Actionable Protection Strategies for 2025 with Secureframe’s Shrav Mehta

This is Textron tv. Hey everyone, welcome back here to techron tv. We've got another interview for you to, to, uh, check out.

I want to introduce you all to Shrove Meta. Shrove is the founder and CEO of a company called Secure Frame. We're gonna find out all about them and talk a little bit today.

But first, let's say hello to Schwab Rave. How are you? Thank you, and welcome.

I'm doing well. Thanks for having me. Great.

It's great to have you on here, schwa. Before we get into Secure Frame and this shift to automation of federal compliance, we're gonna discuss, let's talk a little bit about you. You're the founder and CEO over at Secure Frame.

You know what they say, everyone has at least one startup in them. But what, what's been your, uh, give us an idea of your journey. Is this your first startup or first time your founding?

What, you know, what, tell us about you. Yeah, um, well, one, thanks for having me on the show. So, you know, first and foremost, I think of myself as an engineer and, you know, product person.

So when we started Secure Frame, our goal was to automate the tedious parts of the compliance process and have a more real time continuous view of your security. Um, so, you know, before Secure Frame, I worked for a number of different startups and, you know, each of them, we experienced these problems of having to get the security certifications and, you know, actually secured the business. Uh, so that eventually, of course, you know, led to me, uh, starting secure frame.

Very cool. Um, so, and, and this is a common kind of fact pattern, you see, right? You faced a problem in your own experience and said, look, I can't be the only one who's dealing with this.

There's gotta be other people who have the same problem. Let's fix it once and for all. Um, so that led you to Start Secure Frame.

Give us, give us, yeah, you don't have to give us a blow by blow, but give us, uh, the, the elevator story of, of, you know, how you came to found it and, and what you've been, you know, how long ago and what you've been doing up to this point with it. Yeah, totally. So, um, you, you know, before Secure Frame, you know, that's really where the, the journey started.

So I'll, I'll, I'll, I'll take it from there. Um, at a number of the startups I worked at before we had to get HIPAA compliant. We had to get SOC two compliant.

We had to get ISO 27,001. We had to get PCI, we had to get all sorts of certifications, and this was an extremely painful process. You know, back then most people didn't know what SOC two was.

They didn't know what was required to get compliant with these frameworks. It was a huge, you know, gray area. Uh, and if you ask the average person, you know, how much it might cost, it might cost, you know, somewhere like, you know, between a hundred and $200,000 a year, uh, to maintain and, you know, achieve these certifications in the first place.

And so, you know, after, you know, working with some of these companies, helping them achieve their certifications, we, you know, had built some scripts to automate some of the more tedious parts. You know, just coming from an engineering background, the first thing we're always thinking is how can we, you know, codify this? How can we automate this?

How can we make this, you know, much simpler process so that next time we're, we're not doing manual, repetitive, tedious work. And that's essentially how Secure Frame came to be. We turned a lot of those scripts, uh, into the first version of the product.

And, you know, back then, you know, this was a very, very time consuming process to get done. You know, on average you'd see people take a year to get their SOC two, and now I think we'd consider that crazy. You know, our average customer probably gets done in four to six weeks, and you can get done much quicker, um, if you're using automation than you ever have in the past.

Absolutely. And, and, you know, I let, let's be real, I would, I would guess that a majority of folks out here still haven't automated their compliance, right? They're still doing it the old fashioned way, manually, you know, task by task by task.

And, and it is a huge, I don't wanna say a drain or a waste 'cause it's not a waste being compliance, right? There's, there's benefits, all kinds of benefits to being compliant, but it's a huge man hour eater or people hour eater in terms of, of what goes on here. Um, so Secure Frame is automating this, is it a SaaS kind of offering?

Or, or how, how does that work? Like how do people engage with Secure Frame? Yeah, so Secure Frame's a software as a service offering.

Just like you mentioned. com, you can sign up, you can get a demo, um, if you are an MSP or a or channel partner with Secure Frame, we also give you, you know, free instances, a free gap assessment to work with your customers. So there's a lot of ways to, to work with Secure Frame.

Excellent. Alright. Shava, if it's okay, let's, let's shift over to our topic of discussion today, which is automation with federal comp compliance.

Um, and we're talking now about the FED IT departments being compliant, right? The, the, and I, one of the companies I helped found a security company, uh, 60% of our business was DOD and the agencies and stuff like that. So there's a, there's a whole slew jungle of compliance, information assurance and compliance regulations that federal IT systems have to comply with that don't necessarily apply to, you know, general public.

Um, and again, you wanna talk about manpowers Man hours, you know, spent on it. It's huge. But, you know, I, I think this started, if I'm going to guess this shift to automation with compliance, I'm gonna guess started like in the Obama administration or something like that, when that they brought on the first federal CIOs and they were, you know, trying to do this.

