Episode 45 of The Security Podcast of Silicon Valley aired on May 26, 2024. Jon McLachlan hosted alone. The guest was Craig Goodwin, then cofounder and CEO of Bleach Cyber, and the subject was security for small businesses: why a chief security officer of large companies left to build for them, what Bleach did, when a small company should start on security, and what he learned as a founder (Podbean).
“So started off in the military in England, in the intelligence side of the military.”
Craig Goodwin, at 0:36
Craig’s LinkedIn lists the roles behind his answers (LinkedIn). He was group head of technology at Working Links from February to July 2012, then vice president of global information security at Monster from July 2012 to October 2015. At CDK Global he was chief business security officer from October 2015 to November 2016, then vice president and global chief security officer from November 2016 to October 2019. At Fujitsu he was chief information security officer from November 2019 to April 2020 and chief trust and risk officer from April to September 2020. He was a venture advisor at YL Ventures from September 2018 to January 2023, and cofounder and chief operating officer of Cyvatar.ai from February 2020 to November 2022. His Bleach Cyber role, as CEO and cofounder, starts in January 2022.
Monster.com is a global employment website and job search engine. It moved its headquarters from Maynard to Weston, Massachusetts, in 2014, and Randstad, an HR and recruitment firm, bought it in August 2016 for $429 million in cash (Wikipedia). CDK Global is an American company based in Austin, Texas, that provides data and technology to the automotive, heavy truck, recreation and heavy equipment industries. ADP spun it off on October 1, 2014, and Brookfield completed its purchase of the company on July 6, 2022 (Wikipedia). Fujitsu is a Japanese information and communications technology company, founded on June 20, 1935, with its headquarters in Kawasaki (Wikipedia).
On Bleach Cyber’s site, the headline is “Cybersecurity, Simply!” and the pitch is a way for “any startup or small business to get secure & compliant” (Bleach Cyber). The site says the platform checks a company’s systems for weak spots, applies fixes on its own and keeps watch on cloud accounts. It lists no prices, and its footer is dated 2023.
The conversation was recorded in April 2024, about a month before it aired. Craig says Bleach started “a year and a half ago,” and later that the work is “two years in.” He also says he founded his first startup in 2019. The earliest startup on his LinkedIn is Cyvatar.ai, from February 2020.
The page has a section for each part of the conversation with its sources, nineteen figures, twenty clips from the tape, the full transcript, and five tools: a quiz, a scorecard for whether a small company has the basics in place, a calculator for the hours a spreadsheet assessment costs, a timeline from 2011 to 2026, and a to-do list.
The tape is from 2024. Where a fact has changed since, such as Craig’s company, the page gives the change and its date. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote those words.
Lean on the cyber security bit
Jon asked for Craig’s background. Craig started in the British military, on the intelligence side, and said that work came in two kinds.
“And when you’re doing that, there’s two roles: one’s running around deserts with guns, and the other one’s doing cyber security.”
Craig Goodwin, at 0:41
“And unfortunately, quickly realized that no one cares about the running around deserts with guns when you come out into civilian life.”
Craig Goodwin, at 0:47
He had to lean on the cyber security side to find his way.
Jon thanked him for his service. Craig said he appreciated it, and that it is something Americans say.
“Only Americans say that.”
Craig Goodwin, at 0:58
Later in the episode he names the part of intelligence he worked in, human intelligence, and says it shapes how he leads. Human intelligence, or HUMINT, is intelligence gathered from human sources and conversations with people. It is distinct from technical disciplines such as signals intelligence and imagery intelligence (Wikipedia).
“No, I joined the military straight out of school.”
Craig Goodwin, at 31:05
He went almost straight from school into human intelligence, and he told Jon he still believes in learning from experience.
“And you can get so much from experience.”
Craig Goodwin, at 31:19
Equal parts terrified, equal parts really excited
Craig left the military when the chief security officer job “was just becoming a thing,” in his words. He guessed at how long he spent in the job and said he always gets the number wrong.
“jumping between gradually larger chief security officer roles.”
Craig Goodwin, at 1:19
“So started with Monster Worldwide in Boston, went to CDK Global, which is a 12 billion automotive tech firm in Chicago, and then ended my corporate career at Fujitsu.”
Craig Goodwin, at 1:23
His LinkedIn puts those three companies between July 2012 and September 2020. On the tape he says he always wanted to do startups, and that he founded his first one in 2019.
“That’s crazy and insane and fabulous and spectacular all at the same time.”
Jon McLachlan, at 1:41
Craig called it a mad life, and gave the mix of feelings that comes with it.
“I describe it now as like equal parts terrified, equal parts really excited.”
Craig Goodwin, at 1:47
“And that never really changes.”
Craig Goodwin, at 1:52
“So you’re comfortable being uncomfortable.”
Jon McLachlan, at 1:55
“I think you have to be.”
