Episode 11 of The Security Podcast of Silicon Valley came out on December 28, 2021, with Jon McLachlan hosting. The guest was Robert Rounsavall, co-founder and president of Trapezoid Inc., which builds tools to monitor the integrity of firmware (Podbean, Apple Podcasts, Spotify, LinkedIn, Trapezoid). The episode is called “Robert Rounsavall, Co-Founder of Trapezoid Inc., Firmware to Frontlines.”
Two threads run through the talk. One is firmware: what happens when hardware arrives already compromised, and how a question on a data center tour became a product. The other is endurance. Robert compares a startup to an ultramarathon, a race where the wall comes more than once.
This page follows the conversation in order: a section for each part of it, sixteen figures, nine clips from the tape, a post from Robert’s LinkedIn, the full transcript, and five tools: a quiz, a scorecard for firmware visibility, a calculator for firmware that goes unchecked, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.
From the Navy to the server room
Jon opened with Robert’s time in the U.S. Navy, and thanked Robert for that service.
“So I did four years active and eight in the reserves.”
Robert Rounsavall, at 2:29
Robert served as a military linguist. LinkedIn lists the role as a Navy crypto-linguist and chief petty officer, with the Navy Reserve from 1996 to 2008 (LinkedIn). Wikipedia describes the Navy’s cryptologic technicians as a rating that supports national intelligence work, with an emphasis on cryptology and signals intelligence (Wikipedia).
Security came after the Navy. Robert’s first job out was server support. The next was technical product manager for a remote access product, which Robert described as a pcAnywhere-style remote desktop tool. Wikipedia describes pcAnywhere as a discontinued Symantec suite for connecting to a remote computer (Wikipedia). LinkedIn dates the product manager role from 2002 to 2006.
Bank security teams on the line
The remote access product had centralized authentication and some security features, and those features won big customers. Robert named UPS and Walmart, and some banks used it too.
Then security teams from different banks started joining the calls, over and over.
“I better start thinking about and getting smart on security.”
Robert Rounsavall, at 4:22
That was the turn toward security. A few years later, a friend Robert met through SANS training spent about a year recruiting Robert to Terremark. Wikipedia describes the SANS Institute, founded in 1989, as a research and training organization for information security (Wikipedia).
Incident response at data center scale
Robert described Terremark as a big data center with 750,000 square feet of servers. A small security team there had a contract to do incident response for some of the biggest companies in the world.
“we probably worked between 80 and 120 data breach incidents a year.”
Robert Rounsavall, at 5:12
After Terremark bought another company, Robert built Terremark’s security operations center and handed it off. LinkedIn lists Robert as director of product development at Terremark from 2007 to 2011, responsible for its security product portfolio. A patent from those years names Robert as a co-inventor of a security appliance that runs a virtualization environment at a company’s site, so its security functions can change after it ships. It was filed in 2009 and granted on January 6, 2015 (Google Patents).
Wikipedia traces Terremark to the NAP of the Americas, a large data center and internet exchange point. Verizon announced a deal to buy Terremark on January 27, 2011, and closed it on April 12, 2011. In 2016, Verizon set out to sell its data centers to Equinix, and in May 2017 it sold Terremark to IBM (Wikipedia). On the show, Robert remembered the data centers being sold off several years after the Verizon deal.
Cash or equity
The Verizon deal was a big exit. Robert’s place in it:
“I was one notch down from where it was really meaningful.”
Robert Rounsavall, at 5:46
Jon asked what meaningful meant.
“I didn’t really have any equity or anything.”
Robert Rounsavall, at 5:56
Plenty of people did well on that exit, Robert said, and for Robert it wasn’t life-changing. Jon answered with the rule Jon gives as a mentor, when an offer weighs more cash against equity:
“if you can swing it, like, I always advise to go for the equity.”
Jon McLachlan, at 6:39
Later in the talk, Robert came back to that rule, and Jon added the condition behind it.
“We all have different life situations.”
Jon McLachlan, at 26:05
A race with several walls
Jon asked for one truth most people miss. Robert’s answer was about startups: they’re far from what most people picture. People compare a startup to a marathon. Robert compares it to an ultramarathon. In a marathon:
“you might hit the wall once.”
