Episode 47 of The Security Podcast of Silicon Valley aired on June 17, 2024, with Jon McLachlan hosting. The guest was Clea Ostendorf, then a field CISO at Code42 (Podbean, Apple Podcasts, Spotify). The episode is called “Clea Ostendorf, CISO of Code42, Securing the Unseen: on the Frontlines of Data Protection.” It has no video version. Her LinkedIn lists her as co-founder and CEO of Wolfpack Security since June 2024 (LinkedIn), and Mimecast acquired Code42 in July 2024 (Wikipedia).
The question under the whole conversation came up eighteen minutes in. Clea was describing what happens when Code42 runs a trial at a company that thinks its controls are good enough.
“Somebody just took your roadmap out the door. Does that matter?”
Clea Ostendorf, at 18:15
This page follows the conversation in order: a section for each part of it, eighteen figures, ten clips from the tape, a LinkedIn post, the full transcript, and five tools: a quiz, a scorecard for whether your data protection fits how people work, a calculator for your noise-to-value ratio, a timeline, and a to-do list. Where the decodes of the tape disagree on a word, the transcript puts its best guess in brackets, and the page doesn’t quote those words.
From diplomat to security
Jon had read her LinkedIn before the show. He saw the law side of the house in her background, and maybe some international relations, and asked for a summary. Clea started with what she wanted to be.
“I wanted to be a diplomat, and an actress”
Clea Ostendorf, at 0:55
She did a little law internship and lived abroad. Then she needed a job to pay the bills, and somebody gave her an opportunity in sales and recruiting. She thought it was the best job ever. She sat at a desk, called people, heard what they wanted in a job, and then found them a match.
“and then I would find them a match.”
Clea Ostendorf, at 1:21
The business became transactional, she said, and more about margins and dollars than doing right by the person. So she looked for something different, and stumbled into security. Hacking into somebody’s bank account felt like “sort of a superpower.” She went to meetup groups and OWASP groups, and sought them out when she traveled. There she learned that the hacker side is only one part of it.
“now I know it’s called red teaming.”
Clea Ostendorf, at 2:17
The groups talked more about defense, protection and the human element.
“And it just got me hooked.”
Clea Ostendorf, at 2:25
That was fifteen years before, she said, and Jon repeated the number back. Her LinkedIn fills in the steps: an internship in Brazilian relations at an international law firm in 2009, then assistant manager at Enterprise Rent-A-Car, then technical recruiter and account manager at Signature Consultants from 2012, an account executive at Beacon Hill Staffing Group from 2014, and senior business development manager at nVisium, an application security firm, from March 2016. She joined Code42 in July 2019 as a senior insider risk security advisor, and became a field CISO in July 2023 (LinkedIn). Polina Morozov, a security recruiter, described her own work as matchmaking on episode 46.
People I want on my side
Once she had the hook, Jon said, there was no turning back. Clea agreed. She called security people the smartest she had ever been with, the most clever and creative.
“and frankly, people I want on my side.”
Clea Ostendorf, at 2:40
When she started working for a security consulting company, she knew the people around her had probably seen everything. Her line for them was that they were still talking to her, so they were cool.
All of us field CISOs
Jon asked what a field CISO does at Code42. Clea said nobody has settled that yet.
“We are all figuring that out”
Clea Ostendorf, at 2:58
A group of field CISOs had gotten together and asked each other how they’re measured, what they do, and how they’re out in the market. Her answer was that the role comes in different flavors. A chief information security officer is the senior executive who sets the strategy and program that protect an organization’s information (Wikipedia). A field CISO does that work facing outward. Clea’s job was with customers and prospects: help them feel comfortable with the product, with how Code42 secures it, and with its point of view.
“challenge the status quo of what they’re doing around data protection.”
Clea Ostendorf, at 3:25
There’s the traditional way people want to approach data protection, she said, and there’s the reality of what it looks like today. Her job was to bridge that gap. She had a peer who did the inside work, supporting existing customer programs.
“It’s good to live on a bridge”
Jon McLachlan, at 3:42
She loved that group discussion: smart people who had done amazing things, still trying to figure it out together.
Two more field CISOs came on this show later. Jacob Berry, field CISO at Clumio, told how he stumbled into the same job on episode 58, and Kayne McGladrey, field CISO at Hyperproof, made the case for business risk on episode 56.
Behaviors that put data at risk
Jon asked what Code42 does better than anyone else in the world.
