Episode 34 of The Security Podcast of Silicon Valley aired on December 1, 2023, with Jon McLachlan hosting alone. The guest was Ganesh Krishnan, co-founder and CEO of Anzenna, which the show notes called a cybersecurity engagement and collaboration platform (Podbean). Jon had learned what the company’s name means a few minutes before they started recording, and asked for it on the air.
“Ganesh Krishnan, who is the founder-CEO of a security company, Anzenna, which I just learned a moment ago is Japanese for, what is it, Ganesh?”
Jon McLachlan, at 0:08
Ganesh’s answer was one word: “Safe.” The company says the same thing in writing. Ganesh’s first post on its blog, in June 2023, introduced Anzenna as meaning “Safe” in Japanese (Anzenna), and its company page today calls 安全 the Japanese word for safety (Anzenna).
The conversation was recorded in 2023. Ganesh says he left Sophos “early last year in 2022” and started Anzenna “towards the end of last year,” and his LinkedIn dates Anzenna from September 2022 (LinkedIn). By his own count he’d been in security for 25 plus years by then, as an engineer at Intel, a consultant at Securify, a security leader at Yahoo, LinkedIn and Atlassian, and a founder twice.
This page is the rest of it: a section for each part of the conversation with the sources beside it, fifteen figures, twenty-five clips from the tape, the full transcript, and five tools: a quiz, a scorecard for which type of security team you run, a calculator for how big your security team really is, a timeline from 1985 to 2026, and a to-do list.
A note before the sections. The company of a thousand people, the security team of 10 and the 20% who’ll be supporters are Ganesh’s example, told to make a point, not survey numbers. And Anzenna has changed a lot since this recording. What it was building in 2023 is in the sections, in Ganesh’s words, and what it does now is in After the tape.
Very few people knew what security was back then
Ganesh’s career starts in graduate school, in the middle of the 1990s.
“And my start to security happened during my master’s program at Purdue, where I was a research assistant at one of their cybersecurity labs.”
Ganesh Krishnan, at 0:52
Purdue University is a public land-grant research university in West Lafayette, Indiana, founded in 1869 after John Purdue donated land and money for a college of science, technology and agriculture (Wikipedia). His LinkedIn lists Purdue as his school (LinkedIn). The lab’s topics are still on every security team’s list.
“That’s when, believe it or not, in 1996, I think it was, I got introduced to things like anomaly detection and patch management and all the jargons you still hear 25 years plus later.”
Ganesh Krishnan, at 1:01
Anomaly detection is the identification of rare items, events or observations that deviate significantly from the majority of the data and don’t fit a well-defined notion of normal behavior (Wikipedia). A patch is data for modifying an existing piece of software, often to fix bugs and security vulnerabilities (Wikipedia). Both were research topics in 1996. Both are products now.
“And that’s when I got hooked to it. I got really interested in the field. Very few people knew what security was back then.”
Ganesh Krishnan, at 1:13
IPsec device drivers for Windows 95
After Purdue, Ganesh went to Intel Architecture Labs in Oregon. His first security job was in the network stack.
“writing IPsec device drivers for Windows 95 and Windows 98.”
Ganesh Krishnan, at 1:32
Internet Protocol Security, IPsec, is a secure network protocol suite that authenticates and encrypts packets of data between two computers over an Internet Protocol network, and it’s what virtual private networks use (Wikipedia). His LinkedIn describes the job as designing and building the IPsec protocol for Windows NT and 9x, shipped as part of Intel’s Ethernet cards, plus a security policy architecture for network traffic and a directory service using LDAP to store that policy (LinkedIn). Windows 95 reached retail on August 24, 1995, and Windows 98 on June 25, 1998 (Wikipedia, Wikipedia). Jon suggested where those systems live now, and Ganesh agreed.
“Those were rampant with security flaws back then. But now, if you had a Windows 95, you couldn’t use it and they would be in a museum.”
Ganesh Krishnan, at 1:47
“And writing device drivers for Windows back then was extremely challenging. There’s a system called NDIS.”
Ganesh Krishnan, at 1:55
The Network Driver Interface Specification, NDIS, is the application programming interface for network interface controllers in Windows (Wikipedia). Ganesh’s code sat at the protocol level, and he was frank about how much of it has aged.
“But anyway, I was writing, like, IPsec protocol level code and IKE protocol level code, even that’s obsolete these days with zero trust and stuff.”
Ganesh Krishnan, at 2:03
Internet Key Exchange, IKE, is the protocol that sets up a security association in the IPsec suite (Wikipedia). Zero trust architecture is the design principle that users and devices shouldn’t be trusted by default, even on a privileged network like a corporate LAN, and even if they were verified before (Wikipedia). A VPN’s job is to put a remote machine on the trusted network, and zero trust starts from the opposite assumption, that being on the network earns no trust by itself. Zero trust comes back later in this conversation, from a different direction, when Ganesh gets to what default protections can’t do.
Tired of the rain in Oregon
A few years into Intel, the weather decided the next job.
“And that’s when I was a few years in, I got tired of the rain in Oregon. It used to rain nine months.”
Ganesh Krishnan, at 2:19
“It rains all the time, though, doesn’t it?”
Jon McLachlan, at 2:25
He went looking for somewhere warmer and sunnier, and found a security company with an unusual founder.
“And that’s when I started talking to this company called Securify, which was started by Taher Elgamal, who’s the guy behind the ElGamal signature standard, which became DSA, the digital signature algorithm.”
Ganesh Krishnan, at 2:32
Taher Elgamal is an Egyptian-American cryptographer and tech executive who was founder and CEO of Securify, director of engineering at RSA Security, and chief scientist at Netscape Communications from 1995 to 1998 (Wikipedia). He described the ElGamal signature scheme, based on the difficulty of computing discrete logarithms, in 1985 (Wikipedia), and the Digital Signature Algorithm, a Federal Information Processing Standard for digital signatures, is a variant of the Schnorr and ElGamal schemes (Wikipedia). Ganesh also remembered him as “one of the early pioneers in Netscape.” Wikipedia credits Elgamal’s work on SSL at Netscape as the basis for TLS and HTTPS, and he shared the 2019 Marconi Prize with Paul Kocher for the development of SSL and TLS (Wikipedia). Elgamal founded Securify in 1998, and it was later acquired by Secure Computing in 2008 and is now part of McAfee (Wikipedia). Elgamal came on this show himself in episode 61, on SSL and why passwords are holding us back (episode 61).
