Rod Schultz was three months into a new job when he came back to the show. In October 2024 he became chief executive of Bolster AI, the Santa Clara company that finds and takes down phishing sites, fake accounts and other impersonations of a brand, and most of the hour went to how little it now costs to fake one.
“So within four hours, you can effectively change the weather.”
Rod Schultz, at 18:06
Bolster was founded in 2017 by Abhishek Dubey and Shashi Prakash under the name RedMarlin, and raised a $10 million Series A in November 2019, when its platform used natural language understanding and computer vision to spot brand hijacking (VentureBeat). It runs CheckPhish, a free scanner for suspicious links, and by May 2024, when Microsoft’s venture fund M12 led a $14 million round, it had raised around $40 million (TechCrunch). The legal entity is Bolster, Inc., with offices in Santa Clara and Noida, India, and the company names its category external digital threat protection, the threats that live outside a company’s own network (Bolster AI).
A note before we start. Bolster works with YSecurity. Its logo is on our home page and on our penetration testing page. Everything below comes from the tape and the public record.
Jon McLachlan and Sasha Sinkevich hosted. Rod had been on once before, on episode 29, as vice president of product at DUST Identity. This conversation was recorded in late January 2025 and aired on February 11, 2025, as episode 62, with two short paragraphs of show notes. Since then Bolster has launched Signals, an intelligence product close to the early warning Rod described on the tape, and its own researchers have timed a fake executive account at under five minutes.
This page is the rest of it: a section for each part of the conversation with the sources beside it, eleven figures, twenty-nine clips from the tape, the full transcript, and four tools: a quiz, a scorecard for how hard your brand is to impersonate, a calculator for what a customer abuse mailbox costs to triage by hand, and a timeline from Napster to Bolster’s Threat Graph.
Back from FairPlay
Jon opened with the history. Their paths crossed at Apple, he said, then allowed that was overstating it just a pinch. Both were part of Apple’s iTunes security team, and both worked on FairPlay. Rod told the rest.
“Steve Jobs was putting together a team to prevent people from stealing music and movies, kind of help recover the recording industry from the impact of Napster.”
Rod Schultz, at 0:48
Napster launched in June 1999 and was shut down in July 2001 after the copyright lawsuits (Wikipedia). FairPlay is Apple’s family of digital rights management technologies for music, video, books and apps, and Rod worked on it from January 2006 to March 2008, a story told in full on episode 29. His point this time was that the old question is back with a new kind of content.
“And I feel like what we worked on, Jon, like when it came to encryption and key management and basically enforcing business models, is kind of starting to come back around a little bit with artificial intelligence, large language models, and the question is, like, how do you monetize data?”
Rod Schultz, at 0:57
Sasha added the supply side of the same problem, that the models are running out of good material.
“we will be running short on data, on valid data, pretty soon, or if we haven’t already.”
Sasha Sinkevich, at 1:30
Rod agreed, called the appetite of large language models insatiable, and put the business question plainly.
“It’s turning into a data land grab. And if that’s the case, then how do you reward the people that actually created that data?”
Rod Schultz, at 2:01
When is data trustable?
Sasha asked what the organizations Rod talks to worry about most, and whether they’re looking for accurate data. Rod reframed it as a question of when data can be trusted, which someone has to decide case by case.
“That trust is context dependent.”
Rod Schultz, at 2:46
The example he reached for came from a former employer.
“Adobe has some very interesting things that they’re doing, which was the Content Authenticity Initiative, where they can stamp an image as being created by a camera with this GPS coordinate by this photographer.”
Rod Schultz, at 2:52
The Content Authenticity Initiative is an industry coalition and a business unit of Adobe that promotes provenance standards for digital media. It backs the specifications of the Coalition for Content Provenance and Authenticity and maintains open source kits that let software attach and read that provenance (Wikipedia). Rod didn’t expect any one tool to fix trust on its own.
“And I don’t think there’s going to be any one single killer app that’s going to do it.”
Rod Schultz, at 3:17
Then he named the problem the rest of the hour turned on.
“it doesn’t cost anyone anything for doing something untrustable or false or fraudulent on the internet.”
Rod Schultz, at 3:25
The shadow attack surface
The companies that feel this most, Rod said, are the large consumer brands. They spend heavily to build attention, and a fake site or account takes that attention for almost nothing.
“I can steal that attention for pennies on the dollar and utilize it for a quick buck, ruin the reputation of the brands”
Rod Schultz, at 4:06
Then the attacker moves on to whichever brand is least protected. Bolster has a name for the exposure.
“We kind of call this area that’s attacked the shadow attack surface of the brand or the company. And that attack surface is directly proportional to the size of the brand, the size of the assets under management”
Rod Schultz, at 4:21
Every leader wants a big brand, he said, and the shadow attack surface is the cost that comes with one. Bolster’s own description of the category lists what lives there: lookalike domains, impersonating accounts, fraudulent apps and listings, scam ads and data exposed on the dark web, all of it outside the network a security team usually defends (Bolster AI).