“So Code42 is a data protection platform.”
Clea Ostendorf, at 4:24
It falls into insider risk or insider threat, she said, and data loss prevention. An insider threat comes from people within the organization, such as employees, former employees, contractors or business associates (Wikipedia). Data loss prevention software is a set of strategies and technologies that stop sensitive data from being sent or disclosed without authorization (Wikipedia). Code42 sees data move across endpoints, cloud and email, and gives risk indicators that show where to focus. It doesn’t start by classifying data, she said, because data no longer sits still.
“we’re thinking about what are the behaviors that would put data at risk.”
Clea Ostendorf, at 4:57
Her examples were a departing employee, new hires, an incident, a reorg or a layoff. Around those moments, Code42 watches where data moves and how people work with it, and the team decides whether to act. Wikipedia describes Incydr, the product, as a SaaS data protection tool for enterprises that guards intellectual property, source code and trade secrets, launched in September 2020 (Wikipedia).
Here’s the hammer
The responses run from the traditional block to something softer. Clea acted out the soft one.
“You’re syncing to iCloud. We don’t recommend that.”
Clea Ostendorf, at 5:29
“Here’s a 30-second video on how to reshape that behavior.”
Clea Ostendorf, at 5:31
She said they had seen effective changes in how people handle data that way. The other way sounds like this.
“Here’s the hammer. I’m telling you no.”
Clea Ostendorf, at 5:42
“It sounds like a long-term strategic investment in people.”
Jon McLachlan, at 5:45
Clea said you have to make that investment. You can tell people not to do something, she said, and it still won’t stick.
“unless they think there’s consequences or it affects them, it’s not really going to register.”
Clea Ostendorf, at 5:56
Ganesh Krishnan of Anzenna made a similar case for contextual training on episode 34.
Source code in a chatbot
Jon tested it with a case. Could the software catch someone who had pasted company code into ChatGPT?
“you just uploaded half of the file from our private GitHub repo”
Jon McLachlan, at 6:04
Clea said yes.
“We can see large data uploads.”
Clea Ostendorf, at 6:18
“Source code is one of the strong use cases that we have”
Clea Ostendorf, at 6:22
Source code has value in itself, she said, and in dollars. Code42 has a lot of visibility into how it moves, and ways to control that.
A duck on a pond
Jon asked about a typical day. It depends on whether she’s in the office, Clea said. Her company was hybrid, and she went in twice a week. She’s a morning person, and likes a little time to herself before the day starts. Then come customer and prospect meetings, content, and community events. Those always look flawless from outside, she said, as if nobody did any work and everyone just showed up. Anyone who has hosted one knows the image of a duck gliding across a lake and paddling hard underneath. That was her: “Smooth on the surface,” and paddling hard below. Jon said he’d never met an unhappy duck.
Sharing makes us stronger
Jon asked what people get wrong about working in security. Clea named two things. The first is that everyone is highly technical. The second is the old habit of keeping quiet.
“the more information we give you, the more vulnerable we become.”
Clea Ostendorf, at 8:16
She saw a big change in how companies share. Trust centers lay out how a company is secured, what it’s doing and what its process is. CISOs talk to each other about breaches they’re dealing with.
“And people are collaborating, which just makes us all stronger, right?”
Clea Ostendorf, at 8:46
Jon loves the sense of community in the security community. He couldn’t imagine being so closed off that you can’t learn and grow, and asked where the growth mindset is for a lone wolf.
Clea said it would be isolating.
“you would feel like you’re alone battling these threat actors”
Clea Ostendorf, at 9:12
Put the phone down
Security can look like constant firefighting from the outside: high stress, high risk, high impact to the business. Jon asked how she finds a healthy balance with her personal time. Clea said the pull is real in this job, and in most jobs, when you care about the work.
“it’s really easy to get pulled in and want to do something 24/7”
Clea Ostendorf, at 10:25
“I think setting boundaries is important, but more so putting the damn phone down.”
Clea Ostendorf, at 10:36
She uses do not disturb mode, even for a few hours in the evening or the morning. Human nature, at least hers, is to solve a problem right away. Without a break, that catches up with you.
“you’re going to burn out.”
Clea Ostendorf, at 11:12
The cost is “You’re going to make mistakes.” Jon put it in racing terms.
“you can’t finish the race in red line.”
