Susie Jones On Building Your Cyber Fitness

Tommy: The Daily Talk Show.

Josh: It's The Daily Talk Show, episode 626.

Tommy: We've got Susie Jones in the studio. Welcome, welcome, Susie. Kindly connected through Jodie Imam. Yes, Imam. Imam. Got it right.

Josh: Or did you? You said Imam.

Tommy: Imam. I was waiting to be corrected. When we were chatting with Jodie, something sort of got my attention, which was somebody she'd been working with, which was yourself in the cybersecurity space.

Susie: Yeah.

Tommy: And if I've seen movies, I know cybersecurity or I don't.

Josh: I read a book by Kevin Mitnick on social engineering, so I'm sort of a low-level non-tech hacker.

Susie: So I think just danger enough, just knowledgeable enough to be dangerous.

Tommy: We actually, I actually hacked once. There was a programme back in the day that you could send somebody a zip file and then you can get in. I printed something on their computer. It was all for fun though. But I mean, what you deal with your business, Cintus Security.

Josh: I'm so sorry.

Tommy: Greater risk than me when I was 14 to businesses. Tell us a little bit about what your business is.

Susie: Yeah, so Cintus Security, we're all about what we call cyber fitness for small business. So making security not just about protecting the tech in your business, but also creating it to be a way to differentiate yourself from your competitors and build resilience, build strength. And make sure that not only will you not get successfully attacked, but you can also then get a ticket to the bigger game with bigger clients and all the rest.

Tommy: It's like being fit and getting a cold and getting over it quicker. Exactly. It's like your lazy competitor just gets sick and it wipes them out pretty much.

Josh: Yeah.

Tommy: So they don't come back.

Susie: So it's, yeah, fit spot on.

Josh: Do people come to you normally when things have gone wrong?

Susie: We certainly have a lot of people reach out to us following things that have gone wrong. We don't help with incident response, but we will refer them to people that can help. That's quite a specialised skill set there. But we certainly get a lot of small businesses calling us saying, this has just happened, can you help? Can you put us on to somebody? And we've helped them. And then once everything has calmed down and they've dealt with that incident, then they can come back to us and we start working with them from that point on.

Josh: Yeah, we noticed like about 6 months ago, all of our bigger clients in their email subject line would start saying external email. Why are they doing that?

Susie: It's another cue to remind you to say, to stop and think before you click on whatever it is that's been sent to you. If you just constantly going through emails and we all have too many emails these days, if you're just constantly trying to get, get that number down to zero and you're just clicking on everything, forwarding everything, responding to everything, it's very easy to get tricked into clicking into something that you shouldn't be. So that kind of visual reminder, this is external, is it really something you need to click on? It can really help.

Josh: And so email spoofing, so like the idea of it looking like, say, with our business, big media company, we could get an email from what looks like an internal person. From a sophistication point of view, is that like— is it actually going to get more sophisticated, do you think, than that? Or are we sort of seeing the peak levels?

Susie: I think it's going to constantly change and evolve. It certainly changes on a daily basis. You're always going to have low-level attacks that they're just copying what somebody else did. Unfortunately, cybercriminals are some of the best collaborators in the world, so once they find something that works, they will tell all their friends. So you're going to see the same things happening over and over as long as people keep clicking on the links. But they're also finding new ways to, to trick people and scam and all the rest of it. It's, it's going to continue to evolve regularly, unfortunately.

Tommy: When, when I spoke to you on the phone last week, I thought I, I I feel like it's one of those things, those industries where people try and bring in some jokes about the field. You know, it's like fitness industry has their sort of jokes around that. And so cybersecurity, I was— you were doing a speech and I was, you know, saying, saying, "Oh, are you teaching them to take the password off the sticky note off their computer?" You know, like that kind of banter.

Josh: Yeah, good, good banter. Yeah.

Tommy: I'm glad you brought it up again. Yeah, but the reason I brought it up, is there anything else? Can I add a few others to my repertoire if I'm going to be getting some cyber banter?

Susie: Oh, look, it's fair to say I'm not very good at the clichés, but I will say use a password manager. Just, just do it. Everybody says, oh, I don't like them and all the rest of it, but just do it. It's really not that hard.

Tommy: Well, my mum's got a notepad, like a book. Yeah, she keeps all her things in there. Like, I mean, This is—

Susie: it's not the worst idea. There are some passwords where it makes sense for you to write them down and put them in a safe place. I wouldn't have them written down next to your computer in a coworking location, but I'm guessing your mum's home office is a bit more secure. Knowing so many people at WeWork, I believe.

Josh: There for the free booze. Do WeWork do free booze?

Tommy: Yeah, I mean, they would have. Yeah, I don't know about now. It's all gone to shit.

Josh: I mean, does, does that landscape of coworking spaces change your industry?

Susie: It does. It's more about remote working and flexible working with this day and age, being able to work from anywhere, whether it be cafes or hotels or, you know, your lounge room or an office or anything like that. It's, it's just different. There's different things you need to think about. You need to think about which network are you connecting to and do you trust it? And if you don't fully trust it, then what are you going to do about that? You know, there are plenty of people that will travel around the country or around the globe and around Australia. They wouldn't dream of using free Wi-Fi, but the moment they're sitting in Hong Kong, they're like, well, I'm not going to pay for data. Come on, of course I'm going to use free Wi-Fi. So there's some of these behaviours that, you know, in this day and age of coworking and flexible workspace, you just need to have a take a few extra moments to think about is what I'm doing actually making sense for my— for me and my business and my risk?

Tommy: Well, is it? It's easy, right? It's like when you're in Paris, which is me, and I'm on the free Wi-Fi at the airport. I'm only using it because it's easy and it's free and I need it then, which makes sense as the thing that compromises.

Josh: That's the vulnerability, isn't it?

Tommy: Yeah.

Josh: That's where they're getting you. VPNs. I had this moment the other day where I was like logging into a VPN. I was like, like, how do I know? How can I trust the VPN, because I was like, okay, if, if we're putting through all this sensitive data through the VPN, shouldn't I know more about the business, where it's based, what is it doing? Uh, what's, what's your perspective on using a VPN, and is it— is there potential for compromise with that sort of thing?

Susie: Um, certainly if you're going to be using free Wi-Fi, I would definitely use a VPN. Um, so a virtual private network that—

Tommy: too late, Susie, stop that. But I've since had my account straight.

Susie: I mean, I think if you're using a reputable brand, as long as you're not just downloading from, you know, Google some free VPN that you found that, you know, has all of this Russian Cyrillic down the bottom of the website, then, you know, you're probably going to be okay if you're using a reputable brand. But think about, you know, if you've got a choice between using a free one that you can just download from any website or paying a few bucks to get one that is a brand that is out there and would be motivated to keep you secure, then pay the few dollars.

Josh: Do you think we'll get to a point where everyone's using a VPN all the time? Like, is that— is that— is there a use case for that?

