Episode 27 of The Security Podcast of Silicon Valley aired on January 16, 2023, with Jon McLachlan hosting. The guest was Colin Bitterfield, then head of security at People Data Labs (Podbean, Apple Podcasts, Spotify, LinkedIn). The episode is called “Colin Bitterfield - Head of Security (Acting CISO) People Data Labs.”
People Data Labs sells workforce data, on people, companies and job postings, through APIs and data feeds (People Data Labs). Colin ran IT and security there. His view of the job fits in one line he gave the whole company:
“security is here to say yes.”
Colin Bitterfield, at 11:03
This page follows the conversation in order: a section for each part of it, eighteen figures, eighteen clips from the tape, Colin’s post on LinkedIn, the full transcript, and five tools: a quiz, a scorecard for whether your security helps close deals, a calculator for the hours a ready security package saves, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote or retell those words.
From Army Cyber Command to a startup
Jon read Colin’s background from LinkedIn: the U.S. Army Reserves, a staff officer in intelligence and communications, U.S. First Army, and then U.S. Army Cyber Command, as chief of the data collections branch, an operations officer and a senior cyber warfare analyst. He also listed adjunct professorships, and a move to private industry as a principal infrastructure security engineer at Blackboard.
Colin retired from the Army in 2015 and went to the startup world. He had a reason:
“I was tired of working in the basements of buildings and I wanted some windows.”
Colin Bitterfield, at 1:28
At Blackboard he helped spin up the enterprise security division. The company went through FedRAMP certification, and he set up the vulnerability management systems and a hardening guide. Before that he spent five years as a cyber warfare officer, and much of his adult life in the intelligence community. After the war started in 2001, he gave up his civilian career and went back on active duty until 2015. In all, he said:
“I served for 27 years.”
Colin Bitterfield, at 4:26
Jon thanked him for his service, and said the best and the brightest are needed to protect the country, since information and cybersecurity will be a big part of conflicts. Colin’s LinkedIn lists the roles with dates: knowledge management officer at U.S. First Army from October 2007, information assurance officer at Army Cyber Command from August 2010, operations officer and senior cyber warfare analyst from October 2011 to February 2015, and Blackboard from April 2015 to August 2019, where he wrote about half of a FedRAMP system security plan (LinkedIn).
A company credit card on day one
Colin joined People Data Labs to be an engineer. That changed fast:
“And the next thing I know, I’m the head of security running the IT and security department.”
Colin Bitterfield, at 2:39
He said the company’s leadership wanted People Data Labs to lead in security. On his first day, they handed him a company credit card and told him to make it happen and be the best. He spent a fair amount of money in the first couple of months. Jon had heard that story many times, but never on day one.
His LinkedIn lists the role as information systems and security operations manager, from March 2021 to December 2022, with IT and security operations built from the start (LinkedIn). The episode calls him head of security and acting CISO.
SOC 2 in six months, then ISO
The Army trains you to turn short orders into results, Colin said:
“You want to be SOC 2 in six months? Fine. We’ll be SOC 2 in six months.”
Colin Bitterfield, at 3:21
They made it. Then the company went through an ISO certification, and Colin compared the two:
“which, by the way, is about 10 times harder than SOC.”
Colin Bitterfield, at 3:29
For ISO, the auditors interviewed 20 people, and the team showed hundreds of pages of documentation. The auditors came back with a compliment on how well prepared the company was. Colin credited the military habit of being ready for inspections.
SOC 2 is a report from an audit, under standards of the American Institute of Certified Public Accountants, on controls for security, availability, processing integrity, confidentiality and privacy (Wikipedia). ISO/IEC 27001 sets the requirements for an information security management system (Wikipedia). People Data Labs’ security page lists both, ISO 27001 and SOC 2 Type 2 (People Data Labs).
Focus, and a polite no
The military teaches you to stay focused, Colin said, and that helps in security. People want to talk about everything but the issue. What got the certification done was not getting sidetracked, for example by vendors:
“like the 10,000 vendors that call you every week.”
Colin Bitterfield, at 5:18
Colin said he’ll listen to a pitch for five minutes even when he can’t tell what problem it solves. Jon’s version is shorter:
“I give those calls like 30 seconds.”