Sasha summed it up as a reputational cost of doing nothing, made worse because language models make false content cheap to produce, and drew the conclusion.
“there is a need for the corporations to build a control that will protect from that misinformation.”
Sasha Sinkevich, at 5:17
Perfect replicas
Rod agreed and added two more reasons the problem is growing: the ease of creating a fake, and the ease of tuning it for a target. Then he gave the comparison he’d been using with his team.
“And what you have now is you have very low cost, perfect replicas of artworks”
Rod Schultz, at 5:45
In the art world the fake is sold to a buyer who can’t tell the difference. In phishing it’s sent to a receiver.
“So in the art world, we have the buyer and the seller. And in the phishing and the fraudulent email world, we have the sender and the receiver. And the job is to trick the receiver or the buyer into thinking they’re getting something authentic when it’s really not.”
Rod Schultz, at 6:12
The payout is what differs. A forger takes the cash. A phisher asks for credentials, personal information, or access to a bank account or a credit card.
A cat and mouse game
The creation is getting simpler, Rod said, and the distribution is already optimized.
“The internet is such an amazing distribution engine. The attackers that we see today can spin up infrastructure very quickly. They’re very good at evading detection capabilities and mechanisms that we have in place.”
Rod Schultz, at 6:35
He tied it back to the start of the conversation. On FairPlay the question was how long it would take someone to reverse engineer each new protection. The public record answers it for that round: in October 2006, Jon Lech Johansen announced he had reverse engineered FairPlay and would license the technology to other companies (Wikipedia). The question Bolster lives with is the same one pointed the other way.
“In this case, it’s how long is it going to take an attacker to try and go around our defense mechanisms or our detection mechanisms to get to the victim?”
Rod Schultz, at 7:06
The evasion has kept moving. By March 2026, Bolster was describing campaigns that use geo-fencing, conditional delivery and infrastructure filtering so that real victims see the fraud while “automated scanners see nothing at all” (PR Newswire). In August 2026 Rod wrote about ten months of takedowns for one customer, where adversary-in-the-middle phishing was 34% of what Bolster removed and the pages victims clicked didn’t ask for credentials, because the harvesting happened one hop later (LinkedIn).
We spent ten months running takedowns for a large insurance and benefits customer.
Rod Schultz · CEO, Bolster AI · August 13, 2026
Every check came back clean.
And every one of those verdicts was accurate.
Typosquats that lurk
Jon asked which fraud Bolster sees most. Rod sorted it into buckets and started with the cheapest.
“Number one, the easiest thing to do is to create a fake website.”
Rod Schultz, at 7:35
His example was a brand like Nike. An attacker registers the misspellings and waits.
“These are called typosquats, or misspells. And then you just lurk.”
Rod Schultz, at 7:48
Typosquatting is a form of cybersquatting that relies on the typos people make when they enter a web address, and cybersquatting is registering or using a domain in bad faith to profit from someone else’s trademark or to run phishing (Wikipedia). The lookalikes wait for a moment when a lot of people type in a hurry. Rod named the Olympics, and a band’s tour.
“The URL goes up for, pick your favorite brand or band or performer, tour2025.com.”
Rod Schultz, at 8:18
The fakes are exact copies, and they sell merchandise to fans racing a sellout. “And it doesn’t sell out, because it’s all fake.”
For domains there’s also a formal route to get a name back, ICANN’s Uniform Domain-Name Dispute-Resolution Policy, which covers every generic top-level domain and some country code domains (Wikipedia).
Phishing as a marketing campaign
The second bucket is phishing, and Rod described it in the language of a marketing team.
“Of course, it costs nothing to create a sophisticated phishing campaign. It’s effectively like running a marketing campaign at this point.”
Rod Schultz, at 8:47
Pick a victim, decide how easy they’ll be to fool given what’s in the news, and launch.
“And then the race is on to see who can monetize fraud the fastest.”
Rod Schultz, at 9:06
Bolster’s chief technology officer, Shashi Prakash, put a price on the tooling a few months before Rod joined: “tools that you can purchase for $10 or $20 to launch phishing attacks.” Attackers using phishing as a service, he said, can launch realistic bank login pages “within minutes” (TechCrunch). In December 2024 Bolster’s researchers traced the path from novice to expert through phishing kits, which they call “prepackaged tools that make it easier to start phishing attacks,” and through the hosting, stolen data and stealth tools sold on dark web markets (Bolster AI). The lures look funny until they don’t, Rod said, and they’re getting harder to tell from the real thing.
“Consumers are really paying the price.”
Rod Schultz, at 9:24
If you see something, say something
Sasha asked what companies do about cloned sites today, now that there are tools that will clone a website for you.
“it’s not really a new attack, but as we discussed, it’s just becoming so much easier.”
Sasha Sinkevich, at 9:34
Rod’s answer was blunt.
