Leigh Honeywell spent years helping people who were under attack online, and she kept seeing the same thing. The harassment was personal, but the way in was ordinary: an old password, a forgotten account, a breach from years before.
“But the accounts on the device, that’s what’s getting compromised. That’s the like juicy target that attackers are going after at a consumer level.”
Leigh Honeywell, at 9:03
Leigh founded Tall Poppy in 2018 and went through Y Combinator’s Summer 2018 batch. The company describes itself as building “tools and services to make personal digital safety accessible to everyone,” with proactive work to keep harassment from escalating and incident response when someone comes under attack (Y Combinator). It sells that protection to employers for their people (Tall Poppy).
Jon McLachlan hosted this one alone, and it aired on July 1, 2021, as the fifth episode of the show, with 70 words of show notes. This page is the rest of it: a section for each part of the conversation with the sources beside it, eleven figures, eighteen clips from the tape, the full transcript, and four tools: a quiz, a scorecard for how ready your company is when an employee is targeted, a calculator that puts survey numbers against your own headcount, and a timeline from Bell Canada to 1Password.
Ancient history
Jon opened by reading Leigh’s résumé back to her, and it covers most of the jobs in security: phone systems, malware operations, a security response team, platform security, the ACLU and venture investing. Leigh’s answer was two words, twice.
“Ancient history, ancient history. Let’s go all the way back, all the way back.”
Leigh Honeywell, at 0:49
Her LinkedIn fills in the dates (LinkedIn). She was a malware operations engineer at Symantec from 2008 to 2010, after it bought MessageLabs. She spent 2011 to 2014 at Microsoft as a security program manager, first with the Microsoft Security Response team and then the Microsoft Security Engineering Center. She was a senior platform security engineer at Heroku from 2014 to 2015, then at Slack, first as a senior staff security engineer and then as security response manager until April 2017. From there she spent a year as a technology fellow at the ACLU, working on legal briefs, public writing and advocacy, before founding Tall Poppy in May 2018.
Since July 2019 she has also been a venture partner at Pioneer Fund, which describes itself as “a fund of 540+ Y Combinator alumni” investing in YC startups (Pioneer Fund).
A family of lawyers
Jon asked where the drive came from. Leigh started with her parents.
“I grew up in a family of lawyers. Both my parents were lawyers in the Ottawa, Canada area. And so I was very much exposed to sort of analytical thinking and a degree of rigor in tackling ideas that I think is a little unusual.”
Leigh Honeywell, at 1:53
She was also a downhill ski racer on a regional team, with provincial championships and two near misses at nationals, “by one spot.” Her father ran his own law firm, and she did its IT on trips home from college. That’s where the idea of working for yourself came from.
“I had some, you know, some exposure to that sort of entrepreneurial spirit from a pretty young age, of the idea that you didn’t necessarily need to work for someone, you could work for yourself as a professional”
Leigh Honeywell, at 2:45
The path into security wasn’t straight. She bounced between majors, left university and went to work at Bell Canada.
“Building phone systems. This is like 2005. So it’s like the early, early days of voice over IP. And we were doing stuff that was like really cutting edge.”
Leigh Honeywell, at 3:19
Voice over IP was new then, and Leigh pointed out where it went. Every video call is “the distant descendant of IP telephony,” and people still spend part of every meeting checking that the microphones work.
A voice in the wilderness
Then Jon asked the founder question: what truth did she see that most people missed? Leigh had been working with people facing online harassment, a threat that she said wasn’t being addressed at a technical level or at a policy level, and she saw a gap in the industry itself.
“And we have this whole industry that’s spun up around corporate cybersecurity. I felt like I was this sort of voice in the wilderness in terms of personal security.”
Leigh Honeywell, at 5:45
She put the field’s age in perspective with a comparison from medicine.
“we’re very much in the like, doctors have just discovered that childbirth deaths go way down if you wash your hands. Like, we’re at that phase of computer security.”
Leigh Honeywell, at 5:34
The doctor she’s thinking of is Ignaz Semmelweis, who in 1847 proposed hand washing with chlorinated lime at the Vienna General Hospital’s First Obstetrical Clinic, where childbed fever was killing mothers (Wikipedia). Her point was that security is at the stage where simple habits still make a large difference.