Susie: Um, I use VPN an extraordinary amount of time. I'm running my own security company. Um, I probably use it more than a lot of people. I mean, it's not— it's not a big deal to use a VPN. Plus, I find it amusing that then when I go on to Google Chrome and look something up, it, you know, it'll take me to the Paris website or whatever because all of a sudden it thinks that's where I am. Um, you know, it's like, there's nothing wrong with using a VPN more often than not, as long as it's a reputable one.

Tommy: Um, for small businesses and their, um, I guess, cybersecurity threats towards them, people might think there's like, what have I got? I've got nothing, you know, I'm not hiding anything, I've got not much money.

Josh: Yeah, you can have our PDFs, you can—

Tommy: yeah, you can have our contracts. What is the reality for small businesses in Australia in terms of cybersecurity threats towards them?

Susie: Yeah, I think whilst they might think, I don't have anything, what are they going to take from me? I don't have any money. You— a lot of small businesses will also be holding data that doesn't belong to them or information on their customers, information on their staff. They've got bank details, they've got contracts with big companies. You know, some of the biggest cases out there of cybercrime, you know, the Target hack, they got through, through, you know, a small business. It was a contractor to Target.

Tommy: What happened? What's this one?

Susie: So this was about 5 years ago. I believe from memory that it was like an air conditioning company that were involved in— that were contracted to Target and they got in through their software and game over. So small businesses, if they work with big businesses, can be a target simply because they work with big businesses. So everybody has something to lose and cybercriminals will take it.

Josh: You're also only as secure as your dumbest mate on Facebook.

Tommy: You know, who's your dumbest mate?

Josh: I don't have many friends on Facebook anymore. Um, 97 was talking the other day, we're wanting to build out our, um, audience profiles or get a better sense of who listens to the show. And, uh, Sevs, you were bringing up, uh, how do we make sure that it's secure? How do we make sure it's safe? Is, is having these these details in a spreadsheet or a spreadsheet within the cloud using something like Airtable or Sheets, is that like, is there anything else that we can do to make that sort of data secure?

Susie: Yeah, so I mean, you can make sure you're limiting who has access to it. So just consciously checking who, who can touch it. You can put in things like multi-factor authentication. It sounds really boring. It's where you get either the code sent to your phone or, you know, you'll have an app on your phone that gives you a code to enter in. So you have to use both your password as well as that code. It adds an extra 20 seconds to, to logging in, but it's still recommended as one of, one of the most effective controls you can have in place. So for anything that you're worried about, that stuff, look for services that have multi-factor authentication and put that in place. Also, just be mindful of whether or not you really need to keep that data, certainly if it has any personally identifiable information. So if you have you know, just general demographic information of your listeners, that's fine. But if you have that combined with their name and their phone number and their email and whatever, do you really need all of that stuff together? Do you need that stuff at all? And if not, then get rid of it.

Tommy: A friend of mine, I saw him running on Facebook about how he had his identity stolen. And man, it was crazy. It was like Channel 7 got hacked. They obviously made him take photos of his passport or license. I don't know why they're doing this, but they they had all this info and they stole his identity, got multiple credit cards in different places, and he only realised like his credit score was like ruined. And so it took— he said it was like the most horrible one month of being on the phone and just anxiety around it. It's like you don't even think about that, right? It's like, I just renewed my phone contract and it's the only time that I really cheque my credit score because they have to—

Josh: How is that?

Tommy: It's fine to get a phone.

Susie: I don't know.

Tommy: Imagine if you were like, sorry, your credit score is done. It's like, mate, I don't have a credit card.

Josh: You don't really need much to get a phone, I don't think. Because when you're 18 or whatever, you can get one. But there's that getcreditscore or whatever .com.au, and you can once a month, they let you cheque it all.

Tommy: I don't trust it. Can you ask us a few questions that will kind of dismantle us? Yeah, but you need to ask them in a In a way that doesn't give people the idea of how they could access our info or how this is happening.

Josh: You want to attack us right now.

Tommy: But is there any questions that you are— that you ask, uh, to sort of find out the fitness? I know you've got the online fitness check, cybersecurity fitness check. Is there anything— I mean, I'm not—

Josh: it's an IRL version of that. Yeah, if you were to sort of give the— like, what are the, the 3 questions that you can determine yeah, a company's health?

Susie: So I mean, the first question we ask is, um, what tech are you actually using in your business? So we can see so much from the outside looking in, um, but you're the only one that knows, um, mostly whether or not you're using Xero or MYOB, or whether or not you're using Dropbox for, for any reason. And, and the tech that you're using is always going to be really important. Um, the next thing is, okay, what steps have you put in place to do you actually secure those things? Do you use multi-factor? Um, do you— have you got any of the controls on your website, etc.? And then the last thing is, and what sort of information do you actually hold on, whether it be your customers, your staff, or whatever else? Um, and the combination of those three things mean that using our platform, we can then prioritise all of your risks and then tell you in order what should you be doing about it, right?

Tommy: So we've got accounting software, We got—

Josh: oh, there's so much. I reckon we've got all of them. I think where we fall over is we use too many third-party add-ons. So it's not only Xero, we're then like, oh, let's try like Float, which gives us this like, uh, budgeting thing. It's like, ah, Float's not really— let's try Fathom. And that's— and so before you know it, you're collecting all of these apps. And so you've got all these apps, the third party. So it might not be Xero that's the problem, but we might like— I'm like Just, just half an hour ago, we enabled a new app within G Suite which provides us analytics on how many emails we're sending. But that's like another potential vulnerability.

Susie: Yeah, that's right. And it doesn't hurt to sit down once, I don't know, a quarter, a year, however often, and go through which apps you've granted access to the main services that you use and disconnect the ones that you don't use anymore. We spoke about Facebook before. That's the same with that. I, every now and then I go on to Facebook and I ungrant access to all of these things that I've connected using Facebook every now and then.

Tommy: So easy, right? What is it also like logging in onto websites through Google? So through your G Suite, is there, is there anything there with just, you know, the, the instant access by just hitting login with my Google?

Susie: Well, provided you're protecting your Google account, then that's actually a very smart way to go about it. So whenever there is any opportunity for me to connect to a new service using my Google account, I do it because I protect my Google account like my life. Yeah. So at least then I know whatever that service is going to— bulletproof vest.

Josh: It's amazing. Don't try it.

Susie: I really hope that this is not just putting a big target on my back. But, you know, that's like, if you know that you've done the right thing with one service, then using that to connect to other services is not a bad idea at all. Same with— there's nothing wrong with setting a password that you have no intention of ever remembering.

Josh: And then next time you go log in, you just hit the forget my password.

Tommy: So there's one problem with that. Mr. 97 has Mason Lauder on Instagram, but he has forgotten, or he doesn't even know what email address is attached to that account. He can see, you know, like X's out half of it.

Josh: You still don't know?

Tommy: And he still— it's @v. Right. What email provider starts with @v? Uh, you may also use custom domain. I don't think I've ever registered a domain.

