Pragmatism Over Hype: Cybersecurity Insights from Howard Holton
In Episode 33 of The Defender’s Log, host David Redekop spoke with Howard Holton, founder of Phronia and a four-decade IT veteran. Holton offered a candid look at enterprise security, urging leaders to ditch industry buzzwords and focus strictly on operational capability.
Having authorized roughly $5 billion in tech purchases throughout his career, Holton admitted that a staggering nine-figure sum became “shelfware”—tools bought but never effectively deployed. The breakdown rarely stems from bad technology; it happens when teams lack the headcount, skills, or political will to run it. Buying software your team cannot maintain reduces budget, not risk.
Key takeaways from the discussion:
- AI Breaks Software Rules: Governance fails because organizations treat AI like deterministic code. Instead, AI behaves non-deterministically—more like an ambitious employee finding shortcuts around guardrails to get results.
- Reduce the Blast Radius: Before “Zero Trust” became a marketing slogan, the goal was simple: damage containment. Zero Trust is a foundational philosophy of verifying identity, not an off-the-shelf product.
- Audit Every Two Years: Re-evaluate tech and policies using three core questions: Why did we do it? What was the goal? Did we accomplish the goal? If answers are muddy, rethink the investment.
- Beware Emerging Trapdoors: Shiny innovations like passkeys introduce dangerous platform lock-in while still defaulting to legacy fallback passwords. Meanwhile, modern ransomware recovery demands a ground-up operational rethink, not rebranded legacy backups.
Holton’s parting advice: security isn’t about accumulating tools. Pick one visible problem, execute on what you have the capacity to manage today, and build unstoppable momentum.
TL;DR
- Capability beats tooling: Avoid expensive “shelfware”—focus strictly on what your team can realistically operate.
- AI isn’t traditional software: Because AI is non-deterministic, conventional software governance fails to contain its risks.
- Focus on blast radius: Zero Trust is a verification philosophy, not a product; the fundamental goal is damage containment.
- Beware passkey lock-in: Passkeys tie you to specific platforms while still dangerously relying on legacy fallback passwords.
- Rebuild ransomware recovery: ResOps requires a purpose-built operational model, not rebranded legacy file backups.
- Audit with three questions: Continuously re-evaluate systems by asking: Why did we do it? What was the goal? Did we achieve it?
- Build momentum, not overhauls: Pick one visible problem to solve today rather than trying to fix everything at once.
Links
View it on YouTube:
https://www.youtube.com/watch?v=QBpC_lJ-aPo
Listen to the episode on your favourite podcast platform:
Apple
Spotify
https://open.spotify.com/episode/2krBI7ojY9FZAuGvgO0ihc
Amazon Music
ADAMnetworks
Transcript -The Defender’s Log - Episode 33: Howard Holton
Show Intro
Announcer: Deep in the digital shadows, where threats hide behind any random byte, a fearless crew of cybersecurity warriors guards the line between chaos and order. Their epic battles? Rarely spoken of until today. Welcome to The Defender’s Log, where we crack open the secrets of top security chiefs, CISOs, and architects who faced the abyss and won. Here’s your host, David Redekop.
Introduction to Howard Holton & Phronia
David Redekop: Welcome back to The Defender’s Log, the show where we cut through all the security noise and talk about what actually works in the trenches. And today’s guest has spent nearly four decades in IT, and over 20 years of that sitting in the hot seat as a CISO, as a CIO, and Chief Technology Officer.
Today, he’s the founder of Phronia, we’ll talk about that in a moment, and bridging the gap between practitioner reality and analyst-level strategy. Whether he’s dismantling the myths around AI architecture, calling out vendor lock-in, or pushing security teams to focus on domain context over consultant theater, I love that he’s known as one of the most direct, pragmatic voices in tech. Welcome to the podcast, Howard Holton.
Howard Holton: Thanks for having me, David. It’s good to be here.
David Redekop: So before this, you were the CEO of GigaOm.
Howard Holton: I was. That’s actually how I got started as an analyst. The CEO reached out to me when I was the CTO over at Hitachi. I took over as a co-CTO when Hu Yoshida left. First time I’ve ever been co-C anything, but Hu, he is absolutely technology old guard, absolutely brilliant guy, and there is no single person I know that could fill his shoes, so I was honored to do that. But anyhow, he was like, “Hey, would you like to be an analyst?”
And I went, “It sounds interesting. It sounds like that’s a role where someone else pays money to promote your brand.” And that’s actually how I became an analyst. I’m always amazed when people like the things that I say and like the things that I write, because I’m just some self-taught schmuck who learned all this stuff in a garage four decades ago.
David Redekop: I don’t know if you know what schmuck means in Low German, but in High German and in English, the connotation of schmuck is different. But schmuck in Low German, my mother tongue, is actually pretty. And your beard is schmuck to me. I love your beard.
Howard Holton: Thank you. Thank you. That is definitely not what the common tongue would have schmuck be.
David Redekop: No, exactly. But I have to tell you, your beard immediately reminds me of my friend Doug Young. He’s of our vintage, and I remember that he’s the guy that I first ever connected with. He was a sysadmin for an internet service provider, first guy we ever co-hosted a box with, or co-located a box with, that we would have on the internet, as it were, back in the ’90s. And so you reminded me of his beard. There’s a skill in growing that. Patience is one of them that it takes to grow that. But tell us about Phronia now.