Craig Goodwin, at 1:57
On June 19, 2024, less than a month after this episode aired, a ransomware attack took most of CDK Global’s services offline, and by July 4 nearly all dealers had their access back (Wikipedia). Craig had left CDK in October 2019. Monster merged with CareerBuilder in September 2024, and CareerBuilder + Monster filed for Chapter 11 bankruptcy protection on June 24, 2025 (Wikipedia).
Always felt sorry for the supply chain
After a couple of years at his first startup, Craig founded Bleach. He said he had long wanted to help the smaller end of the market, because even the big companies he worked for found protection hard.
“We, as CISOs, we, even with our tens of millions of dollars, it’s really hard to protect our businesses.”
Craig Goodwin, at 2:12
“always felt sorry for those smaller businesses and just couldn’t get my head around how they were going to protect themselves.”
Craig Goodwin, at 2:21
He named the supply chain first. A supply chain attack is a cyberattack that targets the less secure elements of an organization’s supply chain (Wikipedia).
“So, always had that passion in the back of my mind.”
Craig Goodwin, at 2:26
The search he described had three requirements.
“started out on that journey to find a simple, easy, cost-effective way”
Craig Goodwin, at 2:31
Small and medium-sized enterprises are businesses below set limits on staff and revenue (Wikipedia). Bleach’s site says “any startup or small business” (Bleach Cyber).
Everything is about people
Jon asked what pulled Craig into security. Craig said the thing that interests him most sounds like a cliche to him.
“The thing that interests me most about security is definitely, I don’t even like it because it sounds a bit of a cliche nowadays, but like the human part of security.”
Craig Goodwin, at 2:58
He tied it to his background in human intelligence.
“So I always just think everything’s driven by people.”
Craig Goodwin, at 3:09
“Everything is about people.”
Craig Goodwin, at 3:16
He said it applies to deep technical subjects too: the work still comes down to the people around you who are good at those things.
“So, I always take everything from a people-centric approach, no matter how technical the subject is.”
Craig Goodwin, at 3:41
“I love it, people are what matter at the end of the day.”
Jon McLachlan, at 3:45
Two other guests took up the human side. Leigh Honeywell of Tall Poppy talked about the human side of security on episode 5, and Trevor Hilligoss, a former FBI agent at SpyCloud, called the human behind the keyboard the biggest threat on episode 86.
Bleach is that for security
Jon asked what Craig does as cofounder and CEO. Craig said he and his cofounder, Steve, split the work down the middle.
“Yeah, so me and Steve, we split well down the middle.”
Craig Goodwin, at 3:56
“We grew up together, so we’ve known each other forever.”
Craig Goodwin, at 4:01
“And Steve leads product and development, which is all the techie bits that perhaps aren’t really my forte.”
Craig Goodwin, at 4:27
Craig leads the business side.
“And I go and just sell it.”
Craig Goodwin, at 4:46
Then he gave the mission, and the analogy he uses for it.
“we made it our absolute mission just 12 months ago to really make cybersecurity simple.”
Craig Goodwin, at 4:58
“Who goes and hires a product manager, project manager, to run Asana?”
Craig Goodwin, at 5:22
“Bleach is that for security.”
Craig Goodwin, at 5:32
Asana is an American software company in San Francisco. Its service is a web and mobile work management platform for teams to organize, track and manage their work. Dustin Moskovitz and Justin Rosenstein founded it in 2008, the product launched in April 2012, and the company listed on the New York Stock Exchange in September 2020 (Wikipedia). Asana’s head of security, Sean Cassidy, was the guest on episode 17 in June 2022.
Craig limited the claim to small companies.
“I’m not talking about enterprises here”
Craig Goodwin, at 5:43
How simple can we make it?
Craig said the team repeats one rule, down to the small things.
“make it simple. How simple can we make it? Make it easier.”
Craig Goodwin, at 5:55
“And that’s our mantra.”
Craig Goodwin, at 5:59
Jon answered as a security operator. His day job, he said, is dashboards, tickets and incoming issues.
“and my day job is looking at dashboards, I’m looking at tickets, I’m looking at issues that come in, and there’s a lot of complexity there.”
Jon McLachlan, at 6:07
“I understand where the complexity is coming from, like all these great vendors who specialize in different things”
Jon McLachlan, at 6:16
He said startups and small businesses have to find a balance. Kabir Mathur of Leen made the case against adding tools on episode 63, and Phil Howie of Sidekick talked about making security doable for small companies on episode 83.
You can’t just reset
Craig said every security leader talks about security by design. Secure by design is the engineering concept that security is built into a system from the outset, in its architecture, and not retrofitted later through patches or outside controls (Wikipedia).
“We all talk about like security by design.”
Craig Goodwin, at 6:33
He said he knows from large companies that it is hard to apply to an old one.
“So I know it’s not as easy as resetting.”
Craig Goodwin, at 6:39
“But the reality is, you’ve got 30, 40, 50 years of history built up in a business and you can’t just reset.”