“Unfortunately, what we see is ineffective public service campaigns”
Rod Schultz, at 9:54
A banner telling customers to watch for phishing, he said, is the airport announcement, “if you see something, say something,” and it’s almost like a checkbox for the PR team.
Sasha named the weak link.
“Because you depend on people identifying that this is a fraud, and then you depend on people to report it.”
Sasha Sinkevich, at 10:26
The reporting channels do exist. The FTC’s advice on scam texts is to check with the real agency using a number or website you already know, use the phone’s junk report button or forward the text to 7726, and delete it (FTC). Rod’s point is that a report only helps if someone downstream acts on it.
The abuse mailbox
That was the opening for the product Bolster had just released.
“We do have a new product we just released, guys. It’s called AI Security for Email”
Rod Schultz, at 10:42
Large companies publish an abuse address and ask customers to forward anything suspicious. Bolster takes the forwarded mail, dissects the links and buttons, and takes down the infrastructure behind the real phishing. The volume is the problem.
“one, they send us 30,000 emails a month, of which 56%, I believe, around that number, are actually, like, true fraud.”
Rod Schultz, at 11:41
The rest, Rod said, are things like campaign donation emails that customers forward anyway. Bolster’s own post on the product, from the last day of 2024, calls it Customer Abuse Mailbox and gives the averages behind it: “Leading brands receive over 30,000 customer-reported phishing emails per month on average,” and “It can take up to 6 minutes to review a single phishing email,” with two out of three being false positives (Bolster AI). Those are company figures, and the share of real fraud varies by brand, 56% for the customer Rod described and one in three in the post’s example.
At six minutes a report, 30,000 reports is 3,000 hours of reading a month. The calculator below runs the same arithmetic on your own numbers.
A dossier for the host
Sasha asked what a company responsible for its own marketing and fraud prevention would do without a service like Bolster. Rod’s first answer was almost nothing, beyond press releases and banners.
“you can protect what’s inside of your house, but you can’t prevent bad things from happening in your neighborhood.”
Rod Schultz, at 12:52
Bolster’s job is the neighborhood: scouring the web outside the enterprise for signs of fraud and abuse, then taking them down. A company could build that itself, Rod said, or use a team built to do it.
Jon asked about the takedowns. Most of the work is a negotiation with whoever hosts the fake.
“we’ll come to them with a dossier of information and say, we can prove this is fraud.”
Rod Schultz, at 13:40
Some providers act in minutes. Others are slower, and that’s where Bolster leans on its playbooks for hosting and DNS providers and the data it has built up.
“based upon playbooks that we have, but also a lot of information and data that we’ve acquired and accrued over the last five years.”
Rod Schultz, at 14:04
The slowest hosts are the ones built to be slow. Bulletproof hosting is infrastructure “resilient to complaints of illicit activities,” usually run from jurisdictions with lenient laws (Wikipedia), and Jon’s follow-up was about exactly that: knowing the laws in each state and country where something is hosted. Bolster’s own numbers for its takedowns, from its home page today, are 98% resolved within 72 hours, a median takedown time under 10 hours and a cost per takedown 20 times lower (Bolster AI). Those are the company’s figures.
Bursty storms
Rod called what Bolster sells a scalable apparatus for legal, for trust and safety, and for brand security, sized to the attack rather than to a headcount.
“These attacks are bursty. They don’t come at predictable times.”
Rod Schultz, at 15:02
Paying three or four people to watch full time is hard to justify for something that comes in bursts. The service, he said, can be turned on within a day and scaled to meet the phishing storms and fraud storms “that come out of nowhere.”
Jon asked what pushed Bolster toward email. The customers did, Rod said. They felt helpless, because their customers’ inboxes aren’t theirs.
“And the challenge is that the enterprise doesn’t own the inbox of the consumer.”
Rod Schultz, at 16:02
The abuse inboxes stacked up faster than anyone could work through them. So Bolster started from an assumption about what a defender can and can’t change.
“you can’t control the supply of fraud, right? But what you can do is you can control how it’s consumed, and you can destroy it the minute it comes up, with the assumption that it’s going to pop up somewhere else.”
Rod Schultz, at 16:34
And the storms move. Through other measurements in its system, Bolster has watched attackers who get pushed back from one customer turn elsewhere.
“they’re moving to weaker targets that aren’t using us to protect them.”
Rod Schultz, at 17:03
Internet security weather
Jon liked the storm image. He’d always thought of some campaigns, like the external vulnerability scans that sweep the internet, as background conditions.
“It’s always kind of like the weather.”
Jon McLachlan, at 17:23
“We essentially have internet security weather.”
Jon McLachlan, at 17:28
Rod took the image one step further.
“the crazy thing is the weather is being manipulated with, like, very low cost.”
Rod Schultz, at 17:32
The people manipulating it need only a small share of victims to click all the way through, he said, and the infrastructure they need is cheap to set up.
Four hours
That led to the number in the episode’s title.