Jon McLachlan, at 5:33
Colin tries to answer everyone who emails him, if only with a polite no. Jon called it seeing the person behind the hustle, who most likely means well. One pitch Colin remembers came as a cartoon on a whiteboard:
“I love your ad. I don’t need your software, but I love your ad.”
Colin Bitterfield, at 6:15
Entry-level jobs that are entry level
When Colin hired, he read hundreds of resumes himself, whatever the applicant tracking system said, because many people don’t know how to write a security resume. About 14 of his own students applied. He was teaching a program at the time, and he wrote the job descriptions so that a graduate of the program was fully qualified. Students tell him they can’t get hired after a certification, because employers want too much:
“people want them to be a purple unicorn or a dancing squirrel.”
Colin Bitterfield, at 6:58
He put the problem this way:
“the entry-level positions really aren’t entry-level.”
Colin Bitterfield, at 7:03
So he asked for a year or two of IT experience and a wish to break into security, and he hired one of his students. Colin’s LinkedIn lists teaching from 2010 to 2024 at StackRoute Learning, the University of Wisconsin-Madison, ECPI University and ITT Technical Institute (LinkedIn).
One team, and security as the edge
At People Data Labs, Colin said, the whole company works as a single team:
“you don’t need to ask permission to talk to somebody, just go talk to them.”
Colin Bitterfield, at 7:58
That makes for fast action when there’s an issue. The data market is crowded, and the company chose security as the way to stand out:
“our intention to set ourselves apart is to literally be the best in security”
Colin Bitterfield, at 8:13
The aim was for customers to trust People Data Labs, and it paid off. The SOC 2 report and the ISO certification let People Data Labs work with much larger companies, who trust it because it takes the time to do everything right.
Vanta, and the next certifications
Jon guessed the company’s compliance tool, and he was right:
“It was Vanta. Vanta was great.”
Colin Bitterfield, at 8:55
In the year and a half before the episode, Colin said, Vanta had tripled or quadrupled the number of tests it runs, and had moved from SOC 2 and ISO into GDPR and CCPA, with FedRAMP likely next. People Data Labs planned to certify ISO 27017 and 27018 the next year, because of a growing business in Europe. It had hired a head of privacy six or seven months before.
ISO/IEC 27017 adds security controls for cloud service providers and their users, and ISO/IEC 27018 is a code of practice for protecting personal data in public clouds (Wikipedia, Wikipedia). Vanta was founded in 2018 by Christina Cacioppo and Erik Goldman, came out of Y Combinator, and automates security monitoring and compliance work (Wikipedia).
Colin’s summary of the company:
“And we really do everything we say we’re doing”
Colin Bitterfield, at 9:37
Jon liked the candor:
“our most valuable currency is really trust.”
Jon McLachlan, at 9:47
Security on the revenue side
People Data Labs used a second vendor for trust, Whistic, so salespeople could send the SOC 2 report or the ISO certificate to a customer straight from Salesforce. Colin’s department had a philosophy:
“to make security part of the revenue cycle, not just an expense category.”
Colin Bitterfield, at 10:08
About 30% of the team’s time went to answering RFPs, the requests for proposal that buyers send to vendors. Colin said most security people miss what RFPs teach:
“And RFPs are a real valuable lesson for security people to see what your customer wants.”
Colin Bitterfield, at 10:17
In his first month, he read every RFP, put everything a customer had asked for on a list, and made sure the company did it. Now, when a customer asks whether the company does something, the answer is yes almost across the board. The gaps are small. The company’s breach notification window was 48 hours, and some customers asked for 24. People Data Labs’ security page now says it will notify affected people within 24 hours of a determination, for major events (People Data Labs).
Security’s first answer is yes
More than a year before the episode, Colin spoke to the whole company. He told them security was there to say yes:
“Our first answer to everybody in this company is yes.”
Colin Bitterfield, at 11:06
The goal was to help people do what they want, in a secure and responsible way. Because of that, people call security with questions, such as whether an email is phishing, and they don’t hide anything. Colin said that lets his team solve problems before they happen. He contrasted it with the department of no, where people don’t bring an issue up for fear it gets shut down or slows them down. He said the trust now runs to customers and to engineering, product and marketing.