For individuals, the tools had stalled. There was antivirus, then password managers, then a detour through VPNs, whose value to an individual depends on the threat.
“it was so clear that there was this gap in terms of both consumer education, but also consumer tools around personal cybersecurity. And eventually, that sort of dawning realization that there was this problem here led me to start Tall Poppy.”
Leigh Honeywell, at 6:24
Commoditized breaches
Jon asked whether Tall Poppy deals with account break-ins and the information they leak. Leigh said the goal is to prevent them, and that most of what happens in harassment cases is ordinary.
“so much of the kinds of attacks that you see in harassment situations, it’s sort of fairly commoditized security breaches. It’s people noticing that you haven’t changed your password on a bunch of sites since the Dropbox breach in 2012.”
Leigh Honeywell, at 6:56
The attacker doesn’t need a new exploit. They take a leaked password from a credential dump and try it on every account they can find, until one opens.
“And they find your, like, I don’t know, Tumblr account that has like embarrassing content on it or whatever, right?”
Leigh Honeywell, at 7:18
That technique has a name, credential stuffing: stolen usernames and passwords, often from a data breach, used to get into other accounts. Old breaches keep circulating for years. Wikipedia’s Dropbox entry lists the leak of 68 million account passwords on the internet in August 2016.
Leigh didn’t blame the people it happens to.
“And through nobody’s fault, right? Like, this stuff is hard. It’s complicated. It’s honestly pretty tedious.”
Leigh Honeywell, at 7:30
What changes the outcome is timing. People who are worried about harassment are motivated, and that’s when a little help goes furthest.
“That’s going to prevent a lot of those breaches. It’s going to prevent a lot of those account takeovers, a lot of that shared personal information that you didn’t want out there. That little tiny bit of prevention ends up being super, super powerful.”
Leigh Honeywell, at 7:54
The accounts are the target
Jon said the focus on people is what security usually misses, and Leigh tied it to a wider shift in how companies think about security.
“whether it’s like BeyondCorp or Zero Trust or whatever the latest buzzword is, we’re moving beyond this idea of like there’s a laptop and a server and you have to secure them.”
Leigh Honeywell, at 8:42
BeyondCorp is Google’s implementation of zero trust, the idea that being on the company network shouldn’t earn trust by itself. Leigh’s version for individuals is simpler. Patch the devices, yes, and maybe skip the “pizza box on the network.” The account is what an attacker wants.
That’s the line this page opened with, and it’s the thread through the rest of the conversation. A phone or a laptop is hard to break into. An account protected by a password from 2012 is not.
Working quietly in the background
Jon asked, carefully, whether something in her own life had led to the insight. Leigh said she gets that question all the time, and that her own experience has been mild by comparison.
“the worst that’s happened has been like people like tweeting at my employer trying to get me fired because I told them to go away”
Leigh Honeywell, at 9:38
She also mentioned harassment that followed after she spoke up about an abuse situation, which she said fell more heavily on others than on her. Most of what she learned came from standing next to people facing far worse.
“But very much more ended up being this sort of person who was working quietly in the background with targets, with victims, with survivors, trying to do what I could to help protect them and help them recover from this kind of much more severe situation.”
Leigh Honeywell, at 10:21
Those years turned into a company. Jon put it as scaling the help, and Leigh’s answer was short: “That’s what we’re trying for.”
The scale of the problem in 2021 was large. A Pew Research Center survey from September 2020 found that 41% of Americans had personally experienced online harassment, and 25% had faced more severe forms such as physical threats, stalking, sexual harassment or sustained harassment, up from 15% in 2014 (Pew Research Center).
The best and the worst day
Jon asked about the best day at Tall Poppy. Leigh had struggled with the question when he sent it ahead of time, because in her work the most meaningful days are the worst days for someone else.
“The fact that we can be there for them, it’s both the best and the worst day at the same time”
Leigh Honeywell, at 12:11
Her example was a disinformation campaign aimed at one of Tall Poppy’s customers a few months before the recording.
“And we were able to be there for them and help them feel safer and make sure that their information wasn’t sort of being spread about them by helping them take down a bunch of stuff preemptively.”
