Digital forensics is the process of identifying, preserving, analyzing, and presenting electronic data for investigative purposes. It's often related to addressing cybercrime and is crucial in tracing the origin of breaches, recovering lost data, and security hardening. Emery Tanez Tepe is the founder and CEO of Benalize, which is a cybersecurity company specializing in digital forensics and incident response solutions. He joins the podcast with Gregor Vand to talk about his path into engineering, his time in the infantry, Benalize, digital forensics, and more. Gregor Vand is a security-focused technologist and is the founder and CTO of MailPass.
Previously, Gregor was a CTO across cybersecurity, cyber insurance, and general software engineering companies. He has been based in Asia-Pacific for almost a decade and can be found via his profile at vand.hk. Hi, Emery. Welcome to Software Engineering Daily. Hi, Gregor. It's a pleasure being here. Thank you for the invitation. Yeah, great to have you here, Emery. Yeah, as we might get into, we've met once before, back when I was at a company, Black Panda. And as we might hear, that's now a customer of Binalize, which is what we're here to talk about today. So normally, I kick off these episodes with a background of yourself. I'm actually going to just add in one pre-question just to help, I think, our listener base, because we're going to be talking a lot about digital forensics today. And I think just to make sure there's no misunderstanding around what we're talking about, actually, could we just define digital forensics and then we'll jump into your background? Sure.
So digital forensics is actually a pretty old profession. It's an industry on its own. These days, I see that it's kind of seen as just a feature when it comes to endpoint security, but it's actually an industry on its own, and it's even longer than the endpoint security industry. So it's basically the art of collecting evidence, preserving it, and analyzing it. And the way we define digital forensics in traditional aspects is this. So collecting it, preserving it, analyzing it, and then presenting it to the court for solving an investigation. But what we do...
is a modern way of doing digital forensics, which we'll be digging deeper into. Exactly, exactly. Okay, that's great. We've got a sort of a basis of what is digital forensics. So I will now go to the normal start, which is, tell us a bit about yourself before founding Finalize. I'd love to just hear what was the road to founding Finalize. Sure. Before we start, today I learned you were the one who referred our product to Black Panda and also our chief investigator now. So you guys were working there together. That's another indicator of developing a product that solves a challenge, that addresses a need. So thank you once again for the invitation. That did happen, yes. Thank you so much. 39 years old, I started coding.
at the age of 11, 12. So it's been a very long time. And I don't remember myself without like having access to a computer, like not coding something. So maybe like two months, three months break, but I was always developing something because that's the passion. And the way I started was like, we had five computers at that time. And we were sitting, I clearly remember that when we were sitting like three students in front of every PC. So we were like coding interns. And I think this is very important because the teacher who taught us how to code, she said, this is not actually a part of the semester. So this is not a part of the curriculum. I'm supposed to teach you Windows 95.
But I studied archaeology, and I wasn't able to find a job. So I'm going to be teaching you QBasic because that's how I started making money. And that's how I decided to be a computer teacher, like programming teacher. So she said, I'm going to teach you just in case you use it in your career. So that's how things started for me. And then again, I'm in XMIL3. I started in XMIL3 High School after that one, after the secondary school. At the end of every computer class, our teacher was giving us some like 10 minutes for us to like play or do whatever we want. Because if he didn't, then people are finding ways to do it like in between the class. So in the last like 10 minutes, I was coding something on QBasic. I was probably writing some like for loops, like printing some numbers to the screen. And then he asked me, what are you doing?
I said, I'm learning QBasic. And at that time, I was also jumping to Perl, which was another programming language, which was quite popular at that time. So I mean, these are happening at a very early age. So I'm really grateful for meeting these teachers. And then I started Military Academy in that period again. I had access to computer all the time. And started learning Massen 32, which is Microsoft Assembler. So I was going deeper and deeper. Started with QBasic and then Perl. I remember working with Java for around a year. And then PHP was getting quite popular those days. So we were designing, not with frameworks. So I really envy the ones who started later because there are no frameworks for that.
So you were basically writing everything from scratch. So all the content of that webpage was delivered by code. There was no middleware in between. So I started to go deeper and deeper. And I remember at the last year of the university, it was Muslim days, a Microsoft assembler, which was basically 32-in instruction set. And I was fascinated with it because that was the moment I understood that, okay, all these codes that I've been writing is basically translated into this that executes on the machine. So yeah, that's how it started. And my career has nothing to do with computer science, actually, because I was in infantry. My first mission was in Iraq.
So I stayed there for two years. I was an infantry pilot trooper. And in that process, I proposed 14 projects. None of them were accepted because, you know, military is quite strict when it comes to innovation. That's not the best place to do stuff if you're coming up with new ideas. And my role had nothing to do with innovation. I was an infantry. So I proposed 14 projects. These were mainly robotic devices, like small circuits and some software projects as well. None of them were accepted. And on the 14th one, I decided, OK, I think I'm in the wrong place. So I shouldn't be here. I should be somewhere else in private sector. And I resigned and I was offered.
to work as a malware researcher. Because those days I was like digging deeper into how to reverse engineer malware, how computer viruses work. That was quite a fascinating idea for me. Like having a small, a few kilobytes of binary that can do stuff autonomously and then like spread around the world was, it also like sounded quite dangerous and I wanted to know how it worked. So I started as a malware researcher and then I received an offer from Komodo. I led their mobile malware research team for a year. And that was the moment I understood enterprise is not for me because I really missed being in a startup. My first career opportunity was in a startup. And then I returned back to that startup that I joined after the army, this time as a shareholder.
