8 Apr 2025 · 50m · Lukas Biewald, Christopher Ahlberg · 24 quoted facts
Christopher Ahlberg argues that the internet has become a sensor for the whole world, and that an intelligence company can turn it into useful warnings. Recorded Future collects data from criminal forums, Telegram and the open web, and uses machine learning to extract facts and now generative AI to write analyst-style reports. He says the world is starting to follow the internet instead of just reflecting it.
The episode moves from a vivid cybercrime story to a founder's lessons. Ahlberg describes buying stolen access to a US election agency, then explains how Spotfire's sale funded a bigger bet on web-scale intelligence. A tension runs through it: AI helps defenders and attackers alike, and being useful in this field makes the company a target, including a Russian 'undesirable' designation, before the Mastercard deal.
Ahlberg describes separate criminal roles: people who break in, people who sell access, ransomware operators who franchise their software, and money mules who handle the Bitcoin. Because each group needs a marketplace, they leave data trails that an intelligence firm can monitor.
Ahlberg says much of the underground has moved from old forums to Telegram. It has weaker encryption and a central server compared with Signal, and many cyber criminals and traffickers gather there, so there is a lot to collect.
Early extractors were stacks of if-then rules, and they are now language models that work across many languages. Ahlberg says they can now draft weekly reports on second-order effects of an event, in Arabic if needed.
Ahlberg credits Recorded Future's success partly to picking a bigger problem than Spotfire's, and to the 10-15 year surge in cybersecurity spending. He also says a board member's advice to kill a distracting quant-trading track freed the company to focus.
Ahlberg expects malware that moves through networks automatically, which humans alone can't counter. He quotes Rob Joyce that defenders must know their network better than attackers, and says a crawler plus AI may beat most IT teams at that.
It is a threat intelligence company: it collects data from the internet, including criminal forums and Telegram, and uses AI to turn it into alerts and reports for about 2,000 customers. Ahlberg calls it 'the Bloomberg for intelligence'.
Ahlberg says that around 2016 a hacker broke into the Electoral Assistance Commission using a SQL injection (a common database attack) and advertised the access for sale on a dark web forum. Recorded Future found the ad first, bought the access, and told the government.
Ahlberg says Telegram is simply where many people, including a certain class of criminals, now gather, especially in the Russian-speaking world. He adds that it has a centralized server and weaker encryption than Signal, which makes it a good source of data.
Ahlberg says it's too early to say who wins. Right now attackers mostly use AI for better phishing emails in many languages, but he expects self-spreading attack software soon, which defenders will have to fight with automated AI analysis.
Ahlberg says Mastercard wanted to expand its cyber and intelligence services, and that financial data helps trace criminals. For example, knowing whether a stolen card has been used reveals the supply chain behind it. Mastercard agreed to pay $2.65 billion, and the company keeps operating standalone.
Stated by the speakers. Each quote matches the transcript, which shows what was said, not that it is true.
Christopher Ahlberg says a hacker broke into the US Electoral Assistance Commission using a SQL injection and extracted information.
“some guy there had broken into this thing called, uh, Electoral Assistance Commission, EAC, and and, uh, he had hacked it in good ways using a SQL inject, extracted a whole bunch of information”
Ahlberg says Recorded Future found a hacker's advertisement for access to the Electoral Assistance Commission and bought the access before anyone else did.
“we found it before somebody else and and actually bought the access, crazily enough”
Ahlberg says ransomware operators write the software and franchise its use to other criminal actors in return for a share of the proceeds.
“There's guys who write and operate ransomware software. They then franchise out out the use of this ransomware software to other actors”
Ahlberg says some Russian-language criminal forums, such as Maza and Exploit, were created in the early 2000s and some still exist.
“some of these forums were put up the in the early 2000s, Maza and exploit.”
Lukas Biewald says Christopher Ahlberg founded Spotfire around 1996 and sold it 11 years later.
“you founded Spotfire back in, I think, 1996, and and sold it, um, 11 years later”
Ahlberg says Spotfire was sold to a Palo Alto company, transcribed as Tipco, which is TIBCO.
“So then we we had sold that to a company in Palo Alto called Tipco.”
Ahlberg says Spotfire was sold for $195 million.
“We sold that for $195 million, you know, nothing to sneeze at”
Ahlberg says the idea for Recorded Future came to him while running on a treadmill, after Spotfire's sale was signed but before it closed.
“I was like I was on the treadmill running and and, uh, uh, literally, uh, while we we had signed the deal to sell Spotfire, but we hadn't closed yet.”
Ahlberg says the company was first going to be called Recorded Time, a Macbeth reference, but the domain name was taken, so it became Recorded Future.
“Then, of course, the domain name recorded time was taken, and it became recorded future”
Ahlberg says Recorded Future took early venture funding from In-Q-Tel and Google Ventures around 2008-2009.
“ended up taking money from Incutel and Google Ventures back in 2008, 9 or something like that”
Ahlberg says Recorded Future ran an intelligence business and a quant trading signals business in parallel for several years before a Series C investor urged it to kill the trading track.
“for multiple years ran an intelligence track and a quant trading track to to create quant trading signals”
Ahlberg says Recorded Future's first entity and event extractors were written as large stacks of if-then-else rules.
“We wrote our first entity extractors and event extractors with, like, lots of if then elses just stacks of if then else statements”
Ahlberg says Recorded Future replaced per-language entity extractors with one model that spans roughly 15 to 30 languages.
“Now that that is one coherent model that sort of spans, I don't know, 15, 30 languages”
Ahlberg says about 47 countries use Recorded Future in some national capability.
“we have probably 47 different countries around the world that use us in in some sort of, uh, national capability”
Ahlberg says that after Russia's invasion Recorded Future provided its technology to Ukraine, which was already a customer.
“when the invasion happened, we did not approve of that. So we said, let let's help out, and, um, we provided our technology”
Ahlberg says Recorded Future chose not to have customers in China, Russia, Iran and North Korea.
“chose to not have customers in China and Russia and and and, e- Iran and North Korea”
Ahlberg says Recorded Future has about 2,000 customers and that each goes through a know-your-customer check.
“our stuff is fairly expensive, so we only have 2,000 customers”
Ahlberg says cyber attacks were concentrated in English-speaking countries partly because phishing emails were easiest to write in English, and AI removes that limit.
