Cyber Shields Up: Dan Candee on Reinventing Cyber Insurance for Small Business

Hey, everyone. Welcome back here to Techstrong tv. We've got another interview coming at you in this segment, I want to introduce you to Dan Candee.

Dan is the CEO of a company called Cork Protection. Dan, welcome to Tech Drunk tv. Thanks for coming on today.

Thanks for having me today, Alan. Ah, it's our pleasure to have you on. So, Dan, we're gonna talk about Cork, but before we do, let's talk Dan.

Yeah. Tell us a little bit about your journey. Yeah, you bet.

Uh, perhaps just, uh, like any other college dropout, uh, a guy trying to figure out, uh, uh, how to do things in life and, um, been fortunate enough to have some great mentorships, some interesting education, and, uh, be an insatiably curious person along the way. Um, so yeah, uh, you know, I, I had originally dropped going to college on the East coast and, and I'm a Colorado boy, but, uh, I ended up, uh, uh, deciding it was time to, uh, start a house painting company so I could save a couple bucks and start traveling the world a little bit more. I had been living overseas and studying abroad, and, um, uh, had a lot of, learned a lot about customer satisfaction and, uh, how to manage employees through that very first, uh, that first experience in my twenties eventually sold that, which helped me, uh, afford going back to college and finishing the degree and going back and doing some international business stuff.

But I always was involved in startups and building businesses and early stage companies and, um, and technology and, you know, that's kind of the, the sweet spot for me. Uh, uh, eventually sold a couple of businesses as well, but, uh, got recruited Good for you to EMC and right around the time that Dell was buying, uh, EMC. Sure.

I remember it. Yeah, the, you know, strong software background. I got to help lead some of the VMware, uh, side of that, that, uh, experience.

And that was really fun. Uh, helped grow that to just under a billion dollars, uh, in a couple of years. And then, uh, got recruited to AWS and got to build the VMware cloud and AWS for Andy Jassy and, and Pat Gelsinger and, uh, did the enterprise, uh, side of things for, uh, a little over four years.

And again, you know, that was during COVID and what a wild experience to help, uh, you know, the world move to cloud or hybrid cloud, whatever the world needed to do, uh, in order Digital transformation. Yeah, you nailed it. Um, and, and when my tour of duty was up, uh, from Amazon, I couldn't wait to get back to, to, you know, small and mid-sized business and really be focused on managed service providers and it, which is where, uh, all of my early career had been and where my heart is.

My parents own a restaurant. My brother's a police officer. My sister runs nursing facilities, and so Wow.

That's great. Yeah, the thing, salt to the earth, right, man. Yeah.

This is what we do every day. Right. I, similar, similar story here.

Are you still out in Colorado? I am, yep. I've got, uh, an amazing wife, uh, of just over a decade.

And then my 7-year-old son Luca and my 9-year-old daughter. Good for you. We live out in the country, uh, just a few minutes outside of Boulder.

And then of course you don't running a run into business these days, it means a lot of time, uh, on airplanes on the road, wherever our partners and customers are and, and just being of service, right. Because it's always these days it's about listening. Yes, we have ai, yes, we have lots of technology, but there's nothing more important than sitting down, um, and, and listening to people and asking questions and understanding how we can be of value to one another.

Absolutely. Excellent, man. I spent some time out in Boulder myself.

One of the companies I co-founded was based out there. I have a good friend Brad felt who kinda really helped the whole Boulder scene happen. Of course, Brad, Brad is a force to be reckoned with, and, uh, you know, Yeah, he still is.

Yeah. I sold my very first company to Brad about 30 years ago. Oh my gosh.

And, um, worked every venture backed company I did after that were always either Mobius or Foundry, you know, they were, Brad companies was there when they were starting Techstars, so Yeah. Similar story. Yeah.

Um, His, his office is about 15 minutes west, uh, or you know, of my, my old Air Street. Yeah. I, I have out here.

Yeah. So, well, Brad spends a lot of his time out in, he has a place out near Aspen now, or in Aspen, and actually I haven't seen Brad in a couple years. I, I own a trip out there, but anyway, we'll talk about Colorado all day.

We, but we're here to talk about cork protection. How long, you know, how, when did you become CEO of Cork protection? Yeah, you bet.

Cork's legacy story, uh, is a little over two and a half, about two and a half years ago, uh, maybe three years ago with Austin McCord as one of the co-founders, Austin, of course, of Datto fame. Uh, and Austin is insanely passionate about managed service providers and how, uh, you know, collectively we work to support, uh, small and medium sized business. And he saw along with John McNeil from, uh, DVX, and John McNeil is another, uh, incredible business person, uh, in very compassionate business leader.