Jon McLachlan, at 11:29
To recharge, Clea moves. She had just started lifting weights, and yoga, walking or running all count. Her ask is small: one thing for herself in the day, thirty minutes or an hour.
“I’m not asking for hours.”
Clea Ostendorf, at 13:25
With that done, she said, she can give in every capacity.
Long-term plays
Jon asked where she gets her news when things are going down in security. Clea started with podcasts.
“podcasts are sort of long-term plays, right?”
Clea Ostendorf, at 14:26
You listen for an hour, she said, and you understand how someone thinks and how they would approach a problem. She loves the CISO Series, where David Spark has a show called Top Headlines, “a five-minute fast little snippet.” She also tracks major incidents and digs in when one affects Code42 or its customers. Jon is a huge fan of podcasts too, which surprised nobody.
Changing a status quo
Jon asked her to look ahead: what does success look like for her and her team? Clea had been with Code42 “about five years,” and said Code42 had spent that time changing how people think about data protection.
“anyone who is changing a status quo knows that it is not easy.”
Clea Ostendorf, at 15:27
“It takes longer than anyone expects.”
Clea Ostendorf, at 15:32
She thought the market had turned. People were saying they can’t just block and tackle their data anymore.
“That is not realistic in how people work together, right?”
Clea Ostendorf, at 15:48
Her example was the conversation itself. She and Jon were sharing a Google document back and forth.
“You’re not trusted in my network, but we’re still sharing data back and forth, right?”
Clea Ostendorf, at 16:01
Most of the market agreed that you need a different way, she said. The next step was harder.
“Now we need to actually show people how it’s possible”
Clea Ostendorf, at 16:15
Code42 was doing that with many big customers, and she called it a work in progress.
The noise-to-value ratio
Every security tool is trying to figure out how to cut “the noise-to-value ratio,” she said.
“Oh, I’m going to die underneath all of these false positives.”
Jon McLachlan, at 16:36
A false positive is a test result that says a condition is there when it isn’t (Wikipedia). Clea goes back and forth on this with the people who use the tools, the security engineers and analysts. They tell her they still need to see everything. If you won’t act on it and it adds no value, she asks:
“why do you need to see it?”
Clea Ostendorf, at 16:54
“Can’t you just store it in a log and look back”
Clea Ostendorf, at 16:55
Jon agreed: keep it as history. Clea named what Code42 was working on.
“The materiality of what you’re seeing.”
Clea Ostendorf, at 17:06
“Will you actually act on it?”
Clea Ostendorf, at 17:09
The calculator puts a number on it.
Who are your stakeholders?
Jon asked what keeps companies from moving to this newer approach. Clea said the first question Code42 asks is about people outside security.
“who are your external stakeholders outside of security?”
Clea Ostendorf, at 17:25
That means legal, and it means HR. “Are you engaging with HR?” she asked. The business has to say which data matters.
“if you have indication from the business on what data matters”
Clea Ostendorf, at 17:37
You can’t focus on everything, she said. With the business in the loop, a security team can get ahead of events that put data at risk. If a reorg is coming, find out which team it affects and add monitoring there.
Does that matter?
Then she named the obstacles.
“Initially, there’s pushback.”
Clea Ostendorf, at 17:55
“I just want to own this little castle, this little piece.”
Clea Ostendorf, at 17:56
The first obstacle is not wanting to involve other people. The second is that change is hard. People ask why they should rip and replace a tool when they think their controls are good enough.
“And every time we go into a POV, we prove it wrong.”
Clea Ostendorf, at 18:09
The trial turns up what the existing control missed, and then comes the question at the top of this page. Jon and Clea played out what comes next. It’s in the news. The people who left start a company with the data they took. Then you’re in a legal battle, she said.
Mitigate it or sign it away
Jon described the choices a business has. One is to “actively mitigate it,” with controls, mechanisms like DLP, and processes. If the business doesn’t want to mitigate the risk, it covers it another way. It can buy insurance, he said, or
“you get someone else to sign off on it, or another business owner to own it.”
Jon McLachlan, at 18:54
Kayne McGladrey told what happens after a business leader signs to accept a risk on episode 56. Clea had a live example, and kept the company’s name out of it. It was a large organization with lots of customers, sharing data back and forth.
“And they’ve had multiple insider incidents”
Clea Ostendorf, at 19:07
“where a managing consultant has taken project plans and customer information”
Clea Ostendorf, at 19:10
They paid big fines, she said, and “almost lost a customer.” They still hadn’t invested in Code42 or any product, she said. It didn’t have to be Code42. They didn’t want to upset the culture by seeming to watch the consultants too closely.