Two kinds of security people
Jon has a joke about this:
“I always like to joke that there’s two types of security people in the world.”
Jon McLachlan, at 12:20
The first walks into a meeting and everyone groans, because they’ll say no, push back on the timelines and ask for more features. The second walks into the same room with the same goals, and the room sees a collaborator, someone who works with the timelines and isolates what has to be in the minimum viable product. That person may still push a date back to fit a critical feature in. Jon said the difference is a relationship built on trust and delivery.
On episode 2, Andrew Gontarczyk, then CISO of Pure Storage, described security as a team sport.
Engineers who help other teams ship
Colin’s engineers help other teams finish. When a team runs behind on a project, or has to add a security control under a deadline, his engineers step in and do the work with them. The company had grown from about 56 people a year earlier to 150. During the ISO audit, the auditor wanted to talk to the leadership team. Colin messaged the CEO on Slack, and the CEO joined the meeting about 10 minutes later.
Colin offers the same help to sales. If a salesperson needs someone to talk to a customer’s CISO, he will join the call, any time, to close the deal.
A third of every sale
Colin’s department aims to shorten the sales cycle by taking away security objections:
“because that’s about a third of most sales.”
Colin Bitterfield, at 14:33
Do you have a SOC 2 report? Do you do this, do you do that? Questionnaires can run to 500 questions. The goal is to answer all of it at the start:
“our goal is to take that away in the first 10 minutes of the customer meeting.”
Colin Bitterfield, at 14:42
That means the SOC 2 report, the ISO certificate and the answers to the Vendor Security Alliance questions, so security questions don’t slow the sale at all. Jon went further:
“You can turn those security teams and those potential customer deals into your biggest champions.”
Jon McLachlan, at 14:58
Colin said about a third of his team’s time goes to helping the sales team. One of the first things he did was write questions and answers for sales, so everyone gave customers the same correct answer, without guessing. The pages say what a SOC 2 report means, what the policies are, and what the company does and doesn’t do. He said security takes more writing than people think:
“You wouldn’t think that there was so much writing with security, but there is.”
Colin Bitterfield, at 15:36
The sales and platform teams backed him for it. Before the SOC 2 audit, with a week to go, everyone in the company had to finish security awareness training and sign off on the policies. The whole company did it in two days.
The Vendor Security Alliance released its first questionnaire on October 1, 2016, built by security leaders from ten companies so vendors could be assessed the same way each time (Help Net Security).
How Colin got into security
Jon asked how Colin first got into security. Colin grew up in a time when hackers weren’t bad people:
“They were people who just wanted to explore the world around them and the technology that was evolving.”
Colin Bitterfield, at 16:33
In the late 1990s, he worked in the internet service provider business and saw misconfigurations causing security problems. He remembered routers from Ascend. Working on an ISP, his team logged into the wrong IP address by accident and found they had root on someone else’s core router. The owner had left the default password on it. They told the owner. Colin put it around 1995 or 1996, and he saw where things were heading.
Next he helped a consulting firm with security as Novell moved from IPX to IP addressing, and he designed their routing and their security. At the same time he served in the intelligence community in the Army Reserve:
“So security and intelligence work together. It’s the same logic.”
Colin Bitterfield, at 18:02
In 2010, he moved from knowledge management at First Army to the unit that became Army Cyber Command, a chance to help stand up a new command. Ascend Communications made dial-up equipment for internet providers and was bought by Lucent in 1999 (Wikipedia). Army Cyber Command was established on October 1, 2010 (Wikipedia).
What it does, and what it shouldn’t do
Jon offered a way to look at it. Quality assurance asks whether a thing does what we intend. Security asks a slightly different question:
“does this thing do things that we don’t intend it to do?”
Jon McLachlan, at 18:56
He said picking something apart to understand it draws many people into the field.
Attackers think like generals
Colin compared cyberattacks to Roman military tactics, with probing and cavalry actions, and said his military training carries straight over. He named a computer wargame, The Perfect General, as a way to see how a hacker looks at a target.
The attacker’s first move is to enumerate and probe your defenses. Colin’s view of hackers:
“Hackers are just people who read the manual better than the owner, most of the time.”