Craig Goodwin, at 6:46
A small company starts with none of that history.
“Whereas with a small business, the beauty of that environment is you can, you’ve got to start from scratch.”
Craig Goodwin, at 6:52
“You can build from the basics.”
Craig Goodwin, at 6:58
“You can do the basics right from the outset.”
Craig Goodwin, at 6:59
Jon added a second goal next to the first.
“I like things that are secure by design and simple by design, and that’s actually very difficult to achieve.”
Jon McLachlan, at 7:15
Michael Nov of Prime Security made the case for the design stage on episode 76.
Someone will correct me on this
Jon asked about Steve. Craig said they met as boys and stayed together through two careers.
“So we went to school together when we were about eight years old and onwards.”
Craig Goodwin, at 7:56
“We served in the military together and we’ve worked in multiple large businesses together, with him as my 2IC.”
Craig Goodwin, at 8:01
A 2IC is a second-in-command, the second-highest authority in an organization. In the British Army and the Royal Marines, it is the deputy commander of a unit (Wikipedia). In the military the two served in different regiments, and Steve drove tanks.
“So we were in completely different regiments.”
Craig Goodwin, at 8:12
“So he was driving tanks around the battlefield while I was pretending to be a civilian and involved in human intelligence side.”
Craig Goodwin, at 8:20
“I had no idea that the army did human intelligence.”
Jon McLachlan, at 8:29
Craig said the British Army is small enough that parts of the whole army do human intelligence. Then he compared its size with one American service, and said someone would correct him on it.
“I’m pretty sure the United States Marine Corps is bigger than the entire three services, the Army, Air Force and Navy, in the UK.”
Craig Goodwin, at 8:56
Wikipedia’s figures back him up on active personnel. The Marine Corps had 168,527 active personnel and 32,967 in reserve as of December 2024 (Wikipedia). The British Armed Forces had 137,970 regular personnel plus 4,460 Gurkhas, and 32,030 volunteer reserves, as of April 2026. The British forces are the Royal Navy, which includes the Royal Marines, the British Army and the Royal Air Force (Wikipedia). The two counts are from different dates.
Garrett Smith, a Marine Corps Reserve lieutenant colonel and founder of Reveal Technology, was the guest on episode 90, and Aviv Grafi went from the Israel Defense Forces’ Unit 8200 to found Votiro on episode 35.
Always about taking the basics
Jon asked when the right time is to start on security, and whether there is a framework for deciding. He said security is a priority, and it competes with other things.
“when is the right time to start prioritizing security?”
Jon McLachlan, at 9:09
Craig said the question used to be harder, when security was more complex to do. He put himself on one side of his peers.
“I definitely sit on the realistic side of the CISO group.”
Craig Goodwin, at 9:44
“I would say you don’t have to have sharks with freaking laser beams when you’re early.”
Craig Goodwin, at 9:48
“But it’s always about taking the basics, right?”
Craig Goodwin, at 9:55
Craig’s next point was about the tools a company already pays for. He called it one of the theses Bleach was built on.
“that tech stack you’re already using, the Amazons, the Googles, the Microsofts of the world”
Craig Goodwin, at 10:13
“The one thing that they haven’t done necessarily is made it very easy to use.”
Craig Goodwin, at 10:24
“You can actually leverage what you already got to do security better.”
Craig Goodwin, at 10:35
Amazon Web Services is the Amazon subsidiary that provides on-demand cloud computing, metered and pay-as-you-go (Wikipedia). Microsoft Azure is the cloud computing platform developed by Microsoft, and Google Cloud is Google’s suite of cloud computing services (Wikipedia, Wikipedia).
His answer to Jon’s question was now. He said the industry had made security part of the parlance, so few founders in technology don’t think about it at all.
“I would say now is the time.”
Craig Goodwin, at 10:40
Positivity to come out of a bad economy
Jon asked whether security tools and vendors were being commoditized. Craig said he might get cancelled for his answer.
“maybe this will get me cancelled, but I think there’s a lot of positivity to come out of a bad economy, right?”
Craig Goodwin, at 11:31
“It’s a filter.”
Jon McLachlan, at 11:42
Craig said it had made the past year hard for him and for founders everywhere. He saw an effect on both ends.
“And I think that’s happened on both ends.”
Craig Goodwin, at 11:50
“Like I think on our startup side, it’s made the stronger businesses bubble to the top a lot and will continue to do that over the next year and two years.”
Craig Goodwin, at 12:04
“But then on the enterprise side, it’s definitely pushed people to be more frugal.”
Craig Goodwin, at 12:12
“It’s pushed people to think harder about those investments that they’re making and where they’re putting their dollars.”
Craig Goodwin, at 12:16
He said it had also pushed companies toward platforms that do everything, a trend he said would take a long time to play out, and he mentioned “the golden bullet” in the same breath. Jon said it was the first time he had heard that one, and they settled on silver bullet.