“but you’re going to take that business risk.”
Clea Ostendorf, at 19:38
No business driver, no initiative
Jon said there’s only so much security can do when a leader has decided to swallow a risk, knowing what it means and what it costs.
“There’s always going to be a cost associated with it.”
Jon McLachlan, at 19:53
Protecting your data is cheaper for the business, he said, and cheaper than what might happen if you don’t.
“without a business driver behind security initiatives, there is no security initiative.”
Jon McLachlan, at 20:10
A business leader has to see and feel the problem and the pain point, and decide to protect the data, the process or the IP. Clea said who carries it when they don’t.
“It’s the security team.”
Clea Ostendorf, at 20:40
The stress goes up when the business doesn’t back them. They know it’s a problem, and if something goes wrong, it’s their fault. It’s hard, she said, and Jon added that they don’t have the tools to solve it.
From backup to security
Jon asked about her most challenging day at Code42. Clea said it was the beginning.
“I would say when I started, it was the most challenging.”
Clea Ostendorf, at 21:03
The new job was only part of it.
“It was really shifting a mindset of an organization who has been very successful in what they were doing.”
Clea Ostendorf, at 21:09
“We came from backup,” she said, and the company was shifting into security. Code42 created CrashPlan in 2007. In August 2017 it announced it would shut down CrashPlan for Home to focus on enterprise and small business, and in September 2020 it launched Incydr (Wikipedia). The two products ask for different habits.
“backup is, you set and forget it, and you move on”
Clea Ostendorf, at 21:26
Security is different, she said.
“you constantly have to be tuning”
Clea Ostendorf, at 21:31
Security means looking into things, setting up alerts, removing things, and telling people what matters. She had to win over a smart engineering team and a smart sales team, who asked her what she knew about any of this. Then COVID hit, everyone went home, and that brought its own challenges. Jon said Code42 was lucky to have her. Clea pointed to the team.
“Good leadership is really important.”
Clea Ostendorf, at 22:23
“People who listen and will fight your battles.”
Clea Ostendorf, at 22:26
The company hat
Jon said it’s always interesting to find alignment inside a company. People get political, especially at larger companies, and process turns into bureaucracy. His fix is to go back to the basics, and remind everyone that they’re all in the same boat and on the same team. Everyone takes off their personal hats, or their little fiefdoms, and puts on the company hat. Then they think about what’s right for the company and the customer, together. “Oh, remove the ego,” Clea said, and Jon added that you check egos at the door. Jon used the same image of everyone in one boat with Ganesh Krishnan on episode 34.
The diversity hire
Jon said it must be harder in a field dominated by men. Clea said it’s another dynamic.
“I call myself the diversity hire sometimes.”
Clea Ostendorf, at 23:26
At one panel, she was told they were so happy to have a woman on it. She said she was glad she qualified that way. Jon said diversity is overlooked on teams.
“And it’s the differences that we all bring to the table”
Jon McLachlan, at 23:42
A team of copies is an echo chamber, he said, and misses critical gaps. Clea agreed, and added the part people skip.
“how are you going to make them feel like they are part of the team?”
Clea Ostendorf, at 24:40
She has worked in industries dominated by men her whole life, and some team outings don’t interest her.
“I want to go get a pedicure. I don’t want to go to a baseball game.”
Clea Ostendorf, at 24:59
Jon offered to come along. Then Clea asked him a hard question: when do you hire someone with a different point of view, and when do you need to ramp up the team? She had put the same question to a recruiter. Do you need a developer who can hit the ground running, or someone you can train who might shape the direction?
You can’t GPT the drive
“You do both.”
Jon McLachlan, at 25:47
He called that a cop-out answer, then explained. He has interviewed many people. He used to look for specific things, and you still have to check that a person fits the skills. Being a little outside their comfort zone, learning and growing, is a good thing. Now he looks for passion and drive.
“That’s the one thing that you can’t GPT.”
Jon McLachlan, at 26:19
You can’t read it in Wiki or get a degree in it, he said, and with it “you can accomplish anything.” At some point he dropped the belief that the tech was what mattered most.
“actually, people matter at the end of the day.”
Jon McLachlan, at 27:54
Trust people to learn the technologies, he said. For a tactical gap, maybe don’t hire at all: “Maybe just get a contractor.”
