Origins of Human Risk Management with Flavius Plesu, Hosted by Fred Menachem

In this episode, OutThink Founder & CEO Flavius Plesu sits down with host Fred Menachem to chronicle how his quest to go beyond the limitations of conventional, legacy security awareness training programs led to the emergence of Human Risk Management as a category and the founding of OutThink.

While in industry, Flavius tackled the challenge of increasing engagement with cybersecurity by every employee across an enterprise organization. What he found was what he refers to now as the “Sea of Sameness:” monotonous, uninspiring compliance programs and training modules ill conceived for stimulating genuine interest in employees across the organization.

Flavius recognized the opportunity. He collaborated with other practitioners and subject matter experts to develop a new approach based on personalization, instructional design best practices, and alignment with business objectives: cybersecurity human risk management was born. OutThink, the world’s first AI-native cybersecurity human risk management platform, was founded to bring that vision to life.

Learn about how OutThink’s relentless pursuit of building a truly excellent human-centric cybersecurity product was inspired by the greatness of Michael Jordan and the sacrifices and commitment of an amazing team.

What You’ll Learn in This Episode:

  • Why Traditional Security Awareness Training Is Flawed: while compliance is important, addressing the human element in cybersecurity warrants a more personalized, impactful approach.
  • The Founding of Outthink: How interactions with other industry practitioners demonstrated the need for a game-changing product.
  • Cybersecurity and Beyond: Why improving the security of digital life served as a gateway to dreaming about solutions for other significant challenges. -
  • Lessons on Leadership and Impact: The powers of a steadfast belief that the status quo can be improved and the perseverance to fully commit to that belief.

Full transcript

Fred Menachem (00:00)
Welcome back to the Engage and Secure podcast brought to you by Outthink. I'm your guest host, Fred Menachem.

And in part one, we uncovered how Flavius, of course, the CEO and founder of Outthink, his relentless drive shaped by his parents influence and early passions and experience led him from underdog to excelling in academics, sports and beyond. And despite setbacks, finding his path and struggling with anxiety, he transformed through self-reflection, self-awareness and innovative wellness practices, turning personal challenges into strengths.

And this journey sets the stage for his bold mission to redefine cybersecurity by addressing human vulnerabilities like no one else has. And without further ado, welcome back my brother. It's so good to see you as always. I'm so excited to be continuing on this journey with you. What's going on, man?

Flavius Plesu (00:53)
Thanks Fred, it's good to be back. I'm really excited for our conversation today. know today we're going to talk a bit about Altynk and perhaps the solution and what are we seeing out there in the real world? What are we learning from our customers? It's going to be a good one today. So yeah, excited.

Fred Menachem (01:12)
I'm excited in the first episode we got to really get to know you, who you are as a person. And it was amazing. It really had an impact on my life. And today, like you said, yeah, man, of course you are having an impact on me, man. And you're a really good person. And like I said, nothing more important in this world than surrounding yourself with good people. So yes, like you said, we're going to talk about, you know, outthink, man. We didn't really get so much into it last time, right? We're talking about you, Flavius, but.

Flavius Plesu (01:20)
Well, I appreciate that.

Fred Menachem (01:42)
So in the last episode, Flavius, we got to know you as a person, right? Who you are and what drives you, what makes you tick. And today we're gonna get into the great work that you're doing, not just you, that your team's doing and your board and your entire family at Outthink. So.

You know, see if sameness, you know, we're talking about what's wrong with human risk management today and, you know, let's talk about the status quo and generic compliance solutions that failed to engage. Maybe we should start there.

Flavius Plesu (02:12)
Absolutely. What's wrong with human risk management today is that up until a few years ago, this practice did not exist in cybersecurity. the genesis of all things, if you will, I was working with Aaron Argyle, both of us in NYCHA's market, 14,000 people across, I think it's something like 70 countries, 100 different sites.

hundreds of products and services, data everywhere. Cyber is this serious thing that the board now worries about. And you read the Verizon data breach investigation reports, for example, well-known report in the industry. And every year we see how people are the root cause of 70, 80, 90 % of breaches. And that's not changing. So Darren just asked me, right, how do we manage this?

And I didn't have a good answer. I went back to Royal Holloway, my university. I started speaking with some of the professors, some of the researchers. Our chief scientific advisor today, Professor Angela Sasse at UCL back then. We met. We were trying to think differently. That's where the company name comes from. I'll think, right? We were trying to think differently back then. And...

And we started building internally. started experimenting with different things. And what was out there available as solutions in the market was just those generic compliance solutions that just failed to engage people. You your usual security awareness training, phishing simulations, and that's what was wrong with it first and foremost. And we pretty much invented the category.

It was actually back in 2017, what's that now? Eight years already that we thought, need a better name for it. We were playing with security awareness, human risk protection, and then human risk management. And around that time, we were actually speaking with analysts like Gardner, Forrester, because we were looking for better solutions. No one had those solutions. But given those conversations, and then we've been working with

the analysts with the industry now, now it's become a term. So now you go Google human risk management, you'll get a list of solutions. Great. So, that's the first thing. Now, now we have a new software category. And I guess the second thing that's wrong with it is how do you do it? We have customers we start working with them and this is some of the best security teams on the planet. Some of the biggest companies in the world, FTSE, Fortune 100, you name it.