The usual phrase is silver bullet. In software, it goes back to Fred Brooks’s 1986 paper No Silver Bullet, which argued that no single development promises even a tenfold improvement in software within a decade (Wikipedia).
Craig said the most positive change was attention to the investment and to the basics. He said businesses further up the chain would benefit from the basics too, whether they admit it or not.
“I think there’s been a big reset, and I think that’s a relatively positive thing in general.”
Craig Goodwin, at 13:20
If your only differentiator is that you’re AI
In the same answer, Craig named the conversation he expected to draw email: a CISO who calls generative AI the biggest risk while the patching is behind.
“the next CISO that says to me generative AI is my biggest risk in the organization when they’re not doing patching very well is, wait.”
Craig Goodwin, at 12:46
He said he would want to talk about priorities first.
A patch is data that modifies an existing piece of software, often to fix bugs and security vulnerabilities (Wikipedia).
He then gave his theory on startups and AI. He said every business should use AI, and Bleach used it for several things.
“I think every business should be using AI in some capacity.”
Craig Goodwin, at 13:50
“But if your only differentiator is that you’re AI, then I think over the next 12 to 24 months, you’re going to have to shift that, quite frankly, because I think everyone’s using it.”
Craig Goodwin, at 14:00
“Yeah, I can see that.”
Jon McLachlan, at 14:15
The window he gave runs from about April 2025 to April 2026, counted from the recording.
That blue check mark
Jon asked Craig to time travel and describe success. Craig said he had said the same thing from the start.
“where we’d like to get to is that Bleach becomes the de facto cybersecurity solution for small businesses and startups.”
Craig Goodwin, at 14:33
He compared it to two things a founder signs up for early: a cloud provider and insurance.
“Bleach is just the vernacular or the verb for security, for securing a small business.”
Craig Goodwin, at 14:57
“They think, I’ve just bleached my business.”
Craig Goodwin, at 15:06
Jon asked how far into the future they had gone. Craig joked six months, then said three to five years. He said Bleach would become a mark that others check.
“It’s that blue check mark for cyber security that everyone looks for when they’re doing M&A, or when they’re investing, or when they’re going to grant insurance, or when they’re going to give a contract from a big enterprise by a CISO.”
Craig Goodwin, at 15:33
“Let me see your Bleach scorecard. Okay, you’re good.”
Craig Goodwin, at 15:48
Mergers and acquisitions, or M&A, are transactions in which the ownership of a company or one of its units passes to, or is combined with, another entity (Wikipedia). Cyber insurance is a specialty insurance product against risks related to information technology (Wikipedia).
A bit of flimsy script
Jon asked about the go-to-market strategy. Craig said Bleach reached small businesses two ways.
“Number one is direct B2B small businesses.”
Craig Goodwin, at 16:08
“So we’ve got 500 plus small businesses right now that are utilizing Bleach to monitor, control, assess, remediate security risks within their environment.”
Craig Goodwin, at 16:11
“Number two is through managed security service providers and security services businesses.”
Craig Goodwin, at 16:24
A managed security service provider, or MSSP, provides outsourced network security services (Wikipedia). Craig said the second route puts tools in the hands of virtual CISOs and security consultants. He described one consultancy he was talking to that week.
“Their consultants are using like a bit of flimsy script that they’ve used and an Excel spreadsheet that they walk into a customer”
Craig Goodwin, at 16:52
The results end up in the spreadsheet, and the consultant spends hours on it. Craig described the alternative.
“Imagine a world where you’ve got a beautiful UI where you can go and hook up their cloud within minutes, get assessment results within seconds and deliver those results, help them to risk manage, help them to remediate.”
Craig Goodwin, at 17:07
Jon described what YSecurity does.
“Here at YSecurity, we offer an on-demand security team and we specialize in ambitious B2B companies that are trying to raise their operational and security maturity level.”
Jon McLachlan, at 17:32
“Oftentimes it’s business driven, for SOC 2, ISO, FedRAMP, or even just, oh, we’d like to prepare ourselves to go public.”
Jon McLachlan, at 17:43
“We’ve got all the standards built into Bleach.”
Craig Goodwin, at 17:52
SOC 2 is one of the AICPA’s system and organization controls reports (Wikipedia). ISO/IEC 27001 sets the requirements for an information security management system (Wikipedia). FedRAMP is the United States government-wide compliance program for cloud products and services (Wikipedia). Jon and Sasha Sinkevich walked through these standards on episode 37, and the calculator below puts a number on the consultant’s hours.
Look what we can do
Jon asked for Craig’s best day at Bleach. Craig picked two early moments. The first was with Steve, whiteboarding on their own.
“I think it was super early, actually.”
Craig Goodwin, at 18:13
“just whiteboarding and just drawing things and going, look what we can do.”
Craig Goodwin, at 18:32
He said the excitement was still there two years in, and he hoped it would be there at five and ten. The second moment came in a Starbucks, right after he left his last startup, when he needed a name.