Leigh Honeywell, at 12:29
The stakes were physical. She described the outcome as preventing the situation “from escalating into actual in-person physical violence,” and said the relief came with a chill, because it had been “actually pretty scary.”
Plan for the worst, hope for the best
Jon shared a moment from his own life when he expected the worst from the people around him and turned out to be wrong. Leigh answered with the paradox at the center of incident response.
“Your discipline as an incident response professional is to be the one doing that thinking of like, what are those scary, scariest possible outcomes? Right. And then what can we do to make them less bad? What can we do to mitigate? What can we do to prevent?”
Leigh Honeywell, at 13:31
The other half of the job is hope.
“And at the same time as you’re doing all of this like worst case scenario planning, you’re still hoping for the best. And it can be a bit like unsettling when it does actually end up okay.”
Leigh Honeywell, at 13:45
That’s a fair description of good incident response anywhere. The plan assumes the worst so that the person in the middle of it doesn’t have to.
Bob in accounting
Jon asked how the business works. Leigh said the product speaks to individuals, but the buyer is usually an employer.
“So the product itself is definitely pitched to individuals, but we’re working on sort of employee benefits model.”
Leigh Honeywell, at 15:24
Teams with a public face buy first.
“So we tend to sell either to individual teams within an organization, whether it’s maybe the trust and safety team or the developer relations team, where there’s like a real sort of public interface.”
Leigh Honeywell, at 15:42
Trust and safety teams police a platform’s users, and developer relations people are the company’s public voice to developers, so both draw attention from strangers. But Leigh’s ideal customer is the whole company, and her example is someone nobody would think of as a target.
“But sometimes it’s, I always pick on poor Bob in accounting who has like a bad breakup and his ex shares his nudes, and it’s just this whole like dramatic, traumatic situation. And what does Bob do?”
Leigh Honeywell, at 16:04
The usual answer is the employee assistance program, which typically offers confidential counseling and referrals (Wikipedia). Leigh’s point is that a counselor may not have the technical skills, and Bob probably won’t walk into the security team’s office either.
“we as a security field, we haven’t done a great job like helping people feel comfortable asking, hey, like, I’m dealing with this situation, what do I do? Like, there’s often not that trust with something like a security team.”
Leigh Honeywell, at 16:27
With Tall Poppy in place, Bob knows where to go “where there wouldn’t otherwise be resources.” Jon summed it up as a B2B play, and Leigh agreed: “primarily B2B.”
Here’s Tall Poppy
Jon asked whether the model could work the other way round, with a platform buying protection for its own users. Leigh had already thought about it.
“wouldn’t it be cool if when you reported some particular kind of malfeasance on one of the social platforms, if one of the recommendations was consider tightening up your security, here’s Tall Poppy.”
Leigh Honeywell, at 17:36
She said she’d have to convince the platforms first. The longer-term goal was a product sold directly to consumers, and the open question was how to keep the human touch at scale.
“We know that it needs to be a lot more automated, a lot more like chatbot focused. And then the real challenge is, how do you maintain that sort of empathy and connection and supportiveness when it’s literally like a robot, right?”
Leigh Honeywell, at 18:21
Jon offered a name for it: “An empathy bot of some kind.” Leigh answered, “Someday, someday.”
Self-defense tools
Leigh was clear about the limits of a company like hers.
“what can we do as a company basically providing like self-defense tools? Like, these are tools to keep your account safe. And where is the line of responsibility where the platforms actually need to make their own platforms safer?”
Leigh Honeywell, at 18:52
“there’s always sort of limits to things that are solved with education versus solved at a structural level.”
Leigh Honeywell, at 19:06
Education helps the person in front of you. Some problems, such as how a platform handles reports, can only be fixed by the platform.
Not in your security context
Jon asked whether the consumer product was a five-year plan. Leigh hoped for two to three, and laid out the two principles behind everything Tall Poppy builds. The first is about access.
“One is not putting ourselves in the user’s security context wherever possible. So we don’t currently ask for any third-party permissions to apps. We don’t have access to any apps, any sort of third-party content.”
Leigh Honeywell, at 19:59
When they do add access, it will be the minimum.