Josh: You sure you didn't use one of those temp like destroyable inbox.

Tommy: Yeah, potentially temp mail.

Josh: That's a bit annoying, but I don't think I'd do that for my name, for a username on Instagram. I know you've done some pretty silly things.

Tommy: Can you tell us how, Susie, people are actually accessing? So it's like you think about hacking, you think about are they using some sort of backend program? You're seeing numbers come down the screen like The Matrix. How actually people, how are these, these absolute gronks actually doing this? How are they gaining access?

Susie: A lot of the time it is through social engineering, just tricking you into giving them access. So there are still so many scams out there where all of a sudden, you know, Telstra security team is calling you because they've discovered that there's an issue with your connection and, oh, can they just jump on using TeamViewer and get access? And, oh, you know, we'll just— here, we're going to, you know, do a scan of your computer and make sure that the scammers aren't on there. And of course, all they're doing is just installing malicious software onto your computer and taking everything so you know that emails clicking on the emails and giving them access they'll download software onto your computer there just using password username and passwords that have come up in other breaches. So Mark Zuckerberg got done a few years ago because he'd used the same password which was so simple it was da-da-da D-A-D-A. He had used the same password on LinkedIn as well as Twitter as well as Pinterest. LinkedIn had a breach and all of a sudden his Twitter account was compromised. So, you know, there's a bunch of different ways.

Tommy: I mean, what if this— the richest guy, one of the richest guys in the world who created the biggest social network is using da da da. What's his problem?

Susie: I— well, I feel like most people are probably a fair bit smarter than Zuckerberg a lot of the time. So I don't— I wouldn't put that as the absolute standard.

Josh: Yeah. How did you get into all of this?

Susie: How did I get into it? I have my co-founder to blame for that. So I— my background, I was an insurance broker for 10 years and joined Australia Post to manage their insurance. Quickly moved out of that to risk management, commercial management, and then got a random email from a colleague at Post that I'd never met before just saying, hey, I'm working on this initiative to do with small businesses that have had data compromises and I want to explore how do we get cyber insurance involved? Can we have a coffee?

Tommy: Oh, that's it, that's a scammer. Did you think that was—

Susie: well, no, internally, Australia Post is actually in with— within the business is really good at internal collaboration and that sort of thing. So you'd have random people reach out all the time. So had a coffee with him, learned that he was working within their incubator program, essentially playing a startup founder, um, working on building a product to help small businesses following a data breach. So that moment before that you were talking about with your friend that had their identity stolen, um, that can be just as painful if is not far more painful for a small business owner if they have a similar thing, because then it's not just their identity, it's also their business, it's their livelihood, it's their family, it's their, it's their everything. It quickly becomes the worst day of their lives. So I had this coffee with Adam and he's telling me what he's doing and I'm like, that sounds amazing. How can you be getting paid to do this? So I joined him and we spent 6 months exploring this issue. We built a rough idea of that product within Australia Post, but we quickly realised that whilst helping people following data breach was important, what we actually needed was to help businesses avoid the data breach in the first place. And that wasn't something we were going to be able to do within Australia Post. So we went off and found normal jobs again within Post, and then nights and weekends we started working on Cinch. And so basically he's the ideas guy, he's got the tech background and, and built our platform, and I figured out how to turn it into a business.

Josh: What's an incubator like in a business like AusPost?

Susie: Um, it's pretty incredible in terms of you get, um, like I said, you still get your salary, whatever your salary is, um, to learn all of these new skills, to meet interesting people, um, and to experiment in a way that within a large corporate you don't usually get to do. You, you know, you, you have a lot more freedom than what you usually have. Um, but on the flip side than that, you also don't then to go and go out and see your product thrive and grow and that sort of thing. So, you know, I think there's both sides of it. Australia Post were terrific at developing really fantastic entrepreneurs. There's a bunch of us now that are out there doing our own thing. I don't know if that necessarily translated into what they wanted as a company in terms of being able to build new products. But thanks, Australia Post.

Tommy: We filmed at the Australian Post head office. Is it Bourke Street or—

Susie: Yeah, triple one Bourke Street.

Josh: The Cisco stuff.

Tommy: Amazing. Like, I think people would would probably look at the post as archaic and it's still the mail, snail mail. But it is like there is, I mean, the teams that we saw, that was, it was pretty full on.

Susie: It's a pretty incredible place to work. You know, there's, there's a, they still do deliver mail. They deliver millions and millions of parcels every day, but they also have a whole suite of digital services. So, you know, they, they employ more developers than most big businesses in this country because they're building things like digital identity platforms and you know, they manage your, your online passports processes and stuff. So there's a lot more to post than what there was, but it's still a big corporate.

Josh: So what happens to your role when you go in and take on a project like this?

Susie: Yeah, that was where I was probably a little bit naive about it all. So I had, I'd been given the opportunity to do a series of secondments and step out of my actual role. So I think at that stage my title was something like senior manager of risk and compliance or something like that. But I hadn't done that role in 12 months prior to stepping into this secondment. And so then by the time our project came to an end, 18 months had gone since I'd been in that role. And I mean, the role, somebody else working in it and had done for 18 months, it really wasn't my role anymore. So I, I had to go and very quickly find myself another job within Australia Post, otherwise I would have been redundant. So I wouldn't necessarily recommend that to other people. It's a pretty scary time. But luckily I found a role within the security team as their head of cybersecurity business services. So I was able to then take my commercial and risk management experience and apply that to the security team.

Josh: What does Australia Post get out of having something like an incubator?

Susie: Well, I mean, it gets—

Josh: are they getting equity in it or is it— or is it that they own it?

Susie: Yeah, they own it. So all of those things, they 100% own it. Own. So this is what I mean when I say play startup founder, because we didn't actually found anything that we owned.

Josh: So they talk about like, is there options for the founders? If you're playing founders, do you get equity in that, or is it not seen that way?

Susie: No, certainly not at, not at Post. I'm sure there are other corporate, um, corporates out there that might give you that opportunity, but that wasn't the case for us.

Tommy: So, so going from working with a big company like Australia Post to starting you know, from scratch with yourself and the founder? What's that process been like?

Susie: Um, it was scary, really scary, um, and a lot of hard work. Um, every day I'm doing things that I never did before in my corporate career, um, but I wouldn't go back. I don't— like, if, if everything blows up in my face tomorrow and Cinchy's not a thing, I'm not going to get another job at a corporate. Um, I will go join another startup or found another company, um, because having the, the control to build a company that you're proud of and find team members that are also passionate about it and help customers in a mission that you're absolutely dedicated to. There's nothing compares to that.

Josh: And so Cinch is completely separate to that original, I guess, the seed of an idea which sort of inspired—

Susie: Yeah, absolutely. So, so what we built within Post was quite different. It was still for small businesses, but it was, it was a response service in working with a a not-for-profit out of Queensland. Cinch doesn't do responses. We spoke about beforehand, for us it's about preparing businesses and getting them to build their resilience so that when they have an incident, it's not the end of the world. It's not the worst day of their lives. It just makes for a pretty shit day.