“So it was actually a security consulting company, and had a stint with security consulting in 1999-ish, that time frame, and was working on security stuff with companies like Yahoo and others, and got to really learn about pen testing and vulnerability scanning, things like Nmap and things.”
Ganesh Krishnan, at 2:50
His LinkedIn has him as practice area head at Securify from 1999 to 2001, running consulting engagements for e-commerce, financial, wireless and healthcare clients (LinkedIn). A penetration test is an authorized simulated cyberattack on a computer system, performed live to evaluate its security (Wikipedia). A vulnerability scanner is a program that assesses computers, networks or applications for known weaknesses (Wikipedia). Nmap, the network scanner Gordon Lyon created, was first released in September 1997 in Phrack magazine (Wikipedia), so it was two years old when Ganesh was learning it.
“They’ve existed forever now. So that was a great experience, being a software engineer writing device drivers. It was a kind of a dramatic switch.”
Ganesh Krishnan, at 3:11
One of the early members of their security team
One of Securify’s clients became his next employer.
“And then one of the companies I worked for was Yahoo, and then joined Yahoo sometime in 2001 after the dot-com bust, which probably not many people remember. That was the biggest tech bust and slowdown ever.”
Ganesh Krishnan, at 3:19
The dot-com bubble was a stock market bubble of the late 1990s that peaked on March 10, 2000. Between 1995 and that peak, investments in the Nasdaq Composite index rose 600%, and by October 2002 they had fallen 78% from the peak, giving up all of the bubble’s gains (Wikipedia). Ganesh joined Yahoo in the middle of that fall.
“And joined as one of the early members of their security team, was doing software engineering security”
Ganesh Krishnan, at 3:35
Yahoo is the American web portal behind Yahoo Search, Yahoo Mail, Yahoo News and Yahoo Finance, and it’s now run by Yahoo! Inc., 90% owned by Apollo Global Management and 10% by Verizon (Wikipedia). Ganesh stayed nine years. His LinkedIn has him at Yahoo from August 2001 to October 2010, ending as vice president and CISO, and describes the arc in one line: he started as an engineer and grew to lead global information security, a role his profile calls Chief Paranoid (LinkedIn). A chief information security officer is the senior executive responsible for the strategy and program that keep an organization’s information assets and technologies protected (Wikipedia).
Through the IPO
In 2010 the industry moved again, and he moved with it.
“Left in 2010 when companies like Facebook and LinkedIn and others were starting to expand their footprint.”
Ganesh Krishnan, at 3:46
“Joined LinkedIn to build their security program, their trust engineering, anti-abuse engineering program, and then spent several years at LinkedIn through the IPO”
Ganesh Krishnan, at 3:52
LinkedIn is the business and employment-oriented social network Reid Hoffman and Eric Ly launched on May 5, 2003 (Wikipedia). It filed for its initial public offering in January 2011 and traded its first shares on May 19, 2011, on the New York Stock Exchange under LNKD, at $45 a share (Wikipedia). Microsoft bought it for $26.2 billion, in a deal completed on December 8, 2016 (Wikipedia). Jon stopped him there.
“That’s big. A lot of people aim for that in their careers, and very elusive.”
Jon McLachlan, at 4:06
His LinkedIn adds the scale. As head of security and privacy engineering from October 2010 to May 2016, he led more than 100 data scientists, security experts and software engineers across information security, security infrastructure engineering, and anti-abuse and privacy engineering, which built abuse and fraud prevention on machine learning, login and authentication systems, and site privacy features (LinkedIn). From August 2011 to April 2013 he also ran LinkedIn’s India Technology Center in Bengaluru, which he set up “from nothing to about 50 engineers” (LinkedIn). Bengaluru, also known as Bangalore, is the capital of the southern Indian state of Karnataka (Wikipedia).
I’ll probably go native
Then came Atlassian, and a decision about what kind of career he wanted.
“And then moved to Atlassian to run their identity and security engineering programs as Atlassian was growing.”
Ganesh Krishnan, at 4:11
Atlassian is a multinational software company headquartered in Sydney, Australia, that makes collaboration tools mainly for software development and project management (Wikipedia). It was founded in 2002 and went public on the NASDAQ on December 10, 2015, under the symbol TEAM (Wikipedia). Ganesh’s LinkedIn has him there from May 2016 to July 2017 as head of engineering for identity and security, the CISO role, leading the global information security program and the identity engineering team that built shared authentication and authorization for all of Atlassian’s products (LinkedIn). One of those products is Jira, Atlassian’s bug tracking, issue tracking and agile project management tool (Wikipedia), and Jira comes back later in the conversation, in Ganesh’s list of what Anzenna helped employees fix.
“And that’s when I realized, hey, I’ve been doing this security practitioner CISO thing for a while. And if I continue doing this, I’ll probably go native.”
Ganesh Krishnan, at 4:18
“So I have to shake myself and see if I can do something that’s completely different.”
Ganesh Krishnan, at 4:27
Every problem looks 10x bigger
The something different was a startup of his own.
“So I ended up starting a company in the cloud security space in 2017 called Avid Secure, which was then acquired by Sophos in 2019.”
Ganesh Krishnan, at 4:34
Sophos announced the deal on January 8, 2019, describing Avid Secure as an artificial intelligence-based cloud security analytics, compliance and DevSecOps platform for public clouds such as AWS, Azure and Google, founded in 2017 and headquartered in San Francisco with engineering in Gurgaon, India (Sophos). Ganesh’s LinkedIn has him as Avid Secure’s co-founder and CTO from August 2017 to January 2019 (LinkedIn). The buyer was older than most of the industry.