“When we do do that down the road, we design our access in a least privileged way. So thinking about, is there a specific API that gives us security information? Can we just look at metadata rather than looking at content?”
Leigh Honeywell, at 20:12
That’s the principle of least privilege applied to a consumer product. The alternative she rejected is the broad grant, “just give me your whole OAuth token,” which would make Tall Poppy itself a target. An OAuth token with full access to someone’s accounts is exactly the kind of thing an attacker would go after.
Your smart security friend
The second principle is about tone.
“We don’t want to do the like shadowy hands over keyboard, hoodie, dark, scary hacker thing. We want to be like your smart security friend that you come to for advice, right?”
Leigh Honeywell, at 20:41
The friend tells you the truth and doesn’t sell you things.
“who’s going to give you the real deal, who’s not going to like bullshit you or sell you products that you don’t need, but also is going to like point you in the right direction to stay safe.”
Leigh Honeywell, at 20:54
She contrasted that with the alarm-bell style of most consumer security marketing, the “oh no, the world is on fire, your passwords have been hacked” approach. Fear makes people freeze. A trusted advisor gets them to act.
We don’t control the internet
Jon asked about the worst day, and Leigh pointed out that she had already answered: the best day and the worst day were the same one. The hardest days are different. They’re the ones where nothing technical will help.
“Whether it’s, you know, somebody’s being harassed online and, you know, the attackers are actually like technically sophisticated, using strong anonymity, and they’re just, you know, there actually sometimes isn’t anything for us to do at a like technical level.”
Leigh Honeywell, at 22:11
Even then there’s work to do, which she described as moral support and risk analysis. But the limits are real.
“We don’t control the internet. My name’s not Jack Dorsey. I can’t ban people from Twitter.”
Leigh Honeywell, at 22:46
Jack Dorsey was Twitter’s chief executive until November 2021, a few months after the recording (Wikipedia). What a firm like Tall Poppy can do is “reduce the burden, reduce the impact,” as Leigh put it when Jon said the work still makes a difference.
Signature moves
Jon asked whether attackers hide behind tools like Tor or just use fake names. Leigh said it varies by the kind of attacker, much as malware groups do.
“There’s whether you’re dealing with like an individual who’s stalking someone over like a romantic obsession, versus a large group of disaffected fans, versus neo-Nazi or other extremist groups.”
Leigh Honeywell, at 23:46
Each group has its own habits, and the technical skill ranges widely.
“all the way from like doing stuff from their home IP address with no, any sort of obfuscation, and under their real name while logged into Facebook, all the way to anonymous remailers, Tor, you know, the tools that you mentioned, hacked proxies and stuff like that”
Leigh Honeywell, at 24:14
An anonymous remailer strips identifying information from email, and a hacked proxy hides where traffic comes from. The interesting part is what the choice of tools says about the person using them.
“Do they know that what they’re doing is kind of wrong, and that’s why they’ve gone to like great lengths to cover their tracks, right? Or are they so convinced of their own righteousness that they’re like sending death threats from their actual Facebook account?”
Leigh Honeywell, at 24:55
That’s how a threat assessment reads a case. The tactics are evidence of motive and self-belief, and the attacker who doesn’t bother hiding can be the more alarming one.
Don’t look at the internet
Jon asked whether Tall Poppy works with law enforcement when there are death threats. It does, but from the side.
“Typically, we will act in more of an advisory role where we’re working with the client and they are reporting directly to law enforcement themselves”
Leigh Honeywell, at 25:24
Leigh called Tall Poppy “a tiny little firm” that police wouldn’t know “from a hole in the wall,” so the client makes the report and Tall Poppy helps them make it count. The default response is the problem.
“Because you go to law enforcement and you say, like, I’m getting death threats on the internet. They’re like, oh, well, don’t look at the internet. And that’s not really helpful.”
Leigh Honeywell, at 26:00
What works is preparation.
“Like, getting it taken seriously requires a degree of documentation, requires like an understanding of which parts of law enforcement are going to be more effective at tracking this stuff down or not.”
Leigh Honeywell, at 26:09
She added a harder truth about who gets to use that route at all.
“the folks who face discrimination at the hand of law enforcement are also often the folks that are facing threats online.”