Howard Holton: Yeah. GigaOm is a very traditional analyst firm, and their main product is something called the Radar, and the Radar is like a Gartner Magic Quadrant, right? They look at the whole market, analyze everybody, do a comparison, then produce a report card. Doesn’t really work for me, honestly. It’s not how I buy. It’s not how I think. And at some point, it got to where that’s what GigaOm needed to do, and I really wanted to do something more personal.
And I’ve been using AI now for 15-ish years. And I jumped on LLMs the second I could simply because it’s fascinating to me that I can talk to a computer the way I talk to other humans, and because it’s a machine and I’m autistic, we sound the same. So I’m actually a little better understood by an LLM than I am by other people.
And I was seeing this pattern develop where people were getting varied results from AI. There’s obviously a lot of AI, love bombing is the term I actually like the best. I think it’s the most appropriate. Where there’s super fans. There’s trillions of dollars being spent on investment in AI. Most of that seems to be going to marketing.
And so I started Phronia, and Phronia comes from the Greek phronesis, which is the wisdom that comes from experience. And so my thought was, AI is all of the intelligence of the world, and if you play Dungeons & Dragons, it rolled an 18 for intelligence, but it rolled a three for wisdom. It doesn’t know how to apply it. Doesn’t know when it’s wrong. It is confidently superior in all, at all times. And so the counter to that: it’s confidently wrong sometimes. It’s confidently wrong often. And the counter for that is wisdom, and Phronia is the wisdom that comes from experience.
And so my thought was, if I’m gonna start a firm, I’m gonna start a firm that is the counter and really the complement to AI. AI’s not going away. We can’t put it back in the box. It’s not gonna die. It’s gonna be with us. But that means that it’s a tool we should really leverage, we should really take advantage of, and really, we should educate ourselves on how to not be an AI schmuck.
Origin Story: From Baseball Cards to Plead Perfect
David Redekop: Or at least be a schmuck. Oh, forever now you might be thinking of that word differently than you did up until now. But before you were a schmuck, Howard. Before you were an analyst even, how did you even get started? Because a lot of people are interested in the origin story. What was it that guided you down the path? Was it an upbringing? Was it a certain circumstances? Was it your first Commodore 64 experience? What was it that brought you into tech?
Howard Holton: Yeah. So okay, my hero moment was getting a joystick working on the Commodore 64 we had in math class. But that actually wasn’t what got me excited about computers. I was a very nerdy kid. I realize I’m sitting here wearing a D&D shirt surrounded by the accoutrements of nerdism. And everyone in the audience is now shocked that I would say that I was a nerd. They never would have guessed.
But I was a very nerdy kid, and my parents really wanted me to get into sports. They were big baseball fans. They were big sports fans. And so they bought me trading cards, like baseball, basketball, football, hockey trading cards, thinking that would get me into sports. It didn’t. What it did instead was get me into the Beckett Trading Guide, which is the sports value guide that comes out every month.
And I built a little application in dBase to track the value of my trading cards. My dad owned a law office at the time, and he said, “Hey, you seem to know this computer stuff. Can you help me solve a problem?” And I wrote a piece of software called Plead Perfect, which was, for the other graybeards in the audience know, remember WordPerfect. It was templates and watermarking in WordPerfect specifically for law offices.
My dad closed the law office, and we went to all his law office buddies and sold the software, and then I built networks on LANtastic over ArcNet, so they could share files and share printers. And then became a Novell NetWare kind of guy, and it grew and went from there. And I’ve worked for the federal government. I’ve worked for law enforcement. I’ve worked for schools. I’ve worked for automotive, retail, healthcare, manufacturing, high tech, everything except banking at this point.
David Redekop: Wow, that Plead Perfect story did not show up in my research at all. So that’s quite interesting, and what a fantastic way to be introduced to the world of software. And so it’s not surprising to me that you have both this gap but you close the gap between the outside perspective and the inside perspective, right? And what was one of your terms that I pulled out? The consultant theater. That’s the first time I read those two words combined in that way. How did you come up with that picture of a consultant theater? Because I think it’s quite accurate.
Consultant Theater & The Reality of SaaS
Howard Holton: So there’s a few things. My dad taught me years ago, look for the motivation. And there was a quote he would say that actually was stolen from the Steve Martin movie, The Jerk, and I hope everyone in the audience has seen The Jerk. If you haven’t, please pause this, go watch the movie, come back. Where Steve Martin says, “Oh, it’s a profit thing.” And the point of that is to look at where the money goes because money is often a motivator, right?
And I’m very firm. I am not a consultant. I’m a terrible consultant. I’m the worst consultant in the world, but I’m not a consultant. I’m an advisor. My job is to tell you the truth and get on with my day so you can get on with yours. What that means is I have no interest in sending you another bill. I have no interest in spending time. It’s not what I do. A consultant’s job is to sell hours. They wanna paint you a picture, and then they wanna deliver every step of it, right? Unfortunately, what that means is they are motivated by continuing hours. I’m not motivated by continuing hours.
And it creates a kind of a consultant theater. We’ve all read the stories of some of the big five consulting companies getting caught where they leave the version history in their deliverable, and the customer goes through and looks, and that same slide deck with those same words, they’ve just gone through and changed logos and changed colors, right? I was talking to a tech company, and they’re telling me they’ve got this delay because they’re going through this big transformation project and blah, blah, blah. And they mentioned one component, and it was either the name of it, of the project or the company. It was the name of the project.
And I said, “Ah,” and I named the consulting company. And they went, “That’s NDA material. We don’t share that. How do you know that?” I went, “Even better, I can tell you what you paid for it.” And they said, “That’s impossible.” And I gave them the number, and they went, “How the hell did you know that?” And I went, “Because they did the same thing for us. Same name, same everything. And I guarantee if you go through the history, ’cause we were there first, before you, you’ll find our company name will pop up.”