Robert Rounsavall, at 7:39
Pain and suffering come five, six or seven times in an ultramarathon, Robert said, and a startup has several walls too. From inside a startup, it can feel like everybody lives this way, until you talk with friends who earn a W-2 wage or work as consultants.
Wikipedia defines an ultramarathon as any footrace longer than the 42.195-kilometer marathon (Wikipedia). Hitting the wall is the sudden fatigue of an endurance athlete whose glycogen runs out (Wikipedia).
Why anyone runs it
Jon pushed on the obvious question.
“why would anyone put themselves through that?”
Jon McLachlan, at 8:09
Robert would do it again.
“the next time I do a startup, I get to make all different mistakes”
Robert Rounsavall, at 8:28
Building something new with a team, something that solves a problem, is fulfilling and challenging, in Robert’s telling.
“there’s just not a feeling like it.”
Robert Rounsavall, at 8:42
It is also a step into the unknown, unless you’ve done it before. Trapezoid was Robert’s first startup.
Years too early
Jon listed what a founder can’t know at the start.
“You don’t know if the market is going to react to products like the way that you think it might”
Jon McLachlan, at 9:18
Sales, messaging and marketing to the right buyers are all open questions too. Timing came up next: early, too early or too late. Robert said where Trapezoid landed:
“we were years too early”
Robert Rounsavall, at 9:38
At the time of the episode, the traction Trapezoid expected five years earlier was finally arriving.
Crewing at Badwater
Jon asked whether the ultramarathon was a figure of speech. Robert has run about 20 ultras, including a couple of hundred-mile races. Robert’s own rating: a solid mid-pack runner. Robert also crews for other runners, twice at Badwater and once at the Bigfoot 200.
Wikipedia describes the Badwater Ultramarathon as a 135-mile race from 282 feet below sea level in Badwater Basin, in Death Valley, to 8,360 feet at Whitney Portal. It runs every year in mid-July, when Badwater Basin can reach 130 degrees Fahrenheit (Wikipedia). Robert crewed it in 2018, one of the hottest on record by Robert’s account, with nights near 110 degrees.
Robert sees a likeness between the people who run these races and the security and startup communities.
“it’s a small group of people that you kind of see the same folks over and over”
Robert Rounsavall, at 10:37
Why start running them at all?
“The reason I started doing it is I didn’t know if I could finish or not.”
Robert Rounsavall, at 10:55
Jon took the thread to teams. Ultras and startups both take a form of crazy, everyone has their own, and the differences make a team interesting.
“everyone is going to see the same problem a little bit differently.”
Jon McLachlan, at 13:23
A question on a data center tour
Jon asked for Trapezoid’s founding story. Starting a software company wasn’t the plan.
“it was not my idea to start a software development company at all.”
Robert Rounsavall, at 15:03
The plan was to take the capabilities of Terremark’s security operations center to other service providers, and consulting paid well in the first year or so. Those capabilities were unusual. Robert credits the team behind the Volatility memory tools, who worked at Terremark at the time, as some of the best incident responders on the planet. Wikipedia describes Volatility as an open-source memory forensics framework for incident response and malware analysis (Wikipedia). Terremark put some of those capabilities into its cloud platform, so a customer could get memory as well as logs.
While still at Terremark, Robert walked two security people through the data center. One of them asked a question Robert couldn’t answer.
“but what happens if you guys buy equipment and it arrives already compromised?”
Robert Rounsavall, at 16:35
The follow-up: what if you throw away the hard drive, put in a new one, and the system is still compromised?
“I have no idea. That’s a great question.”
Robert Rounsavall, at 16:51
The team put some procedures in place. The question stayed with Robert for a couple of years.
Wikipedia explains why a new drive might not help. A firmware rootkit hides in device or platform firmware, such as a router, a network card, a hard drive or the system BIOS, because firmware is not usually checked for code integrity. In March 2009, researchers published a BIOS-level rootkit that survived a disk replacement and an operating system reinstall (Wikipedia). A supply chain attack can tamper with hardware during manufacturing or distribution (Wikipedia).
