11. Robert Rounsavall, Co-Founder of Trapezoid Inc., Firmware to Frontlines

Welcome to another show of the Security Podcast of Silicon Valley. I'm your host, John McLaughlin, and I'm here today with a very special guest, Robert Runcimball, the co-founder and president of Trapezoid Inc. , also the host of another podcast, Cynic Finic. So you should definitely go check out his podcast as well.

It's also on security. Hey, Robert, welcome to the show. Hey, John, I'm glad to be here today. Thanks for having me.

You have a lot of great experience here that goes all the way back. Looks like you've always been in security, at least in some form or another. And way back in the day, you were even part of the U. S.

Navy. So thank you for your service. Appreciate it. Absolutely.

But was there anything in your childhood that really connected you to security? Was there some part of that experience growing up that made you and connected you to security? Well, it's funny, you know, I don't know that my childhood, it was obviously influential. I was thinking about my childhood, my entry to security.

My entry to security was post-Navy, but in my childhood, what led me to kind of join the Navy and join the military is you think of a startup founder, you think of Navy and all this stuff. Maybe you think of confidence, abilities, and all that stuff. My childhood was more, really, I was a timid and scared and easily influenced kid who never followed through on anything. I get it.

I think you're describing almost every kid in the world there. I don't know. I never, you know, it was like I would almost start to do stuff and then not quite get there. You know, so I quit everything.

I ever started. I talked to my grandmother into buying me an $800 lawnmower for a lawn business and I was afraid to call on anyone. So really what led me to the Navy was to, I wanted to do something that would force myself not to quit. So I, if I joined the military, I'll have to stick it out at least four years.

And then I figured it would have a positive influence in my life. And in fact, it did. So that's odd. And I'm looking at your LinkedIn.

You were there for a little bit longer than four years. That's correct. So I did four years active and eight in the reserves. I was a military linguist, went out to California and Defense Language Institute and learned Spanish.

And then what's interesting is I worked in Texas, focused on the Southwest border. And my first job out of the Navy was doing support for our servers. So what ended up happening is my Spanish became 50% narcos and 50% geek speak. It was really terrible.

So I can troubleshoot your server with an accent of a drug dealer, but I can't talk about what is a knife and a fork and a spoon. I'm getting better though. Hey, I mean, if that's all you need, then that's all you need. Fit the bill, right?

More power to you. Who cares about the knife and the fork and the spoon? I mean, I guess unless you're going to Mexico on a beach and need something to eat your ceviche with. Right.

So that was when you were at Teramark? Yeah. So I went to the Navy. I got out.

My first job was doing the server troubleshooting. I had another job in between where I was a technical product manager for a remote access product. And what ended up happening was this product was PC Anywhere, remote desktop type thing way back when, but it had centralized authentication and it had some security features that gave us some big customers. Like I think UPS and Walmart were our biggest customers and some banks were using it.

And all of a sudden I'd be on these calls with security teams from different banks. And it started happening over and over. And it was like, it was at that point I was like, okay, I better start thinking about and getting smart on security. So that's really when I started focusing on security.

And then I was at that company for a few years. And one of my friends who I met through SANS training had recruited me into Teramark. He had been telling me for about a year to jump over there. And I eventually went and it was just, it was a phenomenal experience.

So for people who don't know about Teramark was a big data center down in Miami, 750, 000 square feet of servers. And we had a small security team that had this contract where We did incident response for some of the biggest companies in the world. Anything from classified data leakages to presidential campaigns to, you know, you name it. And the team, we probably worked between 80 and 120 data breach incidents a year.

And then I ended up, we acquired, Terremark acquired a company and I ended up building the security operations center there, handing that off. And then in 2011, I guess, Terremark was scooped up by Verizon. So now it's just part of Verizon, all of the data, the data. Yes, they acquired the data centers, they acquired this, and then I think they actually sold off the data center several years later.