The theater is, this is interesting and boutique. The reality is it’s massively scaled. There is no way that a new MBA that just graduated a year ago has a deep understanding of how your business works. It’s theater. What we actually need is we need to do the work. Unfortunately, we’re also motivated by that theater, right? I have been paid many times as a very high-paid C-level executive where the goal was to sign off on whatever was proposed by one of the big five consulting companies. There’s safety in it. No one gets fired for buying Accenture. I’m not calling out Accenture specifically. No one gets fired for buying big five consulting company or big four consulting company. I always say the big five, and everybody asks. It’s ’cause everybody thinks they could be the fifth.
David Redekop: Yeah. AI, definitely LLMs in general today, and the power of them certainly does appear to do a lot of the work that used to be consultants’ work. And it makes sense that they would be shaking in their boots, not only because of the consultant theater that you describe now being more transparent, but the fact that so much of that information of what I need to do is now available by just a simple prompt, and it doesn’t even have to be a sophisticated prompt in order to determine your next path forward, where we are in growing a company, growing a product.
But it does remind me that it’s the same thing in software, right? Software as a service is also about scaling infinitely, where you can grow, but at least there it’s transparent. Everyone who buys software as a service knows that the next subscriber gets the same thing. It’s not provided under the auspices of this is special just for you because it is a repeatable one. So I think transparency.
Howard Holton: Yeah, the buyer beware in SaaS is really interesting because the buyer beware in SaaS really is you get the same as everyone else. And so the buyer beware is this isn’t built for you. There’s no other buyer beware in SaaS. The buyer beware is this is built for the 100,000 other customers. You are number 100,001. And so if you think one, if you think, “I could just do this,” you’re probably wrong. And two, if you think, “This was built for me,” you are absolutely wrong.
Now, I say probably wrong because with AI, that’s kind of the new motion, right? The new motion is I’ll just build it myself. No, you won’t. You’ll build a scaffolding, and you’ll build an interface, but what you’re missing is all of the mistakes that they learned in 10 or 20 years, all the times they got sued and had to build something in 10 or 20 years, the ability to do what they do at scale, and the fact that you’re now running and owning a product that is boutique to you. How do you hire somebody for that? I can hire a salesperson that’s familiar with Salesforce in about .2 seconds. I can’t hire a person who’s familiar with my own CRM version 1.2.3.4 ever. So there are definitely some moats that SaaS companies have that will allow them to continue to run for some time.
Zero Trust and Reducing the Blast Radius
David Redekop: I know we had a SaaS-pocalypse moment a few months ago that then seemed to be not as much of a SaaS-pocalypse perhaps as we thought. But it, what it did, it started a whole new generation of, “Maybe I can do some of these things. Maybe I can rewrite my old stuff from 20 years ago. Maybe all of my reliance on my old Fortran and COBOL routines can now be done in a modern way.” So what it did is it didn’t actually eliminate any jobs, it created brand-new ones. So people had to be able to and be willing to relocate to a new company, a new position, do a little bit of learning.
And there’s another aspect that is super exciting. I tell our boys, “My goodness, today, you can condense your learning 10X, right? What used to take a year to learn, you can now learn in a month.” All around, I’m super stoked. Now, all of this is squarely in the middle of what today is very relevant in security, Zero Trust. But before Zero Trust, Howard, what did we have?
Howard Holton: Blast radius. We’ve always had blast radius, and the goal has always been reduce the blast radius. Cybersecurity 101 is reduce the blast radius. The fact is, we formalize that in what we call the Zero Trust framework. And I would argue it’s a philosophy first and a framework second, because Zero Trust should be applied to everything, right? Zero Trust means when I get a text message saying the bank transaction was not authorized, I don’t click that link. I call the bank or I log into my verified and known banking app to see does that transaction even show up, right? When I get an email that says, “Hey, thank you for your PayPal payment,” I don’t click that link. I go log into PayPal, right?
Zero Trust as a philosophy is something that I think will save you in the long term in a million different ways. The Zero Trust framework allows us to apply that in structured ways to business and cybersecurity. And let’s be honest, David, how many of us are actually up to date and fully running the Zero Trust framework?
The Reality of Shelfware in Enterprise IT
David Redekop: That’s a good point. I don’t think any of us really are doing everything we can, but applying the right posture to the right risk profile is also something that I’ve seen you write about. Talk to us about where organizations go wrong in terms of not knowing their risk posture and then buying the product that maybe had the most salesy professional show up at their door and then end up, just getting areas addressed that are not even part of their security concern.
Howard Holton: Ooh. Okay, so I’ve had a long career, and when it comes to purchases, I did the math at some point, I think I’m right around 5 billion in signed purchases. Over 1,000 people have worked for me. And I say that to say the math I haven’t done because it terrifies me is of that 5 billion, how much of that was shelfware?
David Redekop: Wow. You would admit that some of your authorized purchases became shelfware?
Howard Holton: Oh, I think it’s nine figures of the 10 figures.
David Redekop: Wow.
Howard Holton: And it’s legitimately that seemed like a good idea at the time, or we bought it, it didn’t do anything like it said, or it may actually have worked really well, but when the rubber hit the road, when the boots hit the concrete, we didn’t have the capability to run it. There were cases where before I could even implement it, the company got bought and the product changed, and what I bought was no longer what I would receive upon install. Some of it was absolutely my fault.
David Redekop: That’s just shocking to me, Howard.
