Incidents Are Inevitable. The Chaos Isn't. | Stephen Garcia on BreachRX and Governing Cyber Crisis Response

Russ Fordyce (00:00): Welcome back to the Winner Circle, everybody. I am here today with Steven from Breach RX. They are the latest Fortress Cybersecurity Award winner. And they have invented a completely entire new platform and kind of industry or sub-industry in cybersecurity. And Steven's going to walk us all the way through it. Steven, welcome to the Winner Circle and congratulations on the award. Stephen Garcia (00:00): Thank you, Russ. Appreciate it. look, the award's meaningful because cybersecurity recognition often goes to like the loudest breach or or the biggest vendor. this one is about the work, the sustained, unglamorous discipline of protecting things that matter. and I I'd rather win an award for what we built rather than what happened to us. So thank you. I do I do appreciate it. Russ Fordyce (00:00): Yeah, and it's about results. You know, all all of our programs are about performance and results, you know, and that's what we always tell people is focus on, you know, quantifiable results. You guys had plenty of them. you're in this new, you've kind of invented this new space because, you know, it well, I'll let you tell us about it. Tell us a little bit, give us that elevator pitch on Breach RX and kind of what the platform is. Stephen Garcia (00:01): Yeah, happy to. Look, most organizations, when an incident hits, they have excellent tools for containing it. what they don't have is a governance layer. You know, so something that manages the legal exposure, regulatory deadlines, communications obligations, and accountability trail simultaneously. Rechar X is built for that moment. So when a technical event transitions into an enterprise crisis and you need more than a binder and a conference call, right? That's where we come in, right? So the platform creates a governed, auditable, legally defensible response, you know, process in real time. that's a category that didn't really have a name two years ago. Gartner now calls it cyber incident response management or CERM for short. and BreachRX is one of the reasons, and that's, you know, that's why BreachRX exists. Russ Fordyce (00:01): Now you were new to the company. and you're new to the kind of this role. You're you're in this CISO role, but you were on the kind of on the customer side before. You've been at Western Union, you've been at a bunch of banks, Johnson controls, fan duels, some fun work at Napster. What was it about this platform that made you switch sides? Stephen Garcia (00:02): Yeah, so when I was looking at what becomes part of it, and I think a lot of CISOs, Jim, but I can definitely speak for myself, has a certain toolkit, right? Not necessarily a specific vendor, but what are the things I think are necessary to do the job as effectively and as efficiently as possible? you know, Breach RX came through my attention through Hitch Partners. They had a security dinner that that Mike Piacente company call Sanctuary Dinners. And I met the Breach RX team. And we had a conversation. I was like, this sounds interesting. Let me have another conversation with these folks, you know, outside of this dinner and see what's there. And once I saw what they were talking about, I was like, this is it. This is, you know, when you've dealt with enough incidents, you know, because I've definitely had my share, right? And to be clear, right, each organization defines incidents differently. and not every incident obviously leads into a breach, but the way that this was managed, it was a process. And I very much believe in systems and order, right? And so You know, and you'll see Breach R X talk about that chaos in an incident. That's what I wanted to manage, right? because we can manage that, right? Ins like and we have that tagline, right? Incidents are inevitable, the chaos is not. That's what really got me talking to the Breach RX folks. this is a full circle moment because I, you know, I've not been on this side of the fence before. but I very much believe in what you know Andy Lunsford and the team was doing here. So it is very much my privilege to be here because I can now share. And I was already talking to the folks in my inner circle about this well before this was ever an opportunity for me. So that that's what got me here. Russ Fordyce (00:03): Yeah, now you it well, you bring a very unique perspective to their organization, right? You're on the you were on the customer side. So you know what those organizations are going through. You know, from a just a kind of a high level, walk me through what the incident response actually looked like at one of your prior organizations when a serious event hit. Not in theory, but in the reality. What did the first four hours look like? Stephen Garcia (00:04): Yeah, I so one of the things I've always, you know, told the teams, we have to get our incident response right immediately, right? Because that preparation is very important, right? What we're logging, who's gonna get contacted, right? That's all important stuff because you don't get to log after the fact, right? So you want to make sure you're prepared. Now, what I've noticed over time is that as well prepared as you you can be in terms of like, hey, we got a policy and we got all this stuff, when an incident actually happens. You know, one of the most important parts of that incident response plan, in my opinion, has always been the lessons learned. What did we learn after this one? Right. And so enough of the incidents that I've dealt with have been more about misconfigurations from the inside than it has been like an external attacker. but what I c like it was just scratching at me. I'm like, there's something more efficient that we could be doing here. Like, and I I just couldn't put my finger on it, right? And so chaos is definitely the