Leigh Honeywell, at 26:32
So the advice has to fit the person. For some targets, going to the police is the obvious step. For others it carries its own risk, and a plan that assumes everyone will report isn’t a plan for everyone.
Fellow travelers
Jon brought up Belarus, where protests had been met with a crackdown, and the role of online harassment in campaigns like that. Leigh widened it to elections and shutdowns around the world.
“we’re in a fragile time in terms of the intersection of democracy and the internet, whether it’s what we saw in the States with disinformation in the last election.”
Leigh Honeywell, at 27:06
She was clear that it isn’t Tall Poppy’s focus, but it’s next door to it.
“I think that a lot of the folks in the trenches of disinformation are very much fellow travelers.”
Leigh Honeywell, at 27:37
Jon said misinformation is tied up with the rest of it, and Leigh finished the thought: “It’s tied right in with the hacking and the account takeovers and the leaking of emails and all of that stuff.” Her own best-and-worst day was a disinformation case, and the way in, again, was an account.
Your iPhone’s not getting hacked
Jon asked what success looks like if the consumer business works. Leigh’s answer was about access to good advice.
“I think the key piece there is really that everyone should have access to affordable expert advice on personal security.”
Leigh Honeywell, at 28:17
It’s easy to get a broken laptop fixed, she said, and much harder to find out how to keep your digital life safe. The market doesn’t help.
“There’s so much crap in terms of what’s in the market, whether it’s like people selling anti-malware on iOS. Like, your iPhone’s not getting hacked.”
Leigh Honeywell, at 28:57
What gets hacked, in her experience, is the account behind the phone.
“what’s getting hacked is your iCloud account, because you’re reusing your password.”
Leigh Honeywell, at 29:06
She held up an imaginary iPhone to make the cost point.
“Like, it costs like one to three million dollars to hack into this with a one-click exploit, because it’s the same bugs that are used for jailbreaks.”
Leigh Honeywell, at 29:14
That’s her estimate of the market in 2021. The bugs that let people jailbreak an iPhone are the same ones an attacker would need, and they’re expensive, so no one spends them on “an individual random human unless you’re literally Jeff Bezos.” The hack of Jeff Bezos’s phone is the famous exception that proves her rule. For everyone else, it’s typically accounts.
Jon added that the cloud is where the stuff that leaves the device ends up. Leigh had the line for it.
“You know what they say about the cloud? It’s just somebody else’s computer.”
Leigh Honeywell, at 29:48
A tight-knit group
Near the end, Jon gave a shout out to StartOut, a nonprofit for LGBTQ+ and allied entrepreneurs (StartOut), and Leigh described its accelerator.
“The StartOut Growth Lab is the world’s only LGBTQ-focused startup accelerator. We were in the fourth cohort in spring 2019.”
Leigh Honeywell, at 30:25
Growth Lab takes “zero equity” in the companies it works with and says it has supported 119 founders (StartOut). What Leigh valued was the length.
“It’s six months long, so longer than the sort of average accelerator, and it’s like a tight-knit group.”
Leigh Honeywell, at 30:49
Jon said the authenticity in the group was “just through the roof,” and Leigh put a name on it.
“Yeah, I feel like people let the like the hustle mask down a little bit.”
Leigh Honeywell, at 31:27
Take over their own world
Jon closed by inviting Leigh back once the consumer product had taken over the world. Leigh reframed the ambition.
“Exactly. It’s like take over the world or prevent the world from being taken over.”
Leigh Honeywell, at 31:59
Jon’s version was “Or enable everyone to take over their own world,” and Leigh said she’d buy it. It’s a fair summary of the whole conversation: security that starts with the person, and the accounts they actually live in.
What happened after the tape
When we recorded. The episode aired on July 1, 2021. Leigh mentions a disinformation case “a few months ago” and Jon brings up the recent events in Belarus, so the conversation most likely took place in the first half of 2021.
Tall Poppy kept going. The Y Combinator directory still lists the company as active, with a team of 10 in Ottawa (Y Combinator). Its site sells online harassment protection to organizations and their employees, with proactive risk management and incident response on standby (Tall Poppy).