But yeah, that was a big, and I was one, I was one notch down from where it was really meaningful, you know, so, you know, there was. . . That's an interesting comment.

What does it mean to be really meaningful in the. . . Well, well, you know, I didn't, I didn't really have any equity or anything.

There was, there was a lot of people who did really well on the, on that exit. So it, you know, wasn't life-changing or anything for me. And that ended up leading me to where I'm now at Trapezoid. So, which, which are new adventures, great adventures, which I'm sure you wouldn't have pursued unless you had that path before you.

So. Absolutely. Yeah. There's no way I would have been able to without, without that experience.

Yeah. It's one of those things, whenever someone asks me, you know, personally or as a mentor, hey, there's this opportunity. They're offering me more cash or they're offering me more equity. And I'm like, well, like if you can swing it, like I always advise to go for the equity.

How about one truth that you see in the world that most people end up missing? Wow. That's a, that's a big question. Yeah.

Yeah. No, that, that, that's a big question. And you've been in a startup. I've been in a startup.

You know, I think they're way different than what most people think, whether you're a startup founder. And you mentioned it, you mentioned it briefly just a second ago. You said, go for the equity if you can swing it. If you can swing it.

Yeah. And if you can, and I think that being in startup, it's like, it's, you know, people say it's like a marathon. I think more like an ultra marathon because there's in an ultra marathon, you'll have pain and suffering like five or six or seven times before you're done with the race. You know, in a marathon, you might have, you might hit the wall once in a startup or an ultra marathon, there's multiple walls.

And unless you've been inside having done it, you just, you know, when you're in a startup, you think, oh, everybody does this until you are talking to your friends who are either normal W2 wage earners or consultants. It's just, it's a little bit different from a pain threshold and pain tolerance, I would say. If you could swing it. Yeah, exactly.

That's, I understand completely what you mean, but help our listeners understand that why would anyone put themselves through that? Why would anyone run that ultra marathon, hit the wall multiple times? I don't know. You know, I may not.

People say, would you, you know, would you have done it? Would you have done it again? And I'm like, well, yes. And I will say, well, the next time I do a startup, I get to make all different mistakes than I've made this time.

Building something yourself or being part of building something with a team of people that is in your mind new or different or unique or solving a problem. There's just not a feeling like it. You know, there's, you know, it's different. It's fulfilling.

It's, it's challenging. It's you're stepping into an unknown area. Do I know if, you know, I can achieve this, if, if the team can achieve this? Yeah.

It's just a big, you're stepping out into a big unknown unless you've done it before or maybe been around it all your life. But that wasn't my case. This is my first one. Even if you've done it before, I imagine that the other ones that you'll do, they'll be different.

And so it's again, the unknown, you step into that unknown. You don't know if the market is going to react to the products like the way that you think it might, or like how your sales or your messaging is going to go or your marketing is going to be targeting the correct target market. All these questions. Or if you're early.

Or if you're too early. Yeah. You know, too late. Yeah.

By too late. And in our case, we were, we were years too early and that we're finally starting to get the traction that we thought we were going to get five years ago. So. Well, congratulations.

Traction is always good. Take it whenever it shows up and however, whatever form comes in. And I love the connection to the ultra marathon. So let's just be clear.

We're, are we mixing real world? Well, then, analogy here, have you actually run an ultra marathon? I've done some ultras. I'd say I'm a solid mid-pack ultra marathon.

I've done about 20 of them. I've done a couple hundred milers. And what's been a lot of fun is crewing or helping other people run ultra marathons. I've been lucky enough to help some people run some of the hardest races on the planet, like Badwater 135.

The Death Valley race. I've helped two people. I've crewed two people for Badwater. I've crewed someone for the Bigfoot 200.

And yeah, so I'd be, I love the, it's a small group of people that you kind of see the same folks over and over, the security or the startup community, you know. And they're all a little bit nuts, kind of like the startup community. And no, it's, and it's something that you, it's an un, a lot of times it's an unknown. The reason I started doing it is I didn't know if I could finish or not.

