Episode 83 of The Security Podcast of Silicon Valley aired on December 2, 2025, with Jon McLachlan and Sasha Sinkevich hosting. The guest was Phil Howie, who founded the company now called Sydekick, a cyber resilience platform for small and medium-sized businesses (Podbean). Jon introduced him like this.
“He is the founder and CEO of a security startup called Sydekick, the simplest route to cyber resilience.”
Jon McLachlan, at 0:13
Two details about that introduction, both from Phil and his company. The name is spelled with a Y, Sydekick, and the website is sydekick.co (Sydekick). The show notes spell it Sidekick and link a sidekick.co address that doesn’t load. And by the time of the recording Phil was the co-founder and CTO, because Kendra Ross had joined as co-founder and CEO, which Phil explains in a three-year job interview. His LinkedIn has him as founder and CEO from 2020 to December 2024, and co-founder and CTO since (LinkedIn).
The conversation was recorded in 2025. The tape fits that: Sasha asks what Phil would build if he started a company “in 2025,” and Phil says Kendra came in “last year,” which Sydekick’s about page dates to 2024 (Sydekick).
This page is the rest of it: a section for each part of the conversation with the sources beside it, fifteen figures, twenty clips from the tape, the full transcript, and five tools: a quiz, a scorecard for whether your security is doable yet, a calculator for what security questionnaires cost you, a timeline from 1657 to 2027, and a to-do list.
A note before the sections. When Phil talks numbers about Pushpay, they’re his numbers from memory, and the page says where the public record agrees and where it’s silent. The pre-seed amount on the tape is hard to hear, so the page takes the figure from Sydekick’s own announcement. And the SafeStack collaboration rests on Phil’s account, because SafeStack’s post about the product doesn’t name Sydekick.
One or two name changes, like a band
Sasha opened with the name, and Phil said Sydekick isn’t the company’s first one.
“So we’ve been through one or two name changes, like a band or something like that.”
Phil Howie, at 0:35
The first one was Onwardly. Phil launched Onwardly in February 2021, and the company announced in 2025 that Onwardly was becoming Sydekick, with Kendra Ross joining as co-founder and CEO and Phil moving into the CTO role (Sydekick). The old name still shows in places. The site’s sign-in button points at an onwardly.io address, and the company’s podcast is still called Upwards (Sydekick). The new name came from a story about who the hero is.
“we turn our customers into superheroes. They’re the heroes in their journey towards security and privacy and resilience.”
Phil Howie, at 0:46
“the trusty sidekick that comes alongside and helps them.”
Phil Howie, at 0:53
The rename announcement puts it in one line: “Every great hero needs a trusted sidekick” (Sydekick). The spelling was deliberate too, a little twist on the word.
“so we spell it with a Y as a little nod to the cybersecurity element of that.”
Phil Howie, at 1:02
He added the practical reason, which anyone who has tried to buy a domain will recognize: a Y makes the name more unique and the domains easier to get. The company’s tagline on LinkedIn is “Digital resilience, made doable,” and the site’s footer says “Cyber resilience, made doable” (LinkedIn, Sydekick).
A consequence of the global pandemic
Then Phil said when, and why then.
“So Sydekick was founded around four or five years ago, at the beginning of COVID.”
Phil Howie, at 1:15
“So we’re a consequence of the global pandemic in a sort of good way. It’s something that I’d been working on really for about a year in the background.”
Phil Howie, at 1:19
“COVID really forced me, or gave me the chance, to dive in and really go all in on this startup journey.”
Phil Howie, at 1:30
New Zealand reported its first COVID-19 case on February 28, 2020 (Wikipedia). Sydekick’s about page dates the founding to 2020, “to help SMEs to proactively defend themselves in an achievable and affordable way” (Sydekick). Onwardly launched publicly on February 9, 2021, and Phil’s launch post thanked his advisor and investor Laura Bell of SafeStack (Sydekick). Eleven days later Stuff ran a story headlined “New business plans to disrupt the cybersecurity market for SMEs,” with Phil saying Onwardly was “democratising” cybersecurity practice (Stuff).
Four or five years from 2020 lands in 2024 or 2025, which fits the recording.
A cyber resilience platform for small business
Phil described the company in one sentence and then said who it’s for.
“So what we are is we’re a cyber resilience platform for small business.”
Phil Howie, at 1:36
“So we help really small to medium-sized organizations build out an entire security program where they really don’t have anything and they really don’t have a place to start.”
Phil Howie, at 1:40
Wikipedia defines cyber resilience as an organization’s ability to keep delivering what it’s meant to deliver despite cyber attacks, and small and medium-sized enterprises as businesses below set limits on staff and revenue (Wikipedia, Wikipedia). Phil’s order matters here. Resilience comes first, built from the ground up, and certification and compliance come later, once there’s something to certify.
“and then work towards eventually things like certification and compliance.”
Phil Howie, at 1:54
“So we make it super easy, super, super easy for people to get started on their journey.”
Phil Howie, at 2:00
The site today promises a program “in 30 minutes a week” and a 15-minute assessment that ends in a prioritized action plan (Sydekick). Its pricing page lists three plans: Lite for up to five users, Core for up to twenty with Australia’s Essential Eight at level one, and Pro with ISO 27001, the NIST Cybersecurity Framework and the CIS controls (Sydekick). That ladder is the same order Phil described: start simple, and add frameworks when a customer or a regulator asks for them.
Understanding you have a problem
Sasha asked the question every small company faces before it buys anything.
“How do these SMBs know that they are mature enough and they need security programs?”
Sasha Sinkevich, at 2:06
“Well, you know, understanding you have a problem is the first part of any journey, obviously.”
Phil Howie, at 2:13
His answer is the assessment. It does two jobs at once: it shows a company where it stands, and it turns the gaps into work.
“So we kind of create the problem for them in a way.”
Phil Howie, at 2:35
“And that creates an understanding, and it creates a problem for them that we can then fix and say, okay, well, here’s your generated program.”
Phil Howie, at 2:43
Then he named the hard part, the one every security vendor runs into.
“So really, a lot of people don’t understand cybersecurity, and that’s the huge challenges that we face.”
Phil Howie, at 3:00
Sasha put it the way a founder feels it.
“Yeah, security can often be seen as this dark box that you don’t really want to dip into because there are so many unknowns that you don’t want to uncover.”
Sasha Sinkevich, at 3:08
That’s the case for starting with an assessment instead of a framework. Nobody opens a dark box willingly, but most people will answer fifteen minutes of questions about their own business, and the answers do the opening for them.
What are we doing about security?
Sasha asked about the biggest pain points, and Phil started with the obvious one.
“Like, I think obviously compliance is a huge one.”
Phil Howie, at 3:28
“That’s a big driver towards business and towards becoming more secure, you know, to provide that assurance to your potential customers.”