Uh, uh, they saw this opportunity to, uh, to really think about where cyber insurance was falling short for SMB and how MSPs in particular were trying to be of, of service in that market. And by falling short, meaning, um, not that a lot of those products were not designed for SMB, and I saw the same thing, uh, at, at AWS right, where I was, uh, although I had an SMB business, it wasn't as large as a lot of my enterprise customers where we were doing, you know, incredibly large deals with some of the biggest, uh, banks and financial, various financial institutions and healthcare institutions and manufacturing worldwide. Um, and a lot of the cyber insurance and financial protection things were designed for the biggest, not the smallest medium size.

And, and, and I didn't want it when I left a WSI didn't, I didn't want to do that anymore. It's just like there's this gap. And so that's where Austin and I are very aligned in the purpose of Cork.

Cork is a cyber risk platform that, that understands exactly all the open windows and doors of where the threat actors can get in. And we do that by working with an a managed service provider's existing stack, API agent list, right? In less than an hour, less than time it takes to order a need a pizza, as we like to say, we're fully integrated and we can make the MSP that much smarter with all of our compliance, monitoring, compliance insights, and we can create incredible efficiency and security within the first day.

Right. But the interesting piece of all of it, and we're the only company in the world doing this, is we tie it into cyber warranty and cyber insurance. We believe that just understanding risk is okay, but what is phenomenally important in this next, in the next decade of our lives and are running businesses, is being able to write checks to have money in the bank account when things go wrong.

And that's the only way that s and b is gonna stay in business. The average s and b only has 18 days of cash flow on hand. And so that's where our cork solutions, our cork warranty, et cetera, puts, you know, writes checks.

So I've got an SLA within an hour, I'm handing over a $10,000 virtual credit card just, just to spend, like, wherever you need to go, just go. And within another SLA 14 days reimbursement, that's for like a CH wire transfer fraud. I've got a number of these different situations.

We real use cases we could talk about where, you know, 20, $30,000 of, uh, of money is going out the bank, uh, that shouldn't have because, and but You know what? That, that could be fatal for SMBs, that kinda money It is, yeah. And that, and that's, and honestly, that's the world we're living in where enterprise is so well protected because they have the bank accounts, they have the deep bench of cybersecurity expertise, and they have incredible cyber insurance policies, and then cash in the bank to be able to deal with the short term hits.

That in many ways, the threat actors are going, all right, this is pretty tough. Where is it easier? And that's where they're looking And they always, yeah, they look for the lowest hanging fruit man.

Yep. That's, that's the mo there. And that, you know, Dan, I, I, I've been in security 25, 30 years.

I have an interesting take on cyber insurance. When I first really got into InfoSec, there was only, I mean, the only company that was writing cyber was Aon. If you, I don't know how long you remember, he goes back on this, but Aon was the only one, then it started becoming a thing, but I would say maybe five years ago, four years ago, during COVID, perhaps I saw an interesting thing happen.

The cyber insurance companies became sort of the police officers, the enforcement agents of good cyber hygiene and resilience, right? Because as you mentioned, without insurance, a lot of these companies are dead in the water, you know, without some sort of coverage. And the cyber insurance people were in a fantastic place to say, Hey, we'll give you coverage, but, you know, let's do something about managing the risk here.

Right? You know, and so I am not getting political or anything, but where we didn't have the political will to have enforcement on certain compliance and best practices around cyber, the cyber insurance industry became the, the enforcers of, of best practices. Well, if you think back to being a third grader, right?

You're learning how to do a math equation. Your teacher says to you, show me your work. Right?

Right. And in a way, if I'm being generous to the insurance companies, they're saying to s and p and to managed service providers, show me your work, prove that everything was taken care of at the time of the incident. That burden has been very difficult in a way, because a lot of the technology and a lot of the compliance monitoring in in the systems haven't been set up for the proof and just needing to demonstrate the proof to insurancers companies.

It's been about protecting the castle, right? It's been about providing the answer to the teacher Here, I, I got the answer right, or I'm really trying to learn how to get the answer in part because the threat actors are so damn good and they just keep getting better. And so that's where Cork and a number of other really good companies are leveraging the same tools and better tools than some of the threat actors to actually simplify the show your work concept, which may, which means we're working hand in hand with the insurance companies to go, Hey, we're doing our part.

Which means that when there is a scenario, Mr. And Mrs. Insurance Company, you gotta pay out.

Like we actually have the tooling to enforce payouts and to, and for the first time ever, we've got the leverage to assist company companies and making sure that insurance companies pay out. And in the meantime, I'm not gonna wait around, right? Insurance companies typically pay four to six months after an incident.

Cork said, you know, there's an opportunity in the market for, for doing good in the market, but there's also a business opportunity where, which is where the best businesses exist when there's a triple win, right? There's a win for the end user client, there's a win for the managed service provider. There's a win for cork, which is let's do something immediately, let's be of service to one another right now within the first few minutes.

And that's how we're creating a, a better environment for all of us. And I'll tell you something, I'm not throwing stones. I wish every cyber insurance carrier had that attitude though, right?