“But the trend at the moment is names that have got nothing to do with what they’re doing.”
Craig Goodwin, at 19:07
He told his wife what he wanted to build.
“It’s about keeping the business clean.”
Craig Goodwin, at 19:26
“It’s about sweeping things up and just making sure that your hygiene, your daily routine, is really good.”
Craig Goodwin, at 19:28
She came up with the name. He registered the Bleach Corporation in the US and bought the domain, Bleach Cyber.
“this is going to be epic.”
Craig Goodwin, at 19:46
Jon asked whether he took a picture. He didn’t. Jon suggested generative AI could recreate the moment.
Sticking to your guns
Jon asked for the most challenging day. Craig said there had been a lot of them.
“It goes massively up and down.”
Craig Goodwin, at 20:25
“Resilience is absolutely key.”
Craig Goodwin, at 20:30
He put the hardest days early, around funding. He said you don’t always need funding, and most founders can’t fund a company themselves. Early on, he said, people didn’t believe what he was saying, and he named investors.
“VCs in general were always very reluctant to back SMB focused plays, right?”
Craig Goodwin, at 21:13
“The security market is so traditionally focused on the enterprise that the majority of investors, as soon as you say, I’m focused on SMBs or small businesses, they’re just immediately like, I’m not sure we can do that.”
Craig Goodwin, at 21:21
Venture capital is private equity financing for startups with high growth potential, in exchange for equity (Wikipedia). Craig said attitudes were changing, and that competitors helped.
“I welcome some of the competitors that popped up.”
Craig Goodwin, at 21:45
“I think it adds validation to the cause.”
Craig Goodwin, at 21:48
“And I think hopefully gone are the days where everyone goes, SMB, no way.”
Craig Goodwin, at 22:01
He named the hardest thing.
“I think that’s the hardest thing, is just sticking to your guns and being resilient enough”
Craig Goodwin, at 22:11
He said a founder also has to take feedback and let the idea change, and called it a tricky balance.
“The balance between humility and confidence.”
Jon McLachlan, at 22:32
Building the plane while you’re flying it
Jon asked how Bleach was funded at the start: angels, pre-seed, seed, friends and family, or bootstrapping. Craig said he was lucky, because people who knew his work backed him again.
“So I had a couple of really close mentors of mine, investors slash angels, that had seen me through the journey of my last startup.”
Craig Goodwin, at 22:48
“were almost blindly backing me into the next thing, which got us started.”
Craig Goodwin, at 23:11
An angel investor is an individual who provides capital to a business, often early, and a growing number are organized into angel groups or networks (Wikipedia). Craig said 2023 taught them frugality.
“I think 2023, back to the finance thing, has taught us about frugality and testing things and building things frugally.”
Craig Goodwin, at 23:20
“I think gone are the days where it’s like growth at all costs.”
Craig Goodwin, at 23:27
“And it now is about conservative growth and considered growth.”
Craig Goodwin, at 23:32
He said Bleach was the opposite of his last startup on one point. This time they had six months to build the product before selling it.
“And one of the lessons I learned last time was trying to build the plane while you’re flying it is really freaking difficult.”
Craig Goodwin, at 23:50
“So, if you can raise the money and raise the capital to give yourself the room to build at least an MVP that’s solid enough that people can use it, that’s a really important first step.”
Craig Goodwin, at 23:56
A minimum viable product, or MVP, is a version of a product with just enough features to be usable by early customers who can then give feedback (Wikipedia). Craig credited Steve with the foundation, so they didn’t have to sell and build at the same time. His LinkedIn also lists him as a venture advisor at YL Ventures from September 2018 to January 2023.
Built by 10,000 CISOs
Jon asked how big Bleach was. Craig said most of the development was outsourced.
“But then on top of that, it’s me and Steve and just a few others right now.”
Craig Goodwin, at 24:41
The few others were in customer success, support and internal development. Jon asked about the customer count he had mentioned.
“500 companies on the platform.”
Craig Goodwin, at 25:00
“and the great thing about being early is they’re giving us feedback every single day.”
Craig Goodwin, at 25:08
“And we’re in this amazing position where we’re getting that every single day.”
Craig Goodwin, at 25:24
He said he used to doubt that an early company could get enough feedback to steer by. Now it was shaping the plan.
“Like it’s genuinely influencing the roadmap, which is really exciting.”
Craig Goodwin, at 25:37
“Your suggestion box doesn’t feed into a paper eating machine”
Jon McLachlan, at 25:41
The feedback covered which integrations to build next, what to protect next and what the dashboard should look like. Craig said they were also building an advisory board of chief security officers.
“We’re building a kind of, like, CISO advisory board as well.”
Craig Goodwin, at 26:03
He said the CISOs on it were not customers, and their job was to shape the roadmap for small businesses.
“built by 10,000 CISOs or something to help your small business would be a great tagline.”