Colin Bitterfield, at 20:20
Most attacks, he said, use known vulnerabilities, where someone forgot the mitigating control or didn’t get to it. He named the Colonial Pipeline attack as an example of a missing patch. Wikipedia’s account says the attackers got in with a compromised password for an inactive VPN account that didn’t have multi-factor authentication, on May 7, 2021 (Wikipedia). The Perfect General came out in 1991 for the Amiga and MS-DOS (Wikipedia).
Colin likened security to riding a motorcycle:
“It’s not a matter of if, it’s a matter of when.”
Colin Bitterfield, at 20:43
The reason, he said, is that an attacker only has to be right once. The defender has a harder job:
“You have to be right every day.”
Colin Bitterfield, at 20:49
Do it right, every day
Doing everything right every day is part of what keeps customers’ trust, Colin said, even after an incident, because you can show you did it right. His team patches and updates everything and runs mobile device management.
Engineers ask him why they need security awareness training when they know what attackers do. His answer is the insurance:
“our insurance won’t pay off if there’s a problem.”
Colin Bitterfield, at 21:35
He needs a report that shows everyone took the training, so the insurer pays and customers keep trusting the company. Every engineer also takes training in secure coding and secure design.
Read your cyber insurance policy
Colin called the company’s insurer and asked what it wanted the company to do. The insurer sent a short list, and the company was already doing all of it. He still checked:
“I don’t know how many security people actually call their cybersecurity insurance company and find out what the requirements are, or even look at the policy.”
Colin Bitterfield, at 22:12
He reviewed the policy, didn’t like it, and asked the CEO for more coverage and a better policy. Part of his job, he joked, is keeping the company off the front page of The Wall Street Journal. He asked Jon how many security people have read the insurance that covers them. Jon couldn’t say, and compared it to car insurance:
“it’s just like you never drive a car without insurance”
Jon McLachlan, at 23:10
Many cyber insurance policies require an IT security audit before the insurer will bind the policy (Wikipedia). On episode 2, Andrew Gontarczyk talked about cyber insurance too.
The security package in ten minutes
When a customer asks to see something, Colin’s team shows it. Vanta let them email a trust report that shows the controls around the clock, and they used it with some bigger customers:
“Every salesperson in our company can send a SOC 2 or an ISO certification in like less than 10 minutes.”
Colin Bitterfield, at 23:54
The NDAs are automatic. The customer usually has all the security documents after the first meeting with sales. It wasn’t always that way. When Colin started, customers sent lists of questions, such as whether there was a disaster recovery plan, and answers went back and forth with NDAs:
“It was taking several weeks to get the customer the information that they wanted to make the decision to buy”
Colin Bitterfield, at 24:42
Now, he said, they rarely hear from the customer a second time after sales sends the security package. Only a big customer with a validation company behind it asks more. He said this shows the value of security:
“a lot of companies look at security as an expense category, not as a revenue category.”
Colin Bitterfield, at 25:12
Helping sales also makes it easier to get funding. If he needs something, he gets it, sometimes after a couple of weeks. Jon said Vanta sounded like an easy purchase to justify:
“It’s a game changer.”
Colin Bitterfield, at 25:36
On episode 64, Daniel Marashlian of Drata told how a customer’s request for a SOC 2 report pulled engineers off the roadmap at his previous company.
Best day, worst day
Jon asked for Colin’s best day at People Data Labs so far. Colin’s answer:
“Tomorrow. The next day.”
Colin Bitterfield, at 25:44
Every day brings something new, he said, and none of it is bad. In the military, part of his work was to imagine what the bad guys would do and solve it first. At People Data Labs, the team tries to stay ahead of what customers and the industry ask for. When a salesperson asks for something, the answer is usually a link, dropped into Slack within minutes. He had the backing he wanted:
“I literally have zero pushback from any engineer on security requirements”
Colin Bitterfield, at 26:32
The leadership team supported the work, too. Jon asked for the worst day. Colin named a hard week, the ISO audit, with long days of preparation the week before. It was tiring, he said, but it didn’t feel bad, and in almost two years he hadn’t had a day he didn’t want to go to work.
Fix it, and fix mistakes together
Colin gives his team a short set of rules. If you can fix something, handle it. If you need help, ask. And if you make a mistake:
“And if you make a mistake, we’ll fix it together.”