And so these security teams, just thought, how do we do it? They've been trying for a while. There's no instruction manual for it. This is cutting edge stuff in cybersecurity. So defining that practice and then helping customers, first of all, meeting them where they are. Right. So you've been running annual security awareness training. You've been putting some stuff out in October around security awareness month.

and you have an acceptable use policy and you've been phishing people courtly. Is that about it? Yeah. All right. So meeting customers where they are and then taking them on a journey and getting them really, really excited and fired up about this. We have a real passion for it, I think. And then they start seeing results and they start seeing that difference is possible. And yeah, it gets fun. But the start, that can be a bit challenging.

Fred Menachem (06:05)
So the start you're saying as when you started out you're talking about when you started

Flavius Plesu (06:09)
When we started out, when we started working with a new organization, with a new security team, that's used to doing things in the old way, although the old way doesn't quite deliver results. we all know what definition of insanity is, right? Doing the same thing, expect different results. So that can be a bit challenging, but beyond that point, there's real value and real excitement.

Fred Menachem (06:34)
So talk to us about the value. Like, how does that work? Yes, obviously we all know the hurdles. That doesn't matter with any type of technology, right? We're trying to implement, you know, there's always going to be, right? There's always going to be pushback and all of that. But once you get past that, how does it make, you know, what is the impact that, that, you know, these companies are seeing? Maybe give me a real life example, or you may not be able to give me a specific, you know, client per se. And I know you have, you know, significant amount, but, but give me some examples. Tell me, tell me how some success stories.

Flavius Plesu (06:41)
Yeah, I it.

Tons of stories. We'll actually go to our website. Yeah.

Fred Menachem (07:07)
Am I putting you on the spot? Because I know you've told me about it. Yeah, I know you've told me a lot of them,

but now I'm putting you on the spot. But go ahead. Tell I mean, you know, talk about it. It doesn't have to be specific to a company. But, you know, it has made an impact. And it's also it's also given people more employees more time to do other things. And you know, there's a lot of a lot of things that it's accomplished. So talk to me.

Flavius Plesu (07:13)
No, yeah.

Yeah.

Lots of customer success stories on the website, but I'll try to share, I guess, some of my favorite ones. Yeah, absolutely. Yeah, yeah.

Fred Menachem (07:30)
Yeah.

This isn't a commercial, obviously. We're not trying to give a commercial, no, I think it's important because this is not

just about Flavius, Plesiu, and a success financially for a company. This is about securing digital life. And that's really what your focus is. How do we secure all digital life? And so it's really about a mission.

Flavius Plesu (07:56)
Absolutely, absolutely.

That's our enduring division, the mission. how we do it is we have security teams put the human at the heart of security operations. And now if you think about these security teams, who is the CISO? Who is the head of cyber? Well, these are folks that have been doing it for 20 years. Perhaps in the early days it was called IT security. Perhaps then it was information security. Now it's cyber.

You did for 20 years, you get that that CXO title, you're the CXO, great. Engaging these people and helping them appreciate how.

different is possible. And if they've been doing it for 20 years, most of them, like me, they're computer geeks. So you start with your technical security controls, your firewalls, your application security, patch, vulnerability management, endpoint detection and response, all of that good stuff, which we need. But it's almost like if you were to build a pyramid, you're just keeping one level. And what I believe and what seems to be true is

you build that strong foundation and that strong foundation is your people. And so you gotta engage your people. So many, many systems out there, listening, guess, hardcore technologies, we all go towards what's more comfortable and what's more comfortable is what we've been doing the longest, so your technical security controls. But unless we address the human element,

You know, we're constantly going to be talking about those bridges, those human initiated security incidents. And so how do we do that? Well, two ways. First, and possibly the most important thing is we got to engage people in cybersecurity, right? And I think as an industry, we've been completely missing that part. We got to engage them. No, we don't just have to get them to complete the training or to...

not fish and report on the last simulation. No, no, we got to engage them. How do you engage them? Do people really want to engage with cyber? Yeah, yeah, they do. They do actually, Fred, they do. And there's a way, there's some tricks we've learned along the way there.

Fred Menachem (10:12)
So what kind of

tricks?

Flavius Plesu (10:24)
First one, make it relevant. And there's a lot that's been written on this. The top five ways to run an awareness program, the seven things, the 11 practices, whatever. And there's a lot, people are saying, well, use humor, make it personal, talk about friends and family and your kids. And it goes a lot deeper. And ironically, to address the human challenge and make people as cyber resilient as possible, you take them up to one point and...

Fred Menachem (10:27)
Yeah.

Flavius Plesu (10:54)
I'll talk about what's beyond that point. But to do that, ironically, you need some smart technology. Technology that's able to understand the audience. We use applied psychology, behavioral science, machine learning, natural language processing, AI to automate getting to know people. And this is no easy feat, you know, we're talking about organizations of thousands.

some of them into hundreds of thousands of employees. How do you get to know 20,000 people at scale? Well, pretty much you're done.

So that's where we bring technology to the solution here. And so you get something out and in a way, the Outting Solution now is able to listen to your people and start mapping out the different human risk factors, behavior and psychological attributes. And it does that. And then the next step is it presents people with the most relevant piece of information at the right time.

in line with their long-held beliefs and risk perception and behaviors. And really automating all of that, well, first of all, I've never seen it done with a spreadsheet or with pen and paper, which leads me to believe it would be impossible to do it without technology. And there's a lot of value in that one.

for the people who trying to engage and teach them a thing or two about cyber. It's saving them a lot of time. We're only presenting them with the most relevant information at the best point in time in line with their behavior. And the second thing for the security team, saving a lot of time. You conjured manatee and this is saving, this approach is saving a lot of time. So you bring it together, you're engaging people within the organization, you help them see the relevance of cyber.