“And was skeptical going into a 35-year-old security company. It’s probably one of the oldest security companies in existence that still does really good business.”
Ganesh Krishnan, at 4:44
Sophos is a British security software and hardware company, founded by Jan Hruska and Peter Lammer, which began producing its first antivirus and encryption products in 1985 (Wikipedia). It was listed on the London Stock Exchange until the American private equity firm Thoma Bravo acquired it in March 2020 (Wikipedia), during Ganesh’s time there. The culture surprised him.
“But I was pleasantly surprised working for Sophos. I had a great time. I spent three years there after the acquisition and got to work with really good people.”
Ganesh Krishnan, at 4:55
His LinkedIn has him as VP of engineering at Sophos from January 2019 to February 2022 (LinkedIn). Jon asked who he’d started Avid Secure with.
“It was a gentleman by the name Nikhil Gupta.”
Ganesh Krishnan, at 5:05
Nikhil Gupta was Avid Secure’s CEO and co-founder in Sophos’s announcement (Sophos), and ArmorCode, the application security startup he co-founded, launched in May 2021 with $3 million in funding (SiliconANGLE). Jon had met him from the other side of the table.
“He tried to sell ArmorCode to me at Pure Storage.”
Jon McLachlan, at 5:16
Jon was the product security lead at Pure Storage from May 2018 to January 2021 (LinkedIn). Pure Storage is the Santa Clara company that started with all-flash data storage, and it rebranded as Everpure in February 2026 (Wikipedia).
“So it’s a small world. This is a small community, guys.”
Jon McLachlan, at 5:22
Then Ganesh described what changes after the first company.
“And post Sophos, once you start a company, every problem looks 10x bigger, as you probably know.”
Ganesh Krishnan, at 5:28
“Yes, it does.”
Jon McLachlan, at 5:33
“And so basically, left Sophos early last year in 2022, and then started Anzenna towards the end of last year.”
Ganesh Krishnan, at 5:35
We get employees to engage with cybersecurity
Jon asked the question every founder on the show gets: what does Anzenna do better than anyone else?
“Yeah, what we do is we figure out how to engage employees on cybersecurity.”
Ganesh Krishnan, at 6:07
He called it an age-old problem that keeps getting worse, and he gave two reasons that pull in opposite directions.
“primarily because the surface area of cybersecurity is expanding and IT itself is decentralizing.”
Ganesh Krishnan, at 6:18
“And so when IT is decentralizing, security is the opposite. It’s dependent on a set of experts who are hard to hire, train and scale.”
Ganesh Krishnan, at 6:29
“And every risk and vulnerability has to go through them.”
Ganesh Krishnan, at 6:37
That’s a bottleneck. Employees can do more on their own than they could five or ten years ago, he said, and every one of those new powers creates risk that only a small team of experts is allowed to handle. His fix wasn’t a bigger team.
“We need a way for security teams instead to manage the process and the workflow and focus on high-value items versus being in the middle of every single alert and then mediating all of that.”
Ganesh Krishnan, at 6:44
Security awareness training is broken
Then he described the loop Anzenna was built around.
“So the goal of Anzenna is to go from risk identification directly to surfacing that risk to the employee in question, and then working with the employee to self-remediate while providing them contextual training.”
Ganesh Krishnan, at 6:58
“So what we see happening is security awareness training is broken.”
Ganesh Krishnan, at 7:12
“That’s not a new thing, because it’s very, very content-driven.”
Ganesh Krishnan, at 7:16
Security awareness is the knowledge and attitude people in an organization have about protecting its physical and especially informational assets, and Wikipedia notes it’s tricky to build because organizations can’t impose it on employees directly (Wikipedia). Many organizations require formal awareness training when people join and periodically after, usually once a year (Wikipedia). Ganesh’s June 2023 post was blunter about it, calling annual awareness training ineffective and phishing simulations punitive (Anzenna). The Wikipedia article describes the newer approaches, from security nudges like password reminders and phishing warnings to gamification and phishing simulations (Wikipedia).
Ganesh’s answer was to make it contextual.
“And so this makes it contextual and, in the process, engages employees. And that’s really what you need for employees to take more ownership of their own security posture.”
Ganesh Krishnan, at 7:22
“So that’s what we do at Anzenna. We get employees to engage with cybersecurity.”
Ganesh Krishnan, at 7:32
The same post spelled out the alternative. It argued for moving from content-based, centralized awareness to context-based, employee-driven awareness, and listed three pillars: contextual engagement, with visibility, fixes and bite-sized training sent to each employee in Slack or Microsoft Teams, employee empowerment, and unified visibility across the company’s existing tools (Anzenna). And it describes the culture he’d tried to build as a CISO, one where “employees are seen as the strongest link in security, rather than the weakest” (Anzenna).
Two types of security professionals
Jon answered with something he’d always believed about the job.
“I’ve always thought of, like, security as having two types of security people in the world. There’s two types of security professionals.”
Jon McLachlan, at 7:38
The first type walks into a meeting and the room deflates.
“There’s the type that will walk into a meeting room and everyone in the room will say something along the lines of, oh no, so-and-so is here”
Jon McLachlan, at 7:43
What follows, in Jon’s telling, is a list of strange standards, SOC 2 Type 2 requirements thrown in the team’s face, and a deadline that slips.
“and it’s like super negative.”
Jon McLachlan, at 8:07
The second type walks into the same room with the same goals, and the room changes.
“But everyone in that meeting room is like, oh, great. Like, so-and-so is here. They’re going to help us navigate this challenging space.”
Jon McLachlan, at 8:23
That person helps the team sort what has to be in the MVP from what can wait for later versions. A minimum viable product is a version with just enough features to be usable by early customers who can then give feedback for future development (Wikipedia). Jon’s point was that the outcome may not even differ.
“And you might actually get exactly the same thing happening as a business in both of those cases.”
Jon McLachlan, at 8:50
“You’re going to have a much better experience with that second type than the first type.”