Colin Bitterfield, at 27:40
Nobody needs permission:
“If you know how to do it, do it.”
Colin Bitterfield, at 27:47
The result, he said, was IT tickets of every kind closed in about 40 minutes on average. Jon was impressed:
“That’s incredible and almost unheard of.”
Jon McLachlan, at 28:00
As they spoke, the queue had no open tickets. If someone needs something to do their job, they buy it and expense it. People Data Labs is a remote company, with its headquarters in San Francisco and an office in New York for FinTech, and no one has to go in. Half of Colin’s team was on the East Coast and half on the West Coast.
A side project, and four hours on Friday
Jon asked for Colin’s favorite interview question. Colin teaches it to his students too:
“what’s their side project?”
Colin Bitterfield, at 29:14
What do they do in IT that no one requires? Colin does 3D printing and programs Arduinos. Someone without a pet project or a new technology they’re learning is probably not a fit, he said:
“If you love the work, you’re doing that. If you are just doing a job, you’re not doing that.”
Colin Bitterfield, at 29:49
Jon agreed that the best engineers always have a side project or a hobby they poke at to understand it. Colin’s department gives every engineer four hours on Fridays, staffed so there’s always coverage, to learn anything they want, even a database the company doesn’t use:
“But spend four hours a week improving your professional skills.”
Colin Bitterfield, at 30:32
He took the idea from officer development in the Army, where everyone is expected to keep getting better. He pays for online training, and engineers can use an Amazon account to practice:
“But the idea is to be a better professional every week”
Colin Bitterfield, at 31:01
Jon called it a growth mindset. Colin added that he had watched the platform team play Oculus games together after hours.
Amazon’s compliance page as the goal
Colin called People Data Labs a NIST-heavy shop that also follows the best practices of its vendors, including Amazon for its infrastructure. Jon asked what tool or service he wished someone would build. Colin wanted a couple of vendors to grow, and named a target:
“right now we’re focused on that page that Amazon has with all their certifications.”
Colin Bitterfield, at 32:39
Jon agreed it’s a giant page. Amazon Web Services lists its compliance programs there: certifications and attestations such as SOC, ISO 27001, ISO 27017, ISO 27018, FedRAMP and HITRUST CSF, laws and regulations, frameworks such as NIST 800-53, and privacy pages for GDPR and CCPA (AWS). Colin wanted the same set of certifications for People Data Labs. They were planning which certifications to get and in what order: ISO 27017 and 27018 next, then GDPR and CCPA. When he worried about what came next, he said, Vanta had a dozen new kinds of certification in the works a week later. The team had also filled out every questionnaire it could find in Whistic, including the Vendor Security Alliance’s, even where it wasn’t certified, so it could send any of them fast.
FedRAMP needs a sponsor
Colin jokes with the salespeople that FedRAMP is one customer away:
“The only thing we’re missing is an SSP and a customer.”
Colin Bitterfield, at 34:05
The customer would sponsor the authorization. The SSP, or system security plan, is the security document FedRAMP requires:
“Basically, it’s every security control you have and how you’re doing it.”
Colin Bitterfield, at 34:16
He guessed it would take a few days to a week to write. FedRAMP is the U.S. government’s program for a standard approach to security assessment, authorization and continuous monitoring of cloud products. A memo from the Office of Management and Budget set it up in 2011 (Wikipedia). At Blackboard, Colin wrote about half of a FedRAMP system security plan himself (LinkedIn).
Data where the customer works
Jon said Colin saw security as a way to open up growth. Colin listed the work in progress: integrating customers with Azure and Databricks, and already with Snowflake, where some customers like to work. People Data Labs puts its data sets there so customers can connect to them, and it was working on GCP too. He came back to his number: 30% of the team’s time goes to the revenue side, by anticipating needs. People Data Labs’ site now lists data sharing through Snowflake and Databricks, and data feeds delivered on AWS and GCP (People Data Labs).
The same rules everywhere
The salespeople thank the whole security team, Colin said, and so do customers, because the answers are honest and easy to follow. Do you encrypt data at rest? Yes, everywhere. In transit? Yes, everywhere, at all levels. His name for it:
“security through simplicity is not having different rules for different areas. It’s applying the same rules everywhere.”