Clea brought up a trend on TikTok, the personality hire.
“You hire more on the way that they’re going to complement the team”
Clea Ostendorf, at 28:39
That’s a hard thing for a hiring manager to say to a recruiter, she said: “go find me somebody charismatic and fun.”
“But you can look for that in the people who are interviewing who maybe aren’t your traditional background.”
Clea Ostendorf, at 28:58
“you can’t put that in the job description, right?”
Jon McLachlan, at 29:06
Those are soft skills, Jon said, and “good cultural fit” may be what recruiters mean by it. You still need skills to drive the business. Then he defined the business.
“A business is an entity that exists to make money.”
Jon McLachlan, at 29:33
A company is a group of people with a mission to solve a pain point and make people’s lives better. Usually those people are called customers.
Critical infrastructure
Jon asked about the threats on her mind. Clea said she’d go broad first and then narrow it down, like a funnel.
“what I am scared about is our critical infrastructure.”
Clea Ostendorf, at 30:35
Critical infrastructure is what governments consider essential for a society and an economy to function (Wikipedia). She said she doesn’t know enough about securing it.
“I know there’s plenty of vulnerabilities.”
Clea Ostendorf, at 30:42
She told of a pen testing company that ran a bunch of pen tests on water treatment facilities. The question there was “where do you want us to begin,” she said.
“But I think we are really vulnerable.”
Clea Ostendorf, at 30:52
Look at how people got through COVID, she said. Crisis doesn’t bring out the best in many people. Her worry was what happens when “electricity, internet, water” are gone.
“what is society going to turn into, and how quickly are we going to devolve?”
Clea Ostendorf, at 31:15
Take control of your data
Then she moved to the narrow end of the funnel, the thing she thinks everyone is already dealing with.
“The more realistic thing that I think we’re all dealing with is our personal data privacy”
Clea Ostendorf, at 31:40
People have given out their information all over the internet. Now you can choose whether cookies track you, she said, and two years before that you couldn’t. A cookie is a small block of data a website’s server places on your device while you browse (Wikipedia).
“our data is still funneling and being collected and manipulated.”
Clea Ostendorf, at 31:58
“how do you start to take control over what information, personal information about you, is out there?”
Clea Ostendorf, at 32:05
She was starting to see products aimed at the general population, and she liked that. They give a little more sense of control.
“at least you can clean up the data spread that’s out there about your personal information.”
Clea Ostendorf, at 32:26
A data broker is a person or company that collects personal data about people, mostly from public records (Wikipedia). Leigh Honeywell of Tall Poppy talked about self-defense tools for people online on episode 5.
“I look forward to living in a future that has better privacy, now, for all of us.”
Jon McLachlan, at 32:33
Jon asked where cyber espionage is headed, and what it means for international relations.
“I assume everybody has access to everything already.”
Clea Ostendorf, at 32:51
All the nation states that want to see what we’re doing already can, she said. The interesting part is what comes next.
“What would be interesting is how it’s weaponized, right?”
Clea Ostendorf, at 32:58
The news is a business
Later, Jon said the news is a business.
“Yeah, the news is unfortunately a business.”
Jon McLachlan, at 34:28
“It’s designed to make money,” he said, with the same mechanisms social media uses to grab attention. His morning routine is an app called the Hourly News, which plays short headline clips from several news services in different countries, among them NPR, Fox News and CBC in Canada. The big events show up on all of them, told differently. Nobody is lying, he said, and you still hear the slant. You realize “it’s being curated.”
“You need to use your brain when you’re consuming information.”
Clea Ostendorf, at 36:07
Ask about their genesis
Jon asked for her favorite interview question.
“And I love to ask people their genesis.”
Clea Ostendorf, at 36:27
“Like, how did you get into what you’re doing today?”
Clea Ostendorf, at 36:31
You learn a lot about someone’s approach to life that way, she said. If they had a hard job and didn’t like it, what did they do to improve it?
“I am all about not staying static, right?”
Clea Ostendorf, at 36:42
She asks where they were then, how they got where they are, and what sacrifices they made or what paths they took. The answers show how someone is motivated, and how they’ll learn and fit into the team. Jon called it double-clicking on life experiences.
A huge book
Jon asked for a book or movie that changed how she sees the world.
“I am a voracious reader.”
Clea Ostendorf, at 37:31
Jon told listeners there are many books behind her. She reads and listens, so she couldn’t name just one. She likes stories everyone thinks they know, told from another side.