“In fact, we did some research. It takes less than four hours to set up an effective phishing campaign”
Rod Schultz, at 17:49
The build has five parts in Rod’s telling: create the website, grab the URLs, set up the servers, write the phishing emails with their hook, and redirect the victim to the phishing site. We couldn’t find the study itself on Bolster’s site, so the four hours stands as Rod’s account of it. Sasha did the business math.
“it only costs you four hours of labor to deploy a clone, and then you can craft an ideal attack, and off you go.”
Sasha Sinkevich, at 18:31
Bolster’s later research points the same way, and faster. In December 2025 it wrote that generative AI lets criminals create “hundreds of unique, high-quality phishing sites in minutes” (Bolster AI). In September 2026 one of its analysts created an X account impersonating a real chief executive, using a Yahoo address and his own phone, and stopped there: “From start to finish, it took less than five minutes” (Bolster AI).
The FasTrak text
The advantage sits with the fraud creator, Rod said, and it’s growing, because stolen data makes each lure more precise.
“they make them more and more precise based upon stolen data.”
Rod Schultz, at 18:58
Then he told on himself. Right before New Year’s, he got a text.
“if you’re in the FasTrak lane, you need to prepay the tolls for this weekend. You need to click here.”
Rod Schultz, at 19:22
For a second, he said, he wondered whether he’d paid. Then he worked out what the sender knew: a Bay Area area code, the holiday travel season, and how much a FasTrak lane on Highway 101 is worth when the traffic backs up.
“I’m just another guy with a sophisticated attack that’s happening through just a little bit of information.”
Rod Schultz, at 19:36
He wasn’t alone. In April 2024 the FBI’s Internet Crime Complaint Center said it had received more than 2,000 complaints since early March about smishing texts posing as road toll services in at least three states, warning that “the scam may be moving from state-to-state” (IC3). On January 17, 2025, a few weeks after Rod’s text, the FTC warned that “Scammers are pretending to be tolling agencies from coast to coast” (FTC).
Fraud at scale
Jon saw where it leads once everyone’s public data is scraped into models.
“you could have some very convincing fraud at scale, which is probably something we haven’t seen ever.”
Jon McLachlan, at 20:13
Rod laid out the recipe from the attacker’s side.
“I’m just going to buy a bunch of data. That’s going to give me the context I need. I’m then going to match that with software that I can effectively get at very low cost.”
Rod Schultz, at 20:41
“So the ability to automate it, to scale it, and then to distribute it is just there.”
Rod Schultz, at 20:51
The brand pays too. People who fall for an attack on a brand, Rod said, turn away from it or rethink the relationship. Bolster’s December 2024 post puts a company number on it, phishing “costing companies as much as $500 per account takeover” and a 15% customer attrition rate (Bolster AI).
Three months in
Jon asked about Rod’s proudest moment since October 2024. It was the customer reviews of the new email product, and what they implied about everything Bolster never sees.
“for every X number of emails that we got, there’s probably a thousand X out there that we didn’t receive.”
Rod Schultz, at 21:46
He’d been sitting down with customers’ security operations teams to watch how they use Bolster’s web, social media and dark web products together.
“And I love how Bolster is becoming almost the central hub in some ways for the collection of data”
Rod Schultz, at 22:25
The data then moves on to the tools the team already runs, a SIEM or attack surface management tooling. The rest was people: meeting the company and watching it win accounts. Three months in, he said, one thing was already clear.
“The problem is only getting worse”
Rod Schultz, at 23:10
Where fraud goes next
Sasha asked where fraud is heading. Rod named three directions. More of it in finance, because that’s where money moves. More in Web3.
“Web3 is designed to put money on rails and to just suck it from one location and move it to another.”
Rod Schultz, at 23:40
And a tailwind he saw on the social platforms, as content moderation and fact checking were being pulled back and fewer people would flag a post that sends users on to a phishing site.
Sasha asked about the news of that month.
“And so, did Meta pull the plug on content validation?”
Sasha Sinkevich, at 24:12
Meta had recently made a statement, Sasha said, that it would no longer be doing fact checking.
The statement was Meta’s of January 7, 2025: “We will end the current third party fact checking program in the United States,” moving to Community Notes (Meta). The same post said Meta would keep its automated systems on illegal and high-severity violations, “like terrorism, child sexual exploitation, drugs, fraud and scams,” and rely on reports for less severe ones. Community Notes is the crowd-sourced context program that began on Twitter in 2021.
Information asymmetry
Rod tied it together with a term from economics.
“So all of those are contributing to what I call the information asymmetry of, like, receiving information or reading information.”
Rod Schultz, at 24:24
Information asymmetry is “a situation where one party has more or better information than the other” (Wikipedia). In Rod’s version the attacker holds the extra information, and the receiver assumes it isn’t there.
“the sender knows more about me than the receiver, right?”
Rod Schultz, at 24:40
The trust comes from the channel. A post sits on a big platform, an email lands in a real inbox, so the content borrows the trust of where it showed up.