Jon McLachlan, at 8:59
And he put Ganesh in the second group, and Anzenna with him.
“And this is really incredible, because it sounds like almost you built a company around that second type of security, where it’s collaborative, it’s learning, we’re in the same boat together.”
Jon McLachlan, at 9:16
The SOC 2 requirements Jon used as the first type’s weapon are the same ones a second-type security lead turns into a plan the team can ship against. That’s the approach behind our SOC 2 Type 2 work.
Making them own the problem
Ganesh agreed, and described where his best results had come from.
“That’s correct. Yeah. And my best experiences have been when myself and my team have worked with the rest of the company in coming up with solutions to problems.”
Ganesh Krishnan, at 9:54
A security team can propose its own fix, he said, and that works to a point. The better way goes through the people who own the system.
“But my best experiences, like you said, have been to take the problem to the right set of people who we think can help solve it, and actually collaboratively working with them, making them own the problem.”
Ganesh Krishnan, at 10:14
“And that has pretty much unanimously, universally resulted in a better solution”
Ganesh Krishnan, at 10:28
Jon picked up the business case.
“And the right thing happens quickly for the business, because you have the expert in that area of the product focused and owning the problem and resolution.”
Jon McLachlan, at 10:44
“You get to learn a little bit about security. You get to engage with a new team. It’s like fun and dynamic.”
Jon McLachlan, at 10:52
This is the section the page is named for. The owner of the system knows it best, so the owner’s fix is usually the best fix, and the owner learns something about security on the way. The security team’s job becomes getting the problem to the right person with enough context to act.
Gain credibility within the organization
Jon admitted the hard part.
“And I think everyone tries to approach security in this manner. I do have to admit, it can be very difficult sometimes.”
Jon McLachlan, at 11:13
Ganesh didn’t argue.
“these are challenging things to productize and take to market and get, like you said, people who are dealing with their day-to-day stuff, get them to use it and embrace it.”
Ganesh Krishnan, at 11:23
“There’s lots of tools that find new security challenges, new security problems, the new risk, right? But there’s very few tools that will say, okay, how do I help you effectively resolve it and gain credibility within the organization?”
Ganesh Krishnan, at 11:38
That last word is the one Jon repeated back: credible. A security team that only produces findings spends its credibility, and one that gets findings resolved earns it.
OAuth grants that employees keep doing
Jon asked how listeners could try it, and Ganesh walked through the 2023 version of the product.
“So what we have done is, if you can go and go to anzenna.ai, there’s a Try Now.”
Ganesh Krishnan, at 12:05
He described the range of use cases as running “all the way from basic awareness training to more contextual awareness,” and then got specific.
“Like, how do you get your employees to fix certain types of issues, like security tickets in Jira, vulnerability tickets in Jira, all the way to, hey, there’s these OAuth grants that employees keep doing through the IdP all the time.”
Ganesh Krishnan, at 12:32
“Those are things that the security team shouldn’t be following up, or a SOC shouldn’t be, like, it should be raised directly to the employee, and they should self-remediate.”
Ganesh Krishnan, at 12:46
OAuth is an open standard for access delegation, the way people grant websites or applications access to their information on other sites without handing over their passwords (Wikipedia). An identity provider creates and manages identity information and provides authentication to the applications that rely on it (Wikipedia). So each grant is an employee, signed in through the company’s identity provider, handing some app access to company data. A security operations center is the team responsible for protecting an organization against threats (Wikipedia), and Ganesh’s point was that a stale or risky grant shouldn’t wait in its queue. The person who made the grant can review it and revoke it, if someone tells them.
Connected apps are also how many AI tools reach company data now, and Anzenna’s own site lists OAuth-connected AI apps among the places data leaves a company (Anzenna). Finding those connections is part of our Corporate Shadow-AI Detection work.
Talking to the second type
Jon asked for the best day so far.
“Talking to security practitioners and CISOs, saying, hey, we are thinking of this concept, this is what it means. Does this make sense? Is this solving the right thing? Is this right?”
Ganesh Krishnan, at 13:43
“Talking to the second type of security practitioner you mentioned earlier.”
Ganesh Krishnan, at 13:54
“The second type.”
Jon McLachlan, at 13:58
What those practitioners said back was the whole thesis in one sentence.
“hey, this is exactly how I want to run my security program, in an open, honest, transparent way, where I tell people why I’m doing something, why, and solicit their help and empower them to make it better, rather than dictate a set of policies.”
Ganesh Krishnan, at 14:03
We don’t really want to trust them
Jon asked for the hardest day too, and Ganesh’s came from the same kind of conversation.
“And unfortunately, one of the feedbacks that I heard is, hey, this is great, but you know what? Employees, you know, we don’t really want to trust them when it comes to security.”
Ganesh Krishnan, at 14:52
“And that was, I think, the worst part of my journey so far.”
Ganesh Krishnan, at 15:01
“hey, if we don’t trust our employees, we can’t run a business, let alone cybersecurity.”
Ganesh Krishnan, at 15:08
“So we have to change the mindset.”
Ganesh Krishnan, at 15:11
Jon played devil’s advocate for the skeptic.
“maybe they meant it from an insider trust perspective, or they just meant it from this, they didn’t trust them to do the right thing.”
Jon McLachlan, at 15:18
An insider threat is a threat that comes from people within the organization, such as employees, former employees, contractors or business associates, who know its security practices, data and systems, and it can involve fraud, theft of confidential information or intellectual property, or sabotage (Wikipedia). The skeptic had a point, and Ganesh granted it.
Absolutely necessary, but they’re not sufficient
“That’s right. And they might be justified in their statement. And I think that’s how we’ve been brought up in security.”
Ganesh Krishnan, at 15:25
“If you, like, 15, 20 years ago, I would probably say the same thing, right? Is, hey, we need to just build around these people, have technology controls and blocks and tackles.”
Ganesh Krishnan, at 15:33
Then he drew the line that holds the rest of the episode together.
“Like, default protections are absolutely necessary, but they’re not sufficient.”