You know, that's, you know, I wanted to see if I could finish and see if I could successfully get it done. So. Well, congratulations. You're still here.

You didn't die. And, you know, there's not, there's no such thing as success without first a challenge. That sounds like a hell of a challenge. In both accounts, both like the startup world and the ultra marathon world.

I love the parallels though. You know, I've, myself, I've just started to get into running, like taking it a little bit more seriously now. Marathon end of last year, messed up my foot with plantar fasciitis. I don't know if I'm going to do bad water, but I'll, I'll definitely.

We'll have to, we'll have to figure out and meet up somewhere. Just for a destination ultra. Who have no idea what we're talking about here. Badwater is a, it's a hundred mile race down in Death Valley, which is the hottest place in the world.

It's also the largest national park in the lower 48. It's also the lowest point on planet earth. And it's surrounded by these two beautiful mountain ranges and it heats up to like what? 120, 130 degrees Fahrenheit in the summer.

Yeah. And that's when you run that race. Yeah. The race is in July.

And the last time I crewed it with my friend, it was one of the hottest on record. It was 2018 and it normally gets down into the high nineties at night, but it was still like 110 at night. It was pretty, pretty rough. You finished.

100. Oh, hey, finishing it. You're a winner. That's on my, that's on my bucket list.

I'd really, I'd like to do that race one day. I have something right next to my desk. I'm going to show it to you. This is for the listeners who can't see it.

The e-book, Scott Jurek. One of the guys who runs it. And it's also, as I understand it, a little bit of a health nut, which is spectacular. I mean, you got to be a little bit crazy to do a race like that.

You have to be a little bit crazy also to do startups. And everyone has their own form of crazy. But I think it's our differences that really make things interesting. You get together and you can share your points of view and everyone can bring their strengths to the table and do a little bit of learning from everyone else's strengths.

And it's just like an incredible experience. That's what I love about diverse teams too, is, you know, you get different people together and everyone is going to see the same problem a little bit differently. And someone is either going to learn something new about how the world works, or you're going to be able to see the world from someone else's perspective and sort of see it through their lens and through their values, where maybe the problem is not even a problem anymore. You know, like really incredible things start happening.

Right. I imagine that you get a lot of similar things when you get into the nitty-gritties of training for an ultra. Like, should you be plant-based? Should you eat a lot of protein?

Should you get meat? Should you eat, like, you know, all of these questions. Yeah, and it's kind of an individual thing. I mean, there's like Jurek, he has great success plant-based.

I know other people have great success and other people are like complete opposite end of the spectrum. They're hardcore carnivore and do great. It just, yeah, it really depends on what you kind of find that works for you. I'm somewhere in the middle in between the two.

But yeah, it's, you see both ends of the spectrum and a lot of folks do really amazing on the plant-based and are, as a matter of fact, my one of my good buddies who just got into software dev is a vegan and he's done Badwater and he's done the Appalachian Trail. All, all, he, and he maintained his, yeah, he maintained his plant-based diet for 2, 700 miles over the six months on the trail. So we're hot. That's incredible.

Great for him. Yeah. Awesome. So Trapezoid is, is your startup?

Yes, that is correct. What's the founding story there? How did that get going? So, it was not my idea to start a software development company at all.

I wanted to take the unique capabilities we built in the security operations center back at Terremark and apply them to other service providers. So we started out doing consulting and did great, made great money the first year or so doing consulting work. And then what happened was back when I was at Terremark, we had built some unique capabilities for our security operations center. We had done, we had the team who developed the volatility framework memory tools, worked for Terremark at the time, super smart, some of the best incident responders on the planet.

They're now, the company is called Vilexity now. They're just brilliant. And like I say, the best incident responders I'm aware of is that team. And they had developed the volatility memory tool.