“there was a reason most cyber attacks happened in English-speaking countries for a long time, because writing the phishing emails was easiest to do in English”
Ahlberg cites Rob Joyce, a former head of cyber defense at the US National Security Agency, who said defenders must know their network better than the attacker.
“there's a guy Rob Joyce, who's in who's a terrific man who used to run cyber defense for the US government at NSA.”
Ahlberg says Telegram's founder first built VK, the Russian social network, before starting Telegram.
“he built VK first, sort of the the Russian Facebook.”
Ahlberg says Telegram has a centralized server and does not use end-to-end encryption in the same way Signal does.
“does have sort of a centralized place to be. It has encryption that is not at the same way of end-to-end encryption as of Signal and others do.”
Ahlberg says the General Prosecutor of the Russian Federation issued a statement declaring Recorded Future an 'undesirable' enemy of the state.
“the General Prosecutor of the Russian Federation put out a statement around why Recorded Future is an enemy of the state.”
Lukas Biewald says Recorded Future announced it was being acquired by Mastercard for $2.65 billion.
“you announced that, uh, you you were getting acquired by by Mastercard for $2.65 billion”
Ahlberg says Mastercard's payments data could reveal whether stolen credit cards were used, which would help trace the criminal supply chain behind them.
“we get our hands on a stolen credit card, it would be awfully interesting to know whether that card has been used or not”
Ahlberg explains Recorded Future's core idea: collect everything bad happening online and turn it into insight. This frames the rest of the conversation.
“the world is actually becoming a reflection off the internet, crazily enough.”
A concrete story of how dark web monitoring works and why speed matters when stolen access is for sale.
“he went back out and said, I'm selling access to this.”
Explains the division of labor among criminals and why ransomware became so profitable.
“it becomes one of the best business models ever operated on planet Earth.”
Ahlberg traces the idea of pointing an analytics engine at the internet and how the company chose its market.
“what if I could hook up an analytical engine straight to the internet.”
A candid comparison of the two exits and the mistake of pursuing too many applications at once.
“We sold that for $195 million, you know, nothing to sneeze at”
Shows how the technology behind threat intelligence changed in 15 years, from hand-written rules to multilingual models and AI-written reports.
“it's amazing how it cross learns between languages”
Describes why attacks on Ukraine produced intelligence that helped other customers, and how Recorded Future decides whom not to serve.
“every customer of these 2,000 goes through a sort of a KYC process”
Covers AI in offense and defense, why criminals use Telegram, and the personal risk of being named an enemy by Russia.
“he built VK first, sort of the the Russian Facebook.”
Explains the logic of joining Mastercard and why financial data strengthens cyber intelligence.
“it would be awfully interesting to know whether that card has been used”
You're listening to Gradient Dissent, a show about making machine learning work in the real world, and I'm your host, Lukas Biewald. Christopher Ahlberg is an old friend and the CEO and founder of Recorded Future, an AI cybersecurity startup that was founded in 2009 and sold recently to Mastercard for $2.65 billion. Previously, he was the founder of Spotfire, an information visualization startup, and we talk about AI applied to cyber threats, war in Ukraine, and compare notes on being two-time founders.
I hope you enjoyed this one. All right, so Christopher, welcome to Gradient Dissent. Um
Great to see you, Lucas, thank you for having me.
So you're like my favorite kind of guest, um, which is someone who's taking AI and applying it to an important domain that I don't understand super well. So I think for our audience, you're gonna have to tell us about your company, um, Recorded Future, and and the problems that you solve. So maybe we could start with that.
Yeah, no, for sure, you know, you could sort of I wouldn't use this description widely, but in this context, maybe you could say that we're doing, you know, AI for intelligence or intelligence for AI, if you want. Uh, we're we're an intelligence company, threat intelligence. We try to get our hands on everything bad that's going on in in in the world, but maybe more importantly in the sort of the internet-y world that's I like to say that there's sort of this opportunity that came along to think about the internet as a an incredible intelligent sensor, uh, that happened at the same time as the world have sort of slowly migrated onto the internet.
And and as that migration is happening, it's sort of going to the point where actually the world is actually becoming a reflection off the internet, crazily enough. Um, and so in that, we've done hard work over the last 10, 15 years to try to organize this data, collect it, you can imagine all kinds of crazy data. We've had to use a lot of, you know, call it machine learning, big data, analytics, now AI, pick pick your favorite words, to sort of make sense out of a lot of data.
A lot of that stuff got started in natural language and processing these sort of things, but then all kinds of other data. And in the end game, it's all about producing great insights. And these could be insights about geopolitics, they could be insights about cyber threats, that's sort of where our main stuff is. It could be insights that support a warfighter, it could be insights of all kinds, but all in this sort of bad news domain and the threat intel domain.
And and, uh, we built a good business there. Sometimes I summarize it by saying it's sort of the Bloomberg for intelligence.
Hm. And so I'm sure that, like a lot of our guests, the maybe the most interesting things that you've done, you you can't say. Uh, but is there any particular insight that you pulled out that you're proud of that you can talk about?
Yeah, you know, through the years, there's been wild things, you know, going back to in 2016 when the election stuff sort of was the first time around, sort of thing, and we found some Russian dude who was selling access to the Electoral Access Commission or electrical, yeah, whatever it's called, you know, incredible stuff. That was probably the first sort of that the moment where you're just like, Wow, dude, what's going And can you on?
talk about how did you figure that out? That's amazing. Like, what what how does that work?
In that case, it's this sort of wonderful dark web world where, um, that that back then was in these forums that still exist. A lot of that has now moved on to Telegram, if you want. That's sort of where a lot of the bad news of the world now happens. Uh, but some guy there had broken into this thing called, uh, Electoral Assistance Commission, EAC, and and, uh, he had hacked it in good ways using a SQL inject, extracted a whole bunch of information, and but maybe more importantly, he went back out and said, I'm selling access to this.
Who wants who wants to get the access? And we found it before somebody else and and actually bought the access, crazily enough, that
Really? was like, Yeah, and Wow.
and took took custody over of it, and then went back to the government and said, You may want to make this thing go away. And and, um, yeah, it was a little bit of a wild thing. I remember when this guy, a colleague, fantastic colleague Andre, calls me in the middle of the night and just says, you know, something not so great is going on. What should we do? And, uh, yeah, a long time ago, but good story.