Phil Howie, at 3:30
The second one is newer.
“So things like cyber insurance.”
Phil Howie, at 3:40
“We’re seeing more stringent requirements coming from the insurers’ side and people kind of having a bit of a wake-up call”
Phil Howie, at 3:42
Cyber insurance is specialty insurance that protects businesses from risks tied to their IT (Wikipedia), and its application form can be the first security questionnaire a small company fills in. The third pain point isn’t a document at all. It’s a moment.
“and at some point they have a management meeting, and someone goes, hey, what are we doing about security?”
Phil Howie, at 4:01
Usually one person, he said,
“has that responsibility, hopefully, and they go looking for answers as well.”
Phil Howie, at 4:07
That one person is usually the founder or the first engineer, and we wrote about that stage, and the triggers that end it, in In-House, On-Demand, or YOLO?. Phil wants to arrive earlier than the meeting.
“But we want to help from day one, if we can.”
Phil Howie, at 4:22
Employee number one at Pushpay
Jon asked where the spark came from.
“I’m super curious. Did you notice something, or there must have been a spark, that moment where you realized, like, this needed to exist in the world and that you were going to help build this?”
Jon McLachlan, at 4:24
Phil’s answer started two decades back.
“I’ve spent really 20, 25 years in engineering and design.”
Phil Howie, at 4:37
His LinkedIn bears that out, starting with web design work in 2001 (LinkedIn). Then came the job that shaped the rest.
“So I was lucky enough to be employee number one at one of New Zealand’s unicorns, a startup called Pushpay, which really began last decade.”
Phil Howie, at 4:47
“That grew to about $100 million in something like four years.”
Phil Howie, at 4:57
“And through that, I designed really the entire user interface for this app, which processed about $100 billion in finance payments”
Phil Howie, at 5:10
Pushpay makes mobile giving, donor management and church management software for faith-based and nonprofit organizations in the United States. Chris Heaslip and Eliot Crowther founded it in New Zealand in 2011, it listed on the New Zealand Stock Exchange in 2014 and the Australian Securities Exchange in 2016, and Sixth Street Partners and BGH Capital took it private in 2023 (Wikipedia). Phil also said it was worth about $2 billion at its height on the New Zealand exchange. Those three figures are his, and Wikipedia’s article doesn’t give them. One word of his needs a footnote: a unicorn, strictly, is a privately held startup valued at over US$1 billion, a term the venture capitalist Aileen Lee coined in 2013 (Wikipedia), and Pushpay’s peak value was on a public exchange.
His LinkedIn fills in the rest. He was engineer and product designer, employee number one, from February 2012, built the first version of the product, and handled its “security, PCI-DSS auditing” along the way. He was head of product design from 2014 to 2018, then ran product and engineering as CTO at Whip Around from 2018 to 2019, before Onwardly (LinkedIn). Two of Pushpay’s founders, Eliot Crowther and Chris Heaslip, later backed Onwardly’s seed round (Sydekick).
Security has to be easy to use
The Pushpay years gave Phil the lens he brought to security, an experience that’s easy to use.
“So I took a lot of their learning from that and my engineering background and sort of combined the two”
Phil Howie, at 5:19
“I think security has to be easy to use.”
Phil Howie, at 5:29
“And one of the frustrations I felt from the outside is that it’s not easy to use.”
Phil Howie, at 5:31
He was candid about where he comes from.
“I’m not a traditional cybersecurity insider.”
Phil Howie, at 5:36
“So looking at it from a sort of different lens, from a design lens, from an engineering lens, I could see a real opportunity to make a huge improvement there.”
Phil Howie, at 5:39
The field that studies this has a name, human-computer interaction, the study of how people operate computers and how to design the interfaces between them (Wikipedia). Phil’s verdict on most security software was blunt.
“Whereas a lot of stuff in this space is needlessly complicated, horribly designed, and just needs to be better, basically.”
Phil Howie, at 6:00
Two weeks after the episode aired, Sydekick’s launch post for Sydekick Lite quoted him on the same point: “If something feels confusing or overwhelming, people won’t use it” (Sydekick). It’s the security version of a rule every product designer learns early. A control nobody uses is a control you don’t have.
The Fortune five million
Phil named his market with a phrase worth stealing.
“And my aim and my vision is to deliver resilience to, you know, to the Fortune five million, as they’re called, and make this really straightforward, make this actually achievable for people in a way that the average civilian can use and understand.”
Phil Howie, at 5:47
The joke rests on the Fortune 500, Fortune magazine’s annual list of 500 of the largest US corporations by revenue, first published in January 1955 (Wikipedia). Security tooling grew up selling to that list, with the teams, budgets and vocabulary to match. The Fortune five million is everyone else: the companies with one person who “has that responsibility, hopefully,” and no time to learn a new language to do it. Five million is ten thousand times five hundred, and the figure below draws that ratio to scale.
It’s actually hard to make things simple
Sasha checked the obvious inference.
“So you don’t like complex dashboards?”
Sasha Sinkevich, at 6:12
“No. No. Like, it’s easy to make things complicated, right? And it’s actually hard to make things simple.”
Phil Howie, at 6:18
“great design firms, things like Apple and things like that.”
Phil Howie, at 6:24
“It requires a lot of wrestling with choices. What do you display for people? What do you take away?”
Phil Howie, at 6:29
Then he brought it up to date. The age of AI, he said, is one where “you can just code anything.”
“and we can just vibe our way to success, I think what we need is thoughtful design, because I don’t think we’re there yet with AI.”
Phil Howie, at 6:41
Vibe coding is the practice of describing what you want to a large language model and letting it write the code, sometimes without reading what it wrote. The computer scientist Andrej Karpathy coined the term in February 2025, and Collins named it its word of the year for 2025 (Wikipedia). Phil’s point is that the expensive part of a product was never typing the code. It was deciding what to leave out. We wrote about the security side in how to stop AI agents from shipping vulnerable code.
I didn’t have time to write you a short letter
Jon reached for a quotation.
“I think it was Pascal, actually, who said, well, I didn’t have time to write you a short letter, so I wrote you a long one.”
Jon McLachlan, at 7:13
He had the right man. The line comes from the sixteenth of Blaise Pascal’s Lettres provinciales, published in 1657, where he apologizes for its length because he “did not have the leisure to make it shorter” (Quote Investigator). The Provincial Letters were eighteen polemical letters Pascal wrote under the pseudonym Louis de Montalte between January 1656 and March 1657 (Wikipedia). Jon’s point was that a short letter and a simple product take the same extra work. He called it
“exactly the same thing that happens in design and security.”
Jon McLachlan, at 7:24
Jon had Sydekick’s website open while they talked.
“And I have the website open, sydekick.co, side with a Y, sydekick.co.”