We have a thing we call cyber IQ. So we demystify cybersecurity for employees. We put it in front of them. say, there you go. This is your role. These are your behaviors. This is your cyber IQ. And we have leaderboards and people compete to increase their cyber IQ. you do that. They have fun. Yeah, they have fun. They compete. People are naturally competitive. They want to win. Or at least they don't want to be lost on that leaderboard. So yeah, we make it fun.

Fred Menachem (13:05)
Yeah.

So they have fun. It's games. They have fun.

haha right so wait i'm gonna

stop you for a second because yes you know there's so many different folks that are interested in cyber right so i want to i want to kind of simplify it a bit for people that might you know not be following you know there's a broad a broad audience that might be listening and learning about what you do and sometimes it's not just cso's right

Flavius Plesu (13:32)
Yeah.

Yeah, absolutely.

Fred Menachem (13:50)
What is it that you do talk to talk to the regular man and woman or, here, how would you explain to them what you do?

Flavius Plesu (13:58)
Well, actually, thanks a lot, Fred. I realized I went in too deep, too fast. No, thanks a lot. Thanks a lot. Yeah, it's easy to slip into that mode when you've been obsessing with something for as long as I have here. Look, it's straightforward. Now think about fiber. We've not been around for hundreds of years, for centuries, millennia. That's perhaps

Fred Menachem (14:00)
Yeah, I'm trying to pull it back here.

Flavius Plesu (14:26)
doctors or lawyers or accountants have been right. So cyber is a new discipline. And when we talk about cyber, we all know it's people process technology. And we started with technology first for computer, most of them computer gigs, most of us, I include myself here, I did my computer science degree, right? So most of us computer gigs. And so that's where we start, technical security controls, good. And then we realized,

We got some processes in place. We got to write the policy, perhaps write the information security policy acceptable, acceptable is policy. And then we're left with the people element. How do we do that now in cyber? If cyber is a new discipline, well, human risk management, it's really in its infancy. And so, so what do you do to address that challenge? Well,

You turn to security standards such as your NIST, your ISO 27001, your critical security controls, your standard of good practice. You pick your favorite and you go through the standard and it tells you what to implement. And then you get to people and it reads, deliver regular security awareness training for the employees. Okay. That sounds good. It's not all that smart.

Fred Menachem (15:45)
Right. And so, right. I'm sorry.

No, so I'm stopping you for a minute. OK, because we're to get to this. want you to continue. But this is where you start to address a problem, right? Because humans are humans are can be the biggest danger, but also probably the biggest strength at some point one day. So so Flavius plushes here. He's like and you tell the story after I know the story about when this all started out like how. But but you're breaking the mold, man. And so

Flavius Plesu (16:04)
Okay.

Fred Menachem (16:15)
You're getting into the problem now, you know, you talk about, you know, let's talk about the genesis of outthink and you know what you're doing and and and how it's making an impact and all of that because you were getting to it. But I just wanted to interrupt for a moment.

Flavius Plesu (16:32)
The genesis really we started with research. At some point we realized we had a team of CISOs and researchers, all of us around the table trying to figure this out. And we counted and we realized we had over 100 years of collective experience and that made some of us feel old. So we're not talking about that much now.

But it started with some of that research, Darren and I internally at IHS Marquis, we were trying some of those things, mostly failing. And then it continued. I went to the Bank of Ireland, again, we were trying a number of things there. And I was talking about this stuff, I getting on stage. I remember, I guess the reason why I think was important.

Fred Menachem (17:26)
You were talking about the problem

before you were talking about the problem, right? right, right.

Flavius Plesu (17:30)
was talking about the problem, was talking about human risk management. We

came up with that concept already. And I think in 2018, if I remember this correctly, Verathon, the large UK British telco, they hosted the information security forum at their campus in Newbury. And I was on stage and I was talking about a problem, potential solutions back then. And they approached me and they said, hey, we have the same problem. 130,000 people across the world.

Can we use your solution? That was the magic question. And I was naive and I said yes. And I didn't know what I said yes to. 2018, yeah, what, seven years now? Of course. Yeah. That's exactly what I thought. And then before you know it, before you know it, you realize you've got to hire lots of engineers.

Fred Menachem (18:01)
This is the

How long ago is this? How long ago?

2018 so they come up to you they're like and you're like, of course you're like, yep. Okay, right. You'll figure it out. All right.

Flavius Plesu (18:28)
You realize this stuff is really expensive. So I had to go learn how to raise money from VCs. I didn't even know what a VC is, venture capitalist. You're laughing Fred, but I didn't know what a term shit was. was in... There you go. I remember I was in this elevator in New York and another founder said to me, he's getting a term shit. And there were a bunch of other people in the elevator. I didn't want to sound stupid. So I didn't ask what that was, but...

Fred Menachem (18:36)
hahahaha

Hey, guess what? I'm not laughing because I never understood what it was until the last like seven, eight years. Yeah, so don't worry about it. No.