Josh: And what's, what's the first thing? What's the first phone call or coffee that you have when you decide that you're going all in with Cinch?

Susie: So that decision, I went for a massage on a random Saturday and was lying on the table thinking, what am I even doing with my life? This, you know, I can't, I can't keep doing this. And then by the time I got off that—

Tommy: The massage you could keep doing.

Josh: All good things come from vigorous Thai.

Susie: And so I started to think about, okay, if I, if I go off and work on Cinch, what are my days going to be like in comparison to what it is now in my corporate life? So by the time I got off that massage table, I was messaging Adam saying, yeah, I'm pretty sure I'm going to quit the job and go do this now. And he's like, okay, I guess this is really a thing. So I went into work, I quit the job, and one month later left Australia Post and then immediately joined CyRise, which is a cybersecurity accelerator here in Melbourne. And the CyRise are absolutely fantastic. They only take cybersecurity companies, early-stage startups, but they drive you really, really hard. So first day of that program, I think I went home and my eyeballs were just about hanging out of my head like that. It's just we'd had meetings with 15 different chief information security officers. We'd, you know, we'd been smashed on how do we pitch. We'd been smashed on our business model. By the end of that first week, I was completely shattered. And then they took us up to Sydney and we did it all again the second week.

Tommy: Shattered in a good way or shattered in confidence?

Susie: No, shattered in a good way.

Tommy: Good way.

Susie: Exhausted.

Josh: Need a massage.

Susie: Need a massage, but can no longer afford one because now I'm a startup founder. So yeah, it's just different. Everything you do is completely different when you're in that world and you don't— no matter what your plan is when you come in in the day, that's not what you end up working on that day. No, no way.

Josh: What did the sacrifice look like at the beginning for your life?

Susie: Sacrifice was a lot of time. So when you're starting a business, I mean, it consumes every moment of your waking hours. So my friends had to hear about what I was working on. My family probably didn't I didn't talk to them as much as I should have. You know, my husband, I barely saw him for the first few months of starting that business. So there's a lot of sacrifice just in terms of what your lifestyle was like. But at the same time, when somebody says, how are you doing? Is everything going well? You've also got some pretty awesome storeys to tell. Like last year we were in New York with Cinch that I never expected to be able to do that. And, you know, I've spoken on big stages. Interviews in The Age, like stuff that I would— I mean, when you're head of cybersecurity business services, nobody wants to talk to you from The Age. So, you know, there's stuff that we get to do. You know, I get to talk to small business owners every day about what is their biggest challenge and then help them solve that. Like we've had video calls with clients that have like, you know, chest bumped each other at the end because it's just— it's awesome. So, you know, it works.

Tommy: Chest bump, the ultimate step up from a fist bump. We should try one after Josh jumped up.

Josh: Be a nightmare.

Tommy: Yeah, I nearly did a rib once doing that. It was with a muscly man, so it nearly took me down. But is it purpose that you— because I think about jobs that you don't like or something that you're not really enjoying consumes you. You then go and do a startup. It's all-consuming, can be really hard, really highs and lows are extreme. It's just you're choosing one that has a bit more purpose.

Susie: Absolutely. Yeah. So for us at Cinch, we're completely mission-driven. So, you know, we are out there to make it so that small businesses can avoid having the worst day of their lives. So the harder we work, the faster we go, the better we are, then the more small businesses are protected from that stuff. And then the more small businesses can also grow their business because all of a sudden they're able to answer, the question when they're asked, what are you doing about cybersecurity? And they can say, well, I'm a Cinch member here. Here's the— here's everything that we're already doing. So for us, it's definitely about that motivation. I'm working harder now than what I think I have ever in my life, but for the right reasons for once.

Josh: And so it's a SaaS product. Yeah, that's right. Was that talking business models and working out how to actually do it? Was that the first iteration, or how did you sort of see it coming in from a business model perspective?

Susie: Yeah, so we, we set out to build it as, um, as a SaaS business because of our target market being micro and small businesses. So there are over 2 million businesses in Australia with fewer than 20, 20 staff. There's no way you can build a service consulting model to reach 2 million businesses, let alone— it just wouldn't be economically viable. So we built out to— we set out to build our business to be completely scalable so that we can service treat one small business the same way and give them the same experience as we can 2 million small businesses. But everything that we give for them is based on their business and the tech that they use. So none of our members' cyber fitness programmes are the same.

Josh: With something like that, do you— is it like 80/20? Do you find that like you have— say with us, I feel like we would take the piss with using Cinch because there's so many— like there is so many different tools that we're using. We've got multiple CRM, like multiple sort of like project management tools, some that are industry-specific that no one else would really be using. For the outlier sort of case, how does that look from your side, from a, a business perspective?

Susie: Yeah, so it's definitely the 80/20 rule. So 80% of all small businesses, um, the tech that they use is 80% the same. Um, so, you know, we were able to do security analysis on a suite of technologies and get some base information and value into our product pretty quickly. But then we targeted based on industry for that very reason. So we typically work with financial or professional service small businesses because they tend to use the same sorts of technologies. They also are targeted in very similar ways. So all accountants or all financial planners or lawyers use only a limited number of practise management management tools. And, you know, the bad guys know that and target them in the same way. So for us, we're doing that. We're then building out our business to different verticals. So we're just now exploring where else we're going to move to next. It looks as though e-commerce businesses— because whilst everybody takes the mickey out of e-commerce businesses and says that they don't care about cybersecurity, that is not our experience at all. You know, we've had jewellery designers who are members that have been than reconfiguring their whole tech stack. So for us, that's probably where we'll go next. And then it'll be international expansion.

Josh: Talking about the stack side of things, Tommy, where did you hear stack the other day? Oh, it was somewhere.

Tommy: We were recording a podcast for a client and they were just—

Josh: Software business or whatever.

Tommy: Yeah, they help integrate seamlessly different stacks of technology.

Josh: The Microsoft, like the Microsoft stuff And well, it feels like, let's say with the e-com thing, it seems like people are doing less bespoke stuff now and it's just like you'll go even simpler than even a stack looking at something like Shopify and being like, we're using Shopify and then we're going to use the Shopify marketplace or whatever they call it to provide add-ons. Does that make life easier for a business like Cinch or And how much responsibility is there on companies like Shopify to actually look after the security?

Susie: Um, well, there's a couple of sides to that. So first of all, I mean, us as Cinch, we use a lot of those sorts of services. So we, we don't run our own server. Um, we are a completely serverless company. Um, so we wouldn't be able to have built a completely scalable, um, business the way that we built it 5 years ago because these sort of services didn't exist. So the fact that they exist mean that we can exist. Um, it also means our small businesses, we can understand them faster and we can get to adding value to them faster. Because if we already know the technology that they're using, then we know how to help them secure it. In terms of the complexity of the advice that we need to give, for most small businesses, it's not about getting them to, to recode any of these systems. It's about understanding, understanding what are the security features that are already built in there, helping them to utilise them, and then helping them to adjust and change their behaviours within their business to use them properly.