Craig Goodwin, at 26:31
Why are you passionate about it?
Jon asked Craig for his favorite interview question. Craig said it has nothing to do with work.
“I think my favorite interview question would be nothing to do with work.”
Craig Goodwin, at 26:47
“what’s your favorite hobby and why are you passionate about it?”
Craig Goodwin, at 26:58
He said what people do in their spare time, why they found it and what it does for them matters to him. He answers it himself before he asks it.
“So I always would never ask someone to answer something that I wouldn’t answer myself.”
Craig Goodwin, at 27:11
His own answer is road cycling.
“road cycling is my meditation.”
Craig Goodwin, at 27:18
“It’s my thinking time.”
Craig Goodwin, at 27:25
“And I think what comes back from people when they answer that question says a lot about who they are and what’s important to them.”
Craig Goodwin, at 27:34
Jon cycles too, and the two compared rides. Jon said time away from screens matters for founders.
“It’s important, I think, to have a little bit of time to disconnect from all of the glowy screens and all of the intensity around building businesses”
Jon McLachlan, at 28:37
Craig said he calls Steve on Slack with ideas as soon as he gets back from a ride, before he has changed.
“That’s a really good question to ask folks.”
Jon McLachlan, at 29:03
Polina Morozov, a security recruiter at Grammarly, talked about careers and culture in cybersecurity on episode 46, the next episode.
The Psychopath Test
Jon asked for something Craig read or saw that changed how he sees the world. Craig picked a book he called a bit off-beat.
“He’s a fantastic author, a guy called Jon Ronson.”
Craig Goodwin, at 29:39
“and he wrote a book called The Psychopath Test.”
Craig Goodwin, at 29:46
The Psychopath Test: A Journey Through the Madness Industry is a 2011 book by Jon Ronson about psychopathy and the mental health industry, including mental health professionals and the mass media (Wikipedia). Ronson is a British-American journalist, author and filmmaker whose other books include Them: Adventures with Extremists and The Men Who Stare at Goats (Wikipedia).
Craig described the test at the center of the book from memory: created by psychologists in the seventies or eighties, with ten constituents. The test in the book is the Hare Psychopathy Checklist, which the Canadian psychologist Robert D. Hare developed in the 1970s. It has 20 items, a list of personality traits and recorded behaviors used to assess psychopathy (Wikipedia).
He said the book spoke to his own theories about people.
“And I come from a human intelligence background.”
Craig Goodwin, at 30:24
“So I’m just fascinated by the way people behave and how it can be influenced and how different people react in different situations.”
Craig Goodwin, at 30:26
“Like, how do you get psychologically conditioned to join a group and just follow them blindly?”
Craig Goodwin, at 30:52
He said the interest is in human psychology, and comes from his military background. Jon asked whether he studied it. He went into the military straight out of school, and learned it in practice.
This too shall pass
Jon asked whether Craig would want to meet his younger self, and what he would say. Craig said he would, out of fascination, and picked a quote.
“I think it’s Tom Hanks or someone that said, this too shall pass.”
Craig Goodwin, at 32:04
The phrase “this too shall pass” is an adage of Persian origin about impermanence. The phrase appears to come from medieval Persian Sufi poets, it is best known in the West from Edward FitzGerald’s 19th-century retelling of a Persian fable, and Abraham Lincoln told a version of the story in an 1859 address (Wikipedia).
He said it held for the financial problems at startups up to the year before.
“whether it’s good or whether it’s bad, it will pass.”
Craig Goodwin, at 32:19
“It just means that there will be an outcome to this and you will get through it and it will work out the way it’s supposed to work out.”
Craig Goodwin, at 32:31
Looking back, he said the better response was to step back.
“When in reality, a better response to that was just step back and just take your time and think about it.”
Craig Goodwin, at 32:49
Jon offered a line he had heard with the same idea.
“the secret to life is that everything is temporary”
Jon McLachlan, at 33:42
Craig answered with a stock chart. Watched minute by minute, it goes up and down.
“But actually, over the course of a longer period of time, if the general trajectory is up, then you’re onto a winner.”
Craig Goodwin, at 34:07
“And that’s how I look at life.”
Craig Goodwin, at 34:13
“But ultimately, keep the eyes on the goal.”
Craig Goodwin, at 34:18
Simplicity in the chaos
Jon asked what problem Craig would pay someone to solve. Craig named a telecommunications platform that brings Zoom, Google Workspace and Microsoft Teams together.
“like something that centralizes all those things, so everyone could just join the same thing no matter what technology they’re using.”
Craig Goodwin, at 35:16
“one to rule them all but brings them all together, I would love that.”
Craig Goodwin, at 35:38
“There’s the next billion-dollar idea.”
Jon McLachlan, at 35:41
His second was the same for cyclists: one place for all the fitness data, from a Garmin on the bike to a Whoop and the rest.
“Like one source to rule them all would be really cool in that space as well.”