“I like to listen to books or read that tell a story that we all maybe know from a different perspective.”
Clea Ostendorf, at 37:45
She had just finished Covenant of Water, which she called about a foot big, an undertaking and well worth it. One part tells the story of World War II through what was happening in India.
“a perspective that you would never traditionally get from the Western history books that we see.”
Clea Ostendorf, at 38:12
The Covenant of Water is a 2023 novel by the physician and author Abraham Verghese. It follows three generations of a Malayali family in Kerala, in southwest India, from 1900 to 1977 (Wikipedia). Jon said different perspectives are exactly what he looks for in the news.
Invest in relationships
Jon asked what she would tell her younger self.
“When I was younger, I spread myself very thin.”
Clea Ostendorf, at 38:46
Maybe that helped, she said, because she had lots of experiences. Time is worth more to her now than when it seemed endless. Jon added the other half of being young: all the time in the world and no money.
“I didn’t focus on investing in relationships.”
Clea Ostendorf, at 39:17
She was happy floating around then, and a bit superficial. Now she values “one-on-one conversation” and getting to know how someone ticks. Jon said he was the same way, until it clicked for him.
“this tech stuff is great, but people are what matter.”
Jon McLachlan, at 39:58
A giant red button
Jon said many entrepreneurs listen to the show, and asked for one tool she wishes existed. Clea named it.
“Personal privacy.”
Clea Ostendorf, at 40:26
“because I just feel very exposed on the internet.”
Clea Ostendorf, at 40:29
Jon said everything people have uploaded over the past 15, 20 or 30 years is about to get a sweep from AI.
“And even if you didn’t tag yourself in a photo, people are going to know that was you.”
Jon McLachlan, at 40:49
Jon pictured a giant red button that wipes it all, and asked how much she would pay to wipe her history on the internet. Then he pictured another service, one that analyzes your exposure to risk on the internet, as in “Give me a number for how much I might lose.” Clea framed the question she’d want answered.
“How could my data be weaponized against me?”
Clea Ostendorf, at 41:38
She wants to take ownership of what’s been put out there. Trevor Hilligoss pointed listeners to a free personal exposure check on episode 86.
You are the product
Jon had looked at this problem before. When he was building Peacemaker, which was all B2B, the team looked late at a B2C product for this exact problem. Adoption is hard, he said. Many people have accepted that they aren’t private, or think they aren’t important enough to matter. When you don’t pay for the product, he said, you are the product. Companies are positioning themselves to monetize our data, he said, and advertising works on us even when we don’t like to admit it. Michael Moore made a similar point about free AI tools on episode 73. Clea shared an idea she liked. Companies that use your browsing history, your clicks and whatever else they collect would let you opt in, and pay you for it.
“they’ll pay you a universal basic income, right?”
Clea Ostendorf, at 42:59
“Or you opt out of that, and they can’t touch anything you engage with.”
Clea Ostendorf, at 43:07
A universal basic income is a proposal where everyone in a population regularly gets a minimum income with no means test (Wikipedia). Most people would opt in and get paid, she said, and the companies would still make their money by advertising to the right people.
Phase two
Clea turned the idea back on Jon.
“So, Jon, maybe you should invent that one.”
Clea Ostendorf, at 43:34
He’d squeeze it in if he had the spare time, he said, and turned it back on her.
“Maybe you’ve got the entrepreneurial spirit yourself.”
Jon McLachlan, at 43:41
“Perhaps,” she said, and called it phase two. Jon offered to team up as co-founders, and Clea told listeners they heard it here first. Her LinkedIn dates her start as co-founder and CEO of Wolfpack Security to June 2024, the month the episode aired (LinkedIn).
See both sides
Jon asked for her pearls of wisdom.
“always try and approach things from the other side.”
Clea Ostendorf, at 43:59
“See both sides.”
Clea Ostendorf, at 44:01
Jon said it’s enriching to step outside our comfort zone, and to remember the world is colored by the lenses we look through.
“We can try on different lenses.”
Jon McLachlan, at 44:16
Clea said there had been a lot of laughing, which is always a good way to start a day.