NIST’s Platform Firmware Resiliency Guidelines, SP 800-193, came out in May 2018. They describe three jobs: protect the platform against unauthorized changes, detect the changes that happen, and recover quickly and securely (NIST). Checking whether firmware has changed is the detect job.
Servers on the doorstep
The answer started with a phone call. Trapezoid had done some work with Intel, so Robert called a contact there about the hardware security features Intel was building. The next week, a stack of servers arrived. Trapezoid’s CTO wrote code that took the hardware security capabilities of a recently released Intel chipset and fed them into McAfee ePolicy Orchestrator, a tool the CTO knew well.
“This was right after Intel acquired McAfee.”
Robert Rounsavall, at 17:44
Wikipedia dates that purchase to February 2011 (Wikipedia). The mix of Intel’s hardware with McAfee’s security software got Intel excited, and Intel took the team to RSA to show the proof of concept. The following week came a meeting with the Marine Corps’ CIO, a general Robert knew from an earlier incident response job.
The episode doesn’t name the chipset feature. One feature of that era is Intel’s Trusted Execution Technology, which uses a Trusted Platform Module to measure software and platform components, so management tools can decide what to trust (Wikipedia).
At the end of the presentation, the general had a question, and Robert gave the honest answer.
“And I said, well, sir, it’s not a product.”
Robert Rounsavall, at 18:18
Jon asked why Robert hadn’t pointed to the signature line. Robert’s lesson from that day:
“I’ll get you a quote.”
Robert Rounsavall, at 18:32
The red face test
A few moments like that one convinced the team there was enough for a product. The product had to pass what Robert calls the red face test, and its job was clear:
“something to validate the integrity of firmware on a system.”
Robert Rounsavall, at 18:45
That is how Trapezoid moved from consulting to software. At the time of the episode, Robert summed up the result:
“now we have a platform that checks the integrity of firmware for systems.”
Robert Rounsavall, at 18:58
Jon asked what the red face test means. Robert’s answer had two parts. The product had to be
“not just a cool science project capability”
Robert Rounsavall, at 19:10
It had to be something a buyer could look at and think:
“there might be an actual product here.”
Robert Rounsavall, at 19:16
Trapezoid’s About page tells the rest. The company was founded in 2012 and first focused on x86 servers, to secure cloud production environments. Customers wanted that view below the operating system across the whole enterprise, so the team rebuilt the platform to take data from any type of device, whether IT, OT or IoT (Trapezoid). The product is Trapezoid FIVE, short for Firmware Integrity Verification Engine (Trapezoid).
No single best day
Jon asked for the best day in Trapezoid’s ten years. Robert reached for the ultramarathon again: little bursts, second and third winds, and no single banner day. The wins came in small pieces: customer acceptance, a big project, a little money raised.
The hard moments are easier to recall.
“You don’t remember the people who encourage you. You remember the people who poke at you a little bit along the way.”
Robert Rounsavall, at 20:08
The recent wins, at the time of the episode:
“we’ve had a couple of wins in the federal space, and we’re starting to get a couple of commercial wins.”
Robert Rounsavall, at 20:18
Jon noted those wins are hard to land. Robert listed what they take: certifications, contracting and all the rest.
Trust your gut
Then the worst day. Like an ultramarathon, Robert said, a startup has several stretches where you think you’re down and out.
“And it also comes to listening to your gut.”
Robert Rounsavall, at 21:10
A year or so into the company, a board member suggested bringing in a new CEO, a well-known executive from a large company, to help raise money and reach a big valuation.
“But there was something in my gut that told me no, but I listened to the board member.”
Robert Rounsavall, at 21:37
The company ran out of cash, and the board heard that Trapezoid had no product. That damaged Trapezoid’s credibility with the board and with the people who had helped it get started. Robert’s reply to that verdict came years later:
“three patents later in the space”
Robert Rounsavall, at 23:08
Trapezoid’s product overview from April 2021 lists three US patents (Trapezoid).
Responsible and accountable
Jon described what a founder gets that an employee of a large company doesn’t.
“So you’re never going to learn that much in a big company.”