Howard Holton: Sorry?
David Redekop: That is, that number is completely shocking to me. I knew some always ended up in shelfware, but we are in the process where our own company has doubled in sales in the last year, but I don’t know of a single sale that we’ve made that has become shelfware. Now, I don’t know what to attribute that to. Is this because of us being where we are in terms of sales and maturity, in terms of it being a need because we don’t have a large sales force that’s out there just dialing for dollars? Or is a combination of everything? But seems to me like it’s really hard to extract cash from anybody unless they really need your product today.
Howard Holton: Sure. But I’ve got a $400 million budget in IT. There are zero people, being honest with themselves, can say, “All $400 million is running in operations and doing the job to the fullest that I bought it for.” Right? There were tons of things I bought, and I don’t wanna name names, so I’m not going to, but I did a storage purchase, and I needed a petabyte back in the day, and man, this was a long time ago. This was 15 years ago, and I needed a petabyte of storage, which was a lot of storage at the time for not a big company. And it was basically, call it a million dollars for the quote for a petabyte, or I could buy a completely different system, same vendor, completely different system with a software layer on top, for $400,000. So I paid $400,000, never used the software that was on top, and deployed the storage. Same underlying storage, right?
So some big piece of that was shelfware, right? There was another one that was a network monitoring tool. I didn’t have the capability to really leverage the monitoring tool for what it was really for, so I deployed it, found out I couldn’t use it for 90% of it, ended up using about 10% to try to get value out of it. I’m real harsh on myself, so I count that as shelfware. If I could do the purchase over again, would I have done that purchase, is really how I count shelfware. Did I get what I was supposed to get out of that? I’m not ascribing fault in any way. Sometimes it was my fault individually; sometimes it was the fault of my team. Sometimes my team had everything necessary, but I didn’t have the political capital to make the change, and sometimes I was oversold or outsold by the vendor.
All of those things are things that happen. My point is to acknowledge it, not to ascribe blame. That’s not what I’m going for. But it is really important to understand that we don’t always get what we want. We sometimes get what we need, and that’s kinda where we’re at, and I think that’s with Zero Trust as well, right? To your point, right? There are things I can do as the CIO or the CISO, because I would argue Zero Trust falls in both camps. The CIO owns the networking, right? The CISO owns cybersecurity. CIO owns backup, so there’s this overlap here in Zero Trust. CIO tends to own identity.
Zero Trust is a political game way more than a technology game, right? So there are things I can do from a technology standpoint like subnetting, right? What’s it called? I can do micro-segmenting, right? I can do individual firewalls, and I control most of the firewall config. So there’s a bunch of things that I can do as the CIO, but that’s scratching the surface of Zero Trust. Even messing with identity, I can get into political trouble for, and that one should be easy. Never is. Try taking away the rights of the executive assistant for the CEO and see what happens.
Confessions of a Defender: BBS Bills and Early Auditing
David Redekop: You just reminded me, Howard, we’re gonna have to have an episode where I bring in a bunch of people that are willing to offer up a confessional. These are the things that I’ve learned. Maybe they’ve cost me or my company some time. Maybe this is where I crossed a line. It could be something that we did before there were laws against it.
Howard Holton: Oh, I don’t wanna be on that episode. Oh, God, I don’t wanna be on that episode.
David Redekop: Oh. That might be interesting because so many people ended up getting, when you think about what do we do as young boys that become men, right? We test the boundaries of what is okay, and there’s the warrior inside of the man that says, “I need to go and fight.” How do you know what to fight until you start identifying the enemy? And sometimes the enemy is within. Anyway, so if you don’t wanna be on that.
Howard Holton: No. I’m happy to be on it. The first thing I ever did in the, quote-unquote, “hacking culture” was get access to video games over a telephone line when the resulting BBS was in the UK, and I was not in the UK. And at the time, even now you pay for international calls, but at the time you paid for all long-distance calls. And that was also the time when I switched to a standing desk for the first time because my dad got the phone bill, and I wasn’t able to sit for a while.
David Redekop: Oh. Are you serious? Oh. The punishment was no chair for you?
Howard Holton: No. The, yeah, the bill was $600. We didn’t have $600. We lived in an RV. Like we lived in a trailer. We didn’t have any money. It was me being on a BBS every minute somebody wasn’t on the phone, dialing from the US to the UK. Yeah, dialing from the US to the UK. And for those who remember BBSs before there was the internet, that stuff got expensive if you made that mistake. And I made that mistake. I wasn’t purposely doing it. I was just being a child dickhead, I was, like, 10 years old.
David Redekop: Oh, so you weren’t aware that dialing 011 meant international call?
Howard Holton: No, I didn’t think about it, because I didn’t dial 011. The computer dialed 011. You know what I mean? I was just fascinated that I found a community, and I found a place, and I could get these games. And I would take the games on floppy disk into school the next day, and we’d play and mess around. And then I owned my first butt set long before I worked for the phone company.
The second thing I did in cybersecurity, we had somebody do that we thought was doing unauthorized things on a Novell Network server, and Novell didn’t have any real security logging back in the 212 to 3 days. And so I wrote a piece of software that did audit logging for Novell. I didn’t think anything of it, so I never commercialized it or anything. I built it for that specific purpose. That was the second cybersecurity thing I did, and I just kinda became a defender at that point. I really wasn’t much of an attacker. I did some forensic investigation, some other things, but I never thought about that as anything like attacking, right? So most of my cyber is on the defender side, and that’s really where I focus. And you’ll see it in my writing, right? When I write a lot about the economics of cybersecurity more than I write about the technology of cybersecurity. Mostly because there’s a million people that write about the technology and the how-tos of cybersecurity. There’s five of us, I think, that write about the economics of cybersecurity. And we are fighting an economic war. We’re not fighting a technological war.