And we put a lot of these capabilities on our cloud infrastructure as a service platform. So if you were a cloud customer, you could get, you could get your own memory. You could get your, torture logs, normal stuff, but you could also get full. And so what happened was we ended up, you know, Terremark sold, we jumped, we were doing consulting, but while I was still at Terremark, I was taking a couple of guys through the data center.

One was Alan Poller from SANS who recently, who recently passed and another security gentleman named Sean Carpenter. And I was showing them all the capabilities. And Alan said, you know, Robert, this is all really interesting, but what happens if you guys buy equipment and it arrives already compromised? And I was like, I don't know.

And he said, well, like if you throw away the hard drive and put in a new hard drive and it's still compromised. And I was like, I have no idea. That's a great question. So we started thinking about that, like, what can you do to deal with this problem?

And yeah, we started putting some procedures in place and whatnot, but that had kind of been swirling around in the back of my head for a couple of years. And we'd done some work with Intel Corporation and I called up a buddy at Intel. I said, look, we're a stupid little startup in Miami, but that hardware security stuff you guys were working on is pretty cool. I'd love to kick the tires on it again.

So like the next week, a stack of servers shows up on our doorstep and Michael, our CTO, wrote some code that took the hardware security capabilities from the Intel chipset that had recently released and fed them into McAfee ePolicy Orchestrator because he was familiar with it. This was right after Intel acquired McAfee. So we, needless to say, they got all excited because we were combining Intel's hardware technology with McAfee's security stuff. And they took us out to RSA and we showed our little proof of concept to a bunch of people.

And then the following week, they took us to the CIO of the Marine Corps to show the general. And I happened to know him because of an incident response gig that I previously worked. And at the end of the presentation, he said, what do I got to do to cut you a purchase order for this? And I said, well, sir, it's not a product.

It's just kind of something we're working on. Well, you didn't say like, oh, sign this, please, right here on the line. Yeah, I was a little naive at the time. And yeah, now I know that, you know, the right answer was, I'll get you a quote.

But the, yeah, so a few things like that happened and we felt like there was enough to start doing a red face test, a product that would pass the red face test of firmware, something to validate the integrity of firmware on a system. And that's how we shifted from consulting to software dev. And yeah, we've been kind of making that switch and developing. And now we have a platform that checks the integrity of firmware for systems.

Incredible. So help our listeners understand, what do you mean by the red face test? Well, developing something that is not just a cool science project capability, but something that you can look at and go, okay, there might be an actual product here. So, yes.

Nice. Nice expression just to capture all of that. Okay, so in your 10 years now at Trapezoid, what has been the best day of all of those days? Like an ultra marathon, you have little bursts and second and third winds here and there.

And there's been some good little, some good little wins. It's hard to pin like, oh my gosh, this is the banner best day. We've had some neat stuff happen from, you know, gaining some customer acceptance to getting a big project or raising a little bit of money or things like that. Those have all been wins.

It's, it's. A lot easier to think of the, you know, what have been some of the big problems or challenges. You know, it's interesting. You don't remember the people who encourage you.

You remember the people who poke at you a little bit along the way. But no, there's been a lot. There's been some nice little wins. I think recently we've had, we've had a couple of wins in the federal space and we're starting to get a couple of commercial wins.

So that's been really good. But those are hard to land too. It's like dedication and effort and planning and certifications and. .

. And yeah, certifications and contracting and all of that stuff. It takes, yeah. Okay, so what about the worst day that you've had in your entrepreneurial journey?

Again, like an ultra marathon. Being poked a couple of times, pretty good. Like an ultra marathon, you usually have several times when you think you're down and out. So, you know, I don't know that there's been a worst day.

You know, some of the, there's a couple of things that, like incidents or instances that come to mind where things have been hard, to give you a sense of startup. And it also comes to listening to your gut. You know, one of the worst days was we had a, this was a year or so into the company. We had a board member who suggested we bring on a new CEO that was going to help us raise money and all of this good stuff.