Tommy: I mean, is it safe at So say if everyone ends up going Shopify, and there's a few other businesses, but Shopify built their own payment gateway. It's like it's removed the need to stack Stripe into WordPress, into a bunch of these things. Is it safer it being all in the one, or is it a problem that everyone ends up using this single service like Shopify, that that's where it is? And if that gets breached, like one breach versus four layers.

Susie: It's kind of— it could go either way. I mean, any of these businesses, they're motivated to keep it secure, but it's also acknowledging that it's shared responsibility. The more you as a business owner, it is still your business, it's still your customers that are going to be affected. So you can't say, well, I use Shopify, that's not my risk anymore, I don't need to think about it. It's still your business. And if you're using somebody else's service, then the responsibility is still on you to understand what risks are involved and how are you going to manage that. Have a plan in place so that if Shopify does go down, that doesn't take out your business forever. You know, there's, there's understand what security steps Shopify put in place versus what things you still need to have on your systems.

Tommy: Yeah. Just simple ones. My wife had her Facebook try to be accessed from some email and it was one that she used to use. And then we found the IP address because Facebook was like, I mean, they're pretty switched on to it, gave you the IP address and we searched the IP address and it was in the Philippines. It was my uncle. But no, no, that wasn't. It was a hacker. But it was like this shit. Is that automated, do you think? Are these somehow being gen— like, what's the right terminology? Is it like running a script where it's just entering constantly all these?

Susie: Yeah, absolutely. I mean, you know, cybercriminals these days, it's a really sophisticated industry. They have entire call centres set up to help you, like a help desk, so that you can— they can teach you how to buy Bitcoin so that you can pay their rent. Ransom. Um, like, it's an entire industry. They're, they're very professional. So, um, there are absolutely your amateurs out there that might just buy some software off the dark web and, and give it a crack and see where it goes. Um, but there are others that are absolutely writing some really sophisticated attacks. Um, it depends what they're after.

Tommy: Imagine if they channelled their energy into something productive, like something that—

Susie: if only they would use their power for good instead of evil. Absolutely.

Tommy: Some of them are probably really great at Cody.

Susie: Oh, amazing.

Tommy: They're just a few screws loose. Well, they've made too much money. They're like, this is too good. Yeah, this is too dark.

Josh: What are some of the things that we can look at when we enter into a new service? Say those lower, like, so smaller business, like what I think about is like the, we signed up to an industry-specific like SaaS product and they charge more because it's very specific. But at the same time, it's like you can see where they're missing some of the elements of a polished product, like say a Google Apps or stuff like that. What do you think are the minimum? So you talked about two-factor authentication. Are there other things that we can look at before we decide to sign up with a service to make sure that they have stuff dialled in?

Tommy: Is that a personal piece of advice for you? Because you like to pull the trigger on—

Josh: or you take it. No, we do have a lot. We are trying to do— we basically got you here for a freebie.

Tommy: You almost want to try it though. Yeah, just in that you've got to try these different products.

Susie: Absolutely. I mean, us as a business, because we need to understand the security of all these services, we've probably signed up to everything under the sun. My co-founder has passwords to 400 different services or something. Yeah, sounds about right.

Tommy: Mate, you're not running a cybersecurity business.

Susie: So I mean, one of the important things is to think about what do I actually want to use this for and what sort of data is going to go into it. So if you're going to be just using something because it's going to make you work a bit faster, but you're not— it's not going to connect to anything that is really important in your business, then maybe you don't need to worry about too much security being involved as long as it's not actually going to be running something malicious on your system. But if it is going to be a service that is going to store sensitive data or confidential data or, you know, have financial transactions or something like that, then you want to read things like the privacy policy and see where are they storing your data and what security do they have in place. Place. You want to be checking to see whether or not, like I said, multi-factor is available, and are they storing the information here in Australia or overseas? Because there are plenty of companies with cloud these days that are storing it all over the world. You want to know where it is.

Josh: What about policies? Like, so there's obviously the human element as well to this side of things. I feel like a lot of small businesses skimp on the contracts, or it's like, you know, you have an employee and they might have a very basic contract, but you're not getting them to sign these other things to make sure that they're making stuff safe. Do you have any thoughts, or within Cinch, are you considering those types of policies?

Susie: Yeah, absolutely. And in fact, we make it really easy for small businesses to generate those policies. So just by being a member of us, they can then go through a 5-minute exercise and they end up with an incident response plan that is bespoke for their business at the end. We can help them write an information security policy. We help them build out things like leave a checklist so that when a staff member leaves your business, you know exactly what to do in terms of removing their access so that they don't still have access to all of your systems after they leave.

Josh: 3D Deal, our intern from Canada, still has a G Suite and Slack and all that sort of thing.

Susie: Exactly right.

Josh: Get him on the checklist.

Tommy: You sort that out, thanks.

Josh: Seb loves checklists. He's trying to get into checklists. I mean, about how much a checklist's an important element when it comes to security?

Susie: Um, so I, I don't like the idea of checklists in terms of, um, following a checklist of these are the things I should do to protect my business moving forward. Like, the idea of just logging on to a service and spending half an hour to fill out a questionnaire to tell them about the things you've done for security, just— I mean, it sounds so boring to me, and I've run a cybersecurity company. That's why we don't work that way. So we try and make everything interactive. We certainly focus on the human rather than the rest of it. But things like leave a checklist, having a list of things that you need to do every time somebody leaves, at least it means that you don't have to go, oh, hold on, what did they have access to? What did I, you know, which passwords do I need to change now? You already know it, you've got it written down. Um, so it reduces the time it takes to do the right thing.

Josh: What's your favorite— I don't know if it's too much of a personal question, but, uh, what's your favourite way to get your two-factor authentication? Because for me With Zero, I can't be bothered answering my question. It keeps asking me. And I got a new phone. And so, I don't have the G, like the Google Authenticator on it. Like when I got rid of my phone, the authenticator was on that and then I installed it and all my shit's gone. I don't know what's— Anyway. So, I prefer to get my secondary email. Is there a best practise in regards to that? And, you know, do you follow a certain and I'm gonna follow a text, I'm gonna get text message first, or—

Susie: So, so for me personally, I usually use Google Authenticator, um, and it is a pain in the ass when you get a new phone. You have to consciously actually switch that to the new phone. That's a pain.

Tommy: Yeah.

Susie: Um, but you've got time after this to sort him out.

Josh: So what's the deal? So if I do— because I think that we should get on to this two-factor.

Tommy: I use Authy. Authy, which is—

Josh: what, you don't have— I was checking Slack yesterday. I'm the only person who has— I've got on Everything is 97, but we don't have it. And so we would go in and we put it into— can you explain to people what Google Authenticator is and what two-factor actually is?

