Cybersecurity’s Role in Fintech with Airwallex’s Elliot Colquhoun

This is Textron tv. Hey guys, thanks for the throw. We're here with Elliot Cahoon is vice president of IT and security for Air Wallacks.

And we're talking about how well improvements in cybersecurity for all the worries that we have about this have actually gotten us to the point where we can do things we never imagined, let alone even three years ago. We're gonna talk about just what is the current state of cybersecurity. Elliot, welcome to show.

Yeah, thanks for having me. Every day we wake up to some brand new calamity, but at the other end of it, maybe people don't appreciate enough that we can actually conduct transactions around the world instantaneously. And a lot of that has to do with the current state of security.

What is your sense of what's real here and what's kind of more on the noise factor side of things? Just because well, it's criminal activity. Thanks.

So just before we dig in, a little bit of background about, uh, which I think will call framing conversation. So we're a global FinTech company. Uh, we're focused on building the future of financial tooling and infrastructure for businesses.

Uh, so what this means is replacing a lot of legacy financial systems, replacing applications, bank accounts, uh, and swapping them out was faster, uh, cheaper and better alternatives. And to do that, we obviously need to adopt modern technology. Historically, this has been, uh, you know, cloud-based and the big shift using cloud over the past five to 10 years.

Uh, and more recently ai, uh, but to do so without compromising bond security, uh, which is where we and my team come. And is it your sense that these transactions, are they more consumer transactions or are they more like business to business transactions or a bit of both? Yeah, so it's primarily business to business that we operate in.

Uh, and I think when we think about the, the news that we see about breaches and security incidents across, uh, the industry lately, uh, I think that we actually see a lot more noise than we do signal. Um, I think kind of wholesale, the general security level of businesses has definitely increased over the five, over the past five to 10 years, which I think is largely a mixture of culture and technology. And what's the cultural side of that?

Or people more confident? Is it the business execs are trying to drive, uh, globalization? I mean, what's behind this whole thing and what role is security playing in it?

That's a great question. I think on the cultural front, it's a mixture of, uh, security people understanding that need to be closer to the business and putting more effort into things like educating their users, framing security problems around the business challenges and how to increase revenue effectively. Uh, I think there's a lot more education of executives as well.

Uh, having more of a security focused presence on boards as an example is a great one. And I think also just generally, uh, as we continue to adopt technology wholesale, uh, you have newer generations who are a lot more focused on security and privacy and you look at the introduction of things like, uh, WhatsApp uptake globally and how they're very security and privacy focused app. I think you actually see a lot of that kind of security mi culture shift into the business as well.

Are these transactions occurring directly between businesses or are there banks are still involved 'cause historically we've been transferring money across some sort of network for decades. But, um, what fundamentally is changing, That's a great question for us, uh, we operate by having effectively integrations with a series of banking partners around the world, and then we're able to build like a separate financial infrastructure layer that exists on top of those. Um, so it's a very modern approach to being able to transfer money internationally across borders.

And when you have that kind of consistent infrastructure layer and you operate at the scale that we do, we're able to build much better global controls for the prevention of fraud, for securing those transactions and so on. Are these transactions happening in more real time these days? I can remember a time when you would do a transaction involving an overseas company somewhere and you would measure it in days and weeks.

Yeah, that's, that's exactly right. Uh, I think the overarching goal of anyone with this kind of ambitious, uh, slightly insane goal is to, uh, to make it as frictionless as possible. Uh, at the end of the day, I think ALO is ultimately a user experience company, right?

I think when you operate a business that's an inherently stressful, difficult thing to try and achieve. And to make that successful is very difficult. And so what we're trying to do is just remove the typical burden of the financial aspect of running a business, which means being able to play, pay your suppliers on time, being able to transfer money between your different entities instantly.

That's, that's the direction they're definitely heading in, Isn't it? Getting simpler to conduct business with different currencies. I mean, how instant can that get?

'cause for a long time, that was always a headache for people trying to figure out, you know, what currency are we gonna use to actually process this transaction? And then what am I gonna use to pay you and should I wait till Tuesday because the valuations will be different? Yeah, that's a great question.

I think, uh, it is obviously very dependent on where you are, where you're operating, what currencies you're trading in. Uh, as you can imagine, the finance or the FinTech industry is incredibly heavily regulated. When you think about a company like ols, we operate in many different countries and each of those have their own unique set of regulations that we need to comply with.

And so thinking about the other side of the coin, which is not how do we make it faster, but what are the things that actually slow these transactions down? It's typically things like, uh, your KYC processes to actually open an account, right? Like you think about going to a bank account with your passport and some bank statements and some incorporation details just to be able to set one up.

It's a very slow process, uh, when you're doing that across borders and other countries, it's even more difficult. And you also have things like transaction monitoring that you need to worry about and whether or not a particular transaction that you're making is triggering specific board controls or look suspicious. Is it your sense that the bad guys are getting a little smarter at this game?

They seem to be embracing ai and I imagine you're using ai. So is this starting to devolve into something that feels like an AI arms race? I think there's a huge amount of hype on ai, and I think we need to be pragmatic in how we think about it from our perspective, from a security perspective, we are trying to embrace AI as much as possible.

