generation of cancer treatment into the industry that's ready for disruption, anybody is capable of doing anything. And I think the last thing is, continuously learn, continuously learn. You've got to continue to put-push the limits of technology and the limits of your own abilities and the only way you can do both is be a constant student.

David Moulton: Jim, really well put. Thank you so much for coming on "Threat Vector" today, and talking to us about your journey and the work that you're leading. I really-I've learned quite a bit and I think it's a really interesting jump from security to secure AR to CEO that you've made and are making an incredible impact.

Jim Foote: Well, thank you. I appreciate it and, you know, hopefully it's, you know, it's inspired that next generation. [ Music ]

David Moulton: I found Jim's transition from CISO to CEO of a biotech company particularly compelling, because it illustrates the profound impact personal experiences can have on our professional paths. His shift was sparked by a very personal crisis, his son's cancer diagnosis which drove him to seek out and implement more effective cancer treatments using AI. This move, underscores the potential for personal motivations to catalyze significant career changes and innovations. And it highlights how skills from one field like cybersecurity can be transferrable and highly effective in other fields. By applying his background in security to the medical field, Jim's story reminds me of the lessons learned in David Epstein's book "Range." In the book Epstein makes the case for generalism, a broad competence in many areas rather than an extreme master in one. Jim's career started in technology and IT, dove deep into security and then pivoted to a role as a biotech CEO with First Ascent. Just as Epstein argues that diverse experiences contribute to innovation and problem-solving, Jim's career pivot illustrates how cross-disciplinary approaches can lead to groundbreaking advances in fields as critical as cancer research and treatment. That's it for "Threat Vector" this week. I want to thank our executive producer, Michael Heller, our content and production teams, which includes Sheila Droski, Tanya Wilkins, and Danny Milrad. I edit the show, and Elliott Peltzman mixes the audio. We'll be back in two weeks. Until then, stay secure, stay vigilant. Goodbye for now. [ Music ]