Flavius Plesu (18:58)
When we got out onto the street, said, hey, man, what's the term shift? So that's one of the things we give you when they say, yeah, we like what you're doing. We want to give you some money. These are going to be the terms. And so, yeah, I went out and I raised some money. I we did our first fundraise in 2020 and we raised a small amount. Like I think it was $1.5 million, the first raise, and we started building and we're still building now. And we raised another 10 million.

in between and I think we're, I know we're going to continue raising because really building AI that makes sense and delivers value to customers in the real world, that's seriously expensive. really interesting. It's been quite, quite a ride. I didn't know what it takes to build a software company. So that was the Genesis. We started building. We're still building.

Fred Menachem (19:47)
.

Flavius Plesu (19:52)
And now we're working with these massive organizations and helping them go from what I described earlier as the compliance requirement, run awareness training for your employees once a year, to a journey towards actually managing the risk and preventing, and if not preventing, least reducing the number of human-initiated security incidents. So that's where we are.

Fred Menachem (20:16)
I will say this because I'm always very I love telling these stories and the raw stories because like how many Entrepreneurs have started out that way somebody says can you do it you say yes, and you're like what the heck? But I do want to say this because I think it's very important for people listening to you like this guy's not you know This company's just blowing something up look out think has won God numerous awards. I think and and I think it was it was a Gartner right you were you were recognized a leading representative provider in the security behavior and

Flavius Plesu (20:41)
Yeah.

Fred Menachem (20:44)
Culture programs, think it's SBCB or something. then, and then, you were acknowledged by Forrester and then what is it? Giggum, Giggum, I think I'm saying it right. Is that correct? So I remember hearing all of that. So I just want to say that because you know, you're a humble guy, but like, that's amazing. Like somebody comes up to you, they're like, Hey, you're like, yeah, but you know what? It's that's also for my guy who says he doesn't have confidence. You know, you're like, shit, we'll figure it out. And, and that's, and, and, and so this is a pretty short period of time. This is.

Flavius Plesu (20:48)
Yeah, well done.

Yeah, yeah, yeah. Get you off, yeah.

Fred Menachem (21:12)
2018 was the Nexus. only now in 25 and you you got leading industry awards. So you had an obsession with creating products. You told me once, right? You said something funny. You said functional, then you use the word beautiful. Is that right? Am I remembering that correctly? Yeah. So what's that? What's the story behind that? Yeah.

Flavius Plesu (21:28)
Yeah, absolutely. It's got to be beautiful.

Wow. Interesting. So, when we started, I was introduced to Matt Slater, our CTO now. And Matt, he knows this. I told you once too many times, know, Matt's just amazing with technology. things he does, it's exceptional. Matt was building SAS before SAS was called SAS for some of the top banks.

in the world, some of the leading organizations out there. then Matt and I started building here. So I, today I believe I'm convinced we have the best piece of technology in this space in the world, hand on heart. Now, I decouple between product that customers experience and technology. In my mind is like this iceberg picture. And so what's sticking out above the surface, that's your product. And that part's got to be beautiful and functional.

What's making that possible is your technology below the surface. And that's what that's really good at now. Having been a CISO and out thing having having been founded by CISOs by a team of CISOs, we don't get the technology as much as we want to know what it does and we want to get value from it. So we care about the stuff that's above the surface. That stuff's got to be functional. It goes out in front of everyone. Now we have millions of people.

using the Outting platform. So it goes out in front of millions of people. So it's got to be beautiful. Now, microservices, API first, the CDNs, all of the stuff Matt brought and built, I didn't know much about. But that's what allows the product to be functional and beautiful. and.

I we take great great product in what we put out there in front of our customers. We were really, really on a mission here and we're convinced we're building the best product in this space in the world. It's what I said earlier, Fred, you know, it goes out in front of millions of people. So so so these people, if you picture that, it's. It's probably put them together, it's more than you've ever.

seen the tend to largest concert or Super Bowl or you name it that millions, millions of people, it could be a country, many countries are smaller than that. So it goes out in front of these people and then you have this sense of responsibility. Hey, they're giving us precious lifetime time they take away from their job, their families, their hobbies, whatever, right? So what are we gonna do with that? So we're...

We're feeling this responsibility here to give them a high ROI for whatever time each of them are giving us, for 20 minutes, 10 minutes, five minutes. We've got to give them a great experience. And so we're really a product-led organization and a product-obsessed organization. Yes, it's got to be functional and beautiful.

Fred Menachem (24:43)
So you were talking about, you know, the functional and the beautiful. And it brings me back to what we talked about in the first episode when you were talking about this excellence, right? This is like this in my mind, when I hear you talk about this is like the culmination of everything in your life. You know, excellence, excellence from could be basketball, the kickboxing, the bodybuilding, you know, all the things, you know, you wanted this, this like nexus of being excellent. And now you found your like,

This is like your jewel, man, right? This is like the culmination of Flavius Plesiu and everything in your life that was about building excellence. you say that?

Flavius Plesu (25:25)
It is, but it's not just me and it's probably more my team than it is me. And I say this in the most honest way possible. If I have a gift or a quality here, I guess as a founder, perhaps I'm the guy that has a crazy idea that believes something different and better is possible. And I got things in motion. But all of these people that

Fred Menachem (25:34)
Please.

Flavius Plesu (25:55)
that really brought their contributions along the way, all of their ideas, all of their hard work, their commitment, their... I say this, it sounds big sacrifice. Yes, people have made huge sacrifices to bring this to life. It's really the team. I... Fred, I would not have been able to do any of this other than make a start and I guess keep us on track. That's probably...