right word because no matter how well prepared we were. Things would happen and there's human nature. It's like, how bad is this? You know, and then you got the board, then you got XCOM. Like, are we gonna survive this? The leadership has kind of accepted that now. And they're like, okay, you guys kept telling us when. So when this happens, what are we going to do? And I think CISOs have needed to move to that language of resilience. Stephen Garcia (00:06): That's what an incident really is. At the end of the day, there's this trust element behind it. And I think that's what kept gnawing at me is when we dealt with incidents, what was the trust looking like on the other side of that? Did did we show that, you know, we were enhancing trust or was the trust that we were protecting being deteriorated? That that's where I really fell out on like what we were doing with incidents as my main takeaway. So if my sense after it was like I under my leadership, we've degraded trust, I felt like I didn't do my job. Russ Fordyce (00:07): Yeah. Well in in you know, in the marketing and public relations world where I come out of, we have similar kind of playbooks or response plans for, you know, emergency news coming out, you know, bad news coming out. And there's a there was a playbook. And I noticed it more times than not, there was, you know, something big would happen in a negative way, you know, a bad customer announcement or or, you know, stock price doing something weird or, you know, executive misbehavior, whatever it was. And more often than not, you know, step two and a half, you were onto a different plan because of of something that, you know, fouled up the plan. And I'm sure that most organizations believe they have a cyber incident response plan. Why do they fall apart under pressure kind of like the PR plans do? Stephen Garcia (00:07): Yeah. And I think most plans, and some of the ones that I've developed included, run under the assumption that you're going to be dealing with a single incident. So this is why some of my most recent tabletop exercises inject the second and third incident to see how we manage when something's coming from somewhere else, right? You might get one that came in from a sim. What happens if one comes in from a customer? What happens if now with AI, some agent just did what it was programmed to do and someone wasn't expecting it. So that is what's gonna really help you see how well your plan behaves, right? So that playbook, if it's not designed to handle multiple inputs while you're in flight, I think that's where a lot of incident plans kind of fall apart. which is again, this is one of the things that attracted me to Breach RX. I was like, man, these folks really thought this through. and so I'm excited too because I've now the platform allows you to import your own tabletop exercises. So I've got one for inside the company for us to use. Going through those exercises really lets you see how well your incident response really works. Russ Fordyce (00:09): Yeah, and now so you've got this new breach RX tool that's kind of a I think they describe it as a coordination layer, right? It's not detection or recovery, it's this coordination layer. what exactly happens between we know have an incident and we're coordinating an organized response? Stephen Garcia (00:09): Yeah, like you know, we we've been calling it internally kind of incident response fabric, because it does a for me, it does a better job of encapsulating what we're doing here. one of the more important things that the platform does is that out-of-band communication, right? So if you get hit with ransomware, all of your communications channels that are inside the company likely, you know, out of commission. So this privileged out of band communication becomes something that's really important that we offer to our customers because even during something like a ransomware, you can continue to do what you need to do from the incident side. The platform does a really good job of taking in points, saying, hey, here's who's responsible for this. And it's just the organization of making sure everyone's on the same page. Everyone who needs to know is getting alerted, indications when they need to do something, when they need to act. and just as importantly, folks in legal get pulled in at the right time, you know, not too early, not too late. and for regulatory issues, those can make a difference between how much you get fined. Our chief legal officer said something really interesting that stuck with me. He was like, we help you slow down so you can speed up. Go left to go right. Because if you can actually take a moment to breathe and then say, okay, this is what needs to get done, you have what I would call more effective results. Russ Fordyce (00:11): It is, it's funny. I've seen that a bunch of times when people are slowing down and other people speed up. You you mentioned something a second ago that you're you're communicating effectively across these teams. why does that break down so bad from the response to the communications channels, whether it be with legal or the comms team or to customers or the IT team? Stephen Garcia (00:12): Yeah, again, that's going to depend on how fleshed out your incident response and the preparation part is. Like, look, I've been to enough organizations, I've been to enough conferences where we all share like what our incident response policies look like and who's supposed to respond. And either you get it right the first time or you don't, or you don't update it as it goes along. People have exited the company, they're still on a call sheet. especially now in the age of AI where things are gonna move a lot faster, you need something like a platform to help navigate this stuff. I think one of the lessons I've learned the hard way is that speed and security feel like they're in conflict, but they usually