“It’s being hosted on Meta. It’s being hosted on X. Like, those platforms are trustable.”
Rod Schultz, at 25:04
Sasha called it a form of fake social validation, enough noise around a fake to make it look trusted. Rod traced the technique back to military influence campaigns and radio broadcast across front lines.
“We’ve now taken a lot of that sophistication, and it’s been handed over, in a way more powerful way, to organized crime.”
Rod Schultz, at 26:19
He put the annual loss to fraud in the trillions, his own estimate. The FTC’s count for the United States alone is narrower and still large: consumers reported losing more than $12.5 billion to fraud in 2024, up 25% on the year before, with imposter scams second only to investment scams and email the most common way scammers made contact (FTC).
Deciding what not to do
Jon asked about the hardest part of the job so far.
“The hardest thing right now for us, Jon, is deciding what not to do”
Rod Schultz, at 26:44
The reason is cost. Bolster runs large and small language models, and training isn’t cheap.
“Because we use large language models and small language models, the training costs are high.”
Rod Schultz, at 26:52
“Every single customer we bring in, we train a model.”
Rod Schultz, at 27:04
The next question is where to take what Bolster learns outside the enterprise. Organized crime goes after companies as well as their customers, so Rod wanted a way to see the outside storms before they reach the inside.
“And can we create some sort of heads-up display to warn enterprises that the storms that are being created on the outside will eventually migrate their way toward sophisticated attacks on the inside?”
Rod Schultz, at 28:00
Jon pictured it as a weather map, a map of the internet with storms moving through and the customers in their path. Rod said yes, and then said how fast the ground had moved.
“Bolster was using large language models a couple of years before anybody else. People thought we were crazy.”
Rod Schultz, at 28:46
The public record shows the early machine learning, if not the exact models. The 2019 coverage of the company’s Series A describes natural language understanding and computer vision models that could spot brand hijacking “in as little as milliseconds” (VentureBeat), three years before ChatGPT was released on November 30, 2022. Rod said he’d never seen technology move faster than it has since.
Attackers organize better
Sasha described the imbalance from the defender’s chair. The fraud community is interconnected, and the companies on the receiving end fight alone.
“So there is a little bit of asymmetry of the information and collaboration.”
Sasha Sinkevich, at 29:41
Rod agreed, and called it shocking.
“the attackers organize better than the people that are being attacked.”
Rod Schultz, at 29:50
Bolster was starting to look at threat intelligence built from its own data and from partners, on the model of the crowd.
“I mean, we saw this pattern with Bugcrowd.”
Rod Schultz, at 30:16
Bugcrowd is a crowdsourced security platform founded in 2012, which runs bug bounty programs (Wikipedia). The pattern Rod meant is the same one: the attacks are universal, so what one defender learns is worth sharing with the rest.
From the how to the why
Jon asked who had shaped Rod’s career. Rod named moments more than people, starting with why he left Apple.
“Apple was really happy with me becoming, like, a sharp edge for Apple.”
Rod Schultz, at 31:04
He wanted to grow, so he went to Adobe, which ran an innovation boot camp for anyone interested in turning innovation into products. He also took business classes at Berkeley.
“I took a ton of classes over at the Haas Business School, where I learned strategy.”
Rod Schultz, at 31:32
The Haas School of Business is Berkeley’s business school, and Rod’s courses there come up again on episode 29. What changed was the question he asked.
“And that transition from, like, going from the how to the why was so eye-opening for me in many, many ways.”
Rod Schultz, at 32:06
The second moment was his first startup, Rubicon Labs, and its chief executive, Richard Egan, who told him his questions and framing mattered and to keep pushing. Rod learned to test an idea in a room and live with it being knocked down.
“be willing to have it swatted down, but not having that impact your confidence level.”
Rod Schultz, at 33:00
He started far from boardrooms.
“I was designing protocols for Cisco, in the operating system for Cisco routers and switches, when I first came out of school.”
Rod Schultz, at 33:18
That operating system is Cisco IOS. The full path, from Cisco in 1997 through Apple, Adobe, Rubicon Labs, Zoom and DUST Identity to Bolster, is the slalom on episode 29.
Raised by wolves
Jon asked what Rod would tell his younger self. Stock tips first. Jon suggested Bitcoin, and Rod said to buy a lot. Then the real answer.
“Keep learning from the pain. But don’t take it so personally”
Rod Schultz, at 34:18
At Adobe, he said, he was screaming at people in meetings until someone pulled him aside. He’d learned it somewhere.
“line 97, like, you’re a moron. Like, that’s not an exit condition, right?”
Rod Schultz, at 35:12
That was Cisco in the late nineties, where code reviews went line by line through printed code, and Apple was brutal in its own way during the years of the iPhone, Apple TV and the App Store. The lesson he’d pass back:
“the job is to learn. It’s not to inflict pain back”
Rod Schultz, at 35:44
Put the stamp on fraud
Jon asked about legacy. Rod’s own is teaching.