Ganesh Krishnan, at 15:50
“And you really have to earn the trust of their employees, because you can’t block everything that they’re doing.”
Ganesh Krishnan, at 15:54
“Cybersecurity is not just about technology, it’s about people, process and technology.”
Ganesh Krishnan, at 16:10
“And people are always first.”
Jon McLachlan, at 16:16
The two halves fit together. Zero trust, which Ganesh had mentioned at the start, is a default protection: users and devices aren’t trusted by default, even on the corporate network (Wikipedia). That doesn’t conflict with trusting employees to fix their own findings. The controls decide what someone can reach, and trust decides who you ask for help. The skeptic’s worry treats the two as alternatives. Ganesh was arguing for both.
Security is way broader
Jon was making a point about money and health information when Ganesh jumped in, apologized, and was waved ahead.
“So security often gets compared to operations or QA, right?”
Ganesh Krishnan, at 16:56
“And I would say, of course, they are comparable, but security is way broader.”
Ganesh Krishnan, at 17:06
“If you think about security, it affects every single thing that a company does, all the way from tailgating for the physical security world, to a salesperson accessing Salesforce”
Ganesh Krishnan, at 17:10
His list kept going: a marketing person’s tweets and a compromised company Twitter account, the products the company is building, and its internal IT. In security, tailgating or piggybacking is when someone tags along with an authorized person to get into a restricted area or past a checkpoint (Wikipedia). Salesforce is the San Francisco company best known for customer relationship management software (Wikipedia). Every item on the list is a person doing their normal job.
“You can’t just spin it on the security team.”
Ganesh Krishnan, at 17:40
“You have to democratize it”
Ganesh Krishnan, at 17:42
We’re all in the same boat together
Jon took the image he’d used earlier and ran with it.
“Yeah. We’re all in the same boat together.”
Jon McLachlan, at 17:49
When security asks the rest of the company for help, he said, it should ask from that position: this is challenging, it’s a security thing, and we’re in it together.
“And we don’t want to hit any icebergs. We don’t want to hit land. Just be safe and steer this ship out of the storm. And it takes the entire crew.”
Jon McLachlan, at 18:10
“Everyone on that boat plays a very important role.”
Jon McLachlan, at 18:21
Every single security team to type two
Jon asked what success would look like, as far into the future as Ganesh wanted to go. Ganesh went back to the beginning of the conversation.
“I think that all security teams are the type two.”
Ganesh Krishnan, at 18:38
“where the goal of security teams should be to help the company manage its risks, right? It’s cybersecurity and trust and privacy risks, right? Not to actually own all of it and drive resolution to all of it.”
Ganesh Krishnan, at 18:43
“And that’s the cognitive shift that’s needed.”
Ganesh Krishnan, at 18:56
Success, for him, would be the day every security team, and every practitioner, had made that shift to type two.
The shift he described is about ownership. The security team still owns the risk program, the process and the judgment calls. It stops owning every fix. That’s also the line between a security team that scales with the company and one that doesn’t, and it’s the program design our vCISO Services bring to companies that don’t have a security leader yet.
It takes a great sense of humility
Jon said what the second type needs most.
“But it takes a great sense of humility to walk into a room filled with extremely smart people and admit that you don’t have all of the answers.”
Jon McLachlan, at 19:16
“We bring that security expertise to the table, but it’s not the end-all-be-all.”
Jon McLachlan, at 19:32
Ganesh added the part about parents.
“Yeah, we tell our kids all the time to ask for help, but we don’t tend to do it ourselves when we need it the most.”
Ganesh Krishnan, at 19:42
Jon pleaded “guilty as charged.”
Jon reached for a line he’d heard once, “I’m not young enough to know everything anymore,” and then turned it toward the people early in their careers. He said he was really happy with the interns and mentees he’d worked with, and excited about the future.
“It feels like when you’re close to the problem, it feels like very big and daunting. But when you step back and you really look at the bigger picture, and you realize that there are smart people and people with high EQ helping move the needle in big ways for everybody, that gets me excited.”
Jon McLachlan, at 20:29
From 10 people to more than 200 people
Ganesh made the case for supporters with numbers.
“Let’s say you have a company of a thousand people, and the security team is probably going to be 10, just realistically, right?”
Ganesh Krishnan, at 20:53
“So 20% will actually be supporters.”
Ganesh Krishnan, at 21:03
“Your team just went from 10 people to more than 200 people. That’s massive.”
Ganesh Krishnan, at 21:11
The arithmetic is simple and the effect isn’t. Ten people can’t watch a thousand, but two hundred people inside the teams see problems the security team never would. He tied it to a practice many security leaders already run.
“And I know practitioners do this with security champions and others, where they see exponential returns if they can foster that program effectively, because people who are supporters are proactive.”
Ganesh Krishnan, at 21:31
A security champion is usually someone on an engineering or business team who takes on security as part of their job and is the security team’s first contact there. Ganesh’s description of what supporters do is the best argument for having them.
“They’ll say, oh, I’m seeing this problem that you may not even know about. And they will come to you and say, okay, let me help you fix it.”
Ganesh Krishnan, at 21:42
“A proactive program with a strong sense of ownership.”
Jon McLachlan, at 21:50
The calculator below runs Ganesh’s arithmetic on your own headcount.
Transparent about what an early stage company looks like
Jon asked about hiring, and whether Ganesh had a favorite interview question.
“I generally look for team dynamics, like how someone can actually work constructively with other people, and whether they will actually fit in with the rest of the team.”
Ganesh Krishnan, at 22:06
For a small company, he added a second rule, and it’s a warning to the candidate as much as a test. When he interviews, he said, he’s transparent about what an early stage company looks like.
“So a lot of folks want to work for early stage companies for the learning that it offers, but don’t necessarily fully understand what that comes with in terms of uncertainty and the need to embrace risk”
Ganesh Krishnan, at 22:33
“So it’s not like a stable company where you have a six-month roadmap or a one-year roadmap. You’re talking to customers all the time and you have to change.”