I get a bit of credit there for vision and keeping us on track and keep going towards that. And this relentless pursuit of excellence. And I think of Michael Jordan, for example, basketball going back to that sport. But you also see someone playing the piano. Whatever sport, form of art, there's beauty in that.

That's what we want for our product here. want people to look at it. We want us to look at it and go, man, that's beautiful. That's art. That's exceptional. So yeah. But it's really the team. My promise is the team.

Fred Menachem (27:08)
And look, yeah, but that's about,

hey, listen, when you have humility, you surround yourself with people that are smarter than you. That's what I always say, right? not saying that you're not smart. I'm just saying, but that's the truth, right? Of course. And exactly. And that's, and that's amazing. Exceptional people who have the same vision, which is beautiful. on that note, we're talking about vision. So before we get into the bigger mission, which I really love talk about, I want to talk about, you know, the, the, an important mission, which is compliance and,

Flavius Plesu (27:17)
I'm lucky. I found some exceptional people.

Fred Menachem (27:37)
and how you're going to achieve 100 % compliance. sort of, you know, that's one of the key visions for the company. And that is a noble goal and a difficult one as we know. And it's an important one. how are you, what are you doing to get there and how do you believe you can? And you are on that way.

Flavius Plesu (28:02)
guess it's becoming to feel easy now, Fred. We have customers now that deliver exactly that. They use Alting and they deliver 100 % training completion. 100%. Not 99%, 100%. I remember, well, the CISO there, without naming people and organizations, is now on our customer advisory board.

They've been trying for a few years. We replaced one of the incumbents, one of the legacy solutions in the market. The guy was just desperate giving up on it. And we met and perhaps it was the passion or I don't know. The guy decided to give out things, a try. And a few years now, a few years on now.

They're getting that hundred percent completion that they they're making their people as cyber resilient as possible and they've moved beyond and now they're integrating with their security systems. And, know, even if you really make people cyber resilient, they're still human at the end of the day. So they get tired, they travel, things will happen. They make mistakes. Some of these phishing attacks are really good. You know, we're only human. So what happens, what they did beyond that is they go into conditional access, automating security controls.

to really address the residual risk there and prevent human initiated security incidents. And guess what happened for this ESO? And this is a company in natural resources. It's not even a bank, it's not financial services. What they do is they get gold out of the ground. That's their business. So their board have top 10 priorities as a company. To be in a board meeting, you gotta make it onto that top 10.

Cyber wasn't part of the top 10. A few years, made made Manichiga Cyber into top 10, number seven, number five. Now it's top three for that board, for that company, for that CISO. Cyber is now top three, a top three business priority for that company. And he leads with people. And then so our solution has become of strategic importance to that customer. And then you asked me earlier about customer stories. I remember this other CISO in...

in manufacturing, again, another interesting industry, not as obvious as banking or perhaps, whereas with banks, you would certainly understand why hackers go off their bank. They have data, they have money, but manufacturing, really? Yes. So again, Fortune 100 organization, big manufacturing organization there, the CISO.

Fred Menachem (30:32)
Right.

Flavius Plesu (30:46)
has been getting so much success on this front, he got to a point where he says, if I have 100 bucks, I'm going to spend 50 on people and on human risk management. So this, know, I started out think and then it's just a real to hear about these customers and their success. It's wow. And yeah, talking about the mission and bigger things, Fred, I'm happy to go there. But I feel you have another question for me.

Fred Menachem (31:12)
That's what exactly the mission. what?

No, no, no, exactly. You know what, man? You took the words right out of my mouth. So I wanted to move to the next topic before we do that. I wanted to I wanted to say one thing when you talk about manufacturing, everything's a risk because if it's not economic, it's geopolitics, right? It's foreign adversaries. It's you know, it's it's it's Iran trying to to to get right. Right. Darren and I always talk about that supply chains. And of course, it's it's

Flavius Plesu (31:17)
Alright.

Absolutely.

supply chains absolutely.

Fred Menachem (31:36)
Anyway, that's another conversation we should have in the future, but let's talk about bigger mission. Let's move on to legacy and impact. you know, solving human risk as a foundation for a bigger mission to talk about.

Flavius Plesu (31:48)
Absolutely. So what we're seeing, Fred, is this increased reliance we have as a society, as a species, if you will, on digital services, which certainly wasn't the case 50 years ago. But people really turn to the digital for serious things, know, their health care, their education, their work, their finances.

And we believe this is a one way street. This reliance is only going to continue to increase. And of course, we know cyber criminals disrupting these digital services. There's a lot to gain there. And I guess our vision as a company is to secure digital life everywhere. Whatever digital life is going to look like in the future, there's got to be an organization out there.

securing that digital life and we would like that to be our thing. But now perhaps beyond just cyber, you know.

The world needs people who actually are brave or foolish enough to put themselves out there to tackle some of these big, big issues, right? We have war, a lot of suffering, right? There's this extreme poverty. It's so easy for us, know, living in the UK, in the West.

to believe that, this is probably how the rest of the world lives. And it couldn't be further from the truth. And so I guess that's probably what brought many of us together. I'll think this belief that, well, sure, yeah, we gotta go and we gotta help organizations address human risk management and we gotta go out there and secure digital life everywhere. And then there's gotta be a beyond. There's gotta be.