Leigh’s next roles. She was Tall Poppy’s chief executive until December 2024. Since then she has been Lead Security Strategist for business and executive security at 1Password, working from Ottawa. She has been a founding advisor to iVerify since July 2023, helping it through its spinout from Trail of Bits, and she is still a venture partner at Pioneer Fund (LinkedIn). A password manager company is a natural next stop for someone who spent years tracing harassment back to reused passwords.
What holds up best is the order Leigh argued for. Most harassment starts with an account, so start there: unique passwords, a second factor, and someone to call when it happens, for every employee, not only the famous ones.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each question, then check your score.
-
Which breach did Leigh name as the reason old passwords still work for attackers?
- A bank breach in 2018
- The Dropbox breach in 2012
- A phone carrier breach in 2020
b. "It's people noticing that you haven't changed your password on a bunch of sites since the Dropbox breach in 2012." Transcript, 7:06.
-
Which teams did Leigh say Tall Poppy usually sells to first?
- Finance and legal
- IT and the help desk
- Trust and safety, and developer relations
c. "whether it's maybe the trust and safety team or the developer relations team, where there's like a real sort of public interface." Transcript, 15:46.
-
What is the first of Tall Poppy's two design principles?
- Staying out of the user's security context
- Monitoring every account in real time
- Asking for full access to fix problems fast
a. "One is not putting ourselves in the user's security context wherever possible." Transcript, 19:59.
-
What does Leigh want Tall Poppy to be for the people it helps?
- A hacker in a hoodie on their side
- A smart security friend
- An alarm that goes off when they're hacked
b. "We want to be like your smart security friend that you come to for advice, right?" Transcript, 20:47.
-
What can it mean when someone sends death threats from their real Facebook account?
- That they're convinced of their own righteousness
- That they don't know how to use Tor
- That they want to be caught
a. "Or are they so convinced of their own righteousness that they're like sending death threats from their actual Facebook account?" Transcript, 25:03.
-
When people think their iPhone was hacked, what did Leigh say is usually the real target?
- The phone's operating system
- Their home Wi-Fi router
- Their iCloud account, through a reused password
c. "what's getting hacked is your iCloud account, because you're reusing your password." Transcript, 29:06.
Is your team ready when someone is targeted?
Eight questions for an employer whose people might be harassed, doxed or locked out of their own accounts, drawn from what Leigh and Jon covered. Each one links the part of the episode it comes from.
Scorecard · eight questions
Is your team ready when someone is targeted?
Answer for your whole company as it stands today, not only the public-facing teams. If two answers fit, pick the lower one.
-
Do your people use a password manager, with unique passwords on their personal accounts too?
- No
- Some of them
- Yes, and the company pays for it
"It's people noticing that you haven't changed your password on a bunch of sites since the Dropbox breach in 2012." See Commoditized breaches.
-
Is a second factor turned on for the personal accounts that matter most, such as email, cloud storage and social media?
- No
- For some people
- Yes, with help to set it up
"That little tiny bit of prevention ends up being super, super powerful." See Commoditized breaches.
-
If any employee were harassed or doxed tomorrow, would they know where to get help?
- No
- Only some teams would
- Yes, everyone would
"And what does Bob do?" See Bob in accounting.
-
Do your public-facing people, such as trust and safety, developer relations and executives, get personal security help before anything happens?
- No
- Only after an incident
- Yes, before it happens
"whether it's maybe the trust and safety team or the developer relations team, where there's like a real sort of public interface." See Bob in accounting.
-
Is there a written plan for the first day of a harassment or doxing incident?
- No
- Roughly, in someone's head
- Yes, written down and tried
"what are those scary, scariest possible outcomes?" See Plan for the worst, hope for the best.
-
Would an employee feel comfortable bringing a personal security problem to your security team?
- No
- Some would
- Yes
"Like, there's often not that trust with something like a security team." See Bob in accounting.
-
Can you help someone document threats in a way law enforcement will take seriously?
- No
- If they ask
- Yes, we have a template
"Like, getting it taken seriously requires a degree of documentation" See Don't look at the internet.
-
Do the security tools you give employees stay out of their personal accounts?
- No, they ask for broad access
- Some do
- Yes, least privilege only
"we design our access in a least privileged way." See Not in your security context.