Ganesh Krishnan, at 22:53
Being transparent about that, he said, is how you find out whether the person is really a fit.
Green flags
Jon turned the usual interview advice around.
“A lot of people talk about red flags and how they look for certain red flags, and if they see one, they will shut it down, basically. But not a lot of people talk about green flags”
Jon McLachlan, at 23:21
“I don’t call it a warm and fuzzy feeling, but you know it when you see it.”
Jon McLachlan, at 23:37
“Yeah, I think it’s hard to pinpoint, right?”
Ganesh Krishnan, at 23:48
For Ganesh, the signal is in how the conversation goes, and in whether the candidate cares about the work.
“And are they really interested in what we are doing?”
Ganesh Krishnan, at 24:11
“If you love what you do, you never really work a day in your life.”
Jon McLachlan, at 24:25
Think Like a Rocket Scientist
Jon asked for a book or a movie that changed how Ganesh sees the world.
“Yeah, recently I read a book, Think Like a Rocket Scientist, by Ozan Varol.”
Ganesh Krishnan, at 24:43
“It teaches you about first principles thinking, and just how to embrace uncertainty”
Ganesh Krishnan, at 24:51
Ozan Varol is a Turkish author and former tenured law professor at Lewis & Clark Law School (Wikipedia), and his Wikipedia article lists Think Like a Rocket Scientist: Simple Strategies You Can Use to Make Giant Leaps in Work and Life among his books. In philosophy and science, a first principle is a basic proposition or assumption that can’t be deduced from any other (Wikipedia). Jon called it philosophical, and Ganesh said it came with specifics.
“So the book provides specific examples on what happened in certain NASA launches and how they were successful, but they were really, like, scrambling in background, right?”
Ganesh Krishnan, at 25:13
The lesson he took from it fits a founder: even a successful launch was a scramble behind the scenes, so there’s no reason to be disappointed when yours is too.
I played it too safe
Jon asked what Ganesh would tell his younger self, the grad student or the young engineer.
“Yeah, I wish I had taken more risks early on in my career.”
Ganesh Krishnan, at 26:12
“I think I played it too safe, like joined companies.”
Ganesh Krishnan, at 26:15
“I could have become an entrepreneur earlier.”
Ganesh Krishnan, at 26:22
“Again, like, hindsight’s 20/20. I have no regrets, but that’s what I would have done differently, is taken more risks.”
Ganesh Krishnan, at 26:35
It’s a striking answer from someone whose safe choices were Yahoo, LinkedIn through its IPO and Atlassian. He started his first company more than 20 years after the Purdue lab.
What’s the worst thing that happens?
Jon asked how people should think about risk when their life isn’t set up for it. Ganesh took the answer from the same book.
“The way to think about that is not necessarily just monetary or something, is to say, hey, what’s the worst thing that happens?”
Ganesh Krishnan, at 27:14
“Let’s say it doesn’t work in a year or two. You can always probably go back with those skills to a more stable company and get a gig.”
Ganesh Krishnan, at 27:25
He didn’t wave away the money question. He asked it directly, where are you financially, and said those things matter. His point was about the balance.
“but people tend to over-index on stability versus passion and risk-taking.”
Ganesh Krishnan, at 27:41
Outside your comfort zone
Jon agreed, from his own experience.
“I think that we do tend to overvalue, like, comfort and stability.”
Jon McLachlan, at 27:49
“when I’m outside of my comfort zone, that’s where the good stuff always happens.”
Jon McLachlan, at 27:58
A comfort zone is a familiar psychological state where people are at ease and in control of their environment, with low anxiety and stress (Wikipedia). Jon added a caution about going too far, when a stretch doesn’t line up with your strengths.
“But I think a lot of us maybe worry about being too uncomfortable.”
Jon McLachlan, at 28:33
Ganesh named the force on the other side.
“Yeah, humans are programmed with inertia, right?”
Ganesh Krishnan, at 29:15
“There’s nothing wrong being in your own comfort zone. Don’t get me wrong.”
Ganesh Krishnan, at 29:37
And he widened it from a career choice to a society’s.
“And even in the last 10, 15 years, like, there’s been way more startups.”
Ganesh Krishnan, at 30:04
“Otherwise, if everybody’s in their comfort zone, it’s hard to make advancements.”
Ganesh Krishnan, at 30:14
Help people fix problems, not just create new ones
Jon’s last question was for the entrepreneurs listening: what problem would Ganesh pay someone to solve?
“Oh, boy, I was not prepared.”
Ganesh Krishnan, at 30:44
Then he answered with his own company’s thesis, aimed at everyone else’s.
“So I think that more companies need to be looking at how to help people resolve issues, than to just identify new issues.”
Ganesh Krishnan, at 31:02
“think about how to help people fix problems, not just create new ones for them, because there’s so many problems already practitioners are dealing with.”
Ganesh Krishnan, at 31:15
His second answer was smaller and more personal.
“Simple things like, how do I manage my browser tabs more effectively?”
Ganesh Krishnan, at 31:27
“Like, I have three different windows with three different profiles with 30 different tabs on each open.”
Ganesh Krishnan, at 31:35
Jon had a design ready.
“I could just use something that, if it just expired the tab, like, after 20 minutes of not having the thing open, and just kept it in the history, that would be perfectly fine”
Jon McLachlan, at 31:56
“And each one of those things is a process on your CPU that is running and properly segmented for all of the good security reasons, but that still takes up resources.”
Jon McLachlan, at 32:12
Google Chrome launched in September 2008, and its tabs are the main component of its interface (Wikipedia). Chrome uses its own multi-process architecture (Wikipedia), and that’s the segmentation Jon was describing: isolation that’s good for security, paid for in resources and battery.