Jon McLachlan, at 25:00
In a large company, Jon said, you play your part. In a startup, you see everything, own it and answer for it, from zero to one and then from one to N. Robert put the draw in two words:
“I wanted to be responsible and accountable”
Robert Rounsavall, at 25:34
Robert credits the military training and the ultramarathons with some of the preparation. On when to start, Robert had no formula:
“I don’t know if there is a best time or a right time”
Robert Rounsavall, at 26:43
“I always wanted to have my own thing, but the opportunity didn’t present itself until it presented itself.”
Robert Rounsavall, at 26:47
Jon called life a series of choices, and went back to the race.
“You just have to keep putting one foot in front of the other.”
Jon McLachlan, at 27:12
From the lab to the field
Jon asked what success looks like for Trapezoid. Robert’s list at the time: accounts close to signing, maybe a few small acquisitions of teams and talent, and more commercial wins after the federal ones. Then the partnerships. Agencies and universities were doing research that Trapezoid was looking at partnering on.
“the only people that can use it are PhD data scientists”
Robert Rounsavall, at 28:29
The goal was for an E5 operator in the field, or a SOC analyst, to be able to validate the integrity of a system.
“I love that you’re aiming to bridge that gap between invention and innovation”
Jon McLachlan, at 28:46
Jon’s line matches how Wikipedia separates the two: innovation is more apt to involve putting an invention into practice, where it makes an impact (Wikipedia). Robert’s own description: an operations person.
“I love operationalizing stuff.”
Robert Rounsavall, at 29:45
The firmware and hardware validation research, in Robert’s view, brings a lot, and it needs the operational piece.
Start sooner
Jon asked for parting thoughts.
“if you have been thinking about doing a startup, and it is something that’s been eating at you for a long time, it’s always going to be there.”
Robert Rounsavall, at 30:16
Robert wishes the start had come sooner, and is glad it came.
“You need to step out and try it.”
Robert Rounsavall, at 30:36
Jon agreed, and said risk comes with it.
“There’s never going to be a perfect time to start a new company.”
Jon McLachlan, at 30:53
To close, Robert described the podcast Robert hosts: interviews with security professionals about how they got where they are and what it takes to get ahead in the field. Apple Podcasts lists it as The SynAckFinAck Podcast, hosted by Robert (Apple Podcasts).
What happened after the tape
Jon on Robert’s show. On February 9, 2022, six weeks after this episode came out, The SynAckFinAck Podcast published “Data Encryption In Cyber Security with Jon McLachlan” (Apple Podcasts). Robert hosted, and Jon covered encryption for data protection.
Robert’s work since. LinkedIn still lists Robert as co-founder and president of Trapezoid, a role that began in January 2012. Since January 2023, Robert has also consulted with CyberGeist Security, and since February 2025, advised LoopStudio (LinkedIn).
Still learning. On October 29, 2026, Robert wrote about filling knowledge gaps after a long career in security: “You will never run out of stuff to learn in cyber.”
Robert on filling knowledge gaps while keeping up with AI.
Robert Rounsavall · October 29, 2026
Hardware on this show. Episode 94 had Jim LaRoe of Symphion on printers left at factory defaults, with firmware and end-of-life devices among the topics. Episode 103 had Roei Ganzarski of Alitheon on why zero trust stops at the hardware.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript or its section.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What pulled Robert toward security after the Navy?
b. "I better start thinking about and getting smart on security." Transcript, 4:22.
-
How many data breach incidents did Terremark's small team work in a year, by Robert's count?
c. "we probably worked between 80 and 120 data breach incidents a year." Transcript, 5:12.
-
Why does Robert compare a startup to an ultramarathon?
a. Pain and suffering come several times in an ultramarathon, and a startup has several walls too. See A race with several walls.
-
What question on a data center tour stayed with Robert for years?
b. "but what happens if you guys buy equipment and it arrives already compromised?" Transcript, 16:35.
-
Where did Trapezoid's CTO send the hardware security data from a new Intel chipset?
c. Right after Intel bought McAfee, the CTO fed the chipset's hardware security capabilities into ePolicy Orchestrator. See Servers on the doorstep.