But give us an idea of this shift to automation within the Feds sphere. Yeah, so I think it's actually good to clarify, you know, what exactly does, you know, all this automation, you know, mean, right? So when continuous automation or continuous compliance was first brought up, you know, many, many years ago, what people were really thinking of as continuous compliance is these quarterly access reviews or, Hey, you know, quarterly we're going to check something, or monthly we're going to check something.

And the idea of continuous compliance that, you know, secure Frame has and that, you know, we hold is, you know, actual real time monitoring of all your controls, all your security. And this is all extremely, extremely feasible today. So, for example, you know, what Secure Frame does, um, is we integrate with all your core business systems.

So we'll integrate with your AWS, your Google Cloud, your GitHub, all the different, you know, systems that you use internally. And we'll sync with them in real time to verify what is the state of your compliance. So back in the day, what you would do is you would take screenshots of your AWS console, your AWS dashboard.

A lot of these auditors might use sampling methodologies. Um, so it's easy to miss something that, you know, might be a vulnerability or might be an issue that should be remediated. Now, when you're using a tool like Secure Frame, you know, in a split second, we can scan your entire account, um, on AWS, you know, any other business system you have connected, and make sure that all the settings, configurations are properly enabled for the certifications or frameworks that, you know, you're trying to attest against.

So this is kind of the view of continuous monitoring that we have today. And you know, what's exciting, I think here is that that's what, you know, the federal government is now trying to put in place for FedRAMP. Absolutely.

And, um, how far along are they with this for FedRAMP? Um, you know, I I, I think the words of Pete, the, the FedRAMP director, they're, they're not far along at all. Um, and, you know, for a good reason, uh, this is, you know, a bad thing or, or a knock on FedRAMP, in fact, I actually think it's an incredibly good thing.

Um, you know, the new FedRAMP director, Pete, you know, he, you know, he's on a mission to, to really make procurement for the government much simpler, much easier. And this is something everyone has been asking for, for a very long time. So a lot of the key changes that, you know, he's outlined, or the entire program has outlined is that FedRAMP is shifting to an automation driven compliance framework.

You know, the program won't dictate methods or set, you know, security standards specifically, but they actually want the industry to develop a solution. So the way you know, from my understanding this is actually going to be determined, is there's going to be, you know, a GitHub with discussions where, you know, industry leaders and players will, you know, work together to propose and finalize a standard. And essentially what the government is saying is, Hey, you know, we have a lot of smart people into the industry.

Let's let ha let's have them, you know, decide what is the appropriate format in a way that is most convenient, but also secure and safe to, you know, report on all this data continuously. So I think these are, you know, really big, but, you know, very welcome, you know, changes, uh, to the industry. Yep.

Now, you know, so I learned this when, yeah, as I mentioned, I had a startup, a security company that we, we did a lot of fed work. This isn't just a simple case of Oh, good, we complied with PCAI, so we could take credit card payments, right? There's national security implications.

When we talk about a lot of these systems that, you know, we're doing, we're, we're working on, um, s shab, if you can give us an idea of when we say national security implications, what we mean? Yeah. So a lot of the, you, you know, software, the things that are going through FedRAMP are used by, you know, all the three letter agencies out there.

So obviously, you know, if there's a piece of malware, a vulnerability, or you know, a vendor that hasn't been properly vetted, that's a huge risk, you know, for the government. And, you know, of course all of our citizens, you know, potentially national, um, international security implications. And I think you, you know, one of the first instincts that people, you know, sometimes have when they, you know, think about automation is like, oh my, oh my God, this isn't going to be as, you know, great as a human.

And I want to kind of correct that, you know, misconception. There are a lot of things that are extremely tedious, extremely manual. Imagine if you have an AWS account set up in several regions.

You, you know, I think AWS has like 200, 300 plus services. They're always adding new ones every week. You know, how do you audit that?

You know, there's actually a lot of risk auditing that with just a sampling methodology. And that that's not a knock on the methodology or anything. That's just more of a fact of, Hey, if you're just sampling a few things, there's going to be things that you miss and attackers are looking for that one out of, you know, you know, tens of thousands of S3 buckets you might have created that's open to the public when it wasn't meant to be.

They're looking for that, you know, vulnerability that gets found, you know, through, uh, that might get found through, you know, continuous monitoring, but wasn't caught in between, you know, annual, you know, audits and reviews that are done. And what I think is gonna happen is we're gonna see a lot more automation coming into the compliance space, and the humans will actually, you know, manage a lot of this automation. They'll focus in the higher leverage activities.