Jon McLachlan, at 7:27
The site offers the “5-minute product tour” Jon mentioned (Sydekick). And he named the thing he’s always disliked about the industry.
“bombarded with dashboards and details and nitty-gritties, and most of it isn’t pertinent.”
Jon McLachlan, at 7:47
“So all the gratitude in the world for taking this complex space and just making it a little bit softer around the edges.”
Jon McLachlan, at 8:10
Never seen an industry with more acronyms
Phil took the compliment and went straight to words.
“I think a lot about things like jargon, right?”
Phil Howie, at 8:18
“I’ve never seen an industry with more acronyms than the security industry. It’s outrageous.”
Phil Howie, at 8:24
“And so I’m really careful to things like just not use them where I can, you know, explain things, write things out in full, because most people don’t understand acronyms.”
Phil Howie, at 8:28
An acronym is an abbreviation built from the first letters of a phrase (Wikipedia), and this one episode used more than a dozen. Here they are written out, Phil’s way: SMB is a small or medium-sized business, MSP is a managed service provider, OWASP SAMM is the Open Worldwide Application Security Project’s Software Assurance Maturity Model, NIST SSDF is the National Institute of Standards and Technology’s Secure Software Development Framework, GDPR is the European Union’s General Data Protection Regulation, the CRA is the EU’s Cyber Resilience Act, LLMs and SLMs are large and small language models, and B2B is business to business.
Sydekick kept at it. When it launched Sydekick Lite two weeks after the episode aired, its LinkedIn post said the product “throws out the jargon and those pesky frameworks” (LinkedIn). It’s in After the tape.
A version of Sydekick for AppSec
Making it easy had a side effect Phil didn’t plan for.
“And interestingly, we’re seeing people in the AppSec space as well.”
Phil Howie, at 8:42
“So this is a little bit of an unintended consequence of what we’re doing, is that we developed a platform. Turns out lots of people like things easy to use.”
Phil Howie, at 8:45
AppSec is application security, the work of keeping the software a company builds free of exploitable flaws. Phil named the two frameworks those teams wrestle with.
“So if you’re, you know, if you’re working towards something like OWASP SAMM level one, two, three, or NIST SSDF, some of those complex frameworks”
Phil Howie, at 8:59
OWASP, the Open Worldwide Application Security Project, is an online community, started by Mark Curphey on September 9, 2001, that publishes free resources on application security, and its projects include the Software Assurance Maturity Model (Wikipedia). SAMM has five business functions and fifteen security practices, each with three maturity levels, the “level one, two, three” Phil mentioned, and it’s meant for organizations of any size (OWASP SAMM). NIST’s Secure Software Development Framework, Special Publication 800-218, version 1.1 from February 2022, is “a core set of high-level secure software development practices” meant to fit into any development lifecycle (NIST).
“And so we’ve done a collaboration and joint venture with another company called SafeStack. They’re amazing.”
Phil Howie, at 9:11
“And we actually have a version of Sydekick specifically for AppSec developers and AppSec teams who are working towards those big frameworks.”
Phil Howie, at 9:16
SafeStack, which trains developers in secure development, was founded by Laura Bell Main, who also came on as an investor and advisor in Onwardly in 2021 (Sydekick). SafeStack’s own post describes an application security program platform for rolling out a SAMM or SSDF program as small tasks, with templates, policies and a self-assessment (SafeStack). That post doesn’t name Sydekick, so the joint venture rests on Phil’s account. Either way, the idea is the same one: take a framework built for large teams and break it into steps a small one can finish.
“And as the startup journey goes, sometimes new opportunities present themselves, and you follow your nose in that direction as well.”
Phil Howie, at 9:28
If you build software and a customer is asking about your secure development practices, that’s the work our Product Security team does inside your codebase.
We started really selling direct
Sasha asked how customers find them.
“What is your customer acquisition, top of the funnel? Do people find you because they have a certain pain point and your website promotes the solution to that pain point?”
Sasha Sinkevich, at 9:36
“We started really selling direct. A lot of outreach, a lot of outbound, as you do in the early days of the startup world, where no one knows who you are and it takes a while to build that kind of inbound engine.”
Phil Howie, at 9:52
It worked, and it was slow. And it taught them something about the product.
“And what we found is also that people, even if you build a simple product and a platform for people to use, they still need a lot of help in any case.”
Phil Howie, at 10:10
So they found partners who already give that help.
“is we’ve teamed up with supplier channels, so managed service providers, IT professionals, who really love what we do, and they’re actually adding it into their plans and support plans for helping their customers as well.”
Phil Howie, at 10:22
“And that means that we get to make great software and do what we do best.”
Phil Howie, at 10:37
A managed service provider takes on ongoing responsibility for a client’s IT, usually proactively and on a subscription, instead of fixing things only when they break, and one that runs security services is a managed security service provider (Wikipedia, Wikipedia). Sydekick opened its partner program to managed security providers, consultants and agencies in 2023, and its partner page offers partners discounts and commission (Sydekick, Sydekick). The logic is the one Phil gave. The platform holds the program, and the provider who already looks after the laptops does the hands-on part.
Become a certified Sydekick partner and be part of our movement
Sydekick · February 22, 2026
Steer away from just compliance
Sasha asked whether customers start with compliance.
“Does a typical customer ask for help with compliance? What is the starting point of that discussion?”
Sasha Sinkevich, at 10:49
“It can be a range of things. Compliance is definitely a big one.”
Phil Howie, at 10:58
But Sydekick steers away from compliance on its own, because, in Phil’s words, “It’s a really saturated space,” with some really great products in it already. So Sydekick works on the part before the audit, the stage before a company gets to compliance.
“So there needs to be a lot of just general resilience practices around security, around privacy, even around governance, and things like AI and things like that, that don’t necessarily fall directly under a compliance framework in the beginning.”
Phil Howie, at 11:21
And then the thing that sends most small companies looking.
“It could be just even due diligence. People hate due diligence questions. You guys know all about this.”
Phil Howie, at 11:44
Due diligence is the investigation a reasonable business makes before it signs an agreement with another party (Wikipedia). For a startup selling to bigger companies, it arrives as a spreadsheet of security questions. We do know all about this, and Jon said so.
“I mean, if you’re a founder of a startup and you’re doing the zero to one thing and you’re in the B2B space, you’re going to see those questionnaires.”
Jon McLachlan, at 11:56
“And I’m sure it’d be very nice to understand, like, hey, what are actually, like, the security principles and the practices and the policies and the programs behind all of those questions that I have to implement as a founder in my organization if I want to close those types of markets or close those types of deals?”