Okay, you're, like, instantly pulling me off my script, which I've been trying to stay a little more on script, but I can't help myself. Like, what what what is the the dark web? Like, is, like, is this, like, forums that people log into? Is this, like, on Tor? Or, like, what what actually is that?
It is, you know, like, the and it's a portion just to be clear about, and it's it's changed recently. We we can come back to this and talk about Telegram, but, no, this stuff is still there. Uh, there are these forums, and it turns out that if you're in the business of buying and selling information, you need a place to buy and sell it. You can't just sit on it, then you're not gonna make much money, and these guys have the only interest really is in making money, different from spies and government spies.
But these guys, they want to make money, so they need places to buy and sell. And some of these forums were put up the in the early 2000s, Maza and exploit. iN. They have these wonderful names. Some of them still exist 20 years later, 25 years later, crazy enough. Um, uh, so so they are, most of them are on Tor, some of them are not, and they're sort of essentially marketplaces. Um, and and, uh, we keep, uh, close eye on them, if we put it that way.
So, today, I tell you today, right now, somebody, as of an hour ago or a couple hours ago, was selling access to a particular, I'll just call it big software company's servers, and it's crazy creating havoc right now, right this moment. And we're we got our hands on all this data, we're trying to upload it into our system, generating alerts to all the clients and da da. This stuff is is is never ending. So, yeah.
So, like, so literally right now, someone's selling access to a company's servers?
Many of them, yeah, no, the the it's software that is installed. I'll I because something is going on in real time, I'll leave it sort of a little bit fuzzy, but it's a big, prominent software company, and they're selling access to this, yeah.
And who would typically buy it? Like, do you pretend to be like someone that wants to buy it to to learn more? Like, like, who even It can would want that access?
be it can be, you know, so typically these guys will sell access, i that's one thing, and you know, if you think about the guys who want to buy access, there could obviously be somebody who's wants to get after something very special. But what happens in the this world is that it's very specialized. You have people who go get access, you have people who sell access, you have people who will then, for example, s sell ransomware software or rent access to ransomware software.
You have people who were help you get the ran- execute the ransomware. You have people who then handle the actual Bitcoin flows all the way to money mules, so highly specialized world of of criminals there because they are criminals. A large portion of them are in Russia, not all of them. And in this case, it's probably somebody who's realized that he can sell access to all these different places that opens up all, uh, all kinds of opportunities for ransomware.
I'm sort of guessing in this case since it's happening real time, but it's a pretty interesting world.
It's interesting world and I I guess but I'm I'm totally not aware of this. So, like like, who who would want to buy this data? Is that other criminals, or is that, like,
Other criminals.
this I see?
Yeah, other criminals, so p- probably the ransomware actors. So there is a whole slew of these ransomware actors. There's guys who write and operate ransomware software. They then franchise out out the use of this ransomware software to other actors, and they'll use it, execute, and in return for keep holding on to say 80 of what whatever money they get on the ransomware transaction, the operator gets another get the the other 20, and it becomes one of the best business models ever operated on planet Earth.
And, like, presumably, if someone's selling something illegal, they want to make sure they're selling it to a criminal and not you. And presumably, they're worried about selling it to you, so how how do you convince them that you're, um, not gonna turn them in or something like that?
So so, you know, that that's our job.
Okay, I love it. All right. Is there any AI involved in that, or is that that seems like it's totally different? Uh
there there's AI and be because it turns out that these it's I wouldn't call it big data, big forums, big this, uh, but they're tricky. You had they they might be locked down in all kinds of different ways, so you need a lot of tradecraft to get in. And it's a combination of human social engineering and smart scraping, if you want, that that has, you know, there could be six layers of access to some of these places, so that pretty complicated sort of thing.
So it's a combination. I wouldn't necessarily call it AI or but then at the same time, these scrapers need to operate in human-like behaviors. So I like to joke that they sort of might actually pass a very limited Turing test because they need to sort of operate as if I'm a cyber criminal. I don't know, is that a Turing test? I guess it's a K one kind of Turing test, uh, but so is it AI? You know, you know, it's old who by whose definition you go with by, but yeah, I guess it is, yeah.
Yeah, I guess if there's a human looking at it, it's for sure a Turing test, yeah.
Yeah, no, no. So, artificial criminal behavior. So I guess that's, you know, that's that's a Turing test of of just a special kind.
Okay, well, kinda getting back on script, and then I'm sure we're gonna come come back to this. Um, you know, one of the things that that we have in in common is that, you know, we're both repeat entrepreneurs. And you actually, you know, you founded Spotfire back in, I think, 1996, and and sold it, um, 11 years later, and then you, um, founded Recorded Future a little bit after that. And I was I was wondering if you could go back in time to when you started Recording Future and what you were thinking at that moment and what the insight was that that led you to start Recorded Future.
Yeah, no, it's a great question. So, Spotfire was data visualization. Uh, we started that I started that I'm I'm aging myself here, but in the early 90s, working on, uh, for my PhD on how to visualize large data sets and kind of a predecessor to Palantir and a whole bunch of other sort of things. Not to make any claims about that we were the first by any means because we were not, but we did nice job with certain kinds of data and so on.
So then we we had sold that to a company in Palo Alto called Tipco. It worked out great. Uh, and we were very excited about that. But then the sort of the idea struck me that how that was sort of all about visualizing what was in an Oracle database or an Excel spreadsheet or what have you, that that sort of data. And so we were it were it sort of struck me. I was like I was on the treadmill running and and, uh, uh, literally, uh, while we we had signed the deal to sell Spotfire, but we hadn't closed yet.
So it was, like, in this weird, in between timing, and it struck me that, oh, wonder if we, instead of thinking about analyzing what's in an Excel spreadsheet, what if I could hook up an analytical engine straight to the internet. So so, you know, use that sort of approach to things. So, uh, that and and now the internet is and at at the surface level, at least, is mostly human-produced text. So now you had to deal with look at, uh, uh, for entities and events and these sort of things out of text and try to make sense out of that and organize it in a way that you could do analysis.
And and, uh, yeah, that that was sort of the inspiration, and that's how we got into it.
Interesting, and the name Recorded Fut- Futures is super evocative. Did that did that come to you from the start?
No, not maybe immediately. It was one of my co-founders here, Eric, uh, very clever guy. And and, uh, the idea from the beginning sort of was this idea that we would find these future time points in text, you know, like Xi Jinping is traveling to Moscow on Friday. And if you could actually keep tabs of everything of that's known to the in the world from all the sources, we should get a good picture of where Xi Jinping is to use an extreme example.