After the tape
Anzenna kept Ganesh’s starting point and built a lot on top of it. In 2023 it was a security awareness and engagement platform, and its first blog post, by Ganesh in June 2023, was titled “Goodbye Security Awareness Tools, Hello Anzenna” (Anzenna). Its blog shows the next steps. It announced Microsoft 365 compliance in December 2023, SOC 2 Type II compliance in July 2024, and integrations and a browser extension later that year (Anzenna). In February 2025, a release described Anzenna as “the pioneer of Human-Centered Security,” focused on human behavior, with automated fixes for insider risk, intellectual property exfiltration and compliance violations through a company’s existing tools (PRWeb).
In 2026 the focus moved to AI. Its press page lists AI investigation agents for insider risk probes in March, access control for AI usage in June, and AI data loss prevention for prompts and agent activity in July (Anzenna). Data loss prevention is the set of strategies and technologies that stop the unauthorized transmission or disclosure of sensitive data (Wikipedia). Its LinkedIn page now calls it “intent-based AI DLP and insider risk management,” with headquarters in Redwood City and a 2022 founding date (LinkedIn). Ganesh is still co-founder and CEO, and his co-founder, Albert Yu, is CTO (Anzenna).
The thread from the tape survives in the company’s own words. Its company page says Anzenna was founded on the premise that “the people inside your company are not the adversary” (Anzenna), and one of its four stated virtues is trust as default, starting from the assumption that people mean well (Anzenna). That’s Ganesh’s answer to the skeptic who didn’t want to trust employees, written into the company.
The rest of the people in this story moved too. ArmorCode, Nikhil Gupta’s company after Avid Secure, launched in May 2021 (SiliconANGLE). Pure Storage, where Nikhil once pitched Jon, renamed itself Everpure in February 2026 (Wikipedia). And Taher Elgamal, who started Securify, sat down for episode 61 in January 2025 (episode 61).
What aged best is the part about ownership. Tools that find problems are everywhere, and Ganesh’s bet was that the scarce thing is getting each problem to the person who can fix it, with the context to do it. That’s as true of an OAuth grant in 2023 as of an AI prompt in 2026. Keep the default protections. Then make the rest of the company owners of their part of the risk.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each. The explanation shows once you choose.
-
What did Ganesh say Anzenna means in Japanese?
- Safe
- Trust
- Calm
a. "Safe." Transcript, 0:20.
-
What did Ganesh write at Intel Architecture Labs?
- Firewall rules for Yahoo
- IPsec device drivers for Windows 95 and Windows 98
- A vulnerability scanner
b. "writing IPsec device drivers for Windows 95 and Windows 98." Transcript, 1:32.
-
What did Ganesh say about security awareness training?
- It's broken
- It's the best defense a company has
- It should happen once a year
a. "So what we see happening is security awareness training is broken." Transcript, 7:12.
-
What feedback made Ganesh's worst day as a founder?
- The product was too expensive
- Security teams didn't need another tool
- The company didn't want to trust employees with security
c. "Employees, you know, we don't really want to trust them when it comes to security." Transcript, 14:58.
-
What did Ganesh say about default protections?
- They're enough on their own
- They're necessary, but not sufficient
- They're obsolete with zero trust
b. "Like, default protections are absolutely necessary, but they're not sufficient." Transcript, 15:50.
-
In Ganesh's example, a company of a thousand people with a security team of 10 finds 20% supporters. How big does the team get?
- About 12 people
- About 50 people
- More than 200 people
c. "Your team just went from 10 people to more than 200 people." Transcript, 21:11.
Is your security team type one or type two?
Jon’s two types of security people make a good mirror. Eight questions on which one your team is, from the way findings get fixed to the look on people’s faces when you walk into the room.
Scorecard · eight questions
Is your security team type one or type two?
Answer for how your team works today. If two answers fit, pick the lower one.
-
When a security finding belongs to another team's system, who fixes it?
- Security fixes it, or chases it until someone does
- We file a ticket and follow up
- The owner gets it with context and owns the fix
"But my best experiences, like you said, have been to take the problem to the right set of people who we think can help solve it, and actually collaboratively working with them, making them own the problem." See Making them own the problem.
-
When an employee creates a risk, like an OAuth grant to an unvetted app, how do they hear about it?
- They don't, unless something breaks
- Through their manager or a periodic report
- Directly, in context, soon after, with a way to fix it themselves
"it should be raised directly to the employee, and they should self-remediate." See OAuth grants that employees keep doing.
-
How does security awareness training reach people?
- An annual course
- An annual course plus phishing simulations
- Short, contextual lessons tied to what the person just did
"So what we see happening is security awareness training is broken." See Security awareness training is broken.
-
When security brings a requirement to another team, does it explain why and ask for help?
- Rarely, we send the policy
- When people ask
- Always, and we ask them to make it better
"where I tell people why I'm doing something, why, and solicit their help and empower them to make it better, rather than dictate a set of policies." See Talking to the second type.
-
Do you have security supporters outside the security team?
- No
- A few, informally
- A security champions program with people in most teams
"Your team just went from 10 people to more than 200 people." See From 10 people to more than 200 people.
-
Are your default protections in place, like single sign-on, multi-factor authentication and endpoint protection?
- There are known gaps
- Mostly
- Yes, and reviewed on a schedule
"Like, default protections are absolutely necessary, but they're not sufficient." See Absolutely necessary, but they're not sufficient.
-
Does your security team measure itself on findings found or on risks resolved?
- Findings found
- Some of both
- Risks resolved
"think about how to help people fix problems, not just create new ones for them, because there's so many problems already practitioners are dealing with." See Help people fix problems, not just create new ones.
-
When security joins a product meeting, what does the room say?
- Oh no
- Nothing, it's neutral
- Oh, great, they'll help us
"But everyone in that meeting room is like, oh, great. Like, so-and-so is here. They're going to help us navigate this challenging space." See Two types of security professionals.
Security owns every fix and every alert, and the rest of the company experiences it as a deadline problem. Start with one recurring finding and send it to its owner with context and a fix, instead of fixing it for them.
The controls are there, but people still hear about security once a year. Replace one annual module with feedback in the moment, explain the why in your next requirements review, and recruit your first supporters.
Security manages the risk program and the rest of the company owns its part of the fixes. Keep the default protections current, measure resolution instead of findings, and keep growing the supporters.