Jon McLachlan, at 12:04
That’s the order that works: a program first, and the questionnaire answers come out of it. If a questionnaire is sitting in your inbox now, our Sales Support team answers them and joins the call when the buyer’s security team wants to talk, and we wrote up what a due diligence questionnaire is and the AI questions enterprise buyers ask. The calculator below puts a number on the hours.
Compliance is about adhering to what someone else wants
Jon said Sydekick sounded more holistic than the compliance tools, and Phil agreed, with a distinction.
“Like, there’s a saying that compliance is not the same as security”
Phil Howie, at 12:44
“Now, there’s a lot, obviously, a lot of overlap, but…”
Phil Howie, at 12:49
Sasha finished the thought.
“You can be compliant.”
Sasha Sinkevich, at 12:51
And Phil finished it: you may not necessarily be a super secure company. Then he drew the line.
“Compliance is about adhering to what someone else wants you to adhere to, and good principles-based practices around resilience are really about what’s good for you and your organization.”
Phil Howie, at 12:57
Compliance, in general, means conforming to a rule, whether a specification, a policy, a standard or a law (Wikipedia). Phil’s company made the same argument in writing in 2023, quoting Dean Carter of SafeAdvisory that compliance is “the ability to demonstrate to a third party” that your processes are in place, and warning that a compliant organization isn’t necessarily a resilient one (Sydekick). We agree with both of them, and our What is SOC 2? guide makes the same case from the audit side: a SOC 2 is a floor, and the best programs build on it.
It’s not just cybersecurity, it’s privacy
Phil added the half most small companies forget.
“We start from principles first, and we do privacy as well. So it’s not just cybersecurity, it’s privacy. A lot of people think those are the same thing”
Phil Howie, at 13:07
Sydekick’s privacy program is principles-based, and Phil said it “takes you really to an international level of privacy practice,” in a way that “really adheres to the spirit of the big frameworks around the world,” the GDPR among them.
Information privacy, or data protection, is about how data about people is collected and shared, and the law and expectations around it (Wikipedia). The GDPR is the European Union’s regulation on it, adopted in April 2016 and in force since May 25, 2018 (Wikipedia). At home Phil works under New Zealand’s Privacy Act 2020, which replaced the 1993 act. Its largest change, by the Privacy Commissioner’s account, is that an organization affected by a privacy breach must notify the commission (Wikipedia). It changed again after the recording: since May 1, 2026, a new principle, IPP3A, requires agencies that collect personal information from someone other than the person it’s about to tell that person, as soon as reasonably practicable (Privacy Commissioner). Sydekick’s privacy product launched in 2022 in partnership with Simply Privacy (Sydekick).
A principles-based program is the sensible way to meet several of these laws at once. The principles overlap far more than the paperwork does.
Something we’re all grappling with
Jon asked how a founder should think about AI.
“Like, how might Sydekick help me navigate that as a founder, that new space?”
Jon McLachlan, at 13:57
“Well, it’s something we’re all grappling with, right?”
Phil Howie, at 14:04
Sydekick was just releasing a governance policy, a template companies can customize and roll out to their teams.
“It’s like an acceptable use document.”
Phil Howie, at 14:21
It covers how to think about AI, and, in his words, “what to use, what not to use.”
An acceptable use policy is a formal set of guidelines for what users may and may not do with a system (Wikipedia). Phil’s first rule for the AI version was simple: “Don’t put all your personal information in there.” And he said good privacy practice already covers most of it. Privacy is about being sensible and thoughtful with personal information, so don’t stuff the language models with it.
“That’s probably not cool.”
Phil Howie, at 14:55
“So hopefully good practices will cover some of this stuff.”
Phil Howie, at 14:56
A large language model is a model trained on a vast amount of text to understand and generate language, and it’s what sits behind the chatbots your team already uses (Wikipedia). A short policy that names the approved tools and the data that never goes into them is the right first step, and it’s what buyers now ask to see. We wrote about shadow AI governance and the evidence buyers accept for an AI policy, and our Shadow-AI Detection & Mitigation team finds the AI tools already in use.
A three-year job interview
Jon asked whether Phil has a co-founder.
“Do I have a co-founder? I do now. So I started the journey solo.”
Phil Howie, at 15:23
He went a couple of years alone, and he was proud of what that got done. On the tape he says they raised a pre-seed round and won a couple of awards. The amount is hard to hear, so the page takes it from the company. Onwardly announced in December 2021 that it had closed $1 million in seed funding, in a round led by Kendra Ross of We Love Cyber, with Pushpay’s founders and Raygun’s founders among the backers (Sydekick). The awards include iSANZ’s Best Startup for 2021 (Sydekick).
“Somewhere along the line, I realized that I think I work better with a co-founder.”
Phil Howie, at 15:40
“And so it’s nice being solo in some ways, because you can kind of make decisions and you can get things done.”
Phil Howie, at 15:49
The co-founder was already in the cap table.
“So last year, one of my investors, actually, who I’ve been working with for a couple of years, we had a conversation, and it made sense, and it was the right time for her to come in as an official co-founder and actually CEO alongside me at Sydekick as well.”
Phil Howie, at 15:58
“Her name’s Kendra Ross, and it’s been really great.”
Phil Howie, at 16:19
“What’s great about Kendra is we kind of had a three-year job interview together, really. She came on as an investor and advisor, increasingly just got closer and closer into the business.”
Phil Howie, at 16:36
Kendra Ross’s LinkedIn headline today calls her co-founder and CEO of both We Love Cyber and Sydekick (LinkedIn). Sydekick’s about page dates her arrival as co-founder and CEO to 2024 (Sydekick). Three years from a 2021 seed round to a 2024 co-founder lines up with the interview Phil described. He didn’t pretend co-founding is always easy, and called it a bit of work sometimes.
“But that’s, you know, that’s the journey.”
Phil Howie, at 16:57
It’s not a failure until you’ve given up
Jon said founders don’t sign up for the easy path, and Phil agreed.
Nobody starts a startup to take the easy path, he said, and success has to be defined by the founder.
“and you have to find your own version of success. Sometimes success is just keeping on trying.”
Phil Howie, at 17:17
“failing, trying again, failing, trying again. And sometimes success is the actual just act of trying.”
Phil Howie, at 17:28
Jon offered his own version.
“You’ll get it. I mean, another way that I think about it is it’s not a failure until you’ve given up.”
Jon McLachlan, at 17:38
And Phil added the counterweight, which is the hard part.
“And knowing when to call it, you know, knowing when to be like, look, we’ve tried this one a number of times”
Phil Howie, at 17:44
He called that a skill, a subtle one, and “something that entrepreneurs do really, really well.”
We have global ambitions
Sasha asked whether Sydekick is a New Zealand company or a global one. Phil said they tested the product in New Zealand first.
“They are common across the entire globe. Are you primarily focusing on the New Zealand market, or are you focusing on the global market?”