Um, so so and and from the beginning, Eric suggested we should call it, uh, I guess, recorded time. I guess in one of the Shakespeare's the Mac Macbeth, until the end of recorded time, was sort of that thing. Then, of course, the domain name recorded time was taken, and it became recorded future, but, which was probably a better name to begin with. But, uh, so, yeah. And it fits well with the idea that, you know, most secrets are known, most secrets are it's just gotta get to where they are.
And, uh, let's get let's get to all of them. That's
It's interesting, you know, it seems like a little bit of an entrepreneurial, um, anti-pattern here of like, it's not it doesn't sound like you're really starting with, like, a specific customer pain point and working backwards. It sounds like you kinda started with your your sort of interests. Like, was it obvious that intelligence was gonna be, like, a big customer of this? Because it does seem like, as broadly as you could find it, like, almost any organization would would benefit from this kind of analysis.
totally. And and that's probably my weakness, but maybe it's also a decent strength. But, you know, so Spotfire started as we could visualize any data set. In that case, we stumbled on to visualizing and analyzing pharmaceutical discovery data, very super high-end, super valuable application, and it worked out great. Then, in that, we actually ended up doing a lot of counterterrorism work in the sort of CT space, in in intelligence, and I've always loved that world, and we've done a lot of good work in that.
So when we started Recorded Future, it to your point, we knew that there was an application in this sort of strategic foresight or whatever. Turns out that we ended up in the cyber world with it, but, uh, no, it's it's certainly, uh, more more of, uh, inventing a big-ass hammer and trying to figure out where you could apply it rather than the other way around. But, you know, isn't that how a lot of good stuff comes up?
I don't know what it what what you would say. I think a lot of good ideas come come that way, so
Well, look, I mean, you've been incredibly successful. So, um, I think anything, you know, people's strengths and weaknesses often always, uh, connected. I'm just curious about your process. Like, you know, when you started this company, did you have, like, a big list of possible use cases, and you kinda ran down the list talking to people, or how did you how long did it take you to to kind of get to these, like, specific use cases, and and how did you approach that?
we sort of knew that there was something in intelligence, for sure. Uh, we also thought about commercial intelligence and sales intelligence and lots of other sort of things, you know, for sure. And there's people who've built similar type companies in lots of different spaces. We had a long list. I s I think I still have those, whatever you wanna call them, presentations, you know, you can imagine the first venture presentations. We we quickly went to Incutel and Google Ventures, barely existed at the time, but ended up taking money from Incutel and Google Ventures back in 2008, 9 or something like that.
And and and sort of honed in on this intel thing and, uh, pretty early, uh, the the, uh, but could have gone many other places too, for sure.
So, one question that I always get asked that I feel like I never have a good answer to, but I think I'm gonna turn it around to you and and ask it to you is, you've now done these 2 companies, and and you've done both for quite a long period of time. What did you do differently in your second company? What, like, what did you take away as a second-time entrepreneur?
Oh, that's the sort of Peter Thiel question. It sounds like, you know, like, that that's an unfair
I I only bring that one up cause literally every podcast I do, I always get asked that question, and I never know what to say. So I think maybe you'll have a better response than me.
the the sort of the fa- i if I started with a bad side, you know? So with the first company, it took us a little time and we stumbled on we started very generally, and then we focused on pharmaceutical discovery and killed it in that domain and then worked from there. That domain ended up being fairly limited and probably limited the outcome of the company at some level. We sold that for $195 million, you know, nothing to sneeze at, but, you know
Congratulations, man.
no, no, but these these days people are, yeah, yeah, whatever. People are like, it's it's
To put it in terms, like, now, that would be, like, a $5 billion exit in in 2025 just to for the the younger listeners.
man, man. The these guys, like, they're just thinking about yeah. So so then here, we I think we like, the failure point. We thought we could do multiple application areas. We m for multiple years ran an intelligence track and a quant trading track to to create quant trading signals. And not and we had a Series C investor came on board and he, you know, you shouldn't listen too much to your board. But but this one guy, he just said, Kill that.
And I'm like, You're actually right. Why? Like, we should just kill it. And we killed it, and that was a great sort of, like, freed us, and we could just run. And and it is sort of already started withering a little bit. But so so, uh, that was certainly that we we go to, uh, what do you call it when you you think too big or, you know, like, we we we thought too highly of ourselves.
Um, uh, in terms of what we did differently, that was better, you know, we probably picked a bigger problem. That was great. This this, uh, cyber intelligence turned out that we ended up sort of riding a massive wave. This investment in cybersecurity that have sort of gone through the last 10, 15 years has been incredible. Um, and and even though we certainly dissolve a subset of it, you know, by riding a big wave, you can make a lot of mistakes.
You know, you've seen that in AI also, like the the wave is big enough, it allows for a lot of mistakes. Um, maybe also, uh, no, that that would probably be the the answer to that. I I'm sure there's more, but, uh
No, actually, great segue into my next, my next question, right, which is that, you know, you've been in this massive, um, wave of, um, not just not just, like, cybersecurity, but the application of ML and AI throughout your kind of 15-year arc in Recorded Future. And, you know, I'm I'm really curious how the availability of data and the new applications of ML and AI changed Recorded Future's business over the time that you operated it.
It was good. So so there's sort of 2 aspects to that. One is the data, and then there's, like, what you now can do with data here. So so we started off with, you know, the stuff that we called AI and 08, 09, 10 sort of thing. We wrote our first entity extractors and event extractors with, like, lots of if then elses just stacks of if then else statements, sort of thing. We also wrote a lot of good test cases for to test whether it was right or wrong.
Does this test text lead to this? That sort of thing. Though, obviously ridiculous from a point of view of, like, what people are doing now, and we've by probably gone through 3 generations, even for those entity extractors, and we use some commercial stuff. Now we sort of own all that internally, and it's it's been a great journey with that, and now it that's all based on these sort of models, as you could expect. And and, uh, the availability of data, for sure, have sort of helped through that.
Uh, we used to have entity extractors for for each language. Now that that is one coherent model that sort of spans, I don't know, 15, 30 languages, and it's amazing how it cross learns between languages that are not in not just inside Indo-European languages, but it's, like, cross-linguistic. Sort of bananas that this stuff even works. It's like it's mimicking fucking human brain somewhere. Somewhere there is something wild going on in that. Um, and and so so that's sort of super interesting.