“For me, the ability to watch someone learn an insight is magical”
Rod Schultz, at 36:18
For Bolster, he described a long game.
“it is early days in the information warfare game of fraud.”
Rod Schultz, at 36:57
His five-year hope was to put the stamp on fraud protection: defenses that spin up just in time or stay on, scale against fraud, and eventually take it down from threat intelligence. Jon offered a scene, two strangers in an elevator worrying about someone using their logo, until one says they’ll just use Bolster.
“That’s our first Super Bowl commercial, actually.”
Rod Schultz, at 38:02
The joke landed close to the date. The episode aired two days after Super Bowl LIX, played on February 9, 2025, and Rod’s last line nodded to the most famous Super Bowl ad of all, Apple’s 1984, which aired nationally on January 22, 1984, during Super Bowl XVIII.
“1984 won’t be like 1984.”
Rod Schultz, at 38:29
Secure data operations
Jon asked what product Rod wished someone would build. His answer was traceability: where data was generated, where it’s going, and whether it can be trusted. Data governance tools exist, he said, and companies like Snowflake and Databricks work on it at the database level, but networks are harder.
“secure data operations is front and center for us.”
Rod Schultz, at 40:05
The tension is that data has to move to be worth anything.
“Locked-down data is unusable, right? There’s a reason why the Fed does not want you to put your money underneath the bed, right?”
Rod Schultz, at 40:41
He pointed to homomorphic encryption, which “allows computations to be performed on encrypted data without first having to decrypt it” (Wikipedia), and to secure execution environments, and back to where the conversation started.
“I think a lot of the DRM challenges that we were trying to solve back in the day, in the early 2000s or mid-2000s, they are going to rear their ugly heads again in so many ways”
Rod Schultz, at 41:02
Sasha described Bolster’s work as finding the critical data in a lot of noise, mapping related data sets together, and getting a heads-up before something happens. Rod joked that the marketing team would take the line for the website.
When in doubt, abstract
Sasha connected it to the toll text. Fraudsters reach people easily, while security products still expect specialists to run them.
“We’re talking about security that is stuck in the early 2000s, where we rely on engineers to understand the dashboards”
Sasha Sinkevich, at 42:26
What Sasha saw changing, at Bolster and elsewhere, was the weight on user experience: take the complexity away, and give the customer the output. Rod gave the product rule.
“when in doubt, simplify. I think, and with data, I think it comes down to, like, when in doubt, abstract.”
Rod Schultz, at 43:41
“solve the problems without the expectation that the customer should have a PhD in your product.”
Rod Schultz, at 43:49
Rod expected agentic interfaces to help, and had little patience for dashboards that rewrap the complexity. “None of them look good. None of them interoperate.” Walking the RSA Conference the year before, he said, felt like Vegas, every vendor a new game at the tables. Sasha brought it back to Apple, which wasn’t the first computer maker but made computers easy to use.
“But what Apple brought to the market is user experience, and that gains traction.”
Sasha Sinkevich, at 45:20
Rod picked one part of that story.
“Without Gorilla Glass, we never would have had pinch-pull and all the interesting touch screens”
Rod Schultz, at 46:08
Gorilla Glass is Corning’s chemically strengthened cover glass. The iPhone Steve Jobs showed in January 2007 had a plastic display, and the glass, not yet called Gorilla Glass, came into commercial use when the iPhone launched that June (Wikipedia). Capacitive multi-touch went mainstream with it. Rod’s bet is that AI plays the same part for the next interface.
“AI and large language models may be the Gorilla Glass here of the next iteration, the technology wave”
Rod Schultz, at 46:19
What happened after the tape
When we recorded. The conversation was recorded in late January 2025, a little over three months after Rod started at Bolster, and aired on February 11, 2025. A few weeks after Rod’s toll text, the FTC warned about the same scam nationwide (FTC), and in March it reported $12.5 billion in consumer fraud losses for 2024 (FTC).
The heads-up. On October 29, 2025, Bolster launched Signals, which it describes as intelligence that unites external fraud data with cyber risk data so security leaders can see where AI-generated phishing sites and impersonation attacks originate and how well they’re being taken down. “Fraud, security, and brand protection can no longer operate in silos,” Rod said in the announcement (PR Newswire). Bolster’s account on X put it as a forecast a few weeks later.
With Bolster AI Signals, you get real-time detection, instant risk scoring, and automated takedowns — stopping threats before they spread.
Bolster Inc. (@BolsterAI) · November 17, 2025
Phishing spikes every Monday morning… ⚡ Be ready.
Learn how Signals keeps you ahead: https://shorturl.at/4PvzU
More of the shadow attack surface. In 2026 Bolster added Brand Guardian, built with a leading cybersecurity and cloud company, in March (PR Newswire), marketplace monitoring and takedowns in May, where Rod said most teams can find fraudulent listings “but few can remove them at scale” (PR Newswire), and fraudulent ad monitoring in July (PR Newswire).