aren't. The real conflict is between clarity and ambiguity. When organizations move fast and break things, what actually breaks is accountability. Nobody knows who approved what, who owns the outcome, who caused the failure. So I've learned to build the governance structures before you need them, right? Because in a crisis, you don't have time to design the airplane while you're flying it. Russ Fordyce (00:14): Yeah, and you you came into this with obviously a lot of experience on that customer side. where did you see the clearest evidence before joining Breach RX that the platform was actually working? Stephen Garcia (00:14): Yeah, well so once I met the folks at the dinner, then we had two other sessions. Having names like Ballistic and SYN Ventures behind them, obviously these are not small organizations, right? They tend to pick winners. And then actually seeing the platform, and I was pretty intense when I'm going through a demo and a walkthrough. And the team did a really great job of pivoting whenever I asked the right questions or the wrong questions. Everything I was asking for just got answered quickly. And it it's a shame to say in this day and age when I tell a vendor like, hey, you're doing exactly what you advertise, and that's the compliment, right? Because so few don't. The platform now has 200 plus regulations and legislation from across the world. So there's almost no regulation that we can't figure out. I was about to purchase this thing myself. You know, and the full circle story does give me credibility here. Russ Fordyce (00:16): It's like it's like hair club for men. You're not only the president, you're also a customer, right? Stephen Garcia (00:16): Yeah, not only clients, but also yeah, right. So I think too, and then there was also creative ways because, you know, CISOs get sold to all the time. And of course, if we see something that we like, we almost have never budgeted for it in the year that we're talking to some new vendor. yeah, I was fortunate I was able to get creative because you can use Breach RX's platform for tabletop exercises. Most of us have already had our tabletop exercise budget carved out. So I was able to take from that and say, hey, I've already got that and I haven't done my tabletop for this year. Why don't I use those funds to bring Breach RX in-house. And as I'm talking to customers now, my hope is that they see what I saw when I saw the platform. And understand that this can really make a massive difference in how you operate with any incident. Russ Fordyce (00:17): Well, it's the gaps that kill a business. And what I liked about what I read from your nomination was that Breach RX is actually standing behind financially behind their product too with customers. you do get penalized if you don't react quickly enough. The SEC will fine you, the government will fine you. And it's not insignificant money either, right? So tell us about the warranty that breach RX has come up with. Stephen Garcia (00:18): Yeah, for sure. And we're seeing regulation come out of places like China where if you're mission critical, you got 30 minutes to respond, right? So these manual processes can't keep up anymore. But yeah, the warranty's a big deal, right? Because a lot of CISOs have dealt with this issue, and this is why like Joe Sullivan has been one of the folks who've been talking about the platform. We in the industry know the stories about Joe, about Tim Brown. And so we understand the importance of making sure that we're responding the correct way, making sure we're taking regulations the right way. But there is exposure, right? And those two gentlemen have gone through the phase of where personal liability comes in. So there's about a $3 million coverage instrument tied directly to using the platform. So it protects executives from personal liability arising from any incidents managed through the Breach RX platform. And then this isn't marketing, right? This is a financial safeguard. The anxiety in the boardrooms right now isn't just will we get breached. It's will I personally be held accountable? The SEC disclosure rules, personal liability trends, derivative lawsuits. Executives are exposed in ways that they just weren't five years ago. So the CERM warranty that we're offering addresses that directly. And no other incident response platform has done this. It's the feature that turns a software decision into a trust decision. Russ Fordyce (00:20): Yeah, and it's really telling of the company to stand behind that. You know, I've been in technology for 30 years and we always stood behind four nines or five nines or whatever we were going for in terms of network availability. And the outcomes were you get a credit. So you guys are really standing back and going, well, you know, if this fails for some reason, we got your back financially. Now the company's also leaning heavy into the AI world, right? They've developed Rex AI. It's described as the first gen AI engine built for incident response. Walk us through what Rex AI does and how it's different from regular general purpose AI. Stephen Garcia (00:21): Yeah, for sure. Look, incident response is one of the worst environments for decision making, right? You're under time pressure, information's incomplete, regulators have deadlines that don't care about your fog of war, and you're coordinating people who don't usually work together. So Rex AI is the first generative AI engine purpose-built for that environment. It doesn't just summarize, it guides, right? It gives responders accurate real-time direction based on specific facts of the incident. That matters because the difference between a well-managed incident and a catastrophic one is often whether the right people made the right calls in the first few hours. Russ Fordyce (00:22): Yeah, and I also like that you guys built kind of this executive view. I think they call it mobile