The other big piece probably sort of could spend a lot of time on this, but is how that was one thing to do ex- feature extraction if you want or lang like, yeah, feature extraction, data extraction, out of content. Now, with all this generative stuff, you could obviously so in intelligence, there are sort of 2 aspects to it. You think about if you run fancy intelligence agency, you got the collectors, the James Bonds running around in the world, and then you got the analysts who sort of putting the stuff together.
The collection part is sort of what I first described. The second part of writing to, you know, everything from the simple summarize what happened in Somalia last week to what are the second-order implications of what happened in Somalia last week. You know, like, so from basic questions to more advanced or some summarize the second-order implications of what happened in Somalia and get a report written in Arabic that I can share with my my partner in Egypt about that.
Those are, like, pretty s ge- juicy, heavy questions. And, by the way, do that every week for me and deliver it to me at 8: 00 AM. You know, now you've taken a fair amount of work and stacked up there. Now and we do that, and it's just it's it just happens. It's it's sort of mind-boggling, isn't it? Uh, so so, if somebody would have told me that 5 years ago, I would not have believed it.
Maybe maybe 3 years ago, uh, but it's it's pretty mind-boggling that that this works. And it works with a mix of text and images. And, actually, we collect of other a lot of other weird data, sort of more net flow data, malware data, very technical data. And we spent a lot of time on how to wrap that in human language so that you so the LLMs can handle that sort of data too. And even there, it works.
So, you know, it's a I I'm s fall off the chair here, and, you know, like, maybe that's because I'm dumb, too dumb to understand it, but it's it's pretty mind-boggling.
I I totally agree for what it's worth. Um, actually, I wanted to ask you, when when ChatGPT came out, I think it was, um, 2 or 3 years ago, was that, like, a the same, like, watershed moment in the intel community that it was here in Silicon Valley, or did it take longer for people to realize the implications?
I think, you know, so so, first, even inside Recorded Future, I it took me just like so I remember I was sort of debating with, you know, my co-founder, Stephane Treve about, sort of, like, you know, are we coming to a AI sort of yet another AI winter, or is it about to take off? And I'm like, Ah, it feels like it's done. That was Christopher Collins and Stephane was like, It's gonna take off, buddy. And I'm like, he was, of course, very right, and I was very wrong.
Uh, so so, f- to begin with, but then I think there were people in DC who who ran with this very cool in a very cool ways. Uh, I don't wanna talk about them, put names to things as on. But there are areas in there where people have been extremely forward-leaning and built incredible stuff, and we've had the good chance to spend time with those people. If they listen now, they'll know who I'm talking about. And but we do comparison of notes on what we're doing, what they're doing, and and, uh, you know, sometimes their benefit is if they have access to very special data, we have access to the internet in a way that we think maybe other people
don't, and we try to collaborate on some of that. But no, I would say, in general, the government is never the best at, um, uh, taking advantage of new tech or not never. That's not true because sometimes they put crazy satellites in the sky and stuff, but in general, not always the best adopter of tech. But in this case, some parts of the government was pretty pretty amazing, so
Okay, another big moment that I think happened around the same time as GPT was the invasion of of Ukraine. And I know that Recorded Future is there's important moment for Recorded Future. Could you kind of take me that back to that moment inside of Recorded Future and and what you were doing and and how you responded?
yeah. So so I would say a couple of different things. Um, we have they were a customer from before in in some areas, and, you know, we we have probably 47 different countries around the world that use us in in some sort of, uh, national capability, um, and and all sort of in the West Plus Plus or the extended West, or sort of a weird way of describing the world, especially those who live in the East.
But, you know, it's sort of gotta ex- explain it in one way or the other. So in that world, um, 47 countries, and and Ukraine was one of them, and, um, but so when the invasion happened, we did not approve of that. So we said, let let's help out, and, um, we provided our technology, and and it's been deployed nicely in in in, uh, a a number of places over there. Uh, it has been very good for them, I think.
Uh, we there's been you can find a lot of good, I'll I'll leave it to you to find the the good proof points, uh, that they've been willing to talk about, very, very, very specific, such, um,
Well, wait, why don't you tell us about the proof points? I I would I would love to hear about them. It's a lot to brag on this.
yeah, and you have to be careful with this and that. But there there are some very specific examples where where we've been able to. So so, because part of this is that when something is like, so, think about when a spy tries to again, we talk about the criminals who can be pretty brutal or not brutal, of course, they're brutal, but pretty, uh, non-subtle. They're like just they wanna mo- go make money. They d many cases they don't really care about whether they burn something, whether they create havoc, as long as they make money.
And and, you know, they don't necessarily think the mo- the longest term. A spy, if it's a doesn't matter if it's a Russian spy or Chinese spy or, frankly, our own spies, if they wanna go get access to information, for example, they are willing to take, you know, if you have if the policy is that we should know what's in Putin's diary or in Xi Jinping's travel records or the other way around, one is willing to spend any number of years to get to that information.
And you have to be very subtle about it. So so, if you assume that that Russian spies or Chinese spies or anybody who's trying to come at Ukraine are trying to do that, they'll they'll be very careful, very subtle, and and and so on. So, would what it turns out then, or for that sake, when somebody wants to come and destroy something in in c in the world of computers, when they do that, um, they sort of become a gigantic honeypot, if you think about it.
It's like just everything shows up there. So when we deployed Recorded Future across a whole bunch of places there, we ended up also learning a ton. So you sort of get in the way of the absolutely most modern, uh, malware of various sorts and all the other stuff that comes around that. And so, any number of times we've been able to sort of detect incredible things and and then be able to have that data flow into all our other customers in a way so that they can be defended against the same.
So it ends up being sort of a, I don't know, probably not a popular analogy, but virtual Iron Dome type of a thing that, you know, that that this turns into and and so pretty incredible sort of outcome out of that, and and, uh, yeah, continues well to this day.
Interesting. One question that comes to mind for me there is, you know, d is it is it ever tricky to decide what governments to work with and and not work with? I mean, running with some biases, I've been, you know, kind of surprised by how many different, you know, customers we have where, y- you know, employees might object, and then, you know, I think, like, okay, it's really not, like, my expertise to figure out, like, who the good guys and the the bad guys are, but, you know, we're not exactly at the same level that that you are.