I think there's two key reasons for this. The first is that, uh, AI for us is a revolutionary change in how we actually solve problems, but it's built on top of the kind of core principles of how you build great products, how you build great engineering infrastructure, how you do security, and so on. Uh, and outside of, you know, the wider business value, there's a huge amount of value to us, uh, from security team and ai.

AI has been in security for a very long time. You look at, uh, machine learning for things like malware detection or for detecting phishing, and it's always had this, uh, stigma, I think rightfully so of being very inaccurate. Yeah, there's many ways you can prove this.

You can look at phishing detection across different languages and how it just kind of breaks down. But I think we're now at this, uh, incredible, uh, crossroads where as a security team, we need to figure out what are the high value use cases that we can adopt AI for that give us a huge amount of benefits and can actually help us like mitigate a lot of the risks. And I think the more we try and slow things down, get in the way of ai, uh, the more we slow down the business, the harder it is to be able to actually get in front of the, the risks that we're and benefit from the product and the technology ourselves.

This is a philosophical question, but do you think that the more transactions that we conduct across borders, the the happier we'll all be as a society because we all have vested interests in each other? Yeah, uh, that is a very question. Uh, definitely, definitely.

I think, I think reducing borders is like the consistent theme that we've seen over the past, I don't know, like hundreds of years of civilization, right? Like you look at the way that it's easy to or easier to move between countries, you look at a mass adoption of air travel and so on. And I think from a financial perspective, even from a technology perspective, we're now just continuously reducing those borders and operating one more globally.

Uh, I think that's very core to our mission as well. Is there something you look for in the attributes of somebody who has an IT or a security background that, um, you look for when you're looking to hire these folks? I mean is 'cause there's a lot of people to hire, you hear about skill shortages all the time, but I'm just curious, is there something you look for in these folks that's both their background but also the intangibles?

Yeah, I think that's a really great question. For us as a business, I think the most important things to us is that we find people who are really motivated by the mission of what we're trying to do. Uh, it is an incredibly complex and difficult domain to work in.

Our products suite is very complicated, uh, because of the fact that we operate at such a global scale and we have so many regulators and so on. And so what we look for is people who are deeply curious, who can dive deep into problems, understand the real root of the problem, uh, and then come up with ways to solve it. And we look for people that are most motivated by impact.

Uh, as you can imagine being an incredibly fast moving company like ours, there's a huge number of, uh, incredibly important projects to work on. And what we look for is someone who can see that list and go and pick out the most important ones and then go and figure out ways to solve them and drive impact not just for our business, but also for our customers. We have been talking about the divide between business and IT for decades now.

Do you think it's getting better in the age of FinTech? Do you think that business people understand it and security and vice versa, do the IT and security people have a better understanding of the business? I think what we're starting to see is a bridge of that gap, and I think it's increasingly important, uh, in the industry to close that gap.

Uh, as we talked about earlier with the kind of culture shift that we're seeing in security, having the wider business understand security is obviously really critical to security of, of your organization. But the flip side of this is also really important. You need your security team to really deeply understand your business.

And what this means is having your security team understand how do you actually make money, right? Like what are your revenue sources? What are the different products with the complexity of those, how are your customers using them?

What do your customers actually do each day when they're using your products? I think that deeper understanding of your business, understanding of your product, understanding of your customer base allows you to better identify and understand and prioritize the risk that you're typically dealing with. I think from an IT perspective, it has always done this a bit better than security, right?

We've seen over the past five years in particular this like really like laser focus on business partnership and taking ownership of business systems and trying to deliver IT excellence to other organizations. And I think that, uh, security is like now starting to mess up that. So what's your best advice to your fellow IT and cybersecurity professionals?

As you kinda look at the landscape, a lot of folks are, you know, pointing fingers at people and trying to hold more folks accountable and there's a lot of stress in the job to begin with. How do you get through it? Yeah, it's, it's a really tough question actually.

I think security is an inherently stressful job. Uh, you, uh, typically under, you know, more workloads than the typical person would like, you'll have your like on-call roster. Uh, and it's just a hard to make right?

Like you're trying to work with other people and effectively project manage other people you're not really responsible for, to be able to achieve some outcome. I think the most valuable things that I've done personally is talking to as many people outside of security as possible, talking to customers, talking to your product team, talking to salespeople, talking to marketing, building those relationships, and really deeply understanding the other aspects of the company and then being able to weave those into what we're working on. I think this is really valuable for two reasons for me.

The first is I think it's really interesting and it helps me actually understand and think about the bigger picture of the business. And the second is that it helps other people realize that the security team is not just there to say no to things or to do incident response and constantly reactively fight battles, but that there is a value add for their domain to help them achieve their, their objectives. All right folks, you heard it here.

One, we cannot move forward on this whole digital transformation of our world that we've been trying to drive for the last 10 years or so without the help of security. The downside is, well, it's a thin line between us and all the bad guys with people like Elliot, who's the only ones kind of protecting us from ourselves in some cases. Elliot, thanks for being on the show.

Awesome. So much. Thanks you guys in the studio.