Colin Bitterfield, at 36:09
Advice for a younger Colin
Jon asked what Colin would tell his younger self. His first answer was not to micromanage your team, and Jon seconded it. The second:
“Hire people better than yourself.”
Colin Bitterfield, at 36:45
On his team, everyone has skills the others don’t, and together they did what no one could do alone. He asked how many companies can say they got ISO certified in six months. It was the whole company pulling together, he said. His advice is to get past yourself, and he gave the Army’s version:
“the credit goes to the team, and the blame goes to the leader.”
Colin Bitterfield, at 37:53
He tells his people that a mistake gets fixed together, and no one gets in trouble. That gives them the freedom to take initiative, take a risk and stretch, which helps the team move fast. Jon said autonomy, ownership and respect help a team and the people in it reach their full potential. On episode 45, Craig Goodwin, who also came to security from military intelligence, said everything is about people.
Pick one standard
Colin’s second piece of advice:
“pick a standard.”
Colin Bitterfield, at 38:44
He had recently been at a roundtable of CISOs with people from Amazon. The most successful companies there picked one standard and stuck to it:
“not chasing a certification.”
Colin Bitterfield, at 38:55
It can be CIS, ISO or another one. People Data Labs uses NIST. Treat security as one program, he said, and fit each certification to it. If you implement NIST 800 at the low or moderate level, you cover most of what any certification asks:
“you hit all the buttons for 90% of everything.”
Colin Bitterfield, at 39:29
Then each certification takes a little adjusting. He learned it long ago on a HITRUST project for a medical customer, from a matrix that mapped the controls of many certifications to each other:
“There are certain controls that are just universal across all the standards, all the certifications.”
Colin Bitterfield, at 39:53
NIST Special Publication 800-53 is a catalog of security and privacy controls, and since its fifth revision, released on September 23, 2020, it is a standard for general use (Wikipedia). HITRUST provides risk management and compliance assessments and certifications (Wikipedia). The 90% is Colin’s estimate from his own work.
Vanta or Drata
Jon asked how Colin chose Vanta. He didn’t. The company had bought it about two weeks before he arrived. He could have switched, and had looked at the biggest competitor:
“I have looked at Drata, which is the biggest competitor, and I’ve heard good things about it.”
Colin Bitterfield, at 40:29
At the roundtable, companies using each tool reported similar experiences. Switching would mean a long learning curve, since the tool was tied into all their systems, and he had no reason to switch. His verdict on Vanta:
“we wouldn’t have achieved the certification as quickly without it.”
Colin Bitterfield, at 41:06
Vanta had started to add standards, including NIST 800-53, which matched People Data Labs’ plans. Colin called the trust report a big feature in the sales cycle. On episode 64, Daniel Marashlian, a co-founder of Drata, told the story of building that company.
Privacy, and the honest way
Jon noted that consumer apps now show how they use data, what they track and which third-party services they use, on the App Store. Colin said privacy is serious at People Data Labs:
“Yeah, we’re very serious about privacy here.”
Colin Bitterfield, at 42:09
The company follows GDPR and CCPA, handles data subject access requests by the rules, without deviating, and has a dedicated privacy team. Jon said he wouldn’t mind a future where companies behave like this. Colin said being direct is simpler:
“it’s easier to be direct and honest”
Colin Bitterfield, at 42:46
He ended on the culture he saw at the company:
“But that is our culture, to be honest and to do things the right way.”
Colin Bitterfield, at 43:57
On episode 52, Suha Can, then CISO of Grammarly, covered the questions enterprises ask about where their data goes.
What happened after the tape
Colin’s next roles. His LinkedIn shows People Data Labs until December 2022. Since then he has run Temple of Epiphany, a practice for CISO and virtual CISO work. Its clients include Spire Global, as principal GRC consultant, Verizon Wireless and TracFone, as principal security consultant, and ThreatMate, as virtual CISO and advisory board member. He also taught security certification courses at StackRoute Learning until November 2024 (LinkedIn).