Fred Menachem (33:31)
Hmm

Flavius Plesu (33:56)
you know, the next project that's going to have a big social impact. And I guess we have that in common. It sort of unites us. And I know, you care about these things as well. And I know your team does. So perhaps that's why we enjoy working together so much.

Fred Menachem (34:12)
And I think that's what makes us human beings. Right. And it doesn't matter what we're solving. It matters what we're solving, but it's about solving things. Right. So, you know, there's things that maybe speak to us more and, because, you know, you grew up under communism and we've all had, and I've lived in, you know, I've seen a lot in the world. We, we, when we're exposed to other things, we want to, we're problem solvers. We want to solve them. We don't want to see people suffering, right. In any capacity. So I get it. And, and that's also why, why I, I, I gravitate to you as well. So look,

Obviously, you you're leading the way in this space and like we talked about, it doesn't stop a human risk and, you know, dealing with consequential problems is so important. And I did want to kind of move on a bit to an interesting topic. And I'm kind of just shifting a bit here. But what an eight year old flavius would be proud of today, you know, and, you know, cybersecurity is just the beginning of the story. Right. And you talked about

creating solutions that solve the world's most pressing issues. So talk to me about some of that. You know, yeah. sorry about that. Yeah. I caught you. I called you. I caught you for a loop, man. That's what I was trying to do.

Flavius Plesu (35:17)
That is a great question. I did not see this one coming, but give me a moment.

You do that for sure. Look

man, I grew up, my family, everyone's religious around me. I grew up religious. I got to a point where I think, I don't care whether you call it God or Allah or Buddha or something else, whatever you want to call it. I do believe there's this something that holds it all together. There's this force, this energy.

And I don't know why we're here and the meaning of life and all of that, but I know that we're here. And I think while we're here, the most worthy pursuit is to try to alleviate human suffering. And I think that's what the eight-year-old Slavist would be proud to see me do. My dad...

has always cared about this and I do care deeply and then we've started a couple of charities and but I want to do more Fred. And then perhaps I'll think is going to serve as a stepping stone. know, the way many tech entrepreneurs have done it. Whatever whatever exit this company is going to have, know, perhaps.

At that point, can use that as a leverage and we can, you know, on this journey, we get to meet many, many wonderful people who care again, like you, like your team, like my team. So, yeah, perhaps something is going to be a stepping stone and look, man, I'm not brave enough to even say this out loud. What my, I know, because I'm not going to say it, but I you I'm not brave enough.

Fred Menachem (37:13)
Well, you're about to. Okay, okay, okay, okay.

Flavius Plesu (37:19)
what that next really crazy project is going to be. I'll share it one day, but today I think that that's too crazy and straight away we would lose half of our audience. don't make me go there.

Fred Menachem (37:22)
Yeah.

Well, so we will talk about that in the future. Let me

say a couple of things

I did want to say a couple of things because I know we're getting to time and you and I can talk and we do a lot. the first thing I wanted to say was actually going to end it on this. So there's two things I want to say. And I thought it was interesting. Something that you said to me.

You know, I was going to make a joke that you're called out think because you can out think, you know, the competition, everybody else. But but, you know, that was more to be funny. but something you said to me, though, all joking aside and yes, you know, you're in business and like everybody, you want to be successful. want to, you know, make money for everybody you want to. That's not the that's not the main driver. You know, of course. Yes. Don't your boards listening? Yes. Want to make money and be successful. But I think, you know, you're surrounded by people. And I know some members of your board and everything that believe in something much.

bigger than that and you said something to me the other day and I was like really impressed by it because I said look you know what you do is amazing I've heard great things and you guys are gonna kill it and you're getting more money and you said look yes of course I want to be successful but what I care most about is is to be contribute to the industry in and of itself and say I'm not somebody that thinks I want to destroy my competitors or anything like that say you know I hope

You know that that what I'm doing can help them also build success. I just want to be more successful, but I'm kidding. But, all joking aside, but no, that's what you said. And I thought that was interesting that yes, you know, your, your, your, your job at the end of the day is to make this industry safer and make it better. And that you'd always be willing to, know, and that you're always interested in getting to know leaders in the industry and, and, and, and really contributing to, to, to that mission. And I thought that was just, I really admired that. So.

Flavius Plesu (38:56)
Yeah, absolutely.

thanks.

Well, Fred, it's easy. A rising tide lifts all boats. It's really simple. so whenever I see another solution provider in the space adopt the same sort of thinking or approach, and now they're a human risk management platform, I think that's great. I think that's awesome. It's helping raise awareness. It brings more data.

As a company, last year we've analyzed over 100 million data points. And it's fascinating. What we've seen is 80 % of security incidents are caused by 8 % of people. And there's only about 2.7 % of people within organizations that can do real damage because they have privileged access or are in a high risk role, right? But that's only our thing. That's only our data, 100 million data points, right? How much data can we all bring to this as an industry and what else can we learn?

Fred Menachem (40:05)
Right?

Flavius Plesu (40:12)
So that's fascinating, that's exciting. So absolutely, yes, let's team up, let's partner up. We play with lots of different solution providers in the space, lots of CISOs, lots of experts to actually find the ultimate solution to really making people in organizations cyber resilient. And guess what? Yes, we're fighting cyber crime and that is a worthy cause because fun fact, not fun.

from maybe sad even, the Italian mafia. I had a conversation with the head of the Interpol e-crime unit and I found out that they make more money from cyber than all of their other illegal activities combined, combined everything together. And what happens with this fund, human trafficking, this fund, everything else. So if we can fight this.