Sasha Sinkevich, at 18:17
“But really, we have global ambitions, I would say.”
Phil Howie, at 18:31
“Cybersecurity problems are very similar everywhere, just about, although there are obviously some local contexts.”
Phil Howie, at 18:35
Sasha supplied the obvious one.
“Laws and regulations.”
Sasha Sinkevich, at 18:41
“Laws and regulations, and even some cultural contexts, depending on where you are, I suppose.”
Phil Howie, at 18:42
“We’ve got international customers now. We just haven’t yet really launched into some of the places yet that we want to launch into, but that’s coming. It’s kind of one step at a time.”
Phil Howie, at 18:55
The product reflects the region it grew up in. Its Core plan maps work to the Essential Eight, the Australian Signals Directorate’s baseline of eight mitigation strategies, from patching to multi-factor authentication to backups, with four maturity levels from zero to three (ASD, Sydekick). ASD says there’s no requirement to have an Essential Eight implementation certified, which makes it a good fit for a company that wants the practice before the paperwork.
The Cyber Resilience Act is a big one
Sasha asked about the regulations that open doors.
“There are any region-specific opportunities, let’s call them that way, like EU AI Act in Europe, GDPR, but specific to the New Zealand market?”
Sasha Sinkevich, at 19:03
Phil went to Europe first, with the name slightly scrambled.
“So the Cybersecurity, I think, Resilience Act, CRA, in Europe is a big one. Huge opportunity there. And AppSec really fits into that hugely.”
Phil Howie, at 19:17
The law is the Cyber Resilience Act, an EU regulation setting common cybersecurity standards for products with digital elements, hardware and software that connects to a device or a network. It was published in November 2024 and entered into force on December 10, 2024. Its reporting obligations for actively exploited vulnerabilities and severe incidents have applied since September 11, 2026, the rest applies from December 11, 2027, and the fines run to €15 million or 2.5 percent of worldwide turnover (Wikipedia). For a software company that sells into Europe, that’s an AppSec program with a deadline, which is Phil’s point.
The EU AI Act, which Sasha mentioned, entered into force on August 1, 2024, with its provisions phasing in over six to 36 months and its rules sorted by four levels of risk (Wikipedia). Phil’s other European worry was the older one, the GDPR.
“Like, if you’re really meaningfully in that market, you need to think about that.”
Phil Howie, at 19:38
“But really, I think, you know, I think general principles-based resilience is just about universal, particularly for lots of the smaller side of things.”
Phil Howie, at 19:47
If Europe is on your roadmap, our AI EU Compliance Program covers the AI Act side.
Half US culture, half British
Jon asked what it’s like to found a company in New Zealand.
“I’m super curious, like, in New Zealand, is it, like, if you’re a founder in New Zealand, is it significantly different? Is there a different energy, a different vibe to starting a company, maybe, in New Zealand?”
Jon McLachlan, at 20:19
“And so I think we’re kind of like a weird mix of half US culture, half British, in some ways.”
Phil Howie, at 20:46
“I think New Zealand’s a very friendly place to start a company. It’s an amazing quality of life down here.”
Phil Howie, at 20:55
The scale is the difference he named.
“I think the scale of things is a little bit smaller than US.”
Phil Howie, at 21:10
But he said there are amazing startups everywhere now,
“happening in New Zealand, happening in Australia, happening in Asia, happening all around the world now.”
Phil Howie, at 21:25
And he credited the pandemic with flattening the map.
“People were raising money without even seeing people face to face. It was all happening over Zoom calls in different time zones and things like that, which is kind of amazing.”
Phil Howie, at 21:45
Silicon Valley is still the center he described, in Santa Clara County and southern San Mateo County (Wikipedia). Pushpay is the proof of his other point: a New Zealand company that built its business serving customers in the United States (Wikipedia). Phil closed by calling the US a model of how to do it well, and the scale and size of things there something to aspire to.
Without AI washing everything
Sasha asked what Phil would build if he were starting over.
“If you were to start a security or compliance company in 2025, what space would you tackle?”
Sasha Sinkevich, at 22:24
“I think AI is just huge, right?”
Phil Howie, at 22:31
He added the warning in the same breath.
“without AI washing everything, you know, it’s easy to get caught up in buzzwords”
Phil Howie, at 22:36
“And so at the moment, there’s a huge tidal wave of challenges and change around dealing with AI from a security point, from a resilience point of view. It’s an opportunity, it’s a threat, it’s everything.”
Phil Howie, at 22:55
“Not just slap a sticker on something and say, we’re doing AI, but actually solve real problems.”
Phil Howie, at 23:16
AI washing is a deceptive marketing tactic that overstates how much AI a product uses. The AI Now Institute at New York University first defined the term in 2019, it borrows its shape from greenwashing, and the US Securities and Exchange Commission has penalized companies for it (Wikipedia). Sasha had a joke ready about the keyword stack, small language models and crypto included, that would put a startup “in a really good position.” A small language model is a compact one, typically under forty billion parameters, small enough to run on a laptop (Wikipedia).
When it was Web 2.0
Phil has seen this wave before.
“Yeah, if you’ve been around in the technology industry long enough, there just comes waves of these things.”
Phil Howie, at 23:30
“And when it was Web 2.0, I don’t know if you guys remember that, it was kind of the same thing. Everything was Web 2.0.”
Phil Howie, at 23:35
“content mashups, there was user-generated content, all this sort of stuff, really cool stuff.”
Phil Howie, at 23:42
Darcy DiNucci coined Web 2.0 in 1999, and Tim O’Reilly and Dale Dougherty popularized it at the first Web 2.0 Conference in 2004, for websites built on user-generated content, ease of use and participation (Wikipedia). A mashup was a web app that combined content from more than one source into a single new service (Wikipedia). Some of it was great value, Phil said, and some of it wasn’t, and the job is the same now as then.
“but people have to keep their eyes open and separate what’s genuine and what is just marketing, essentially.”
Phil Howie, at 24:05
Sasha named the cost of getting it wrong.
“and it’s super easy to lose the trust with your audience, with your partners, with your prospects, with your customers. If you do too much of that washing, you lose the credibility.”
Sasha Sinkevich, at 24:11
You either deliver value or you don’t
Phil’s answer to the hype was short.
“I think ultimately it just comes out, like, you either deliver value or you don’t.”
Phil Howie, at 24:31
No amount of keywords will save you, he said.
“It might raise you a lot of money, but that creates a different sort of problem.”
Phil Howie, at 24:37
“I think you have to solve real problems for people.”
Phil Howie, at 24:40
“and to really focus on the customer and not just what you want to do.”
Phil Howie, at 24:48
It’s the same test we’d put to any security product, ours included. Does it solve a problem the customer actually has, and can they tell?
How do our listeners know that we’re human?