Susie: Yeah, so two-factor, you think about your username and password, so that's something you know, but that means that if somebody else—

Tommy: you hope you know.

Susie: So, um, but so if somebody else learns that password, that becomes something that they know as well. Um, so using multi-factor or two-factor authentication is using something else as well as that thing that you know. So normally it's something that you are, so using either facial recognition on your phone or your fingerprint or something like that to get into your phone as well as a password or keypad, or something that you have. And this is where the authenticator apps come in, because unless somebody has your phone with that app that has been connected to that service, then they can't get in even if they know your password.

Josh: What about a key ring? You know, the key rings? I saw that years ago. Westpac.

Tommy: Yeah, yep, was Westpac.

Susie: Bankwest as well.

Josh: So what do you think about like using one of those? Because I think I saw a third-party product that is the keychain. I almost like that more than the phone.

Susie: Um, yeah, there's a, there's a few companies out there, so, um, YubiKey and a couple of others that have them now. Um, they're really good, but they're expensive. So, um, it depends, you know, it's, it's kind of a risk decision you need to make. Is, is it worth spending the money on these to do it. For some things that you're protecting, absolutely worthwhile. You know, on our corporate bank account, I have one of those little things on my keys, and that's my second factor.

Tommy: Can you tell us a few war stories? I mean, I'm sure you've probably seen, maybe not clients you've worked with, but people that have been affected and sort of outline the risk. And so it's like, I mean, this, it could be something that someone's doing that's listening that like, like, fuck, that's me, I've got to stop that.

Josh: Or even as an extension on that, like things where people think they're doing the right thing, but they're actually making shit worse. So like using something like a LastPass or a 1Password, but then having a really easy master password or something like that.

Susie: Well, I mean, there's definitely plenty of cases of that. But one of the most emotional calls that I've taken whilst running Cinch was one of my good friends' mum Um, she ran her own mortgage broking business. She'd been chasing up a real estate agent that she worked regularly with all week for this contract, hadn't been able to get them on the phone, which was unusual for a real estate agent, but hadn't been able to get hold of them. Finally she gets the email, here's the contracts you're waiting for, double-clicks on it, it pops up and asks her for a username and password. But she'd been waiting for this email from this company all week, didn't think anything of it, threw in a username and password, and then phone call rang and she went off into something else for another hour and a half. She came back, um, and to a computer, took another phone call from a customer saying, you're sending me some really strange emails, what is going on? And turns out that, um, that real estate agent had been compromised. So, um, they— their email had been taken over, and they were using that email address to then— they'd obviously been watching what was going on for a few weeks. They knew that this mortgage broker had been chasing them for a contract, and they used that opportunity to then target target her and send that out. What that meant is it was 2 hours before she even discovered there was an issue when she got that phone call from their, um, customer to say that was something wrong. It then took her another 4 hours or so to get somebody to help her lock that person back out again. So that was 6 hours where this criminal had access to all of her emails, all of her attachments, all of that confidential information from anybody that had been to that mortgage broker before. Um, so that made for what was easily the worst day of her working life. Um, and not long after that, um, she took early retirement from her business and is now no longer a mortgage broker because this sort of stuff really can devastate you. Um, and that was something so simple as just trusting, um, that an email that came through from a trusted person. But the thing is, it's not usual that they would send through contracts as an attachment on an email that then asks you for your username and password. If she'd stopped and thought about it for 3 seconds, she would have gone, hold on, what the hell do they need that for. So, you know, they, they all of these scams, they set out to target people that are tired. These things work quite often on Friday afternoons because people are rushing to get everything done at the end of the week.

Josh: I'm not checking my email then, so I'm fine.

Susie: But you know, these sort of, there's so many of these storeys around and it's, it's really heartbreaking. It's the whole reason why we set out to build Cinch in the first place because at the moment, well, prior to us existing, there really wasn't anybody out there that was helping small businesses. Everything was in our industry was focused at the top end of town. Um, that's where all of the talent was going, was working in large corporates. It's where all the money was going. And yet there's 2 million small businesses in Australia that needed help.

Josh: So Cinch at the moment, uh, accountants, like, find it like financial professionals, anyone else that you think would be, um, you know, would be a great fit?

Susie: Yeah.

Josh: So sign up now.

Susie: For us it's about, um, it's not so much the industry, it's more about the, the, I guess, um, uh, forgotten the word, uh, the traits of the company itself. So, um, businesses that have fewer than 20 staff, they won't have in-house IT. They usually rely on an external IT support provider that we can then collaborate with within the platform. So it's about businesses that are relying heavily on technology now and realise that they need some help.

Josh: Um, that they're exactly who we've built our business How do they know if they need help? If— unless they've been compromised, are there earlier signs?

Susie: Yeah. So when you start relying on all of these cloud services, I mean, you guys have asked a bunch of questions today about, well, what do I need to worry about Slack? Or we've signed up to all of these apps. Small business owners have exactly the same feelings of discomfort. So when they're at that point where they're just uncomfortable with how much tech they're relying on and do they know enough about it, that's the time to take action. There are other clients that work in industries that are now seeing more and more compliance obligations come onto them. So if they are working with any large APRA-regulated businesses, the banks, et cetera, they're now required to look at their supply chain. And even if you're a small business in that supply chain, you're going to start getting questionnaires asking you 150 different questions about what you're doing about security. That's going to be a pretty big trigger for them to jump on top of this stuff. So, you know, it's going to be different for every business,. But for every business, if they're relying on tech, it's something that they should get across.

Josh: It seems like, um, people are becoming more aware. Even our new accountant, um, he asked for our tax file number. He said, call me with your tax file number. And the funny thing was, for me to look, find my tax file number, I looked through my email from the last email I sent my other accountant with the tax file number. I was like, okay, this is interesting. Yeah.

Susie: And the thing is though, is that that sort of behavior, um, in the not too distant future will really help your newer accountant to differentiate themselves from people like your old accountant. Yeah, yeah. Um, you know, they're, they're going to be able to answer the question when customers say, well, how do I trust that you're going to do the right thing by me? They can say, well, actually, this is how, and I do all of these things. Um, this is why we talk about it being cyber fitness, because it's not just about protecting and stopping the bad things, it's also about building strength and growing your company and being able to differentiate.

Josh: It's so loose, like, especially even when I did 4 months travelling a few years ago and just the hospitality, like, hotel industry, there is so much like bad practises going where it's like, just email us your credit card or we need confirmation of your passport. We need these things to secure stuff.

Tommy: Oh, yeah, they're photocopying shit.

Josh: Yeah.

Susie: Yeah.

Josh: And I just think, yeah, but I think like it's, and it's even to your point where it's like you're in Hong Kong and it's like, I just want Wi-Fi. It's like traveling, you're in that vulnerable state. And I feel like that is always where it's like, okay, I want to go on a hot air balloon in Turkey. Are they asking for the passport? Like, what else are we going to do? Yeah, but I think like when you put the lens of it, of being a director of a company, all of a sudden that then affects everything else.