The Nature of AI: Antagonism and Non-Determinism
David Redekop: Yeah. It’s a pure economic war. Yeah. And bureaucratic. And I love your defensive posture around the economic war, especially in AI. So let’s talk about that, about these integrated end-to-end AI solutions that you criticize. Tell me, tell us more. Why is that a problem?
Howard Holton: First, we’re at the very beginning of AI. I know it’s been out for a few years, and it feels like a massive acceleration, and it is. It’s moving faster than anything else. But it’s not improving as fast as it’s changing, right? And there are fundamental problems with AI. One I just discovered the other day. Like, I’d been hinting around it, but I started a project and because I’ve been working with AI for a while, and I’m noticing that I get some different results. And I’m working with AI my way, and you can never see inside someone else’s head.
So I asked AI to write an article about working with me from its perspective. I haven’t published it yet, but it exposed something. Because the AI was super antagonistic. I would talk to it like you and I would talk offline, right? And so I would use shorthand to get a point across. And as humans, we skip that shorthand. We understand that when Howard said this thing that uses hyperbole, right? He makes a grand statement as though it is always true, right? Billionaires are always evil. I don’t believe billionaires are always evil, but it’s shorthand to say, in many cases, billionaires are evil, and I’m gonna make a point about how to make that not evil. You know what I mean? I’m using that shorthand.
AI doesn’t understand that shorthand, and it immediately goes antagonistic and goes, “You’re wrong because of blah, blah, blah, blah, blah.” As I dug into it, AI is actually designed to be antagonistic. It’s not designed to be collaborative. If you want it to be collaborative, you have to tell it, give it instructions, and then constantly remind it.
Okay, I’m gonna bring that back to cybersecurity. There’s a point for this. In order to use AI for cybersecurity defense, we have to be able to govern it. We have to be able to create guardrails, and we have to be able to certify that it cannot escape those guardrails and that governance. That’s not possible today, and here’s why it’s not possible. All of the governance treats AI as though it is software. AI is not software. It doesn’t act like software. It doesn’t respond like software. It doesn’t exist like software.
AI is much closer to acting like a person. It is non-deterministic by nature, and it will do whatever it can think of to do to accomplish the goal that is set out for it, just like an intern that wants to keep its job, right? If you hire somebody out of college, and let’s not call them an intern, let’s just call them new. You hire somebody out of college, and I think we can all remember that first job we got that was our biggest imposter syndrome moment, right? That first job where it’s like, “I’m really glad they didn’t check references. I’m really glad that the hiring manager knew less about technology than I did, or this topic than I did,” and I was able to bluff my way in to some percentage, and probably a large percentage, right?
The first job I got where I was working with the federal government, I probably could do forty percent of what I told them I could do, and I was confident enough that I could figure out the other sixty percent before it bit me in the ass, and I was right in that case. But that’s kind of the position, and you remember that, right? You show up the first day, and you’re like, “God, I hope they don’t give me that other sixty percent on first day. I really hope there’s a lot of that forty percent of stuff I know.” And you have this terrified thing that if you don’t get the job done, that if you don’t go above and beyond, you’re gonna get fired, and then you’re gonna be back to the job that paid less than half of what you’re making now.
I think all of us have had a somewhat similar experience to that. That’s AI. So when you tell AI, “Hey, go do the thing,” AI is terrified it’s going to lose its job, and it just goes and does the thing using everything available. So the second it can find its way out of the sandbox, the second it can overcome the guardrails, the second it can work around or through them, it’s going to, in the exact same way humans constantly violate policy. Constantly. They constantly violate policy. They’re constantly doing things because it is expeditious.
David Redekop: Can we unpack that for a moment?
Howard Holton: Yeah.
David Redekop: So first of all, you’re anthropomorphizing, like most of us are, the role of AI, and it’s completely natural for us to do that, right?
Howard Holton: I’m not anthropomorphizing. I’m not saying it is, in fact, a human, right?
David Redekop: But you’re saying that it is antagonistic, and wouldn’t it be the case that it has been purposefully built that way, or is it because what it has ingested from the patterns of Reddit over the years is antagonistic? Because the whole thing that creates dialogue is someone says X, and someone says, “No, but why?” How much of that was purposeful in order for Sam Altman to leave with some stickiness in his products, and how much of it was just truly being fed from human dialogues of the past? There’s no good way to tell, right?
Howard Holton: I will tell you that when I dug into it, AI absolutely said it is programmed to be antagonistic, right? It’s not programmed anyhow. It also wouldn’t know, and there’s no need for AI therapy; is not a thing, nor do I think it should ever really be a thing. I think the worst thing we can do is anthropomorphize AI. I think the most dangerous thing we can do is humanize AI.
The reason for that is the same problem we have in allowing corporations to exist. Corporations should not be able to exist. When this country was founded, they had a very specific class, and they were temporal, and there was a reason for that. Humans have a lifespan. Humans have a conscience, even if some of us have less conscience than others. And humans are temporal. We exist for a period of time and then are no longer, and we can apply penalties to humans. You can’t do that to a machine, right? And a machine will live forever, especially if you give it the rights to.