Jon asked his usual question about the hardest problem five years out, and widened it for Phil to design and to how people and computers interact.
“I think managing risk, managing fraud, managing the challenges that AI brings.”
Phil Howie, at 25:46
“You could probably recreate this podcast perfectly with digital avatars and voice generations that we’re talking about right now.”
Phil Howie, at 25:51
Jon was about to ask the same thing, how the listeners would know the hosts are human, and Phil’s answer was that they may not be able to.
“It may be imperceptible, right?”
Phil Howie, at 26:01
“So I think authenticity is a huge, a huge deal.”
Phil Howie, at 26:05
“I think trust is only becoming more and more important in terms of even just verifiable sources. So how do you know what to trust?”
Phil Howie, at 26:10
Sasha suggested a fix.
“And maybe we should add a human signature onto this podcast.”
Sasha Sinkevich, at 26:20
That isn’t far from what exists. The Coalition for Content Provenance and Authenticity, formed on February 22, 2021 by Adobe, Arm, the BBC, Intel, Microsoft and Truepic, writes the technical standard for attaching verifiable provenance to digital media (Wikipedia). Deepfakes, a portmanteau of deep learning and fake, are images, video or audio edited or generated with AI, and the term itself dates to a Reddit user in late 2017 (Wikipedia). Voice cloning is the audio version (Wikipedia). Jon took it one step further.
“the real interesting question is, like, are some people going to start opting to trust the AI more than the humans?”
Jon McLachlan, at 26:26
“I don’t know the questions there. Hopefully not. I don’t know.”
Phil Howie, at 26:34
“I don’t know either.”
Sasha Sinkevich, at 26:36
We’ve covered the authenticity problem from several sides: Ben Colman of Reality Defender on detecting deepfakes, Lorenzo Thione on the cloned voice that calls your family, and our argument that deepfake attacks keep working because we keep detecting instead of proving.
Less sci-fi than we think
Phil’s forecast was modest on purpose.
“I think the future will be less sci-fi than we think, but there’ll be some different challenges that we didn’t see coming as well.”
Phil Howie, at 26:39
“I don’t think we’ll have floating cars just yet in five years’ time.”
Phil Howie, at 26:45
He pointed at the people the industry forgets.
“They’re just trying to, like, figure out how to book a flight or, like, order their groceries”
Phil Howie, at 26:56
And he came back to the mission.
“I want to help people be resilient digitally, through cybersecurity, through privacy and whatever comes next, build a digitally resilient organization.”
Phil Howie, at 27:09
Jon tied it to values.
“I know those founders want to do the right thing.”
Jon McLachlan, at 27:51
“People care. They just don’t have the tools and the resources to do it well, and sometimes even their knowledge and experience.”
Phil Howie, at 27:54
“So it’s educational, and it’s effective and functional.”
Phil Howie, at 28:06
That’s the best one-line description of a small company’s security problem we’ve heard on the show. The intent is there. The missing pieces are time, tools and know-how, and all three can be bought or borrowed.
Built at runtime, not at code time
Then Phil explained what AI changes for a product like his.
“And I think what AI does is, at the risk of abusing this word too much in this podcast, what it does is allow us to really build an experience which is truly, truly dynamic.”
Phil Howie, at 28:09
“You know, it’s all built at kind of runtime.”
Phil Howie, at 28:19
“and really go through a really sophisticated level of assessment that’s all built at runtime. It’s not built at code time, which is kind of cool.”
Phil Howie, at 28:29
“And then develop out something that’s really specific for you, hyper-specific for your organization.”
Phil Howie, at 28:36
Code time is when a developer writes the questions into the product, the same for everyone. Runtime is when the product decides what to ask next based on what you’ve already answered. Two weeks after the episode aired, Sydekick Lite shipped that idea: it starts from the “Crown Jewels” a business wants to protect, and uses AI to turn them into “a clear, prioritised action plan, all written in plain language” (Sydekick).
Jon liked the tailoring.
“I love the customization aspect to it. I think that’s always an important piece.”
Jon McLachlan, at 28:56
“Exactly right. It’s not one size fits all.”
Phil Howie, at 29:11
“But ultimately, you need to do what’s right for your context and your budget and the sort of risks that you’re addressing and things like that.”
Phil Howie, at 29:17
Exclude a few, adhere to this
Phil’s complaint about frameworks is the flip side of tailoring.
“And this is part of the problem with frameworks”
Phil Howie, at 29:30
“exclude a few, adhere to this. Sometimes it doesn’t make any sense”
Phil Howie, at 29:39
He called it the best we’ve got for now, and he expects it to change.
“So it’d be really interesting to see how that space evolves, and even how regulation evolves.”
Phil Howie, at 29:48
“So one of the other things that kind of presents an opportunity for us is that regulation is changing around the world.”
Phil Howie, at 29:53
“It’s changing in New Zealand, it’s changing in the US”
Phil Howie, at 29:58
And in Australia and the EU, he added.
The frameworks are generic by design. ISO/IEC 27001’s requirements are written to be “applicable to all organizations, regardless of type, size or nature” (Wikipedia), which is exactly why they need a risk assessment to fit them to one company. Since the recording, New Zealand’s new privacy principle took effect in May 2026, and the EU’s Cyber Resilience Act started its reporting obligations in September 2026 (Privacy Commissioner, Wikipedia).
The million-dollar question
Sasha asked whether there can be too much regulation.
“Do you think there is a healthy balance between the volume and amount of regulations with actually what businesses need in order to be successful?”
Sasha Sinkevich, at 30:09
“Often, certain acts can add additional overhead that slows down innovation.”
Sasha Sinkevich, at 30:19
Phil called it the million-dollar question, and answered it.
“I think some is better than none.”
Phil Howie, at 30:32
“I think there’s some parts of the world which really, really are lacking it completely.”
Phil Howie, at 30:33
Regulation, he said, spurs activity and gets people making important changes they wouldn’t otherwise make. It’s a balance.
“Some of it’s good, some of it’s probably a bit over the top”
Phil Howie, at 30:55
And he counted his own part of the world among the places with too little.
“And so, you know, people don’t take it as seriously. That’s the reality we’re facing for thousands and thousands of businesses.”
Phil Howie, at 31:05
The numbers back him on the stakes. New Zealand’s National Cyber Security Centre reported NZ$7.8 million in losses from 1,369 incidents in the first quarter of 2025 alone, with scams and fraud, business email compromise and unauthorized money transfers among them, the most common (NCSC). Its 2025 threat report says it deals with about one incident a day that could cause national-level harm (NCSC).
Be more ambitious
Jon asked what Phil would tell his younger self.
“If you could go back in time and meet your younger self, would you take that opportunity? And if you would, would you have any advice for yourself?”