An old password or a single bad week could become a crisis with nowhere to turn. Start with password managers and a second factor for everyone, and decide who an employee calls when it happens.
Some of your people are protected and some aren't. Extend the help past the public-facing teams, write down the first day of an incident, and make it safe to ask the security team for personal help.
Your people have the basics and know where to go. Keep the plan current, practice the documentation step, and check that every tool you hand out stays out of their accounts.
How many of your people have faced online harassment?
National survey rates against your own headcount. The defaults are Pew Research Center’s numbers for U.S. adults, and you can change them.
Calculator
How many of your people have faced online harassment?
Four estimates: your headcount, the share who have faced any online harassment, the share who have faced severe harassment, and the share of your staff a personal security program covers today.
At these rates, about 82 of your people have faced online harassment and about 50 have faced severe harassment such as threats or stalking. A program that covers 20 people leaves about 45 of those severe cases with nowhere to turn. That's the gap Leigh's Bob in accounting falls into.
The defaults come from Pew Research Center's September 2020 survey of U.S. adults: 41% had personally experienced online harassment and 25% more severe harassment. They're national rates, not a measurement of your company, so change them if you know your own. The last number assumes the people a program covers are spread evenly across your staff.
From Bell Canada to 1Password
Everything on this page sits on one timeline, from a 19th-century hospital to Leigh’s current role. Filter it by thread.
Timeline · 1847 to 2026
From Bell Canada to 1Password
Filter by thread. Dates are from the public record except where marked as part of this show.
- Wash your hands
Ignaz Semmelweis proposes hand washing in Vienna's First Obstetrical Clinic (Wikipedia, on this show).
- Bell Canada
Building phone systems in the early days of voice over IP, by Leigh's account (on this show).
- Independent consulting
IT and phone systems for small offices in the Toronto area, to 2011 (LinkedIn).
- Symantec
Malware operations engineer, after the MessageLabs acquisition (LinkedIn).
- Microsoft
Security program manager, with the security response team and then the Security Engineering Center (LinkedIn).
- The Dropbox breach
The breach Leigh names as the source of passwords people never changed (on this show).
- Heroku
Senior platform security engineer (LinkedIn).
- Slack
Senior staff security engineer, then security response manager to April 2017 (LinkedIn).
- 68 million passwords
Dropbox account passwords leak onto the internet (Wikipedia).
- The ACLU
Technology fellow, on legal briefs, public writing and advocacy (LinkedIn, her blog).
- Tall Poppy
Leigh founds the company and becomes its chief executive (LinkedIn, on this show).
- Y Combinator
Tall Poppy goes through the Summer 2018 batch (Y Combinator).
- StartOut Growth Lab
Tall Poppy joins the fourth cohort, a six-month program (StartOut, on this show).
- Pioneer Fund
Venture partner at the fund of Y Combinator alumni (LinkedIn, Pioneer Fund).
- The state of online harassment
Pew finds 41% of Americans have experienced online harassment and 25% severe harassment (Pew Research Center).
- Episode 5
The episode airs (transcript).
- Dorsey steps down
Jack Dorsey leaves the Twitter chief executive role (Wikipedia, on this show).
- iVerify
Founding advisor through its spinout from Trail of Bits (LinkedIn).
- 1Password
Leigh leaves the chief executive role at Tall Poppy and becomes Lead Security Strategist at 1Password (LinkedIn).
- Still active
The Y Combinator directory lists Tall Poppy as active, with a team of 10 in Ottawa (Y Combinator).
What to do this week
Five things, in the order Leigh’s argument suggests.
- Make a password manager a benefit. Pay for it, roll it out to everyone, and encourage people to use it for personal accounts too. Old, reused passwords are where most harassment cases start. The scorecard above shows where else you stand.
- Turn on a second factor where it counts. Email, cloud storage and social media first, with someone available to help people set it up.
- Give everyone a place to go. Not only the public-facing teams. The calculator shows how many of your people may already have needed it.
- Write down the first day. Who the employee calls, how threats get documented, what gets taken down, and when law enforcement comes in.
- Keep your tools out of people’s accounts. Least privilege applies to the help you give, too. If you’d like a second pair of eyes on the program, our vCISO team can help, and you can book 15 minutes with us.