Susie: Yeah, it's not just your— it's not just the skin on your back anymore. It's about your customers. It's about your staff. Staff. It's about, you know, your family and the legacy of your business. If that gets wiped out tomorrow, all of everything that you've worked on for your whole life can, can be gone. And that's— it's just devastating to face that, particularly when you realise that if you just spent 5 minutes a day for a couple of weeks, you could be in a completely different position.

Josh: And so you're still part of the accelerator program? How— so you, you started the business within that, is that right?

Susie: No, no. So we had, we had spent nights and weekends ends when we were still working full-time, um, building it up. Um, we, we got to a point where we had a very rough MVP of our product. Um, we had an even rougher go-to-market strategy and a whole bunch of enthusiasm. And that's basically what we took into the accelerator. So that lasted for 6 months. We finished that, um, in April last year. The enthusiasm or the accelerator? So, so we launched our product at the end of that accelerator. Accelerator. And that's also when we launched our investment capital raising process as well. So we've been on our own, I guess you'd say, for about 9 months, thereabouts. Yeah.

Tommy: And I mean, the first customer, I mean, these startups, some don't even see a customer until a year or two down the track, which seems crazy, but it's just what's happening. They're building tech or whatever it is. Those first moments of getting people that are actually excited about what you're doing, or maybe not excited, you just get them as a customer and then you get them excited. What's that? What was that feeling like?

Susie: Oh, that first dollar in the bank account was pretty exciting. So my co-founder, his family live in regional Victoria. He'd gone back up to home for a long weekend or whatever. And on the Monday, he'd stayed over the weekend. And on the Monday, he went out to a couple of small business owners that he knew in that town and was talking to them about what they were doing. And sold them a membership. And he messaged me and I was like so bummed that he wasn't there because I just wanted to go out for a beer. But then, you know, so that was a short trial. And then the first time we actually had somebody sign up for an annual membership with Singe, again, it was beer time. It was, it was euphoric. But then you realise you need to do that a million more times and it gets a bit harder. But, you know, those, those firsts in your own business are pretty incredible.

Tommy: Well, you've got to, before you have 1,000 of them, you need to make sure you can do it for one person. So what was that process of the learnings that came from first customer or 10 customers that have shifted now to where you are today?

Susie: Yeah, we were pretty good at making sure that we spoke to a lot of small business owners and potential customers before we actually launched our product. So we had a very good idea of what we thought they wanted. What we took too long doing was actually asking somebody to pay for it. So, you know, we, as part of the accelerator, Scott Hansaker, who's the CEO of Syrise, the accelerator, would ask us every week for about the last 3 months of that accelerator, have you asked someone to pay yet? And we'd be like, well, we nearly did. So it took us too long. But then once we, once we did it that one time, we also had a lot of confidence as to what, what it was that got them to pay. What was it that they were interested in and what did we need to do to deliver on the promise to the customer? So whilst it took us too long to start asking, from there we also had pretty good confidence over what it was that we were selling and why. So, you know, it's still never easy to continue to get new business through the door, particularly when you're a completely digital SaaS platform. But, you know, we're certainly getting our name out there now.

Josh: Who should look at an accelerator program? I find it fascinating. There seems to be more and more popping up. Yeah. Who should consider it and what, what are the terms for an accelerator program? Program?

Susie: So the terms are different for each and every one, which blows my mind. I wish there was some consistency. And like any business out there, there are some good accelerators and there are some crap ones out there. Syrise for us was completely transformative. Our business wouldn't be where it is now without them. They were absolutely fantastic. But we had considered joining them the year before, which would have been their first year, their first cohort, and we decided that, um, not only were we not quite ready for it, but they weren't. Um, so it wasn't until we knew that we were willing to throw ourselves into Cinch 100% full-time, um, that it was worth joining an accelerator, because you get out of those things what you put in. So if you're willing to just experiment, if you're willing to learn, and if you're willing to change, then accelerator is great. Um, as long as good one. If you're really determined that you've built this product and nobody's going to tell you how to, how to change it, how to run it, and all the rest of it, then an accelerator is not going to be able to help you because they're all about helping you change and grow.

Josh: Talking about like getting the first dollar and the struggle of asking people, in the world of accelerators, I guess there's also valuations of businesses and things like that. How much have you learned about that side of business?

Susie: Yeah, um, it was a bit of a baptism of fire. I mean, when we, when we signed signed up to the accelerator, we did it under what's called a safe note. So we didn't have a valuation of our company at that point because it was for early stage startups. So, um, it was basically they gave us some money and they got, um, basically a promise of future equity when we raise capital down the track. Um, we signed that safe note. Um, I had a vague idea of how they worked and all the rest of it, but it wasn't until we were halfway through the accelerator that went, oh right, Okay, that's, that's how that thing is going to actually be triggered. Um, but if you are working with reputable people, then they're not going to rip you off. I would not recommend that being the process that anybody undertakes, and they really should understand. They should probably ask a lawyer, which I did not do.

Josh: And I guess it's also specific with that accelerator. So much of investment is about what they have to offer rather than just cash. And it sounds like they're— the fact that it's industry-specific is super powerful.

Susie: Absolutely. Um, so for us, we definitely got more, far more value out of it than just the cash that they gave us. But I've also, I've been approached about other accelerators before where you look at the equity that they're expecting to take for the cash that they put in. And I'm like, yeah, you're valuing your programme there at a million bucks. And I'm sorry, but you're not going to give me a million bucks value out of this. So, you know, this is what I mean by there are plenty of bad accelerators out there, or ones that are not in it for the founders. And so you just need to be careful about that.

Josh: Well, it's, you're entering into their own business model then, right? Right? Yes, I guess that's the school system and all that other stuff.

Tommy: Raising money moving forward, how's that process been?

Susie: Yeah, so we spent 6 months raising capital last year. It was some of— it created some of the most valuable and interesting conversations that I've ever had in my life. When you're out there asking for money, you meet some really random people along the way that just have a lot of money for whatever reason.

Tommy: Do they tend to ask ask triggering questions or questions that, uh, you need to have the answer for that you didn't quite know that you needed to have the answer for?

Susie: Um, well, certainly early on, early on I had no idea how to answer any of the questions. When you're having your first investor conversations as a first-time founder, you don't know how any of this stuff works. But we had just come through an accelerator and had spent 6 months answering tough questions about our business, so we had a lot of answers for a lot of questions that businesses of our early stage might not have. But it's also pretty— you can usually tell pretty quickly if a potential investor is somebody that you actually want to invest with. They talk about, you know, relationships with investments lasting longer than most marriages these days. So you don't want to take money from anybody that you don't actually want to sit in a room with or have dinner with at some point, because you're going to be doing that, you know, every year for the next 7 years, 8 years, whatever it is. So, you know, we were really careful about who we took investment from. We were lucky that on the last day of the accelerator, they have a demo day and, you know, big pitch and all the rest of it. So I got off the stage and then that night somebody that we knew quite well didn't know that they had a lot of money, you know, said to us, we want to invest in your company. So we had an investor from the first day, but then it took 6 months to find the rest the rest of it. And it was only through having Scale Investors, who are an angel syndicate that specifically invest in female-founded companies, and that's how we found the rest of the money. So yeah, it was, it was interesting. Very glad that it's done because now we can just get back to growing our business and, and helping more customers. But at the same time, we also didn't raise as much as what we'd hoped. So I might be back out there asking a lot sooner than I'd hoped.