People Data Labs’ security page. The page lists ISO 27001 and SOC 2 Type 2, standards from NIST, CIS and ISO, encryption at rest and in transit, and time-based access to critical tools. It says the company runs external penetration tests every quarter, and that for major events it will notify affected people within 24 hours of a determination, half the 48 hours Colin gave on the tape (People Data Labs). Its blog post on SOC 2 explains that a Type I report starts a review period of at least six months before a Type II report (People Data Labs).
The company’s money. On November 16, 2021, People Data Labs raised a $45 million Series B led by Craft Ventures, with $55.3 million raised in all, according to SiliconANGLE. The company was founded in 2015, and SiliconANGLE put its data at more than 3 billion profiles (SiliconANGLE). The company’s own post said it had 80 employees and planned to double in 2022 (People Data Labs).
Colin’s numbers. On August 12, 2025, Colin published “Building Security Culture: From Military Command to Silicon Valley Startups.” He reports that after the SOC 2 certification at People Data Labs, sales cycles went from 9 months to 5.4 months, deal values from $50,000 to $100,000 up to $500,000 to $1.2 million, and the cost of winning a customer dropped 35% (LinkedIn). These are his figures, from his own article.
A guide for new analysts. On October 14, 2026, Colin shared a free field guide for new security analysts, Blue Team Loadout, with entries on standards, laws, court cases, tools and platforms, each linked to its source (cyberguy.site).
Colin Bitterfield on LinkedIn, October 14, 2026: a field guide for new security analysts, and a request for feedback.
Colin Bitterfield · October 14, 2026
Vanta grew. Vanta reached a valuation above a billion dollars in 2022, added AI features in 2023, and was valued at $4.15 billion in 2025 (Wikipedia).
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript or its section.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
How long did Colin say it took People Data Labs to get SOC 2?
b. "We'll be SOC 2 in six months." Transcript, 3:23.
-
How much harder than SOC 2 did Colin call ISO?
c. The auditors interviewed 20 people and saw hundreds of pages. See SOC 2 in six months, then ISO.
-
What did Colin do with every RFP in his first month?
a. Now the answer to most questions is yes. See Security on the revenue side.
-
About how much of most sales did Colin say security objections are?
b. "because that's about a third of most sales." Transcript, 14:33.
-
Why do engineers at People Data Labs take security awareness training even if they know the threats?
c. "our insurance won't pay off if there's a problem." Transcript, 21:35.
-
How fast could a salesperson send the SOC 2 report or ISO certificate?
a. With the NDA handled automatically. See The security package in ten minutes.
-
What did Colin say the most successful companies at a CISO roundtable did?
b. People Data Labs uses NIST. See Pick one standard.
Does your security help close deals?
Eight questions on whether your security program helps the sales team, built from the episode. Each tip links the section behind it.
Scorecard · eight questions
Does your security help close deals?
Answer for the deals you sell today. If two answers fit, pick the lower one.
-
Can a salesperson send your SOC 2 report or ISO certificate in the first meeting?
- We don't have one yet
- Yes, after security signs off
- Yes, in minutes, with the NDA built in
Colin's salespeople could send one in under 10 minutes. See The security package in ten minutes.
-
How long does a security questionnaire take you today?
- Weeks
- Days
- Hours, from answers we already have
Weeks of back and forth is what Colin found on day one. See The security package in ten minutes.
-
Do you track what customers ask for in RFPs and questionnaires?
- No
- We read them as they come
- We keep a list and build against it
Every RFP is a list of what customers want. See Security on the revenue side.
-
Does your sales team have written answers to common security questions?
- No
- A few
- Pages on what we do and don't do
Everyone gives the same correct answer. See A third of every sale.
-
What is security's first answer when someone at your company asks for something?
- Usually no
- It depends who asks
- Yes, done safely
People bring problems early when the answer is yes. See Security's first answer is yes.
-
Do you build to one standard?
- Each certification on its own
- Some controls shared
- One standard, mapped to every certification
Pick a standard and stop chasing certifications. See Pick one standard.
-
Does someone from security join sales calls with a customer's CISO?
- No
- For big deals
- Whenever sales asks
Colin would join any call to close a deal. See Engineers who help other teams ship.
-
Have you read your cyber insurance policy and asked the insurer what it requires?