-
What does the red face test separate?
a. "there might be an actual product here." Transcript, 19:16.
-
Who did Robert want to be able to validate a system's integrity?
b. Research that only PhD data scientists could use, made usable by operators and analysts. See From the lab to the field.
Can you see your firmware?
Eight questions on whether you’d notice a change below the operating system, built from the episode. Each tip links the section behind it.
Scorecard · eight questions
Can you see your firmware?
Answer for the servers, laptops and network gear you'd least like an attacker to own. If two answers fit, pick the lower one.
-
Do you keep an inventory of firmware versions?
- No
- For some device types
- For every device type, kept current
"something to validate the integrity of firmware on a system." See The red face test.
-
When new hardware arrives, do you check its firmware before it goes into service?
- No
- Now and then, by hand
- Every time, against a known-good version
"but what happens if you guys buy equipment and it arrives already compromised?" See A question on a data center tour.
-
Do you have known-good baselines to compare firmware against?
- No
- For some vendors
- For every model we run
Firmware is rarely checked for code integrity, which is where a rootkit can hide. See A question on a data center tour.
-
Does your incident response plan cover an infection that survives a new drive or a reinstall?
- No
- We'd call the vendor and see
- Yes, with steps and owners
"I have no idea. That's a great question." See A question on a data center tour.
-
How do firmware updates get applied?
- Rarely
- When a vendor pushes one
- On a schedule, with a check after each install
NIST's three jobs for platform firmware are protect, detect and recover. See A question on a data center tour.
-
Do you use the hardware's own security features, such as secure boot or measured boot with a TPM?
- No
- On some devices
- On every device that supports them
"This was right after Intel acquired McAfee." See Servers on the doorstep.
-
Do firmware changes show up where your other alerts do?
- No
- In a separate tool
- Yes, next to the other alerts
"now we have a platform that checks the integrity of firmware for systems." See The red face test.
-
Can a SOC analyst run a firmware check without a specialist?
- No
- With help
- Yes, it's in the runbook
"the only people that can use it are PhD data scientists" See From the lab to the field.
A change below the operating system would go unnoticed today. Start with an inventory of firmware versions and a check on new hardware as it arrives.
Part of the fleet is tracked. Add known-good baselines, and write the firmware case into your incident response plan.
Keep the checks on a schedule, and keep the results where your analysts already work.
How much firmware goes unchecked?
The calculator counts the devices and updates nobody checks, starting from the tour question in A question on a data center tour.
Calculator
How much firmware goes unchecked?
Five numbers: the devices in your fleet, the new devices you add each year, the share you check on arrival, the firmware updates each device gets in a year, and the share of updates you verify after install.
In a fleet of 1,000 devices, about 180 new devices a year go into service without a firmware check, and about 2,400 firmware updates a year go unverified. That is about 49.6 unchecked firmware events a week.
The defaults are placeholders, so swap in your own counts. The math treats every device the same. The first number is the tour question's case: hardware that shows up already compromised and goes straight into service.
From the Navy to firmware integrity
Robert’s path, Trapezoid, the field around them, and this show. Filter by topic.
What to do this week
Five things, in the order of the episode.
- Check new hardware before it goes live. For the next batch of servers or laptops, record the firmware versions and compare them with the vendor’s published ones before the machines go into service, as in A question on a data center tour. The calculator shows how many devices skip that step today.
- Plan for the infection a new drive doesn’t clear. Write down who decides when a reimage isn’t enough, who calls the vendor, and when the hardware gets replaced. Wikipedia notes that removing a firmware rootkit can take new hardware (Wikipedia).
- Map your firmware to NIST’s three jobs. List what protects, what detects and what recovers platform firmware today, using NIST SP 800-193.
- Make the check routine for analysts. Put the firmware check in the runbook, so a SOC analyst can run it without a specialist, as in From the lab to the field. The scorecard shows where to start.
- Get help with it. Our 24/7 Monitoring & Response team watches your infrastructure and responds hands-on, Penetration Testing tests the way an attacker would, and a vCISO can own the program. If you want to talk it through, book 15 minutes with us.