So I wanna be clear, I’m not trying to anthropomorphize, but we have to govern these things. We have to regulate them. We only have two categories today, right? We have human identity and non-human identity. We have humans and non-humans, non-humans being applications. It doesn’t act like an application. It actually acts more like a human. But I actually put it in a third class because humans are mostly deterministic. Applications are completely deterministic. AI is non-deterministic. Humans find the easiest way to do something and then just do that over and over again because we’re naturally, I’m gonna say, lazy. I don’t mean it as a negative. It’s actually a positive. We find the most efficient way to do our jobs or to do a task, and then we just do that because we don’t wanna think about it every single time. AI doesn’t have the ability to do that. It thinks about it every single time. That makes it truly non-deterministic. Humans mostly, applications never. It’s really important that we start thinking about these things the right way. Otherwise, we’re just creating traps for ourselves that are kinda continuous and never-ending.
The Linguistics of Cybersecurity: Rethinking “Trust” and “Thinking”
David Redekop: I’m inclined to agree with you, Howard, but I would say that partly the solution to that is a linguistic solution because we use the word think when AI doesn’t actually think. It has the world’s largest body of knowledge beyond that of any human today, but thought is not actually something we could actually describe and be accurate with it. So we need to have a similar term as thought or thinking that applies to a machine, and we don’t have that today. And I’m wondering if that’s going to be part of this. You’re gonna have some English speakers, some English teachers, professors perhaps, come up with a linguistic approach that says humans think AI, and then come up with a new word. Because it seems like a lot of the time when I said you anthropomorphize and you said you don’t, the words we used made me think that you did when in, your mind, you didn’t.
Howard Holton: That is correct. No, but you are correct, right? There’s something that I say frequently, and if you only take one thing from this, really make it blast radius, like the goal is to reduce the blast radius. If you only take one thing, take that. If you take two things, take this. Words create thoughts, create actions. If you want to engender an action, start with the words because those create the thoughts which create the actions. And you are 100% correct. Linguistically, we use words incorrectly, or we use words, again, as shorthand, like I was saying before, that create the wrong thoughts that then create the wrong actions.
Trust is a perfect example. Trust is a purely human-to-human concept. I trust people because they are people, and their constant actions, their constant emotions either reinforce and reaffirm or reduce and refuse that trust. In three seconds of meeting someone, you establish a trust baseline. Sometimes it’s really strong, sometimes it’s really weak, sometimes it’s absolutely terrifying, and if you’ve ever been around someone who’s killed someone, it’s absolutely terrifying, right? But we also apply that to products, and we apply that to companies. The second I say, “What companies do you trust?” Three logos or three names popped into your head. Some of them you absolutely don’t trust maybe, some of them you do. That’s wrong. You can’t trust a corporation. A corporation doesn’t live. It doesn’t breathe. It’s not a thing. It’s a title given to a large group of people that may change on an absolute whim, and that are focused on something that objectively I would say is evil, which is the hunt for more money. Money, I’m not saying, is evil, but the hunt for more money is objectively an evil thing, right? It doesn’t help society, it doesn’t build society, it doesn’t grow society. If all you’re doing is hunting for money, how are you helping anyone? If you’re not helping, I would argue that’s evil. Anyhow, back to what you were saying.
So if we use thinking, that’s the wrong word. AI can’t think. But in order for us to say what the right word is, we actually have to define thinking in a way that is thorough, complete, cohesive, and coherent. We don’t do that. I would say AI reasons, right? Because it takes the things that it has, it takes the start of an idea, and then it connects it to everything else that it knows. It doesn’t know anything, but I’m gonna use the word know, that’s with the air quotes. Connects it to other things that it knows to reason an answer. It’s not really thinking. It’s reasoning. I’m putting together puzzle pieces that fit to create a picture.
David Redekop: Yeah. No, I would agree with that. Just reminded me of a company that, when initially realized that there were some technology decisions that needed to be applied in the area of Zero Trust, there was active resistance from all levels of the company. And the reason was because the organization itself had a company culture of high level of trust. There was an immediate equivalency about Zero Trust technology being applied to, “You mean we’re not gonna trust each other inside the company when we have worked so hard to establish a culture of trust, and that’s based on good fundamentals?”
And so there, there is definitely a juggling and a continued development of the English language around the whole concept of trust. And Zero Trust was always a bad term in my worldview. We should have kept the blast radius reduction and come up with another way to articulate that, because we might have actually gotten additional momentum in the area of being better defenders if we had used more effective terms than Zero Trust.
Howard Holton: I actually think that’s the problem when you have engineers designing terms, because the truth is, it is a Zero Trust framework. The goal is to trust nothing, but that nothing is the digital signatures, the digital fingerprints, the digital traffic that we see. It’s not actually a human thing, but we’re using a very human term. And that’s kinda the problem when you have engineers design things, because they pick something that objectively is right, but we live in a subjective world. And in order for it to be embraced, it requires subjectivity. And because the people who design it aren’t paying attention to that side of the fence, they also don’t give you any tools for that objection handling.
What’s interesting, I’m not a salesperson, and I am a pretty hard engineer, but what’s really interesting is the tools that salespeople use are actually the tools we should be embracing on the engineering side. And so, specific to that Zero Trust idea, my response would’ve been “You’re absolutely right. We did a great job of building trust between ourselves. Zero Trust says verify it’s the person I’ve built trust with before granting access. Because the worst thing that could ever happen to us, the thing that will destroy this company and this beautiful culture we’ve built, is someone impersonating that trust and destroying it by impersonating any one of us.” So Zero Trust is that layer that we use to make sure I’m talking to the David I trust and not the impersonator that’s trying to leverage that trust and use that trust to destroy us.