Fred Menachem (41:11)
Yeah, I and and that's why I brought that up because sometimes we forget we're all focused on business. We forget that we have the opportunity here to save lives. And I'll say this. I'm going to end on this on two things. Right. Really. And protect people. And that's because I was very involved with different industries like that. But so with watching horrible things like that happening to kids and that sort of thing. But I want to say two things that will end on that is

Flavius Plesu (41:11)
Yeah, it's going to make the world a better place. Absolutely.

Real life.

Fred Menachem (41:34)
The first thing is I want to ask you a question. We earlier in this conversation, I saw you, man, you lit up. You were talking about millions of people like being in a freaking stadium, some bigger than other countries. I saw you, man. You're like, wow, if you really think about it. And I saw a smile, man, like all the other, the insecurities, all that went away for a minute. Come on. You got to tell me you're not proud of that, man. Just say it right here.

Come on, man, you gotta be a little, that's something that I mean, I'm proud of you for that. Take a minute, man. Like, think about it.

Flavius Plesu (41:59)
Yeah, it's surreal.

It's a real lie. I started out think I did. I didn't have this this goal. wasn't a million users wasn't five million users. It wasn't a hundred million data points. It was just look, I think something different is needed and we can build that and not many people know this and I'll share it here publicly. Our first head of content was my wife.

Uh, you know, things. Yeah. And then so her boss at the time, my wife used to work for the financial time. Um, and she's created digital content. So her boss at the time, uh, came to me and said, Hey, I think we should hire your wife. You know, she would care. And I've seen her work and she's really good. Sure enough. She did care, perhaps a little too much, um, burnout, right? So she had stopped at some point, but she created our, our, our first set of content and then.

Some of the stuff she created there, it's what now goes in front of millions of people. And then we sometimes joke about this and we think, hey, did you actually really believe the stuff you put together there is going to go in front of millions of people? And no, none of us did. Yeah, pretty proud. And I she's proud as well. Yeah.

Fred Menachem (43:16)
I'm proud. She should be

proud. She should be proud. And I'm proud of you. So on that note, let's end with this man. So we've got two episodes. We're ending the second one. We've talked about a lot of things. So there's no there's no direction here, man. This is on you. But what thought or advice would you like to leave, you know, viewers, listeners with today? Just. Something.

Flavius Plesu (43:47)
It's just that, know, just be brave and believe something better and different is always possible.

Fred Menachem (43:54)
Flavius, bless you, man. The man, the myth, the legend, CNO, CEO and founder of Outthink, an amazing company doing amazing things, protecting people, helping humans do better, helping us stay safer. It's been a great episode, my man. And next on the Engage Insecure podcast, a true powerhouse roundtable. We talked about it, man. It's coming, it's coming with industry leaders, psychology experts tackling human risk management like never before.

Flavius Plesu (43:56)
You

Fred Menachem (44:23)
you know, fresh perspectives are going to come out of it bold ideas and dynamic conversations that will make you question how you're currently approaching human risk. And we're building this as we go and lots of ideas are going to happen. So I can't wait for obvious. What a great, what a great episode, man. It's been so much fun. love hanging with you, brother. Thanks for having me. And thanks for giving me the honor. Yeah, man. We'll talk. We'll wrap soon, brother. Oh, always do my man. Yeah, can't wait, man. Can't wait. It's been fun.

Flavius Plesu (44:42)
Like this one.

I really, really enjoyed it. Yeah. Really excited about the next one. Absolutely.

Fred Menachem (44:53)
All right, brother. So until then, thanks for joining Engage Insecure podcast,

Flavius Plesu (45:01)
Bye!

Train your workforce with the best in cybersecurity

Related Articles
Why Cybersecurity Human Risk Management Benefits CISOs
Gry Evita Sivertsen
29/04/2025

Why Cybersecurity Human Risk Management Benefits CISOs

Read More about AI-Native Cybersecurity Human Risk Management
Cybersecurity's Comfort Zone Problem
Jane Frankland
15/04/2025

Cybersecurity's Comfort Zone Problem

Read More about AI-Native Cybersecurity Human Risk Management
AI Phishing: The Rising Threat of Intelligent Cyber Deception
Roberto Ishmael Pennino
02/04/2025

AI Phishing: The Rising Threat of Intelligent Cyber Deception

Read More about AI-Native Cybersecurity Human Risk Management
What Maslow’s Hierarchy of Needs Reveals About Cybersecurity Flaws
Jane Frankland
01/04/2025

What Maslow’s Hierarchy of Needs Reveals About Cybersecurity Flaws

Read More about AI-Native Cybersecurity Human Risk Management
How Adaptive Security Awareness Training Drives Better Cybersecurity Outcomes: The Science
Rory Attwood
11/03/2025

How Adaptive Security Awareness Training Drives Better Cybersecurity Outcomes: The Science

Read More about AI-Native Cybersecurity Human Risk Management
PIPEDA Compliance: Why PIPEDA Training is Important
Roberto Ishmael Pennino
21/02/2025

PIPEDA Compliance: Why PIPEDA Training is Important

Read More about AI-Native Cybersecurity Human Risk Management
CCPA Training: Building a Culture of Privacy and Compliance
Roberto Ishmael Pennino
10/02/2025