I mean, it kind of is your job, maybe, to figure out who the good guys and bad guys are, and it's actually, like, probably pretty complicated, like, once you really start digging in, like, how how do you approach that? Like, if a new government wanted to work with you, do you have some kind of, like, flowchart that decides, uh, if they're We do on our team or not? Yeah, and how does how does that work?
so, you know, without for so f- f- as you can imagine, it's not not something we necessarily publish, but I can say some general principles about it. But you're right, first of all, it is our job to be able to make those sort of judgments. Uh, and you have to make choices, and no no such choices will be perfect. Uh, and it's not like we can claim to have the most we're we're software dudes, we're not necess- or software people, we're not necessarily moral philosophers, just to be not overstate our own abilities.
But, you know, we we chose to not have customers in China and Russia and and and, e- Iran and North Korea. Those that was sort of an easy choice. There are countries that US law and European law n- nor, uh, the same countries to some degree, but also places like Cuba and, uh, Sudan and, uh, you know, like, there's, uh, 6, 7 countries that Syria that you actually go straight to prison if you sell them stuff.
So that makes it pretty easy.
That's easy. I agree.
Yeah, those are the easy ones. Then you have maybe other places that are more tricky, and there I'm not gonna start naming, but we made a choices where there's a number of countries we just stay away from, and then as well as companies. There's a number of country oh, sorry, companies that, for example, uh, you know, engage in illicit hacking behavior, uh, that we stay away from. So there we we call it an audit list, call it whatever, you don't publish that, but and and, uh, and then there's the companies that help out some of these things and so on.
So so there's a we have a process, maybe, and and it is a flowchart is not a bad way of thinking about it. And and then we have sort of a committee at the very core of this when there's choices to be made, and sometimes you actually have to make choices, and we make those choices. So so, uh, I make no claims about that being easy, but it's never been that hard either. It's it's sort of sometimes it can be hard to write down, and and and, uh, but we have sort of a committee, and in the end game, that committee is who decides, and and I think we've been able to do that in a way that we can
go to bed nicely and so on. Now, our stuff is for cyber defense also, it's pretty worthless. It's not like you're not gonna use our software to decide where you're gonna drop a bomb or to do where where that you cannot even you cannot physically use us to intrude into a phone or do any of the malicious. It's cyber defense. So even if a bad guy got their hands on it, it wouldn't be great, but it's not like it's gonna, like, create complete havoc in the world.
So and in the end game, it's hosted software, so if the wrong guy got their hands on it, we can cut it any time. So, you know, there's a number of controls to it, so that so so it's good.
I guess, uh, d one of the things that's important to me is that, you know, our customers know that we're not gonna cut them off if they get sort of politically unpopular, which is why, you know, I wanna be, like, super clear about our criteria. D do you worry about that at all for Recorded Future? It's just so kind of clear what you guys are willing to do and not.
So, first of all, our stuff is fairly expensive, so we only have 2,000 customers, you know, whereas somebody else, you might have many, many more. So that then so and we know who they are. They run every customer of these 2,000 goes through a sort of a KYC process, know your customer sort of thing. So it's if if somebody shows up and they're called a company name that we have no idea of, they have no website, they have no nothing, it's just not gonna spend $100,000.
Or, you know, if our stuff ranges from that up to millions and millions, you know, that itself selects a lot of different things. It's like, whereas if you have a little dev shop with 4 guys who might use some AI tools, it's it's I think you might it might more difficult for you to make those sort of choices. So, uh, uh, I don't know, tell me if I'm wrong, but but I I think we sort of in there's a whole bunch of variables that have made it so that this has been less of an issue, actually.
That's great. Um, actually, shifting gears, I I think, you know, we found a saying of yours that I think you repeated, uh, earlier here that I want to ask you about, which is saying, you know, the, uh, I think it's like, the in the last, um, 25 years, the internet reflected the world, and the next 25, the world will reflect the internet. Can you e- expand on on what you mean by that?
Yeah, so so there the first part is sort of the the trivial one is sort of, like, everything that's happened in the physical world, sort of whether it's everything from sort of transactions to interactions to, like, how we do business, how we sort of the the simple stuff has sort of moved onto the internet, and and that the internet then through that becomes a reflection of what's going on in the world. And I think we're all very happy to see that, and there's no not a lot of drama that comes out of that.
Then but then sort of saying that as soon as those systems here is sort of the it's internet first is sort of what's what's starting to happen and whether that's sort of, uh the trivial social when, you know, you see kids where where what's going on in TikTok or Facebook or whatever is sort of the maybe not kids in Facebook, that's not true, but but, you know, the whatever the the preference of or social network of preference is, it's sort of it starts in the internet world.
When democracy is sort of first internet and then on to the world, when business is first internet, and and now we end up in a world where what happens on the internet is actually what defines the world. And that's sort of what I think becomes pretty interesting because now if you run a country, it's becomes tricky, you know, who's who's in power? Is it the country or is it Mark Zuckerberg with Facebook? And I think it's been pretty interesting even observing Facebook and just seeing how Facebook, uh, switched, uh, head of government affairs at the same time as he was, you know, flipped president and and, uh, that was probably not by random.
Uh, the so so and I think we're gonna see a lot of this. And and if you sort of fast forward where that will be 25 years from now, I I I wouldn't I'm not keen to be a politician with large, but I certainly wouldn't wouldn't wanna be try to be a politician in 25 years because it's probably gonna be pretty tricky.
And I guess, you know, you talked about elections earlier, and, um, we've had a lot of people on the show actually talking about different kinds of election interference and and mitigation efforts. When when you kind of roll forward the trends that you're seeing, do you think that, you know, the US. society has to operate a different way to be successful in this more vulnerable world?
Big question. I I'm a huge democracy fan, uh, I sort of like whether you take it from a positive way that how positive is in it that we can live in a world we sort of humanity's been around for tens of thousands of years and and it's sort of most of the time, it's been the strong man that rules, and and you sort of follow. And and and this only and even if when there had been democracy, it's only where some it's only been for the super privileged or whatever you have sort of thing.
Like, it's a pretty damn positive that we can have a vote, uh, so that's sort of pretty amazing that we get to live in that that time. Now, if you then fast forward and start thinking about what what's gonna happen now, first of all, oh, I was gonna say the the down the other not so positive way is just to say there's a lot of other ways, and maybe democracy isn't the best, but at least it's it's the best of the worst.