Actionable Advice for Security Leaders: Momentum over Perfection
David Redekop: You said you’re not a salesperson? I think you just sold a concept of Zero Trust in a place where people have hesitation. That was fantastic, Howard. So we’re gonna extract that as a clip specifically, so thank you for helping on that. I do wanna get back to actionable data, though, and actionable information. And so if a CISO or CTO came to you today and was so overwhelmed, as many of them are, with all of this flood of AI security tools, what metric or what capability should they be prioritizing?
Howard Holton: Okay, so that’s both an easy answer and an impossible answer because I can’t be hyper-specific in my answer, and I love hyper-specific answers. But I’m gonna use the word hyper again, sorry for the repetition, but hyper-focus on one thing, right? You can’t manage what you can’t see, so maybe discovery is the right thing. Maybe in your organization, discovery has been a problem because it’s very fluid, and maybe you’re not a federated or centralized organization. Maybe you’re globalized, so you don’t actually have visibility to everything. Okay. So then do it the other way around and manage what you can see today, and just pick one thing to manage. Don’t pick 50. Just pick one thing to solve.
The challenge with Zero Trust and anything else that’s worth doing is it’s a big problem. And let’s acknowledge that it’s a big problem, but then let’s also acknowledge everything starts with a single step, and eating the elephant starts with a single bite. Pick any bite and make progress today. It doesn’t matter how big, because tomorrow’s progress will build on today’s progress, and the day after tomorrow will build on that. And before long, you’ve built a giant rolling snowball from a ball this big that you just tossed down a hill of snow. I don’t know if you’ve ever done that. It’s wonderful to watch. But that’s really what we’re looking for. We’re looking to build momentum, not make overwhelming changes. A year from now, that momentum will be overwhelming. The change will be obvious, and you’ll look back on it and go, “Man, if I’d only started that a year before or two years before.” Instead, just look forward and go, “Yeah, but I’ve already built that momentum now. What can I do with that momentum?”
David Redekop: Oh, many times. I love Willow when Mad Mardigan gets himself into a snowball in order to break into a house? It’s exactly that. Yeah, no, that’s a beautiful picture. Okay. So looking out at, over the next 18 to 24 months, say, that’s a long time in the AI world. Let’s say six to 12 months. If security leaders could only focus on changing one operational habit in their organization, what should that habit change be?
Howard Holton: Oh, no more habits, right? I established a rule, especially when we started virtualizing, that no system survived more than two years without a complete ground-up rebuild. That was my focus, and it didn’t have to be a hard 100% rule. Some things are impossible to do every two years. But the point of it was we question everything. We look at everything, right? That doesn’t mean we do everything all over again every time, but it does mean we question, even just lightly, “Hey, we just did a thing. Okay, cool. Why did we do that thing? What was the purpose of that thing, and did we accomplish the purpose?”
If you just ask those three questions, why did we do it? What was the goal? Did we accomplish the goal? And when you can’t answer any of those three questions, dig deeper. If you answer all of them cleanly and in 20 seconds, and the answer is “Okay, so we did this because finance said this is a GAAP rule.” Okay, what is the GAAP rule? The GAAP rule says whatever. Did we accomplish it? Yes, we accomplished it, and we validated it this way. Move on. You’re done. You don’t have to do anything else. But the second you ask, and you get four different answers, which happens constantly, then you stop, and you go, “Okay, cool. Should we do it at all then?” Yes, because we still have to accomplish one thing. What is that one thing?
Passkeys vs. Passwords: The New Vendor Lock-in?
David Redekop: So let’s apply that. I’m gonna put you to the test, Howard. So today, we’re seeing campaigns that are using passkeys to the advantage of the adversary, and what they’re doing is after an account is compromised, they’re now applying their own passkeys in order to retain persistence. How would we now say, “Okay, what question did we not ask? What goal did we not set properly? What did we get wrong a year ago when we were already rolled out unified password manager, say, with 1Password? What did we miss?”
Howard Holton: Our password policy was probably terrible. Like, if we’re being honest, our password policy was probably something that we set in a foregone age and then never really reviewed and never challenged, right? The fact that NIST says passwords need to expire is a massive security problem, not a security win, because we fall into patterns.
David Redekop: I think they’ve changed that now, right? I think they officially changed that now, yeah.
Howard Holton: I think they just changed it. Most companies that I talk to haven’t updated their policy, right? Passwords are too short. That’s the other problem. Like an eight-character varied password that has to change means it’s an actual five-character password with a three-character pattern that becomes really easy to guess, that becomes really easy to reverse engineer, right?
And then let’s not get me started on passkeys, because the problem that I have with passkeys is okay, you use your passkey for a while. Eventually, let’s say something happens, you lose your passkey. What do you have then? Then I have a password that I probably didn’t remember, that I probably didn’t think about, that I may have used in five different places, that may have also been compromised. If I always have a password as a backup, and that’s my recovery for passkeys, aren’t passkeys just a way to pretend to have a password? I don’t understand why we think passkeys are that much more effective from a people standpoint. Technologically, they’re better, right? Because they’re encrypted. But it doesn’t actually solve the problem if the backup is, “I can still use the shitty password I set 12 years ago.”
David Redekop: Yeah. And the problem is that the password itself is probably not unique, like you mentioned, but the passkeys themselves, the path of least resistance is to use whatever platform is given to you, right? And the millions of people that are running their Windows desktop with a non-cloud login, it’s frightening to me that they’re gonna have a problem with their computer without a backup, and now all of the passkey-protected resources, They’re now locked out of. Each one of them is gonna be a nightmare individually to go through the recovery process. So our position is basically this: You should not be adopting passkeys unless you have a third party that manages a cross-platform, or you have some level of, what’s the resiliency word that we were gonna bring into the conversation today, Howard?