And that's what we've seen across the industry. You know, we've seen a lot more auditor roles open up, you know, we've, you know, at secure frame, we've hired, you know, probably over 50 former auditors, you know, to help our customers, um, you know, in their compliance journeys. So I actually think this is gonna be great for the industry.

Wages will go up. Um, I think that, you know, the industry is gonna get safer. Um, so there's a, there's, there's a lot of benefits here.

Yep. I mean, here's the crux of the issue though. And, and sha you know, as I mentioned, I've been in security almost 30 years.

As systems evolve, they don't get simpler, they get more complex. And we're at a point in time now where a lot of these systems, especially large systems like you would run into at A DOD or other federal, and, and it's not just DOD, there's a whole nother civilian side to the fed space, which is equally as large as these systems get so big and so complex, it really, it exceeds the grasp of men to be able to do these compliance checks in a, in a meaningful way, in a meaningful timeframe, right? And so if you don't automate these things, you might as well just throw the, you know, throw in your towel because you're done without automation, you're never gonna be able to actually test or, or, you know, show compliance with, with this level of, of complexity.

And that, and that's been driving, you know, I'm, I'm reminded, so back in the day when I was doing this, we had a NAC solution network access control, right? Mm-hmm. We were checking every laptop when it logged in to a DOD network that we helped, uh, work on.

Mm-hmm. And one day we got a call, and this is old now, so it's not classified anymore. It's all fine.

One day we get a call, can we put in a check to make sure that the USB ports are disabled? Could we do it? Yeah.

Not a hard thing to do. It's just another test that we run on a laptop. But why, why would you wanna disable the USB ports, right?

How are you gonna get stuff? They said, don't worry about it, just write the test. And we, we wrote the test, you know, it was a year or two later that you heard the stories of some foreign nationals, uh, you know, dump dumping USB thumb drives all over the Pentagon, parking lot people, silly again, the weakest link, right, is mm-hmm.

The person behind the keyboard, people picking up those u SB Things and they're putting their computers, right? Yeah. That's in our security screen now.

'cause probably that, that exact national National security ations Yep. The Chinese came out with a stealth fighter shortly thereafter, very closely based on, on what we were building at the time, right? So that's, that's where rubber meets the road here, right?

This is national security and automation is the only way you're going to get your arms around this. 'cause it's not gonna get simpler, right? We could try to simplify procurement and everything else, but the, you know, you start talking about AI and Quantum's on the horizon and all these other, you know, cloud and, and cloud native and everything else going on, distributed, sovereign data sovereignty, every, it's a complex world.

There's no, you know, there's no sugarcoating that we are living in complex, you know, technology is complex. We, automation is the only way to do this. Um, and I, I think that's what it is.

Go ahead. Yeah, no, I, i a hundred percent agree. Um, and it, it's kind of almost crazy that it's taken so long, you know, for us to get here.

But I'm, you know, very glad that we did. But again, like I was saying, you know, when you're scanning, you know, a huge, huge business, um, for, you know, all, you know, all their security configurations, you know, whether everything's encrypted, whether everything has logging, whether, you know, you have a proper employee onboarding and offboarding process or all these kind of, you know, security basics, there's a lot of things that can go, you know, easily missed. Um, and that's where, you know, automation, you know, has to come in and help.

Uh, there are so many new frameworks across security, privacy, um, that, you know, are coming out pretty much every day in every other country that, you know, companies are forced to comply with. And really the only way to, you know, comply with these is to use some sort of automation tool, um, that also consolidates, you know, all the work people are doing across the different frameworks, regulatory regimes that they're, that they need to attest to everything. Um, and so, you know, we're big fans of this.

I think this is gonna be really great for the industry. I think it's very important, you know, for the US government to have real time, you know, security, you know, dashboards and information on the software that they're trusting with all sorts of, you know, confidential C-U-I-F-U-I type data. Um, so, you know, I think this change is gonna be overall, you know, very good.

I bet we're gonna catch, you know, things that, you know, we never would have, you know, been able to in the past. Agreed. Alright.

Trav, unfortunately we're about outta time. com. If you want to get in touch, um, just, you know, book a demo on our site, um, you know, message us, you know, we're, we're, we're ready.

And of course, and I wanna emphasize this before we go. Automation in automation in the Fed compliance space is the only thing you, do, you do automation across a broad range of, of compliance mandates in, in private sector as well as public sector? Absolutely.

So today's secure frame, um, you know, has support, you know, out of the box for over 40 different frameworks. And, you know, we have a lot of people, you know, building their own custom flavors of frameworks and where we have a team that's, you know, dedicated to adding all the new ones that, you know, come up. com.

Excellent. Shove met our founder, CEO of Secure Frame here on Tech Strom tv. We're gonna take a break.

We'll be back in a bit.