And it was, it was a big name CEO from a big company who was, you know, would supposedly be able to help us get to the other side, get a big valuation and all of that stuff. But there was something in my gut that was told me no, but I listened to the board member and the CEO ended up, after telling us they weren't going to take a salary, took a very large salary and for them and their crony, ran the company out of, out of cash down to zero and told the board we didn't have a, we didn't have a product. We didn't have anything. And this was, and then jumped ship and said, thank you.

Have a nice life. What I found out later was that that big company CEO eventually had charges pressed against them from a previous company for misappropriation of company funds, et cetera. So it was. .

. Wow. That's good. Yeah.

Yeah. It's tough when you get ran out of cash, you know, but then having them discredit us to our board was rough. We've, yeah, this was way early on. That board member must have been like an investor as well.

The board member was an investor. Yeah. They had put in a large stake. They had put in some money and I was like, what about this?

And they were like, well, sorry, it happens. Sorry, it happens. Sorry, it happens. It's weird because they have skin in the game too, right?

This is, yeah. They're coming. I mean, in some sense, like there's some percentage associated with that board member. So.

. . Yeah, it was interesting because, yeah, it was communicated to them that we didn't have anything. And, but we've got, you know, three patents later in the space and, you know, things work out well.

So that was a nice. . . Doesn't that feel good to like prove naysayers wrong?

Oh, you can't do that. You just, you hear that and you're like, no, like I can prove that wrong. Well, it really made me feel good because the, they damaged our credibility with the board and the people who had helped us get off the ground. That was tough.

And then a couple other things that happened with startups is in the running community, I was talking to some friends and they're like, oh, you're doing great. You're the, you know, founder of a startup. And I was like, oh my gosh, you have no idea. You have no idea.

It's, you know, on, I was, I went on a private plane to the Masters tournament one year. Someone, one of our partners took us there and I got home and my car was gone because it was repossessed because the company, you know, the company was out of cash and I wasn't taking it. It's just, it's interesting. Of course, they don't see that.

They just see you get off the private jet, like on your way back from wherever it was. Right. I was like, yeah, you're at the Masters. You're at the NBA games.

And it's like, wow. And you have to kind of play that hustle card and like, you can't really talk about, oh, your car's repossessed because the company, you're not paying yourself anything, you know, so. Yeah, it's interesting. So fortunately, we've been past that for a good while.

And yeah, this was, this has been about five years or so, but it was, it was tight. It was like, so it was so touch and go. And then you have the, your close friends are like, dude, you know, why are you doing this? You could be making great money at a, and it's just interesting.

So there's not a feeling like it. That's right. You know, and there's not a. .

. Experience like it. So, you know. You're never going to learn that much in a big company.

Like if you have all of that responsibility and you have to build something from zero to one, bring it into the world, share it with everybody, and then scale it out from one to N. Yeah, you're leading that. So you're a cog in a machine, like in a large company, and you play a very valuable role in a big company, but those startups, you see everything and you own it and you're responsible for it. Yeah, that's the thing.

The two words, I think what I wanted to be was I wanted to be responsible and accountable for the success or failure of the company. You did a complete 180 from all of the childhood stuff. I guess so. Yeah, I get the military training and the ultra marathon helps prep you a little bit for some of the stuff.

But there's nothing like it. I mean, if you, you know, and I can't help but go back to, you know, the thing you said was if you can, you know, always take equity, like if you can. And that's the thing. Yeah.

We all have different life situations. Right, right. What's important, what's important to you. So, but yeah, some of the.

. . I mean, it's not just important, right? Sometimes we have commitments or we have like loved ones or families and all sorts of like, or we just got out of school and there's a big pile of debt.

Yep. Whatever. Yeah. That and family takes a factor.