How big is your security team, really?
Ganesh’s example was a company of a thousand people, a security team of 10, and 20% of everyone as supporters. The calculator runs that on your own headcount and adds one number Ganesh didn’t give: how many hours a month each supporter puts in. We’ve set that to 2 as an example. Put in your own.
Calculator
How big is your security team, really?
Four numbers: everyone at the company, the people on the security team, the share of the company who'd be supporters, and the hours a month each supporter gives.
With 1000 people and a security team of 10, 20% supporters is 200 people. That's 210 people working on security, 21 times the team. At 2 hours a month each, supporters add 400 hours a month, about 2.5 full-time people.
The thousand people, the team of 10 and the 20% are Ganesh's example from the episode, and the 2 hours a month is ours, not a benchmark. The bigger number is the first one. Supporters see problems in their own teams that a central security team never would, and that's worth more than the hours.
From a Purdue lab to Anzenna and after
Everything on this page sits on one timeline, from the ElGamal signature scheme in 1985 to Anzenna today. Filter it by thread.
Timeline · 1985 to 2026
From a Purdue lab to Anzenna and after
Filter by thread. Dates are from the public record except where marked as part of this show.
- The ElGamal signature scheme
Taher Elgamal describes the scheme that DSA later builds on (Wikipedia, on this show).
- Sophos
Jan Hruska and Peter Lammer's company begins producing its first antivirus and encryption products (Wikipedia, on this show).
- Windows 95
Microsoft's consumer operating system reaches retail (Wikipedia, on this show).
- Elgamal at Netscape
He becomes Netscape's chief scientist, through 1998, and his SSL work becomes the basis for TLS and HTTPS (Wikipedia, on this show).
- A Purdue security lab
As a research assistant, Ganesh meets anomaly detection and patch management, by his account (on this show).
- Nmap
Gordon Lyon's network scanner is first released, in Phrack magazine (Wikipedia, on this show).
- Intel
Ganesh joins as a senior software engineer and builds IPsec for Windows NT and 9x (LinkedIn, on this show).
- Securify
Taher Elgamal founds the company and becomes its CEO (Wikipedia, on this show).
- Windows 98
The second Windows 9x release reaches retail (Wikipedia, on this show).
- Practice area head at Securify
Ganesh runs security consulting engagements, through 2001 (LinkedIn, on this show).
- The dot-com peak
The bubble peaks, and the Nasdaq falls 78% by October 2002 (Wikipedia, on this show).
- Yahoo
Ganesh joins the security team, and leaves in October 2010 as vice president and CISO (LinkedIn, on this show).
- LinkedIn launches
Reid Hoffman and Eric Ly launch the network (Wikipedia, on this show).
- Google Chrome
The browser's first public release, as a beta (Wikipedia, on this show).
- LinkedIn
Ganesh becomes head of security and privacy engineering, through May 2016 (LinkedIn, on this show).
- LinkedIn's IPO
Its first shares trade on the New York Stock Exchange (Wikipedia, on this show).
- Bengaluru
Ganesh sets up LinkedIn's India Technology Center, through April 2013 (LinkedIn, on this show).
- Atlassian's IPO
The company lists on the NASDAQ as TEAM (Wikipedia, on this show).
- Atlassian
Ganesh becomes head of engineering for identity and security, through July 2017 (LinkedIn, on this show).
- Microsoft buys LinkedIn
The $26.2 billion deal is completed (Wikipedia, on this show).
- Avid Secure
Ganesh co-founds the cloud security company as CTO (LinkedIn, on this show).
- Sophos buys Avid Secure
Sophos announces the acquisition, and Ganesh becomes its VP of engineering (Sophos, on this show).
- Thoma Bravo buys Sophos
The company leaves the London Stock Exchange (Wikipedia, on this show).
- ArmorCode launches
Nikhil Gupta's application security startup comes out with $3 million (SiliconANGLE, on this show).
- Leaving Sophos
Ganesh's three years after the acquisition end (LinkedIn, on this show).
- Anzenna
Ganesh co-founds the company as CEO (LinkedIn, on this show).
- Goodbye Security Awareness Tools
Ganesh's first post argues for contextual, employee-driven awareness (Anzenna, on this show).
- The recording
Jon and Ganesh talk, a year after Ganesh left Sophos by his account (on this show).
- Episode 34 airs
The episode goes out on Podbean and Spotify (Podbean, on this show).
- SOC 2 Type II
Anzenna announces its SOC 2 Type II compliance (Anzenna, on this show).
- Episode 61
Taher Elgamal, who founded Securify, comes on the show to talk about SSL and passwords (on this show).
- Human-centered security
A release adds automated fixes for insider risk and data exfiltration through existing tools (PRWeb, on this show).
- Pure Storage becomes Everpure
The storage company renames itself (Wikipedia, on this show).
- AI investigation agents
Anzenna launches agents for insider risk probes (Anzenna, on this show).
- AI data loss prevention
Anzenna brings data loss prevention to AI prompts and agent activity (Anzenna, on this show).
- Anzenna today
Intent-based AI data loss prevention and insider risk management, from Redwood City (LinkedIn, on this show).
What to do this week
Five things, in the order the episode suggests.
- Send one finding to its owner. Pick a finding your team keeps fixing for other people, like stale OAuth grants or security tickets that sit in Jira, and send it to the person who owns it, with the context and the fix. Track how long it takes them.
- Replace one annual module. Take one topic from your yearly awareness course and turn it into a short note that reaches people right after they do the risky thing.
- Count your supporters. Run the calculator on your own headcount, then name your first five supporters outside security and tell them what you need from them.
- Score your team. Take the scorecard with someone from engineering, not just security, and see whether you agree on which type you are.
- Get help with the parts you can’t staff. Our vCISO Services can build the program and lead it until you hire, our Corporate Shadow-AI Detection work finds the AI tools and connected apps your people already use, our Counter Business Espionage & IP Protection team handles the insider risk side, and you can book 15 minutes with us.