The research. In September 2026 Bolster’s lab watched a dark web marketplace for counterfeit currency whose vendors claimed 57,803 orders, against fewer than 2,400 its payment system appeared to generate (PR Newswire). The same month came the five-minute fake executive account, and with it Bolster’s count of impersonation findings on X, about 259 a month on average for the year before June 2026, then 1,300 in June and 1,236 in August. The analyst’s conclusion: “Attackers can afford to lose accounts. Defenders can’t afford to get behind” (Bolster AI).
Threat Graph. On October 20, 2026, Bolster launched Threat Graph, which connects a phishing message to the impersonated brand, the infrastructure behind it and the victim’s experience, so a takedown can go after the campaign and not one site (Yahoo Finance, LinkedIn). It’s close to the map of the internet Jon pictured on the tape.
The part of the conversation that aged best is the plainest. A fake takes minutes to hours, so the defense has to be measured in the same units, and the brands that do it push the weather onto someone else.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each. The explanation shows once you choose.
-
How long did Bolster's research say it takes to set up an effective phishing campaign?
- About a week
- Less than four hours
- About a month
b. "It takes less than four hours to set up an effective phishing campaign" Transcript, 17:50.
-
What does Bolster call the exposure that grows with the size of a brand?
- The shadow attack surface
- The brand perimeter
- The trust budget
a. "We kind of call this area that's attacked the shadow attack surface of the brand or the company." Transcript, 4:21.
-
Of the 30,000 emails a month one customer forwards to Bolster, about what share is real fraud?
- About 10%
- About 90%
- About 56%
c. "one, they send us 30,000 emails a month, of which 56%, I believe, around that number, are actually, like, true fraud." Transcript, 11:41.
-
What did the text Rod got right before New Year's ask him to do?
- Confirm a package delivery
- Prepay his FasTrak tolls
- Reset a bank password
b. "if you're in the FasTrak lane, you need to prepay the tolls for this weekend. You need to click here." Transcript, 19:22.
-
What did Rod say was the hardest thing about running Bolster?
- Hiring fast enough
- Finding new customers
- Deciding what not to do
c. "The hardest thing right now for us, Jon, is deciding what not to do" Transcript, 26:44.
-
Which technology did Rod compare AI and large language models to?
- Gorilla Glass
- The transistor
- The web browser
a. "AI and large language models may be the Gorilla Glass here of the next iteration, the technology wave" Transcript, 46:19.
Would a scammer pass you over?
Rod’s point was that attackers move to the brands nobody defends. Eight questions on how much work your brand makes them do.
Scorecard · eight questions
Would a scammer pass you over?
Answer for your main brand as it's defended today. If two answers fit, pick the lower one.
-
Do you watch for lookalike domains of your brand, and act on the ones that go live?
- No
- We check now and then
- Continuously, with takedowns
"These are called typosquats, or misspells. And then you just lurk." See Typosquats that lurk.
-
When a customer reports a phishing email, does someone review it within a day and go after the site behind it?
- We have no reporting address
- We have one, and it piles up
- Yes, every day
"those fraudulent email inboxes were just starting to stack up" See The abuse mailbox.
-
Could you get a fake site taken down by its host or registrar within hours, with the evidence ready?
- We wouldn't know where to start
- In days, case by case
- In hours, with a playbook
"we'll come to them with a dossier of information and say, we can prove this is fraud." See A dossier for the host.
-
Before a launch, a sale, a tour or a big event, do you register or watch the domains a scammer would want?
- No
- For the biggest ones
- Every time
"The URL goes up for, pick your favorite brand or band or performer, tour2025.com." See Typosquats that lurk.
-
Do you watch social media, app stores, ads and marketplaces for accounts and listings that use your name?
- No
- One or two channels
- Every channel we sell in
"how they use our web product, our social media product, our dark web product" See Three months in.
-
Do your customers know how you will and won't contact them, so a fake text or login link stands out?
- We've never told them
- It's on a help page
- We tell them at every key moment
"You need to click here." See The FasTrak text.
-
Could you handle a burst of fake sites in a single week without hiring?
- No
- With overtime
- Yes, it's automated or on call
"These attacks are bursty. They don't come at predictable times." See Bursty storms.
-
Does what you learn about outside attacks reach the security team's own tools?
- No
- By email, sometimes
- Yes, it feeds our tools
"move it into another tool that they're using for their SIEM" See Three months in.
Someone using your name today meets little resistance. Start watching lookalike domains for your main brand, and give customers one address for reporting phishing that a person reads every day.
You see some of it and act on some of it. Write the takedown playbook before you need it, cover the channels you sell in, and tell customers how you will and won't reach them.
An attacker gets little return from your brand. Keep it that way through launches and busy seasons, and send what you learn outside to the team that defends the inside.
How many hours does your abuse mailbox cost?
What it costs to read every phishing report your customers forward, by hand. Change the numbers to your own.