Craig Goodwin, at 36:06
Jon asked for final words. Craig said it was one of the most open conversations he had had in cyber, and went back to the mantra.
“I would say keep it simple is always my mantra.”
Craig Goodwin, at 36:44
“Like this stuff doesn’t have to be as complicated as you make it.”
Craig Goodwin, at 36:47
“So there’s always simplicity in the chaos.”
Craig Goodwin, at 36:53
“The beauty is simplicity.”
Jon McLachlan, at 37:08
After the tape
Craig’s LinkedIn lists three roles after the tape (LinkedIn). From October 2024 to October 2026 he was managing partner of Wingood Group, a strategic advisory firm with offices in the United Kingdom and the United States. From December 2024 to October 2026 he was a strategic advisor to Bleach Security, whose listing reads “Instantly clean up your digital world with powerful, automated protection.” Since September 2026 he has been cofounder and CEO of AvalonX, which “continuously tests your external attack surface” and reports what to fix.
On October 30, 2026, he posted about the AvalonX launch in the United States (LinkedIn). He wrote that his CISO jobs at Fujitsu, Monster and CDK Global taught him one lesson: “you don’t really know your defenses until someone tries to break them.” He wrote that those companies had red teams, penetration testers and the budget to test all the time, and the owner of a 50-person firm faces the same attackers without that protection. The post promises small businesses “Plain-English fixes, no security team needed,” and a price built for them.
This week we launched AvalonX in the U.S.
Craig Goodwin · October 2026
In April 2024 he said even companies with tens of millions of dollars find protection hard, and he wanted to help the smaller end of the market. In October 2026 he wrote about the gap between a CISO with a red team and a 50-person firm. Bleach Cyber’s site still reads “Cybersecurity, Simply!” (Bleach Cyber).
Chris Kirschke spent 27 years in security operations before a venture studio asked him to run a company, which he talks about on episode 102, “CISO does not spell CEO,” from August 2026.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it, and where it is on the tape.
-
What two roles does Craig say intelligence work in the military had?
- Signals work and imagery work
- Running around deserts with guns, and cyber security
- Planning and logistics
b. "And when you're doing that, there's two roles: one's running around deserts with guns, and the other one's doing cyber security." Transcript, 0:41.
-
Which product does Craig compare Bleach to?
- Asana, for project management
- Slack, for chat
- Salesforce, for sales
a. "the analogy that I love is like Asana for project management, right?" Transcript, 5:16.
-
What does Craig say an early company doesn't have to have?
- A password manager
- Backups
- Sharks with freaking laser beams
c. "I would say you don't have to have sharks with freaking laser beams when you're early." Transcript, 9:48.
-
What does Jon call a bad economy?
- A filter
- A storm
- A cycle
a. "It's a filter." Transcript, 11:42.
-
What does Craig want people to think about their security?
- That they have a CISO now
- That they've just bleached their business
- That they passed the audit
b. "They think, I've just bleached my business." Transcript, 15:06.
-
What lesson did Craig take from his last startup?
- Raise money only after revenue
- Outsource nothing
- Building the plane while you fly it is hard
c. "And one of the lessons I learned last time was trying to build the plane while you're flying it is really freaking difficult." Transcript, 23:50.
-
Which saying does Craig pick for his younger self?
- This too shall pass
- Move fast and break things
- Fortune favors the bold
a. "I think it's Tom Hanks or someone that said, this too shall pass." Transcript, 32:04.
Are the basics in place?
Craig’s advice to a small company is to start with the basics, and he said a small business can do them right from the outset. Eight questions on whether yours are in place.
Scorecard · eight questions
Are the basics in place?
Answer for the company as it works today. If two answers fit, pick the lower one.
-
Do you have a list of every cloud account, laptop and SaaS tool the company uses?
- No
- Partly
- Yes, and we keep it current
"You can build from the basics." See You can't just reset.
-
Do security updates go out on a schedule, and can you see which systems are behind?
- No schedule
- For some systems
- Yes, and we can show it
"when they're not doing patching very well." See If your only differentiator is that you're AI.
-
Have you turned on the security settings that come with your cloud, email and office accounts?
- No
- Some of them
- Yes, and someone checks them
"You can actually leverage what you already got to do security better." See Always about taking the basics.
-
Does someone check your systems for security problems every week, and fix what they find?
- No
- When something breaks
- Yes, every week
"to monitor, control, assess, remediate security risks within their environment." See A bit of flimsy script.
-
Is security a named person's job, even part time?
- No one owns it
- Shared, unofficially
- Yes, one named owner
"Everything is about people." See Everything is about people.
-
Do you know which standard your biggest customers will ask for, such as SOC 2, ISO 27001 or FedRAMP?
- No
- We know the name
- Yes, and we map our controls to it
"Oftentimes it's business driven, for SOC 2, ISO, FedRAMP." See A bit of flimsy script.