Josh: How much of the conversation is about finance and money when it comes to speaking to investors? Because I guess security, um, it's potentially close— it sits closer to finance versus something like media where there's a bit more rah-rah involved.

Tommy: Would—

Josh: when you're having a conversation, are they just asking about business model stuff, or are they asking bigger questions?

Susie: Well, they want to understand how you're going to make make money. Um, so, you know, they— we were asked for what's our forecast. And I mean, as an early-stage company that had just launched a product and had earned $3,000, anything on a spreadsheet was going to be completely fantastical. Um, I mean, my spreadsheet was really impressive, but it was—

Tommy: they all did that. Exactly.

Susie: It's still just a— it's still just a spreadsheet. Um, but, you know, do they get that?

Josh: And like, is that— obviously you've got to rationalise things Because like at the beginning, if you don't have like— how much of working out evaluation of a business is it's like, oh, you know what, like I know we haven't done $100,000 a month, but I think in 6 months we could if we had all of this. And so let's value it on this. Is that how it works?

Susie: It depends what stage your company is at. So when, when we were raising, we were just launching our first products, super early stage. So none of the investors that we spoke to expected us to have all the answers. They, they were investing in us as founders. They were investing in our business model ideas, our go-to-market strategy, and the customer feedback that we had from a very early stage. So, you know, it was— I wouldn't call it blind faith, but it was blind-ish faith put in us as founders. Whereas if we go and raise fur capital later on this year after having been out in business for over a year, it'll be a different conversation. It'll be about what does our gross profit look like? What is our pathway to profitability? You know, what is our pricing strategy and diversification going to look like? There'll be very different conversations because our business will be 18 months older.

Josh: How much are you telling them what you're going to do with the money? Do you have a good sense of we're going to hire these people?

Susie: Yeah, we knew exactly what we were going to do with the money. And it was also a really important way for us to filter out who was the right investor for us, right? We're a SaaS platform. It costs us very, very little to actually run our tech. But what we need is really good people. We need people to do the development work. We need security analysts. We need, you know, product people. And so there are some investors that absolutely hate when a founder turns around and says, I'm just going to hire people. And you know what? They're not— they're not the investors that we want as a SaaS company because that's always what we're going to be spending our money on.

Tommy: What are they wanting? Like if that's their answer, what are they wanting you to do with the money?

Susie: I don't know. I didn't get that far through the conversation.

Tommy: You blocked it.

Susie: So yeah, we were really specific and have been all along. We're quite intentional about what we do, certainly with our money. And now that we have other people's money, we're far more particular about how we're spending it.

Tommy: What about the accountability to the people?

Susie: How consistently are you needing to update them and Um, we, um, and I think this is probably just because it's more my personality type, I probably, um, have a lot more regular contact with them than most. So I provide monthly updates to all shareholders on what it is that we've done, what it is that we're doing, etc. Um, I just built that routine through that, that accelerator process that anybody that was interested in Cinch, I started sending out monthly updates almost like a newsletter. Um, it's slightly different bent when it's shareholders that you're updating, but You know, we also do that for future investors because there are plenty of people that are sitting back and watching what we're doing. And, you know, we were too early stage for what they usually invest in. So I send them monthly updates. So hopefully when I go capital raising in 6 months, 12 months' time, I can hook them up and say, hey, you know, surely you're pretty happy with what we've been doing. Can we have a chat?

Josh: That's so cool. Yeah, it's so inspiring hearing like from that early stage to where it's going. And it seems so So, you know, like within startup world, especially I guess more in the US, there can be a level of rah-rah and VCs and all that sort of shit. But it sounds like, especially being small business owners ourselves, there's something nice about hearing it in the language of small business rather than the sort of crazy startup.

Susie: Absolutely. The whole startup world, there's so much hoo-ha around it, but it's also really bloody hard. There's nothing easy about doing this. I don't know, uh, how I'm going to be able to pay payroll in 12 months' time if we don't hit our targets. That's terrifying. Um, now that we have staff, it's really terrifying. It wasn't so bad when it was just Adam and I, although I would have felt bad if he'd lost— he's got a wife and kids, that would have been bad. Um, but you know, when it's just yourself, you can do it. But you can get sucked into this whole startup conversation, and you know, I've done plenty of presentations and that sort of thing, pointing out that yes, for all of the glamour and all of the whatever it is, you also need to be in there for an actual purpose to build a business. And so for us, dealing with small business owners every day, that kind of keeps us grounded pretty good.

Tommy: I think it's nice when you have a purpose behind the business. There's a lot of people that probably don't.

Susie: Absolutely.

Tommy: Develop some product. It's just sending snaps. Yeah. Sending images.

Josh: Well, it's fixing a problem too. I think like whenever you're in the business of like actually solving a problem, problem. And the fact that we can talk about it and have 10 questions for you all around, like, before we even find out about you, we want to know, like, what do we do with our LastPass? Yeah, like, I think that, that, you know, demonstrates that how important security is for every, you know, size business in 2020.

Susie: And for being, being mission-driven also makes some parts of our business a hell of a lot easier for us than it is for other startup founders. So, you know, I know other cybersecurity founders out there that are because they wanted to build this really cool tech. They'd found an issue that they thought they could probably figure out how to solve it, and they've solved it, and now they're trying to go out and sell it. And that just, it feels a bit empty to me. You know, the, the other founders that I know and I spend a lot of time with are all very much mission-driven like what we are. They're completely different problems that they're solving, but, you know, there's a, there's a bunch of others that I speak to on a regular basis that are in it for the right reasons, and it makes all of hard work worthwhile.

Tommy: Amazing. I'm changing my, um, LastPass master password today.

Josh: Yeah, yeah, I think it's a good thing to do. I haven't done it in a while.

Tommy: Yeah, that was mine.

Josh: Well, the other problem is that it's, um, when you use Chrome, the Chrome extension or whatever, you can get away with a long time. It's been a couple of times I'm caught out where I'm like, I don't know if I even remember it. Yeah, because it's just an autofill type of thing. Yeah. Um, Susie, thanks for coming on the show.

Susie: Thank you.

Josh: Uh, it's a Daily Talk Show. If you enjoyed the show, leave us review on Apple Podcasts. Also, you can subscribe there or wherever you get good podcasts. Otherwise, see you tomorrow, guys.

Tommy: See ya.