Jon McLachlan, at 31:12
“I think I would say, look, just be more ambitious and don’t take things quite as seriously.”
Phil Howie, at 31:21
“You know, it’s a long game, it’s a marathon.”
Phil Howie, at 31:27
“And you have to find a way to make it enjoyable”
Phil Howie, at 31:39
“So I would say basically be more ambitious, try more things, and don’t take it all too seriously. Take the important stuff seriously, but try to enjoy the journey, right?”
Phil Howie, at 31:45
“Well, it’s a journey, right? It’s not a destination.”
Jon McLachlan, at 31:59
Two problems in computer science
Jon closed with the question he asks founders: what would you pay for that doesn’t exist yet?
“Oh, gosh. I’m going to give you a silly answer.”
Phil Howie, at 32:52
“There are two problems in computer science, regular expressions and naming things.”
Phil Howie, at 32:56
“The amount of time we’ve lost to just naming things, naming product features, naming companies, it is unbelievable.”
Phil Howie, at 33:06
“And it’s still a really, really hard problem to solve.”
Phil Howie, at 33:13
It’s a twist on an old programmer’s joke. Martin Fowler’s version credits Phil Karlton: “There are only two hard things in Computer Science: cache invalidation and naming things,” and he lists the variants people have added since, off-by-one errors among them (Martin Fowler). Phil swapped in regular expressions, the pattern language for matching text (Wikipedia), and anyone who has written one will forgive him. The joke lands harder from a founder whose company has changed its name.
“No questions. There’s no follow-up.”
Jon McLachlan, at 33:20
“Hours lost to this problem.”
Phil Howie, at 33:23
“I feel like we’re 50% joking here, but I’m sure there’s someone out there that’s like, oh, yeah, I could build that.”
Jon McLachlan, at 33:42
After the tape
On December 17, 2025, Sydekick launched Sydekick Lite for micro and small businesses. The launch post says it starts from what a business wants to protect, focuses on scams, fraud, account compromise and privacy, uses AI to write a plan in plain language, and is designed to be delivered through trusted partners (Sydekick).
Built for Micro to Small companies, it throws out the jargon
Sydekick · December 17, 2025
In February 2026 the company asked IT providers and MSPs across New Zealand and Australia to become partners, the channel Phil described in We started really selling direct, and its February release notes announced a refreshed plan lineup and two new compliance frameworks (Sydekick).
The rules changed too. New Zealand’s IPP3A took effect on May 1, 2026, and the EU’s Cyber Resilience Act reporting obligations on September 11, 2026, with the rest of that act to follow on December 11, 2027 (Privacy Commissioner, Wikipedia).
And Phil has a new role. His LinkedIn lists him as director of product, enterprise, at Halter since November 2026, alongside his co-founder and CTO role at Sydekick (LinkedIn). Halter is a New Zealand agricultural technology company that makes solar-powered cattle collars and software for virtual fencing and pasture management (Wikipedia). Making a hard thing simple enough for the person in the field to use is still the job.
Did you catch it? A six-question quiz
Six questions from the episode. Each answer links the moment in the transcript.
Quiz · six questions
Did you catch it?
Pick an answer for each. The explanation shows once you choose.
-
Why is Sydekick spelled with a Y?
- It's Phil's initial
- A nod to the cybersecurity element
- The founders' favorite letter
b. "so we spell it with a Y as a little nod to the cybersecurity element of that." Transcript, 1:02.
-
Which channel has worked well for Sydekick lately?
- Paid search ads
- Conference booths
- Managed service providers and IT professionals
c. "is we've teamed up with supplier channels, so managed service providers, IT professionals, who really love what we do" Transcript, 10:22.
-
What does Phil call the companies he builds for?
- The Fortune five million
- The long tail
- The mid-market
a. "to the Fortune five million, as they're called" Transcript, 5:50.
-
How did Phil describe the years before Kendra Ross became his co-founder?
- A long engagement
- A three-year job interview
- A friendly merger
b. "What's great about Kendra is we kind of had a three-year job interview together, really." Transcript, 16:36.
-
What is compliance about, in Phil's words?
- Adhering to what someone else wants you to adhere to
- Getting a certificate on the wall
- Passing one audit a year
a. "Compliance is about adhering to what someone else wants you to adhere to" Transcript, 12:57.
-
What are the two problems in computer science, in Phil's version?
- Cache invalidation and naming things
- Off-by-one errors and naming things
- Regular expressions and naming things
c. "There are two problems in computer science, regular expressions and naming things." Transcript, 32:56.
Is your security doable yet?
Phil’s test for a security program is whether a small team can actually run it. Eight questions on whether yours can.
Scorecard · eight questions
Is your security doable yet?
Answer for how your company works today. If two answers fit, pick the lower one.
-
Does one named person own security, with time set aside for it?
- Nobody, or everybody
- Someone, on top of their real job
- Yes, with hours each week and a budget
"has that responsibility, hopefully, and they go looking for answers as well." See What are we doing about security?
-
Have you assessed your security and privacy in the last year and turned the gaps into tasks?
- Never assessed
- Assessed, but the findings sit in a document
- Yes, and the tasks have owners and dates
"And that creates an understanding, and it creates a problem for them that we can then fix and say, okay, well, here's your generated program." See Understanding you have a problem.
-
Could you answer a customer's security questionnaire this week from things you already have written down?
- We'd be writing it from scratch
- Some of it
- Most of it, from our policies and evidence
"People hate due diligence questions. You guys know all about this." See Steer away from just compliance.
-
Does your team have a short AI acceptable use policy that names what not to put into AI tools?
- No
- Informal guidance
- Yes, written, read and kept current
"It's like an acceptable use document." See Something we're all grappling with.
-
Is your IT provider or MSP part of your security plan, with named tasks?
- We don't have one, or security isn't in their scope
- They do some security, undocumented
- Yes, and we track what they own
"And what we found is also that people, even if you build a simple product and a platform for people to use, they still need a lot of help in any case." See We started really selling direct.
-
Are your policies written in plain language, with the acronyms spelled out?
- We copied a template full of jargon
- Some are readable
- Yes, a new hire could follow them
"And so I'm really careful to things like just not use them where I can, you know, explain things, write things out in full, because most people don't understand acronyms." See Never seen an industry with more acronyms.
-
Do you know which privacy laws apply to the customers you sell to?
- Not really
- For our home market
- Yes, for every market we sell into
"Like, if you're really meaningfully in that market, you need to think about that." See The Cyber Resilience Act is a big one.
-
Do you review the plan on a schedule and see progress over time?
- No
- When something goes wrong
- Yes, at least every quarter
"It's kind of one step at a time." See We have global ambitions.
You're at the management meeting Phil described. This month, name one owner, give them a few hours a week, and run a short assessment so the gaps become a list instead of a feeling.