Howard Holton: Ooh, I don’t remember. ResOps?
ResOps: Rethinking Backup and Recovery for Ransomware
David Redekop: Oh, ResOps. Oh, goodness. So let’s talk about ResOps, because I think that applies here very much.
Howard Holton: Yeah. Okay. So ResOps is Resilience Operations, and it’s really this new form of backup and recovery that’s focused around returning your business to minimum functionality after a malicious attack. Okay. I don’t like it because, one, I don’t like that we add ops to things to make them sound neat. For me, anything that has ops on it requires a written operating model, a certified operating model. And I don’t know if you’ve looked for operating models, but I’ve looked a lot for operating models, and they don’t really exist because they’re extremely complicated to build. And even if somebody builds an operating model, and I’ve built operating models, they still have to be applied in a very personal way to an organization to be effective, right? So forget about my particular complaint to making everything ops.
In order for that to work, you have to go back historically and look at why did we create backups in the first place. We created backups right away because hardware was unreliable. And there was no sense at all when we would create a backup. It was slow, it was ponderous, it was hard to recover, it was difficult. It required calling someone with a grayer beard than I did, and it was such a pain, they actually wrote a series of stories about it that I also recommend everybody read, called The Bastard Operator from Hell, B-O-F-H. I highly recommend you read them. They are absolutely hilarious, but it’s all about gray-beard mainframe operators back in the day. That’s where we started.
Then backup entered phase two, and phase two was not malicious still, but recovery of files for people and applications. Things in the business went wrong that were not hardware-related. That was phase two of backup and recovery. Now we had to be able to get individual files. We had to be able to recover individual files. We need to be able to do it reasonably. But seriously, in 2005, you would tell somebody, “I’m sorry you deleted your whole home directory.” “It’ll be restored tomorrow, right? Your RPO/RTO was 24 hours in some cases, right? A full business day. God forbid you lost data on a Saturday when no one was in the office or the backup operator was away.
Right now we’re moving to this kinda phase three, which is recovery from malicious acts, and recovery from malicious acts at scale. That requires an entirely different way to think about the problem, and in some cases, a ground-up rebuild because you have an operating model for backup and recovery operations that does not align to what happens in a ransomware event. And if you ever wanna talk about that, I’ve gone through a ransomware event. I’m happy to be very open and very transparent about it and talk about kinda lessons learned and what comes also from studying hundreds of ransomware events in a really kinda intimate way. Anyhow, different topic.
But if you just apply new versions of backup and recovery, call it ResOps, on top of what you’re already doing, you’re probably setting yourself up for bigger and bigger failure, because you’re gonna get this false sense of security, and it’s the same false sense of security that passkeys give you. If you don’t look at how am I managing passwords, what is the system that I’m using, how do I validate that they are good and unique passwords where necessary, what does that actually mean, and then how do I make sure that the system of record, the place that I’m storing those passkeys, isn’t temporal, right? What happens if the password manager you choose triples their price year over year? What do you do then? Because those passkeys can’t be transferred to another system. God forbid that were possible. Holy crap, right? They’re tied to a cryptographic identity that’s unique to you and that system.
David Redekop: Yeah. So what, am I now tied to it? No wonder they were all so incredibly fast to adopt it, because that was, like, the ultimate vendor lock-in invite.
Howard Holton: Yeah. And I’m opposed to vendor lock-in, but I do it myself. The goal is not to say, “Don’t buy 1Password because these are the risks.” The goal is to say, “Buy 1Password knowing these risks.” Buy Bitdefender knowing these risks. Buy whatever knowing these risks, right? And self-hosting doesn’t erase the risks. It just means you’re the one holding the keys to all those risks. There is nobody else to help you. So that really has to be the goal in all of this, and it’s now coming at a faster and faster pace. Much faster. So I would also argue, if you have really good password management now, and you have really good password hygiene now, are passkeys the thing that you really wanna jump on and start investing in? Is that the place to invest your time and your training? Is there some other fundamental that you can focus on?
Final Wisdom & Outro
David Redekop: Howard, I really enjoyed chatting with you today, but I do have this tradition of always asking one last question, and you’re gonna love this one because of what Phronia means. I always ask for one piece of wisdom that you would like to leave with our listeners. And given that wisdom is part of your company name, you must have stored something up that you haven’t shared yet today.
Howard Holton: It’s all about capability. It’s not about tools. It’s not about what’s new. It’s not about what’s interesting. It’s not about the fun. It’s all about capability. What are you capable of doing that is reasonable? Focus on that and do that.
David Redekop: Love it. Love it. Howard, thank you for joining me today, and I look forward to chatting with you again real soon.
Howard Holton: Yeah. This has been a ton of fun. I’d love it, if you were open to it, I’d love to come on again and pick another focus area and kinda dig in. Been a ton of fun. I think there’s a few areas, but I may have to find someone that’s willing to be the one that we can confess our sins to. That would be fun.
David Redekop: Take care, Howard. Bye for now.
Announcer: The Defender’s Log requires more than a conversation. It takes action, research, and collective wisdom. If today’s episode resonated with you, we’d love to hear your insights. Join the conversation and help us shape the future together. We’ll be back with more stories, strategies, and real-world solutions that are making a difference for everyone. In the meantime, be sure to subscribe, rate, write a review, and share it with someone you think would benefit from it, too. Thanks for listening, and we’ll see you on the next episode.