It's sort of like none of this stuff is amazing. It all has problems and so on, but it's I've n- I certainly haven't seen anything remotely as good as democracy. Now, so if you put a go forward and and you just say, what are the ways that democracy could develop? Again, there's this sort of thing, what what because we think very much in democracies in terms of countries, and I think that's important, and that's probably gonna remain true.
But, and a again, if if the sort of the groups of people are not necessarily following national borders, it might make it very difficult. Now, maybe we are sort of a new era right now, I'm I can't really make that judgment where there's a new set of nationalism going on in a bunch of different places, better for worse, we can only observe it, and that seems to be the case, but maybe that's a reaction. And what's going on would hap happen on the internet.
And I think there's many other of these sort of things. I think maybe the the negative view would be that there's the world has been manipulated in many different ways, and there's amazing opportunities in front of us to manipulate if if if I put on my I wanna be evil brain, there's many ways to be evil. But maybe on the other hand, people are also let's be positive and say, maybe people are getting smart, and and, you know, a lot of the manipulation is pretty primitive, so hopefully, you know, like, I'm sort of always say, look, people always come up with wonderful tech solutions to deal with this.
How about if we do what they do in Finland and just get people great education, and and, uh, we can sort a lot of these problems, let's make sure that people can read really well and other sort of things, and and it can work out. So, I I'm rambling a little bit, but I guess I'm a generally an optimist. Democracy is better than anything. And and, uh, yeah.
That's great to hear. I mean, what do you like, do you think that, um, when you think about sort of, like, AI's like offensive techniques and defensive techniques, do do you have a sense on, like, what wins in terms of, like, I don't know, election interference or kind of any other conflict that we come into here? Like, um, you know, like, you can use AI to look for security vulnerabilities and fix them, or look for security vulnerabilities and exploit them.
I mean, what
Yeah, I don't know if these if you think about, like, sort of if cyber attacks writ large have just happened faster and faster, uh, and so if I start there just because that's sort of closest to home, and and clearly so so for now, the AI stuff you're really seeing is really only sort of better phishing emails and so on, but even there, it's like, instead you know, like, th- there was a reason most cyber attacks happened in English-speaking countries for a long time, because writing the phishing emails was easiest to do in English, uh, sort of thing.
But now you can do that in all kinds of different things. You can do more targeted stuff, blah blah. But people are gonna start writing software that once it gets in, it traverses through systems automatically, that for sure people are, and there's people working on that, and whether those are slow, slow-moving things that tries to not detect, or it's the sort of stuff where they don't really care, and there's that brrm run through the system.
That's gonna happen, it that's gonna set up the bar for the defenders to try to build things that you you're not gonna actually be able to r- run counter that with just humans. You're gonna have to use AI to sort of get or some version of automated automated analysis, but we can call it AI to fight against that for sure. And that who wins that there? Yeah, I like there's a guy Rob Joyce, who's in who's a terrific man who used to run cyber defense for the US government at NSA.
He before that ran the hacking team there, one of the groups and famously called TAO at the time, and he has a great, uh, saying where he said, You have to know your network better than the bad guy coming at you. And if you're a big company, it's freaking hard to know their network. And and a you know, a crawler plus some AI is is gonna outsmart most IT guys, even if they've worked there for 25 years.
So so there you have that, and I don't think it's certain who wins that. We, um, for sure, in disinformation, to your point, I'd like to think that we should be able to write, you know, so in Recorded Future, when you get text and images and all this stuff, now we try to classify and saying, instead of information you're looking at here is very likely machine generated, and it's been machine generated with these models, that sort of stuff to help the researcher.
Now, when that can be in in our operational system, so whether I'm on TikTok or in my email or whatever, to say that, but maybe on the other hand, maybe 75% of what I'm gonna deal with in the future is gonna be machine generated, so maybe that's not enough. It's like the world the future of is maybe machine generated, so I think that's sort of interesting. And then you have the actual warfare stuff, where what's gonna happen is that I'm gonna I'm gonna paint a square and saying in this 10 by k 10k kilometer, uh, there's gonna be drones hanging over that stuff with guns and grenades or or what you pick, and anything that moves in there is dead.
You know, like that that sort of stuff, and people are working on that right now, and that's gonna change the nature of warfare in a brutal w- way. So, no, there's gonna be all kinds of nasty stuff in front of us, so sorry to sound doom and gloom here, but
um, uh, in that vein, I guess, and maybe this is, like, even a, you know, practical question, like, what does it mean that the, um, the dark web is moving from kind of forums to Telegram? I mean, I'm I'm sort of vaguely aware of Telegram as an alternative to Signal. I've watched many, many, maybe most of my CEO friends gradually move to Signal in the last, you know, year or two, to the point where I feel like I I'm using it quite a bit more than I, um, expected to.
Is is Telegram a Signal-like equivalent, or what why do if shouldn't shouldn't a CEOs be using the same, you know, network that the criminals are using? Wouldn't that be the most, uh, so so, first secure network?
of all, use Signal, you good choice. Make good choices, Lucas, use Okay, all right, Signal. I'm using Signal, just Yeah.
just so you know.
Signal is great. Signal publishes their source code. Uh, you could argue this is actually I haven't still yet really figured it out, but but there's no real server to attack in Signal. There's lots of really good things. And all the fancy spies of the world, in all the count good countries, use Signal. So the fact that they thought it comfortable now, that mean might mean that they have a big cabal where they all share in all or, you know, look at your and my emails, but no, I've seen plenty of very smart people use use Signal, so I'm a huge Signal fan, it's great.
Uh, uh, the good telegram, on the other hand, you know, so the guy, I'm not gonna remember his name now, but, you know, very cool entrepreneur in many ways, he built VK first, sort of the the Russian Facebook. He was forced to sell that, uh, because the Russians, uh, the Russian government did not appreciate that he had built this. They forced him to sell it to, uh, an oligarch in in Russia. Uh, he was sort of really, imagine your arm being up here and you sort of have to say yes, and he had to say yes, and he sold it.