The basics exist, but they live in people's heads. Write the policies in plain language, add an AI acceptable use page, and put your IT provider's security work on the same task list as yours.
Your program is doable and documented. Keep the review cadence, answer questionnaires from it instead of from scratch, and add a framework only when a customer or a regulator asks for one.
What do security questionnaires cost you?
Phil said people hate due diligence questions, and Jon said every business-to-business founder sees them. The calculator puts hours and dollars on yours. Every default here is our example, not a number from the tape. Put in your own.
Calculator
What do security questionnaires cost you?
Four numbers: questionnaires a year, hours each, what an hour of the people answering them costs, and the share you could answer from a written program.
12 questionnaires a year at 10 hours each is 120 hours, about 15.0 working days, and $14,400 at $120 an hour. If 60% of the answers come from a written program, that's 72 hours back.
Neither Phil nor Jon gave numbers for questionnaires on the tape. The 12 a year, the 10 hours, the $120 an hour and the 60% are our examples, not benchmarks. A working day here is eight hours.
From Pascal to Sydekick and after
Everything on this page sits on one timeline, from Pascal’s letter in 1657 to the rules arriving in 2027. Filter it by thread.
Timeline · 1657 to 2027
From Pascal to Sydekick and after
Filter by thread. Dates are from the public record except where marked as part of this show.
- A longer letter
Pascal's sixteenth Provincial Letter apologizes for its length, the line Jon quoted (Quote Investigator, on this show).
- The first Fortune 500
Fortune publishes its list of 500 of the largest US corporations by revenue (Wikipedia, on this show).
- Web 2.0, coined
Darcy DiNucci coins the term (Wikipedia, on this show).
- OWASP
Mark Curphey starts the Open Web Application Security Project, now the Open Worldwide Application Security Project (Wikipedia, on this show).
- Web designer
Phil starts designing and building websites (LinkedIn, on this show).
- The first Web 2.0 Conference
Tim O'Reilly and Dale Dougherty popularize the term (Wikipedia, on this show).
- Two hard things
Martin Fowler writes up Phil Karlton's joke about cache invalidation and naming things (Martin Fowler, on this show).
- Pushpay
Chris Heaslip and Eliot Crowther found the mobile giving company in New Zealand (Wikipedia, on this show).
- Employee number one
Phil joins Pushpay as its first employee, as engineer and product designer (LinkedIn, on this show).
- Unicorn
The venture capitalist Aileen Lee coins the term for startups valued at over US$1 billion (Wikipedia, on this show).
- Pushpay lists
On the New Zealand Stock Exchange, and on the Australian exchange in 2016 (Wikipedia, on this show).
- Head of product design
Phil builds Pushpay's design practice, through June 2018 (LinkedIn, on this show).
- The Essential Eight maturity model
The Australian Signals Directorate first publishes it (ASD, on this show).
- Whip Around
Phil leads product and engineering as CTO, into 2019 (LinkedIn, on this show).
- The GDPR applies
The EU's privacy regulation takes effect, two years after its adoption (Wikipedia, on this show).
- AI washing
The AI Now Institute first defines the term (Wikipedia, on this show).
- COVID reaches New Zealand
The country reports its first case (Wikipedia, on this show).
- Onwardly
Phil founds the company to help small businesses defend themselves affordably (Sydekick, on this show).
- New Zealand's Privacy Act 2020
It replaces the 1993 act and makes breach notification mandatory (Wikipedia, on this show).
- Onwardly launches
Phil thanks his advisor and investor Laura Bell of SafeStack (Sydekick, on this show).
- In Stuff
"New business plans to disrupt the cybersecurity market for SMEs" (Stuff, on this show).
- The C2PA
Adobe, Arm, the BBC, Intel, Microsoft and Truepic form the content provenance standards body (Wikipedia, on this show).
- Best Startup
Onwardly wins iSANZ's Best Startup award (Sydekick, on this show).
- $1 million seed
A round led by Kendra Ross of We Love Cyber, with Pushpay's founders among the backers (Sydekick, on this show).
- NIST SSDF 1.1
Special Publication 800-218, the Secure Software Development Framework (NIST, on this show).
- Privacy
Onwardly launches its privacy product in partnership with Simply Privacy (Sydekick, on this show).
- The partner program
Opens to managed security providers, consultants and agencies (Sydekick, on this show).
- Compliance versus resilience
Onwardly's post argues a compliant company isn't necessarily a resilient one (Sydekick, on this show).
- A co-founder
Kendra Ross joins as co-founder and CEO (Sydekick, on this show).
- The EU AI Act
Enters into force, with provisions phasing in over six to 36 months (Wikipedia, on this show).
- CTO
Phil moves from founder and CEO to co-founder and CTO (LinkedIn, on this show).
- The Cyber Resilience Act
Enters into force (Wikipedia, on this show).
- Vibe coding
Andrej Karpathy coins the term (Wikipedia, on this show).
- Onwardly becomes Sydekick
The new name, and Phil moves into the CTO role (Sydekick, on this show).
- NZ$7.8 million
New Zealand's National Cyber Security Centre reports first-quarter losses, mostly scams and fraud (NCSC, on this show).
- The recording
Jon and Sasha talk with Phil, a year after Kendra joined, by Phil's account (on this show).
- Episode 83 airs
On Podbean, Apple Podcasts and Spotify (Podbean, on this show).
- Sydekick Lite
For micro and small businesses, with an AI-built plan in plain language (Sydekick, on this show).
- A call for partners
To IT providers and MSPs across New Zealand and Australia (LinkedIn, on this show).
- IPP3A
New Zealand's new privacy principle for indirectly collected information takes effect (Privacy Commissioner, on this show).
- CRA reporting begins
Manufacturers must report actively exploited vulnerabilities and severe incidents (Wikipedia, on this show).
- Halter
Phil becomes director of product, enterprise, at the agricultural technology company (LinkedIn, on this show).
- The CRA applies in full
The rest of the act's provisions take effect (Wikipedia, on this show).
What to do this week
Five things, in the order the episode suggests.
- Find out where you stand. Take the scorecard with whoever owns security, then run a real assessment and turn every gap into a task with an owner.
- Write one page on AI. An acceptable use policy that names the approved tools and the data that never goes into them, starting with personal information. Our guide to shadow AI governance has a starting point.
- Ask your IT provider what they cover. If an MSP already looks after your laptops and accounts, put their security work on your task list, and ask what they’d need to do the rest.
- Price your questionnaires. Run the calculator, then answer the next questionnaire from your written program instead of from scratch.
- Get help with the parts you can’t staff. Our vCISO Services build and run the program, our Sales Support team answers the questionnaires and joins the security calls, our Shadow-AI Detection & Mitigation team finds the AI tools already in use, and you can book 15 minutes with us.