What happened after the tape
Wolfpack Security. Clea’s LinkedIn lists her as co-founder and CEO of Wolfpack Security from June 2024. Her description there is about changing how the industry approaches penetration tests, by asking how vulnerabilities are introduced and what it takes to fix them (LinkedIn). The company describes itself as “Boutique offensive security, built for the enterprise,” with deep, manual testing, and lists itself as SOC 2 Type II compliant (LinkedIn). A penetration test is an authorized simulated cyberattack on a computer system, run to evaluate its security (Wikipedia).
Mimecast bought Code42. In July 2024, Mimecast acquired Code42. Mimecast is a British information security company founded in 2003, specialized in email security and risk management, and owned by Permira (Wikipedia).
Her post on the 105 problems. On September 22, 2026, Clea wrote that finding vulnerabilities is cheap. Her example was 569 vulnerabilities that came from 105 underlying problems. One kind of program optimizes for throughput: find it, ticket it, fix it, close it. The other asks why the house keeps catching fire. On the tape, she asked whether you will act on what you see.
Clea on the 105 problems behind 569 vulnerabilities.
Clea Ostendorf · September 22, 2026
More from her feed. On October 5, 2026, she shared Wolfpack’s article “Manual Pentesting Isn’t Dead. Manual Everything Is.” Her summary was to automate the known risk and use human creativity to find the rest (LinkedIn). On October 28, 2026, she wrote: “Assumed breach exercises should be on every leadership roadmap.” (LinkedIn).
More on this show. Jacob Berry named insider threats as his biggest risk on episode 58. Trevor Hilligoss, a former FBI agent, talked about an insider at a bank on episode 86. On the blog, Stop Saying No makes the case for knowing your data over a blanket block, Shadow AI covers the AI tools your team already uses, and Pentest Once a Year? covers what enterprise buyers expect from a penetration test.
Did you catch it? A seven-question quiz
Seven questions from the episode. Each answer links the moment in the transcript.
Quiz · seven questions
Did you catch it?
Pick an answer to see whether you caught it.
-
What did Clea want to be, once upon a time?
a. "I wanted to be a diplomat, and an actress" Transcript, 0:55.
-
What does Code42 look at, in place of classifying data?
b. "we're thinking about what are the behaviors that would put data at risk." Transcript, 4:57.
-
What's the softer response when someone puts data at risk?
c. "Here's a 30-second video on how to reshape that behavior." Transcript, 5:31.
-
What should you do with what nobody will act on, in Clea's view?
a. "Can't you just store it in a log and look back" Transcript, 16:55.
-
Which stakeholders outside security does Clea ask about first?
b. "Are you engaging with HR?" Transcript, 17:31.
-
In Clea's example, what did a managing consultant take?
c. "where a managing consultant has taken project plans and customer information" Transcript, 19:10.
-
What does Clea's favorite interview question ask about?
b. "And I love to ask people their genesis." Transcript, 36:27.
Does your data protection fit how people work?
Eight questions on how your company protects data from the people who handle it. Each tip quotes the tape or paraphrases it, and links its section.
Scorecard · eight questions
Does your data protection fit how people work?
Answer for your company as it runs today. If two answers fit, pick the lower one.
-
Has the business told security which data matters most?
- No. Security guesses
- For some teams
- Yes, and it's written down
"if you have indication from the business on what data matters" See Who are your stakeholders?.
-
Do legal and HR take part in your insider risk program?
- No
- When something goes wrong
- Yes, from the start
"Are you engaging with HR?" See Who are your stakeholders?.
-
Does monitoring change around departures, new hires, reorgs and layoffs?
- No
- For departures only
- Yes, for each of them
Clea's examples of moments that put data at risk. See Behaviors that put data at risk.
-
When someone puts data at risk by mistake, what happens?
- Nothing, or a block with no reason given
- A block and a ticket
- A short nudge that explains why
"Here's a 30-second video on how to reshape that behavior." See Here's the hammer.
-
Can you see source code or customer data going into AI tools?
- No
- In some tools
- Yes, in all of them
"We can see large data uploads." See Source code in a chatbot.
-
Do your alerts get acted on?
- Most are never looked at
- Some get acted on
- We alert on what we'll act on and log the rest
"Will you actually act on it?" See The noise-to-value ratio.
-
When the business declines a control, who owns the risk?
- Security, by default
- Nobody says
- A named business owner signs for it
"you get someone else to sign off on it, or another business owner to own it." See Mitigate it or sign it away.
-
Do you share what you're seeing with peers at other companies?
- Never
- Sometimes
- Yes, and we publish how we're secured
"And people are collaborating, which just makes us all stronger, right?" See Sharing makes us stronger.