He then started Telegram, uh, and moved to Dubai, uh, uh, to be able to sort of run it separate Abu Dhabi or Dubai, I think it's Dubai. And and, um, and built a messaging platform that is, unlike Signal, if I understand it correctly, does have sort of a centralized place to be. It has encryption that is not at the same way of end-to-end encryption as of Signal and others do. In any number, like, some of this is way above my pay grade, but there's a whole set of reasons why Telegram is not as good.
It is interesting from this sort of and and this it's dangerous in there's world to sort of say good and evil, but the set of people that we don't necessarily love that or or many of them are on s on Telegram. So that means that there's a lot of data to be picked up on Telegram. So the signal-to-noise ratio is not signal in a different way, but the it ends up being a good place to go look for, and especially the criminals are on there, whether it's sort of cyber criminals or people in trafficking and all kinds of interesting stuff, are there, and it's turned into a very good information source.
Is there something about Telegram's feature set that it's better for criminals, like, when if any criminals are listening to this podcast, like, they'd be convinced to to switch over from Telegram to Signal? I mean, surely they wouldn't want Social their data to
I think it's no. be I think it's a social just
this is social.
sort of like and it also turns out that Ukr- there there ha- it it has obviously in in the Russian sort of world, it's very popular, so it's popular in in Ukraine as well. Uh, so
I see.
it's not it's it's I'm not by any means saying that old Telegram people users are bad by any means. It just sort of happens to be a certain class of, uh, criminals that ends up being concentrated on on Telegram, and okay. Interesting stuff.
All right. Well, like, rolling forward I think there's into the
some people who would be very mad at me for saying this stuff, but this is
Wait, why? For? Is it what part? Why would they be mad at because once it?
you sort of say that one platform is more criminal than the other, you know, like, Oh, I I'm, you know, see. you yeah, this is
Well, we can edit it out if you want, but, uh, yeah, I
It's all good. know. It's all good.
All right.
I don't mind. People have been mad at me for many things, so I don't mind. It's all good.
You know, actually, a another question, maybe that that comes to mind for me, is, like, you know, I feel like, you know, in my very kind of, like, low, um, level of of celebrity, you know, like, every, like, you know, month or two, I get someone reaching out to LinkedIn, like, saying, I'm gonna come kill you or something, but you must get these kind of threats, like, all the time. Like, do do you worry about you and your family's, like, safety being so kind of involved in this world?
Do you, like, I mean, do you do you walk around with a bodyguard? Like, how do you d you must be constantly concerned about getting hacked, like, how do you think about that?
Do I look afraid?
You don't look afraid. Is that, uh, for cause or for, uh, hubris, I guess?
No, trying to be funny here. No, I'm I'm not afraid, um, that's sort of, you know, and you choose to when you get involved in this, that that you sort of and no bodyguards, uh, unless it's needed, uh, it's sort of one way of thinking about it. Um the uh, one should be cautious, uh, the sort of Russia deemed as, uh, whatever they call it, undesirable, uh, enemy of the state. So that just before, uh, Christmas, uh, there was a uh, uh v- verdict, if you want, from the the National Prosecutor or the General Prosecutor of the Russian Federation put out a statement around why Recorded Future is an enemy of the state.
This an undesirable, very specific language, not like random stuff. It was very specific. So that was less great if you want. Uh
That sounds bad, man. I mean, don't don't, uh, people that are undesirables going to Russia, like, get thrown out of windows and stuff. I'm not super up on this, but, uh
I can assure you, I'm not traveling to Russia anytime soon, so that that seems to be off the, uh, the no. Look, I you know, the the you're I think we're very, very careful with information security here. We run a good physical security program here as well. We try to be very careful and thoughtful about how we travel, what we do, and be thoughtful about things. Uh, then at the same time, one should not overestimate where you are on the list of, uh, problems that the bad guys have, you know, whether it's the Chinese government or the Russian government, they have a lot of shit to deal with, and I don't think we're sort of at the top of that
list, so that's sort of I don't wanna simplify it, but but information security, we gotta be on our A game.
Hm. All right. Well, let's let's let's wrap this up and come back to the here and now. So, um, a couple months ago, um, you announced that, uh, you you were getting acquired by by Mastercard for $2.65 billion. It's gotta be one of the biggest, um, you know, acquisitions of the of the last year. Could you talk about what the thesis was and and how that came about and what your plans are going forward?
Yeah. No, so so, um, uh, we had a long discussion with them, you know, multi-year sort of discussions that has that been going on. Uh, we, uh, the sort of the the simple thesis is that that it's sort of maybe not as known, but they run a great payments business, as of course, they have a services business that inc actually includes pretty nice assets on the cyber and intelligence side. Um, uh, we they wanted to expand on this, and and we could be a nice fit into that.
Um, we also, um, the the financial intelligence side is super interesting. Uh, that's, uh, especially as we talked about cyber criminals and so on, the n- this sort of financial endpoint to things, if if we get our hands on a stolen credit card, it would be awfully interesting to know whether that card has been used or not, and the cards that have been used or not actually tells you a whole lot about the whole supply chain of where those cards came from, just to have a one random sort of example.
So, there's a lot of those sort of things. So, we're gonna be building out our business. We're continue to operate on our own standalone. There's a lot of cool synergies that we can do together. And and, uh, it was also one of those where it was just felt like a really good home for the company. There's great people and sort of long-term value in in, like, mindset of things, which was important to me, cause, kind of to your point, for both you and I who've built companies for a long time, you wanna make sure they end up in places that that that are not just gonna be like 5 by night type stuff, but but people who are serious and
wanna do things over long-term. So, there's a any number of reasons that sort of stacked up where this was a great place to take it.
Any advice for me for for success, uh, post-acquisition?
I I think, you know, make sure to keep doing execution, uh, very well. It's sort of like, you know, have to keep at your A game. Uh, we're early into it, but, you know, build good friendships, good good relationships with people because this stuff is not easy. Uh, w- when you do it, as you know, it's like, you know, it's easy to come up with a lot of clever thoughts on paper, but when you're gonna make make it do, it's like with people.
So, make sure you have good relationships with those people, and and, uh, yeah, I think that's it. Just and and don't just think it happens sort of automatically, you know, sort of like it's it's, um, unfortunately, I guess it continues to be hard work. That's sort of, uh, unavoidable.
Awesome. Thank you, Christopher. Real pleasure to talk to you. Thanks
Thank you.
for taking the time.
This is great.
It was great. Thank you. Thanks so much for listening to this episode of Gradient Dissent. Please stay tuned for future episodes.