00:01:11 · Hanah-Marie Darley, James Wise
[00:01:11] S0: Thank you. Thank you for having me. [00:01:14] S1: It's great to talk to you today. There's so many interesting facets that I want to discuss. Geordie as a product, where Balderton are not just investors, but also users. Correct. The macro challenges of building anything in AI security right now, given both how fast things are changing, but how incredibly important it is. But maybe we should start at the beginning. There are very few 18-year-olds I know who decide to go straight to work for government, in particular the area of government you worked in. Could you give us a little bit on your personal background and sort of the experiences you had running up to joining the more entrepreneurial startup world?
00:01:49 · Hanah-Marie Darley
[00:01:49] S0: So I grew up in the States and I was considering going to university, but I actually couldn't afford to go full-time. And happily, government had such a provision for me that they were very happy to take me in. And so I started working in government intelligence at 18. And through that, I got both of my degrees in international politics and then a master's in psychology, but I did both of those whilst I was working in government. And then in government, I worked across a lot of different desks. I worked across national security issues that focused on foreign policy. I looked at security issues that focused on domestic relations. And then I also looked at like international criminal activity as well as international money laundering. So quite a lot of different areas within government. But I think the red thread through that pun intended is very much data and analytics. I focus a lot on how do you build an evidentiary case and how do you tell a story about what's happening and then how do you predict the future? So how do you, using evidence, not just vibes, explain to people what you think a theory is, how do you build it out, and then where do you think it's going and what are the proof points that it's working or not working? And that was a great place for me to cut my teeth, really. I think it built out a lot of how I think about evidence led in product and about how I think about future forecasting in markets. And yeah, it was it was a good experience.
00:03:07 · James Wise
[00:03:07] S1: Because a lot of people, I think, when they think about um cybersecurity professionals, think about people having, you know, maybe you are a bedroom hacker, maybe you're a red teamer, um, but certainly very deep technical experience of navigating vulnerabilities, identifying them, solving them. But I guess looking at your background, you've come at this space from a technical background, but a different type of technical skill set. And, you know, as you said, alongside your government work, you did your degrees of an element of psychology in there. Um, do you find that has played into your later career decisions to go and work in startups?
00:03:37 · Hanah-Marie Darley
[00:03:37] S0: Massively. Um I think one of the things that I noticed early on in career was a bifurcation between circular thinking and linear thinking. So linear thinking is the thinking that most computer security graduates are trained with, which is the kill chain. Everything happens through a cycle. Um, math graduates have the same thing. We're gonna follow a process, and at the end of this process, there shall be logic and a reason. Um and circular thinkers go, well, what about this factor? And what if we change that? And where would this go? And and kind of unpick all of that lovely, straight laced logic. Um and and I think it massively impacts every decision that I make. I think it impacts the way that I view the world, but it definitely has impacted the way that I think about startups. Because to me, startups are the opportunity to solve really complex problems creatively with no barriers. Like every barrier that you have in a major organization is usually either political, bureaucratic, or um systemic. And so, you know, people process technology. In a startup, you're greenfield. You don't have any of those barriers. So if you had infinite resources, how would you actually go about solving this problem? It's how I approached the agent space, and happily my co-founders felt the same. But it's a really different paradigm to we have to operate within this systemic structure, we have to operate within these boundaries. What is the minimum viable we can deliver that helps move the problem along rather than like, how would you build just to solve this problem? And I think that's fascinating. And it definitely comes into the psychological framing, as you mentioned.
00:05:02 · James Wise
[00:05:02] S1: Yeah. And look, as a venture investor, I think this is the number one insight we've had on markets over time, right? There's a lot of insights we have on people, but the number one insight we have on markets is this ability of insurgents to build the right product for the era we're in. And the reason why they can do that often is they don't have the historical organizational setup to deal with, they don't have the bureaucracy to deal with, they don't have the process alignment to deal with, which often doesn't necessarily match what the needs are of the customer. And so it's incredible you you know you spent 10 years in government, but still came out because you started so young, very young and open-minded about the opportunities to build products and change uh a sector. And initially you started at Dark Trace, where, you know, fortunately Balderton were also uh early investors as well. What was that experience like going from government into Darktrace, which by then I guess was a a scale-up rather than a startup, but still relatively early. And, you know, what are your reflections on your time in Dark Trace when it comes to building at the edge of cyber risk?
00:06:00 · Hanah-Marie Darley
[00:06:00] S0: It was such a step change from requirements and documentation and process to a meritocracy where I think Dark Trace, especially when I joined, still very much had a startup mindset in that if you thought you could solve a problem and you had a good idea, you could probably go run with it, which was massively appealing to me because I was very used to government processes. I was very used to you have to formulate a whole process of requirements and you have to check those requirements of stakeholders and so on and so forth. And so the idea that I can see the problem, I have a solution, I can go implement that solution was like groundbreaking to me. So I was really excited by that freedom. I think the other thing is the intersection between security and AI was probably brought to the fore the most for me there at Dark Trace, more than it was in government. Um, those were always very bifurcated topics in government. You know, AI was kind of over here on the research side, and cybersecurity was more on kind of the offensive or defensive side. And it never the twain shall meet, really, at the time that I was working in government. Whereas with Dark Trace, it was very much an intentional injection of both cybersecurity using AI and AI for cybersecurity and really thinking about those two paradigms in one and how do they coexist and how do they make each other stronger. And so that was really impactful for how I also think about AI, how I think about the different applications that you can use as like a toolkit. Um, all of that's really informed by the building blocks from government, but it was definitely influenced by some of the different tactics and techniques that I saw, not just at Dark Trace, but in industry that worked really well for customers and the ones that didn't. But I think the the kind of again, that red thread through it was how do I think a bigger picture about systems and technology and people when it comes to solving a really complex challenge that isn't just a binary yesno or isn't just uh malicious, not malicious. And I think that sometimes, especially in security contexts, we go really, really down to lease principles, which is like bad, good, um, which is is really helpful from a sock decision perspective, but it's probably unhelpful when it comes to planning our systems.