CCPA Training: Building a Culture of Privacy and Compliance

Read More about AI-Native Cybersecurity Human Risk Management
Data Privacy Week: How Convention 108 Paved the Way for Modern Privacy Laws
Roberto Ishmael Pennino
31/01/2025

Data Privacy Week: How Convention 108 Paved the Way for Modern Privacy Laws

Read More about AI-Native Cybersecurity Human Risk Management
TISAX Training: Strengthening Automotive Information Security and Compliance
Roberto Ishmael Pennino
27/01/2025

TISAX Training: Strengthening Automotive Information Security and Compliance

Read More about AI-Native Cybersecurity Human Risk Management
GDPR Training: Building a Culture of Compliance
Roberto Ishmael Pennino
20/01/2025

GDPR Training: Building a Culture of Compliance

Read More about AI-Native Cybersecurity Human Risk Management
What Is DORA? DORA Training for Compliance
Dr. Charlotte Jupp
20/01/2025

What Is DORA? DORA Training for Compliance

Read More about AI-Native Cybersecurity Human Risk Management
Risk Quantification for Cybersecurity Human Risk Management
Lev Lesokhin
13/12/2024

Risk Quantification for Cybersecurity Human Risk Management

Read More about AI-Native Cybersecurity Human Risk Management
Empowering Organizations with Adaptive Security Awareness Training
Roberto Ishmael Pennino
07/11/2024

Empowering Organizations with Adaptive Security Awareness Training

Read More about AI-Native Cybersecurity Human Risk Management
Cybersecurity Awareness Training for Remote Workforces
Roberto Ishmael Pennino
25/10/2024

Cybersecurity Awareness Training for Remote Workforces

Read More about AI-Native Cybersecurity Human Risk Management
Human Risk Management Gets Adaptive
Lev Lesokhin
08/10/2024

Human Risk Management Gets Adaptive

Read More about AI-Native Cybersecurity Human Risk Management
What is Cybersecurity Human Risk Management? What You Need to Know
Lev Lesokhin
23/09/2024

What is Cybersecurity Human Risk Management? What You Need to Know

Read More about AI-Native Cybersecurity Human Risk Management
Engagement Strategies for Cybersecurity Human Risk Management
Lev Lesokhin
16/08/2024

Engagement Strategies for Cybersecurity Human Risk Management

Read More about AI-Native Cybersecurity Human Risk Management
Enhance Your Phishing Training With Outthink
Lavinia Manocha
02/08/2024

Enhance Your Phishing Training With Outthink

Read More about AI-Native Cybersecurity Human Risk Management
Adaptive Security Awareness Training for Frontline Workers
Lavinia Manocha
26/07/2024

Adaptive Security Awareness Training for Frontline Workers

Read More about AI-Native Cybersecurity Human Risk Management
The Role of Security Awareness Training After IT Outages
Lev Lesokhin
26/07/2024

The Role of Security Awareness Training After IT Outages

Read More about AI-Native Cybersecurity Human Risk Management
Human Risk Management's Eight Dimensions of Secure Behavior Segmentation
Lev Lesokhin
25/07/2024

Human Risk Management's Eight Dimensions of Secure Behavior Segmentation

Read More about AI-Native Cybersecurity Human Risk Management
State-Sponsored Phishing Attacks Target 40,000 Corporate Users: What This Means for Protecting Your Business
Lev Lesokhin
18/07/2024

State-Sponsored Phishing Attacks Target 40,000 Corporate Users: What This Means for Protecting Your Business

Read More about AI-Native Cybersecurity Human Risk Management
Adaptive Security Awareness Training: Unlearning and Relearning Routines
Lev Lesokhin
10/07/2024

Adaptive Security Awareness Training: Unlearning and Relearning Routines

Read More about AI-Native Cybersecurity Human Risk Management
Did You Think Your Password Was Secure? Let’s Talk Password Security
Lev Lesokhin
24/05/2024

Did You Think Your Password Was Secure? Let’s Talk Password Security

Read More about AI-Native Cybersecurity Human Risk Management
Rethinking Security Awareness: Towards a Cybersecurity Human Risk Management Framework
Lev Lesokhin
23/05/2024

Rethinking Security Awareness: Towards a Cybersecurity Human Risk Management Framework

Read More about AI-Native Cybersecurity Human Risk Management
Password Security: Why the UK is Banning Generic Passwords
Lev Lesokhin
17/05/2024

Password Security: Why the UK is Banning Generic Passwords

Read More about AI-Native Cybersecurity Human Risk Management
Instagram Security Awareness Training: A Step-by-Step Guide
Lev Lesokhin
10/05/2024

Instagram Security Awareness Training: A Step-by-Step Guide

Read More about AI-Native Cybersecurity Human Risk Management
Cybersecurity Human Risk Management Forum Kicks Off in London
Lev Lesokhin
18/04/2024

Cybersecurity Human Risk Management Forum Kicks Off in London

Read More about AI-Native Cybersecurity Human Risk Management
Gamification Can Enhance Security Awareness Training – Badges and Leaderboards Are Just the First Step
Rory Attwood
31/01/2024

Gamification Can Enhance Security Awareness Training – Badges and Leaderboards Are Just the First Step

Read More about AI-Native Cybersecurity Human Risk Management