I I, I have friends, I have a friend right now who's going through this. Its companies more in the, let's call it a small medium enterprise than small medium business. But they suffered, uh, I mean, it was a phishing attempt that cost them in the, you know, high six figures and their cyber insurance carriers trying to return it from a phishing attempt into an improper invoicing thing.

And it really makes you sick. 'cause you pay your premium, you think you're protected. I see you getting sick from it.

Yeah. Well, look, I'm, I'm not an insurance company. I don't sell cyber.

No. I, I really, you know what I mean? You Like, it makes me sick too.

And yeah. And that's where, you know, that's where data matters. So we all have to have the source of truth in our life personally and within our communities and professionally, the data matters, right?

My entire framework for success is that it's been an output of love plus performance. That performance piece is the data, right? That love piece is the integrity, it's the accountability.

What else are we gonna do on top of the data? And that's when us as humans are making intentional choices to do business with people we know we'll be there when things get tough, right? Yep.

Because we all got choices on how we spend our money or spend our time, right? Alan? Absolutely.

AB and who and who you wanna spend it with, right? And companies, you wanna do business, and I, you know, I preach this, I I say to the kids, you get to be a certain age, right? But I preach this to the people in my company, right?

You, if you're gonna go to war, you want someone you could trust in that foxhole with you. And if you don't think today's cyber climate with the bad guys using things like AI and all of these other things are, are, you're not in a war. You're kidding yourself, right?

And, and so pick your allies, pick your friends, pick your, you know, your, your war fighters with you. Yeah. I, I couldn't agree with you enough.

I'll give you a quick example, real life example if that's okay. Um, we have a great managed service provider. This one happens to be out of Canada.

Uh, they're, they're called Plexus. They've been in business for over 20 years, and they're a cork partner. They, uh, they not only use our risk insight platform, but they also provide the cork warranty to their partners.

One of the three top, uh, top sectors industries that are being hit that I'm seeing over the last 12 months is construction services. Okay? Construction services is prime, prime target for these sub $100,000 attacks, primarily a CH wire transfer fraud through business email compromise.

There's some ransomware as well, right? The reason is because of invoices and cash flow, and in these construction businesses, everybody's paying one another. You gotta pay, you know, concrete bills, you gotta pay architecture bills, you gotta pay steel bills and on and on and on, right?

Well, in, in this case, uh, the architecture firm that serviced the construction client, our, our client got infiltrated and they, and they just sat through business email compromise for about three months, and they learned who was gonna receive the invoices in the construction company. And then they sent the three emails needed to, the construction company used the real invoice for that month and said, Hey, this month is $21,000. Uh, but we did have to change banks, ironically, because there was a, uh, an in cyber incident, here's the new a CH, please send it, uh, on over.

And despite great things from our friend at, uh, our, our managed service provider, uh, including Sentinel One for endpoint protection, ninja for remote monitoring, Microsoft email, datto for business to cover discovery and like, you know, real security awareness training that had been done despite these things. Construction company just didn't pick up the phone to verify the a CH transfer, so the funds went out, right? Like, that's the world we're living in.

Where not only is the threat actor using time and research, but also the tools, right? Those smart tools in order to get around some of these things. And so if people are not thinking about cyber insurance, cyber warranty, right?

And compliance monitoring as a way to have that next layer of protection, then it's not if, but when, right? And we're all on a journey, but over the next five, 10 years, these things are gonna become more and more common. Does that, does that story make sense, Ellen?

It's like I said, Dan, we're at war. Except if you don't know you're at war, but the other side does, you're at an extreme disadvantage, right? And, and that story you just made is exactly the story I was telling you about my friend, except that was to the tune of 800 plus thousand dollars.

Oh, That's, that's end of, that's end of days for people's careers and for, for businesses. Isn't it Crazy? It's crazy.

Anyway, Dan, we're, we're in low on time. For people who wanna find out more about Cork protection, what's the website? Yvette?

com. com. Uh, we're also constantly doing, taking an education based approach.

Uh, what is ours is yours. So where we can be of service, uh, we try to be, uh, we, we have recently released something called the Cyber Insurance Analyzer, which is a free tool where people can put their cyber insurance policies in there. And we're able to provide a summary analysis of it.

We, um, on the backend of our tooling, we have connections with companies like Datastream and Yukon so that people can access cyber insurance and risk, uh, risk, uh, insurance platforms such as that. Um, and then, uh, we make sure that our team is always, uh, well educated in being able to, uh, provide answers. And if, if I can ever be of service to you or anybody in your community, please let me know.

It's, it's about the love, uh, even more than the performance, honestly, in this world that we're living in. Dan Candee, thanks for being on Text Strong TV and thanks for what you're doing, man. It's good work.

Pleasure to say hello to Alan. I hope you have a wonderful and safe afternoon. You as well, Dan Candee Cork Protection here.

com. Check 'em out. We're gonna take a break on text Strong.

We'll be back in a moment.