I mean, I've got, I've got three kids at the time. They were, you know, they were much younger, but it still, it's, it is a, that's a big consideration that either that deters some people. They think, oh, well, I'll do it, you know. I don't know if there is a best time or a right time or when, when to do it.

I always wanted to have my own thing, but the opportunity didn't present itself until it presented itself. Right. And then when it does present itself, you have an option. Yeah.

Well, you decide when you weigh it and, you know, it's life is a series of choices, right? Yes, sir. I guess like an ultra marathon. You just have to keep putting one foot in front of the other.

Just keep on doing that. That's, it's just a very serious commitment to continue doing that for a very long period of time. And then you're done with your ultra. You get your success.

Yep. So if you look into the future and you look into Trapezoid's future, like what does the success look like to you? We have some accounts that we're working on closing right now that will be good. There's some, there's a couple other companies that we're looking at.

It would be, it would be nice to do some small acquisitions here and there of some, some teams and some talent and things like that. But no, we're, we've had some good wins on the federal side, I guess in the next year or so, we're looking to get some more, a good commercial wins. And like I say, we're small wins here and there, just like from adding some new development horsepower is a great win. But, but no, there's some, I think there's some other companies and technologies we're, we're looking at.

So I, when you talk about technologies and partnerships, there's some, there's some agencies, but also some universities that are doing some really interesting research that we were looking at partnering with to hopefully take some of the technology that's being developed that right now, the only people that can use it are PhD data scientists, et cetera, and making it so that a, you know, E5 operator in the field or a SOC analyst can do what they need to do to validate the integrity of a system. So we're excited about that as well. No, that's awesome.

I love that you're aiming to bridge that gap between invention and innovation, the research going on in the universities and make it accessible for folks outside of that PhD, the expertise. It's very different to invent something new, but you know, when you're doing your PhD or you go very deep and you understand that problem space versus build a product that will actually help someone or improve the lives of people. I think of that latter as innovation as opposed to invention, which is like just conjuring it up. Conjuring.

To your point, there's a lot of really brilliant research out there going on. And I'm more, I've always been more of an ops, operations, operations person. And so it's like, how do we make this accessible is, that's more fun to me. Maybe because I'm not smart enough to invent stuff, but no, I like operationalizing stuff.

I love operationalizing stuff. That's, that's a, that's a lot of fun. It's a lot of, it's a lot of fun for me. So, and there, there's some really neat technologies that are in the firmware and hardware validation space that, that really bring a lot, but need that.

Well, Robert, thank you so much for joining the Security Podcast of Silicon Valley. It's been great to hear about your entrepreneurial journey there at Trapezoid. Would you like to share any parting thoughts or pearls of wisdom with our listeners? I would say if you have been thinking about doing a startup and it is something that's been eating at you for a long time, it's not always going to be there.

So I wish I would have started sooner than I did, but I'm glad I did. I would recommend, you know who you are because it's been eating you. You might be at a job and you're like looking for that opportunity, that gig. You need to step out and try it.

Yeah, you will be in for a unique journey and you'll know, you know, you'll know. You need to find out. That's my parting thoughts. Excellent.

I would echo the same sentiment myself. Just go for it. There's never going to be a perfect time to start a new company. There's so much risk involved.

And I plan on becoming an old man filled with no regrets. So same here. Taking risks is going to be part of that journey. So Robert, thank you so much again.

It's been an absolute pleasure. If anyone wants to look up your podcast, what's the best way to check it out? So my podcast is the Synack Finack podcast, and I interview security professionals about how they got to where they're going, what it takes to get ahead in the cybersecurity industry. I had some really great folks on there, some senior data scientists from NVIDIA, very senior security folks from commercial and DOD.

So check it out. It is Synack Finack podcast, and you can find it on Spotify or wherever you listen to your podcast. Wherever you listen to your podcast, wherever you're listening to this podcast, just search for Synack Finack. I listened to a few episodes.

They're spectacular. So thank you so much, Robert. Hey, thank you, John. We'll catch you soon.