Calculator
How many hours does your abuse mailbox cost?
Four estimates: how many reports your customers forward a month, the minutes it takes to review one, the share that turns out to be real phishing, and the working hours in one analyst's month.
Reading every report by hand takes 3,000 h a month, about 18.8 full-time analysts, to find 16,800 real phishing reports among 13,200 that weren't.
The defaults come from the tape and from Bolster: 30,000 reports a month and 56% real fraud are Rod's numbers for one customer in The abuse mailbox, and six minutes a report is the upper figure in Bolster's December 2024 post. Bolster sells the automation that cuts this down, so treat these as a starting point and time your own reviews.
From Napster to Threat Graph
Everything on this page sits on one timeline, from Napster to Bolster’s Threat Graph. Filter it by thread.
Timeline · 1984 to 2026
From Napster to Threat Graph
Filter by thread. Dates are from the public record except where marked as part of this show.
- 1984
Apple's Macintosh ad airs nationally during Super Bowl XVIII (Wikipedia, on this show).
- Napster
The file sharing service launches, and is shut down in July 2001 (Wikipedia, on this show).
- FairPlay
Rod joins Apple's FairPlay team, through March 2008 (episode 29).
- Reverse engineered
Jon Lech Johansen announces he has reverse engineered FairPlay (Wikipedia, on this show).
- The glass
Corning's glass, not yet called Gorilla Glass, ships on the first iPhone (Wikipedia, on this show).
- Adobe
Rod moves to Adobe, and takes classes at Berkeley's Haas School of Business (episode 29, on this show).
- Bugcrowd
The crowdsourced security platform is founded (Wikipedia, on this show).
- Rubicon Labs
Rod's first startup, where Richard Egan was chief executive (episode 29, on this show).
- Fact checking
Facebook launches its independent fact checking program (Meta).
- RedMarlin
Abhishek Dubey and Shashi Prakash found the company that becomes Bolster (VentureBeat).
- Series A
$10 million, co-led by Thomvest Ventures and Crosslink Capital (VentureBeat).
- $15 million
A round led by Cervin, Liberty Global Ventures and Cheyenne Ventures (PR Newswire).
- ChatGPT
OpenAI releases its chatbot (Wikipedia, on this show).
- Toll texts
The FBI reports more than 2,000 complaints about smishing texts posing as toll services (IC3, on this show).
- Series B
$14 million led by Microsoft's M12, about $40 million raised in all (TechCrunch).
- Chief executive
Bolster announces Rod as chief executive, a role he started in October (Bolster AI, on this show).
- The toll text
Rod gets a text telling him to prepay his FasTrak tolls (on this show).
- Customer Abuse Mailbox
Bolster's post on triaging the phishing reports customers forward (Bolster AI, on this show).
- Community Notes
Meta says it will end third-party fact checking in the United States (Meta, on this show).
- The FTC warns
Scammers are pretending to be tolling agencies across the country (FTC).
- Recorded
Rod, Jon and Sasha record the episode (on this show).
- Super Bowl LIX
The game is played in New Orleans (Wikipedia, on this show).
- Episode 62
The episode airs (transcript).
- $12.5 billion
The FTC reports consumer fraud losses for 2024, up 25% (FTC, on this show).
- Signals
External fraud and cyber intelligence for security leaders (PR Newswire, on this show).
- The 86,400-second war
Rod's Forbes piece on defending trust in every second of the day (Forbes).
- Brand Guardian
A solution built with a cybersecurity and cloud company against impersonation campaigns (PR Newswire).
- Marketplaces
Monitoring and takedowns for fraudulent listings (PR Newswire).
- Scam ads
Monitoring and takedowns for fraudulent ads (PR Newswire).
- Every check came back clean
Rod on adversary-in-the-middle phishing, 34% of one customer's takedowns (LinkedIn, on this show).
- Counterfeit trust
Research on a dark web marketplace that faked its order counts (PR Newswire).
- Under five minutes
A Bolster analyst creates a fake executive account on X in less than five minutes (Bolster AI, on this show).
- Threat Graph
Bolster connects the phishing site to the campaign behind it (Yahoo Finance, on this show).
What to do this week
Five things, in the order Rod’s argument suggests.
- Watch the lookalikes of your own name. List the misspellings and domains a scammer would register for your main brand, and check which ones resolve today. The scorecard above shows where else you stand.
- Give customers one place to report phishing, and read it. Run the calculator on your own report volume before you decide how much of the review to automate.
- Write the takedown playbook before you need it. For each host, registrar and platform you’ve seen fakes on, note where to send a report and what evidence they ask for.
- Tell customers how you will and won’t contact them. A clear rule makes a fake toll text or login link easier to spot. Say it again before launches and busy seasons.
- Send what you see outside to the team that defends the inside. Attacks on your customers are often a preview of attacks on you. If you’d like a hand building the program, our vCISO team can help, and you can book 15 minutes with us.