command. Tell us about that. It's kind of platform in your pocket. Stephen Garcia (00:22): Yeah, so everything we do on the desktop, we want to make sure that you can do it on the go because I personally have been part of incidents where I got contacted while I was boarding a flight. So having something like the mobile command at my disposal would have made a massive difference. We need to make sure that our customers can deal with this wherever they are, however they choose to deal with it. And most of them prefer mobile. Russ Fordyce (00:23): Yeah, I remember starting this business and kind of needing that kind of mobile on the go functionality. It it's almost mandatory these days, right, that we have these tools in our pocket. I want to read something real quick from your first public statement from Breach RX. You said that the organizations that will survive the next wave will be the ones that can compress the time between knowing and doing across every function simultaneously. What does that next wave actually look like? And where does today's model actually kind of fail to handle it? Stephen Garcia (00:24): So I think a big part of the modern change would be around how AI has shifted things, right? So AI has shifted the conversation from can we detect threats faster to do we even know who's acting inside of our systems? So, you know, we're all deploying AI agents, AI generated code, AI assisted decisions, and most organizations, nobody's mapped the authority those systems have been given. And so the security question isn't just, is the AI safe? It's if this AI makes a bad decision, who owns it? And right now that question often gets unanswered. I think in using this platform, especially when you're doing some of these exercises, you'll realize very quickly we didn't assign this to somebody or who owns it, who's making the call. If your process is manual, I think it's gonna be very difficult for you to keep up, let alone if you're getting concurrent incidents. Russ Fordyce (00:25): Yeah. Now you mentioned something earlier. You said that the definition of incident can be debated. You guys are actually kind of expanding the definition of incident. You're not just talking about these major disruptions. You're also talking about these kind of minor ones too. Talk us about why converging the platform actually makes sense now. Stephen Garcia (00:25): Yeah, because at the end of the day, this is all related to enterprise risk. And information security, cybersecurity has always been a subset of what your overall enterprise risk is. And even if you put this in the bucket of IT, the wrong IT incident can have very a massive disruption to the business, right? What if you lose Slack? What if you lose email? Right? Like, you know, we bottled it under IT, but this is an enterprise platform that we're all using. I think when you work with the business and say, hey, security is going to say if we lose something like Slack, that's not just an IT problem, right? That's an enterprise problem. As CISOs go forward, and I understand that we are a part of the business. We're a function of the business just like everything else. And we're there to help support the business, how those incidents are defined become more business aligned than just, that's a tech problem. Russ Fordyce (00:26): Right. Yeah, because there's a huge cost when your email goes down. I remember we had a brand new IT member join the team and you know, his first job was to go decommission some servers in a data closet and he went in and pulled the power plug on the exchange server that was running and it didn't come up for like three days again. So yeah, it was a very big disruption caused internally. Stephen Garcia (00:27): Oof. Yeah. But so this is what I tried to explain to, you know, when I talk about security for leaders who don't come from a technical background, what I explain to them is this is all about trust management, right? Every customer who gives you their data, every employee who uses your systems, every partner who connects to your network, they're making a bet that you'll treat that access responsibly. The moment that bet feels wrong, you lose them. Security is how you make sure that bet is justified. This is how I explain it to folks. And I think generally when I explain that to them, they get a better sense of what we do. Russ Fordyce (00:28): Now you've been on the customer side for a long, long time. Now you've seen kind of the vendor view. If there's one thing you could tell a CEO or board, something they can do in the next ninety days to reduce the organization exposure before the next breach, what would it be? Stephen Garcia (00:28): Yeah, so one of the things I stopped doing a while ago was speaking in technical language to boards. Boards don't need to understand firewall architecture. They need to understand what are we protecting, what could go wrong, what would it cost, and what are we doing about it. My job is to give them enough clarity to exercise real oversight, not to impress them with the complexity, not to reassure them with theater. Confidence comes from clarity. Not from telling them everything's gonna be fine. So I think that's the message I wanna make sure that the boards understand, my peers understand. It goes a long way when you give the board the confidence to make these decisions clearly. Russ Fordyce (00:28): Steven, thank you so much for joining us. It's been a pleasure talking to you. I've learned a ton. You know, this whole new kind of subdomain of managing responses and coordinating communications, everything makes total sense to me. I'm glad there's something out there like BreachRX. So thank you for joining us. Stephen Garcia (00:29): Thank you, Russ. Truly appreciate you having me and it was great conversation on my end too. Russ Fordyce (00:29): Yeah, and good luck on the new role. Stephen Garcia (00:29): Thank you.