- No
- We read the policy
- Both, and we do what it asks
Colin called his insurer for the list. See Read your cyber insurance policy.
Security slows deals more than it helps them. Start with a SOC 2 report salespeople can send, and written answers for the questions you get most.
The pieces exist, but sales still waits on security. Put the documents and answers where salespeople can send them in the first meeting.
Security answers before the customer asks. Keep the list of customer asks current, and map the next certification to the standard you already follow.
What does a ready security package save?
Colin’s goal was to answer the security questions in the first 10 minutes of a sales meeting. This calculator shows the hours a package of ready answers saves on security reviews.
Calculator
What does a ready security package save?
Five numbers: security reviews a quarter, questions in each, minutes to write an answer from scratch, the share of questions your package already answers, and minutes to point a customer to a ready answer.
At 12 reviews a quarter with 200 questions each, writing every answer takes 160.0 hours. With 60% of the answers ready in the package, it takes 88.0 hours, 72.0 hours less, about 9.0 working days.
The calculator counts only the time to answer, at eight hours a working day. It doesn't count the days a deal waits. The default numbers are placeholders: Colin gave 500 questions as the long end, and the other numbers are yours to put in. If a ready answer takes longer than a new one, the saving goes below zero.
From Army Cyber Command to a security package
Colin’s roles, People Data Labs, the standards on the tape, and this show. Filter by topic.
Timeline
From Army Cyber Command to a security package
- U.S. First Army
Knowledge management officer (LinkedIn).
- U.S. Army Cyber Command
Information assurance officer and chief of the data collections branch (LinkedIn, on this page).
- Army Cyber Command
The command is established (Wikipedia).
- FedRAMP
A memo from the Office of Management and Budget establishes the program (Wikipedia).
- Cyber warfare
Operations officer and senior cyber warfare analyst, to February 2015 (LinkedIn).
- Blackboard
Principal infrastructure security engineer, through FedRAMP (LinkedIn, on this page).
- People Data Labs
The company is founded (SiliconANGLE).
- The VSA questionnaire
The Vendor Security Alliance releases its first questionnaire (Help Net Security).
- Vanta
Founded by Christina Cacioppo and Erik Goldman (Wikipedia).
- NIST SP 800-53, revision 5
The control catalog becomes a standard for general use (Wikipedia, on this page).
- Colin joins People Data Labs
To run IT and security (LinkedIn, on this page).
- Colonial Pipeline
A ransomware attack that began with a compromised VPN password (Wikipedia, on this page).
- Episode 2
Andrew Gontarczyk on building a security team (episode page).
- A $45 million Series B
Led by Craft Ventures (SiliconANGLE).
- Temple of Epiphany
CISO and virtual CISO practice (LinkedIn).
- Episode 27
Colin on the show (Podbean, transcript).
- Verizon Wireless and TracFone
Principal security consultant, to September 2024 (LinkedIn).
- Episode 45
Craig Goodwin on security for small businesses (episode page).
- Episode 52
Suha Can on safeguarding user data (episode page).
- ThreatMate
Virtual CISO and advisory board member (LinkedIn).
- Episode 64
Daniel Marashlian of Drata (episode page).
- Vanta at $4.15 billion
Its latest valuation (Wikipedia).
- Building Security Culture
Colin's article on military leadership and startup security (LinkedIn, on this page).
- A field guide
Blue Team Loadout, for new security analysts (LinkedIn).
What to do this week
Five things, in the order of the episode.
- Read your last five RFPs. List everything the customers asked for, and mark what you can say yes to today, as in Security on the revenue side.
- Build the security package. Put the SOC 2 report, the certificates and your written answers where a salesperson can send them in the first meeting, as in The security package in ten minutes. The calculator shows the hours it saves.
- Call your insurer. Ask what the policy requires, and check you can prove each item, as in Read your cyber insurance policy.
- Pick one standard. Map your next certification to the standard you already follow, as in Pick one standard.
- Get help with it. Our Sales Support team answers questionnaires and joins your sales calls as your security team, and SOC 2 Type 2 gets you the report buyers ask for. vCISO Services gives you a security leader, and FedRAMP Readiness writes the system security plan for when a federal sponsor appears. If you want to talk it through, book 15 minutes with us.