-
When a buyer, insurer or investor asks how secure you are, can you show them something current?
- No
- Last year's questionnaire answers
- Yes, a current report we can share
"It's that blue check mark for cyber security that everyone looks for." See That blue check mark.
-
Could someone outside security run your security tools without help?
- No
- With some help
- Yes
"make it simple. How simple can we make it?" See How simple can we make it?
Most of the basics aren't in place yet. Start with a list of what you have, turn on the security settings your providers include, and name one owner.
Some basics are in place. Next, patch on a schedule, check for problems every week and fix what you find, and keep evidence a buyer can read.
The basics are in place and someone owns them. Keep the evidence current for buyers, insurers and investors, and check again as the company grows.
What do the spreadsheet hours cost?
Craig described consultants who run a script, dump the results into an Excel spreadsheet and spend hours on it. This calculator puts a number on those hours. Every default is our example, not a benchmark.
Calculator
What do the spreadsheet hours cost?
Four numbers: the hours of spreadsheet work after each assessment, how many assessments a year, the hourly cost of the person doing it, and the share of that work a tool removes.
At 12 assessments a year and 6 hours of spreadsheet work each, that's 72 hours a year, or $10,800 at $150 an hour. If a tool removes 75% of that work, it frees 54 hours, or $8,100 a year.
The 6 hours, 12 assessments, $150 and 75% are our examples, not benchmarks. Put in your own. Craig didn't give numbers for the consultant's hours.
From Working Links to AvalonX
Everything on this page sits on one timeline, from 2011 to 2026. Filter it by thread.
Timeline · 2011 to 2026
From Working Links to AvalonX
Filter by thread. Career dates are from Craig's LinkedIn, and company dates are from the public record.
- The Psychopath Test
Jon Ronson's book on psychopathy and the mental health industry (Wikipedia, on this show).
- Working Links
Group head of technology, to July 2012 (LinkedIn).
- Asana launches
The work management platform Craig compares Bleach to (Wikipedia, on this show).
- Monster
Vice president of global information security, to October 2015 (LinkedIn, on this show).
- CDK Global
ADP spins off its dealer services division as CDK Global (Wikipedia).
- CDK Global
Chief business security officer, then vice president and global chief security officer from November 2016 to October 2019 (LinkedIn, on this show).
- Randstad buys Monster
For $429 million in cash (Wikipedia).
- YL Ventures
Venture advisor, to January 2023 (LinkedIn, on this show).
- Fujitsu
Chief information security officer, then chief trust and risk officer from April to September 2020 (LinkedIn, on this show).
- Cyvatar.ai
Cofounder and chief operating officer, to November 2022 (LinkedIn).
- Asana goes public
A direct listing on the New York Stock Exchange (Wikipedia).
- Bleach Cyber
CEO and cofounder (LinkedIn, on this show).
- Episode 17 airs
Sean Cassidy, head of security at Asana (episode 17).
- Brookfield and CDK
Brookfield completes its purchase of CDK Global (Wikipedia).
- The conversation
Jon and Craig record the episode (on this show).
- Episode 45 airs
On Podbean (Podbean, on this show).
- The CDK attack
A ransomware attack takes most of CDK Global's services offline (Wikipedia).
- Monster and CareerBuilder
The two job sites merge (Wikipedia).
- Wingood Group
Managing partner, to October 2026 (LinkedIn, on this show).
- Bleach Security
Strategic advisor, to October 2026 (LinkedIn, on this show).
- Chapter 11
CareerBuilder + Monster files for bankruptcy protection (Wikipedia).
- Episode 83 airs
Phil Howie of Sidekick on making security doable for small companies (episode 83).
- Episode 90 airs
Garrett Smith, a Marine Corps Reserve lieutenant colonel, on Reveal Technology (episode 90).
- Episode 102 airs
Chris Kirschke on going from security operations to chief executive (episode 102).
- AvalonX
Cofounder and CEO (LinkedIn, on this show).
- The AvalonX launch
Craig's post on the launch in the United States (LinkedIn, on this show).
What to do this week
Five things, in the order of the episode.
- Write down what you already have. List the cloud accounts, laptops and SaaS tools the company uses, and turn on the security settings your providers include. Take the scorecard with whoever handles IT today.
- Put patching ahead of the new risk. Find the systems that are behind on security updates and set a schedule before you buy anything new. Our Penetration Testing team can show you which gaps an attacker would use first.
- Name one owner. Make security a named person’s job, even part time. Our post on how startups should staff security compares hiring, a fractional leader and a service, and What Is a vCISO? covers what an on-demand security leader does.
- Keep evidence a buyer can read. Find out which standard your biggest customers ask for, and keep a current report you can share. Our plain-English guide to SOC 2 starts with what the report is, and our SOC 2 team runs the work.
- Get help with what you can’t staff. If consultants still hand you spreadsheets, run the calculator on their hours. A vCISO can own the program, and you can book 15 minutes with us.