Security works alone, and the business hasn't said what matters. Start with legal and HR, and ask which data you'd regret losing.
The basics are there. Next, watch the moments that put data at risk, and trade the hammer for a nudge where you can.
Your data protection fits how people work. Keep cutting the alerts nobody acts on, and keep the business owning its risks.
What’s your noise-to-value ratio?
Every security tool is trying to cut the noise-to-value ratio, Clea said. This calculator puts a number on yours.
Calculator
What's your noise-to-value ratio?
Three numbers: the alerts your team gets in a day, the percent of them worth acting on, and the minutes it takes to look at one.
Of 500 alerts a day, 25 are worth acting on. The rest take 23.8 hours a day to look at, a noise-to-value ratio of 19.0 to 1.
Every default here is a placeholder: put in your own numbers. Clea's answer to the rest is to store it in a log and look back if there's an incident, as in The noise-to-value ratio.
From diplomat to Wolfpack
Clea’s path, Code42’s, and the episodes on this site that pick up the thread. Filter by topic.
Timeline
From diplomat to Wolfpack
- Code42
Founded as an IT consulting company. The name honors Douglas Adams: in The Hitchhiker's Guide to the Galaxy, 42 is the answer to the ultimate question (Wikipedia).
- CrashPlan
Code42 creates its backup product (Wikipedia, on this page).
- A law internship
Brazilian relations intern at an international law firm (LinkedIn, on this page).
- Enterprise Rent-A-Car
Assistant manager, through August 2012 (LinkedIn).
- Recruiting
Technical recruiter and account manager at Signature Consultants, through September 2014 (LinkedIn).
- Beacon Hill
Account executive at Beacon Hill Staffing Group, through March 2016 (LinkedIn).
- nVisium
Senior business development manager at an application security firm, through July 2019 (LinkedIn).
- ISSA
Event director for an ISSA chapter, through September 2019. ISSA is a not-for-profit association of information security professionals (Wikipedia, LinkedIn).
- CrashPlan for Home
Code42 announces it will shut it down to focus on enterprise and small business (Wikipedia).
- Code42
Clea joins as a senior insider risk security advisor (LinkedIn, on this page).
- Incydr
Code42 launches its data protection product, and its leaders publish the book Inside Jobs (Wikipedia, on this page).
- Field CISO
Clea becomes a field CISO at Code42 (LinkedIn, on this page).
- The Covenant of Water
Abraham Verghese's novel, the book Clea had just finished (Wikipedia, on this page).
- Episode 34
Ganesh Krishnan of Anzenna on why security awareness training is broken (episode page).
- Episode 46
Polina Morozov on recruiting for security teams (episode page).
- Episode 47
Clea on the show (Podbean, transcript).
- Wolfpack Security
Clea becomes co-founder and CEO (LinkedIn, on this page).
- Mimecast
Mimecast acquires Code42 (Wikipedia, on this page).
- Episode 56
Kayne McGladrey, field CISO at Hyperproof, on business risk (episode page).
- Episode 58
Jacob Berry, field CISO at Clumio, on insider threats (episode page).
- Episode 73
Michael Moore on why free AI tools are paid for with data (episode page).
- Episode 86
Trevor Hilligoss on the human behind the keyboard (episode page).
- 105 problems
Clea on asking why 105 underlying problems produced 569 vulnerabilities (LinkedIn, on this page).
- Manual everything
Clea shares Wolfpack's article on manual pen testing (LinkedIn).
- Assumed breach
Clea puts assumed breach exercises on every leadership roadmap (LinkedIn).
What to do this week
Five things, in the order of the episode.
- Ask the business what data matters. Bring in legal and HR, as in Who are your stakeholders?. Then take the scorecard.
- Watch the moments that put data at risk. Departures, new hires, reorgs and layoffs, as in Behaviors that put data at risk.
- Try the nudge before the hammer. Pick one risky habit, such as syncing to a personal cloud, and answer it with a short explanation, as in Here’s the hammer.
- Count the alerts nobody acts on. Put a number on them with the calculator, and log the rest, as in The noise-to-value ratio.
- Close the door on your roadmap. Our Counter Business Espionage & IP Protection builds insider-risk programs, trade-secret controls and leak monitoring. Our Corporate Shadow-AI Detection & Mitigation finds the AI tools touching company data. If you want to talk it through, book 15 minutes with us.