00:03:07 · James Wise
[00:03:07] S1: Because a lot of people, I think, when they think about um cybersecurity professionals, think about people having, you know, maybe you are a bedroom hacker, maybe you're a red teamer, um, but certainly very deep technical experience of navigating vulnerabilities, identifying them, solving them. But I guess looking at your background, you've come at this space from a technical background, but a different type of technical skill set. And, you know, as you said, alongside your government work, you did your degrees of an element of psychology in there. Um, do you find that has played into your later career decisions to go and work in startups?
00:03:37 · Hanah-Marie Darley
[00:03:37] S0: Massively. Um I think one of the things that I noticed early on in career was a bifurcation between circular thinking and linear thinking. So linear thinking is the thinking that most computer security graduates are trained with, which is the kill chain. Everything happens through a cycle. Um, math graduates have the same thing. We're gonna follow a process, and at the end of this process, there shall be logic and a reason. Um and circular thinkers go, well, what about this factor? And what if we change that? And where would this go? And and kind of unpick all of that lovely, straight laced logic. Um and and I think it massively impacts every decision that I make. I think it impacts the way that I view the world, but it definitely has impacted the way that I think about startups. Because to me, startups are the opportunity to solve really complex problems creatively with no barriers. Like every barrier that you have in a major organization is usually either political, bureaucratic, or um systemic. And so, you know, people process technology. In a startup, you're greenfield. You don't have any of those barriers. So if you had infinite resources, how would you actually go about solving this problem? It's how I approached the agent space, and happily my co-founders felt the same. But it's a really different paradigm to we have to operate within this systemic structure, we have to operate within these boundaries. What is the minimum viable we can deliver that helps move the problem along rather than like, how would you build just to solve this problem? And I think that's fascinating. And it definitely comes into the psychological framing, as you mentioned.
00:05:02 · James Wise
[00:05:02] S1: Yeah. And look, as a venture investor, I think this is the number one insight we've had on markets over time, right? There's a lot of insights we have on people, but the number one insight we have on markets is this ability of insurgents to build the right product for the era we're in. And the reason why they can do that often is they don't have the historical organizational setup to deal with, they don't have the bureaucracy to deal with, they don't have the process alignment to deal with, which often doesn't necessarily match what the needs are of the customer. And so it's incredible you you know you spent 10 years in government, but still came out because you started so young, very young and open-minded about the opportunities to build products and change uh a sector. And initially you started at Dark Trace, where, you know, fortunately Balderton were also uh early investors as well. What was that experience like going from government into Darktrace, which by then I guess was a a scale-up rather than a startup, but still relatively early. And, you know, what are your reflections on your time in Dark Trace when it comes to building at the edge of cyber risk?
00:06:00 · Hanah-Marie Darley
[00:06:00] S0: It was such a step change from requirements and documentation and process to a meritocracy where I think Dark Trace, especially when I joined, still very much had a startup mindset in that if you thought you could solve a problem and you had a good idea, you could probably go run with it, which was massively appealing to me because I was very used to government processes. I was very used to you have to formulate a whole process of requirements and you have to check those requirements of stakeholders and so on and so forth. And so the idea that I can see the problem, I have a solution, I can go implement that solution was like groundbreaking to me. So I was really excited by that freedom. I think the other thing is the intersection between security and AI was probably brought to the fore the most for me there at Dark Trace, more than it was in government. Um, those were always very bifurcated topics in government. You know, AI was kind of over here on the research side, and cybersecurity was more on kind of the offensive or defensive side. And it never the twain shall meet, really, at the time that I was working in government. Whereas with Dark Trace, it was very much an intentional injection of both cybersecurity using AI and AI for cybersecurity and really thinking about those two paradigms in one and how do they coexist and how do they make each other stronger. And so that was really impactful for how I also think about AI, how I think about the different applications that you can use as like a toolkit. Um, all of that's really informed by the building blocks from government, but it was definitely influenced by some of the different tactics and techniques that I saw, not just at Dark Trace, but in industry that worked really well for customers and the ones that didn't. But I think the the kind of again, that red thread through it was how do I think a bigger picture about systems and technology and people when it comes to solving a really complex challenge that isn't just a binary yesno or isn't just uh malicious, not malicious. And I think that sometimes, especially in security contexts, we go really, really down to lease principles, which is like bad, good, um, which is is really helpful from a sock decision perspective, but it's probably unhelpful when it comes to planning our systems.
00:07:57 · James Wise
[00:07:57] S1: Darktrace was founded on the idea of sort of machine learning was going to unlock new types of cyber risk, but also solutions, defensive solutions to those risks, uh, and obviously there for a few years. And then a new form of um artificial intelligence became available through through through Gen of AI, um which added to the plethora of opportunities and threats. Was it the beginning of that technology that inspired you to think actually there needs to be a new product set? Or was it more that you know you met brilliant people at Darktrace who pulls you out and said, look, you know, let's go and build something?
00:08:29 · Hanah-Marie Darley
[00:08:29] S0: No, I think it was definitely looking at where the market was going. I think it it was so obvious to me that generative AI in its 2022, 2023 form, wasn't going to deliver the productivity returns that most businesses wanted from it. And so it necessitated some sort of a vehicle to give the model context and operational power. And that came in the form of agents. And so I think very naturally, as soon as agents started to be kind of discussed in research circles and started to be kind of uh almost a slight ripple in the market. For me, it was an obvious flag of like, this is going to be where things go because it gives the models operational context and capability in a way in which we'll actually deliver transformational change for businesses that was very much promised by large language models themselves and by small language models, but never quite got there because it was so interactive. I always describe LLMs as kind of like, you give me cookie, I give you cookie. Like it's it's all just a back and forth, but it never really moves the needle on operational outcomes or on changing the way that work looks or or on any of the kind of business realities that will bring you true return on investment and productivity. And so again, a lot of that comes from how I thought about in government the future forecasting. I looked at some of the signals and I said, okay, well, if agents are going to be transformational to every aspect of work, if that's true, what are the things that I need to look out for? And some of it is early adoption, some of it is good returns on actual research that that showcase how it can work, especially autonomously rather than more kind of user-directed. And those things started to fall into place. And so my co-founder Henry and I had a funny conversation before we founded the company. He's like, I think businesses are probably going to take 12 to 18 months to get there. And I'm like, Henry, they're going to be there in six. Um, and you know, it was a it was a really hot take. Uh, I'm kind of infamously known for hot takes. They're not always right. But but in this case, you was in this case it was, and I definitely should have bet him money on that. But um, I think it it really, it really shows the pace of change. And I know we talked about this earlier, but the pace of change used to be measured in years.