And then worked around like seven, eight years. It was quite an experience. So I learned what to do, what not to do also, because startups are great for learning what not to do. And then I started Finalize. So that's the quick background on me. Awesome. So I mean, I think it's fair to say that a lot of founders, they end up founding something that's solving a problem they've personally experienced. So I guess sort of leading on from the sort of history, leading up to that point of what you've just explained, was there some kind of something you'd experienced already that then drove you to say, well, Finalize, this should be a thing? Like what was the sort of moment there?
Actually, my background is not digital forensics, but I was pulled to digital forensics because of like working with our advisors. So the first time I realized that there is a need was I met one of our advisors and they were looking for someone who was like going to help them spot an insider case. So there was a malware infection or claimed to be an malware infection, but this needed to be approved. So the claim is like a person, like a suspect was saying, I did not do it. My computer was hacked and it was done by the attacker. So we had to crew this. So it was a combination of forensics and reverse engineering malware analysis. So all of them were getting like close to each other around like 15 years ago.
And then the second investigation, this time with our second advisor from your police department, they had a big financial institution, another breach. And the claims are really high. They will get this from the insurance provider. But the problem is the SDK, the platform, like the software they were using at that time, it shows a file, but no one knows what the contents of that file is. So it shows that potentially encrypted. And the interesting part was this file was starting as an autorun. So it was like automatically running when the machine rebooted. It didn't make sense. So, I mean, it shouldn't have some like encrypted contents if there is some data.
And it turned out to be a trick that was used by attacker to run another binary. So these were the indicators that traditional forensics was actually coming to evolve in a way that traditional antivirus industry evolved. Because when we started on the antivirus industry, first it was the on-demand scanning. So you were scanning your computer and then antivirus companies introduced new methodologies like on-access scanning. So this way, whenever you or the process accesses a file, it was automatically scanned. And then we came up with the idea of why don't we make it faster and introduce on-execution scanning. So if something is not running on your machine...
Why am I supposed to touch that? Because when the first 10 terabytes was introduced, computers were very small, like the hard drives were very small. But the last time I remember having a hard drive, like in my hand, it was two terabytes. So if I'm supposed to scan all those files, it takes like hours. So that was when we decided, why don't we do this on one execution scan? So these type of innovations were being done on the AV industry. But forensics was an exception because we can like dig deeper into this. Why? But I believe it's because it's very traditional. It has its roots from the law enforcement. It's a very strict profession that does not allow people to like innovate, come up with new ideas, because at the end of the day, you are going to the courts. Or that's the assumption, which we're going to discuss further.
So we started experiencing these type of problems. And I was trying to basically solve the problems we were facing ourselves with our advisors from MYPD. And to be honest, I was quite frustrated because we were waiting for FedEx to ship us hard drive images, which didn't make sense. So from time to time, I was asking them, can I get access to that machine or TeamMaver? So give me the access. I want to check some stuff and then you won't be needing a disk image at all. That's how we started. So the need was there. And in simple terms, I wanted to sleep more because I was waiting for evidence to be sent. Yeah, I like that. It's solving a pain point of the profession that you're in.
And I would say like a similar one that's popping up more and more now is a couple of startups of SREs, like cyber reliability engineers. They're very keen to develop tools that will make their lives, like as you just called out, so that they can sleep more as well because they're getting fed up of their routines and they know that, you know, obviously AI, et cetera, can come help them out on that one. So I really like that. You know, you had a lot of skin in the game in terms of what this was actually solving. So that's very interesting. And then, you know, if we look at sort of what the product is, you know, a big part of it is the fact it's all around automation and the fact it's cloud-based. And you kind of touched on it there, you know, you were saying you're waiting on hard drives being FedExed to you.
But what was it that really led you to believe, and you also touched on the fact that it's quite a state industry where, as you called out, law enforcement has driven most of the direction of it up until a certain point in time. So yeah, what led you to believe that being able to move this in a direction of cloud and automation was even possible and that you could be the one to actually be the disruptor here? What was the thinking behind that? Great question. Actually, it's another shift that we observed at that time. So in my previous company, we signed a deal with one of the largest telco operators in the US.
We were expecting to have around 50,000, 60,000 customers. It was an anti-malware product, so it was running on their machines, scanning their machines. But it turned out to be much bigger than we expected. I remember looking at the dashboard, and I remember seeing 100,000, and we thought, okay, that's going to stop now, because they already deployed more than we expected. And then it became 200,000, 500,000, million. And I remember at the end of that period, deployment period, I guess it was around 8, 9 million end users. But before it hit that threshold, we have started to run out of bandwidth in everything. All the infrastructure was based on virtual PCs, VPCs, on data centers.
So that was the moment we started to work with shifts with our currently SVP engineering. We are working at finalized together now. So that was the moment we decided to, okay, we need to solve this problem because we cannot solve this with a data center that is located somewhere in Germany. And then we started digging deeper into how we can migrate our infrastructure to clouds. And I remember when I first logged in into Azure, it really felt like a huge data center waiting for me to run. So it was much, much more advanced than consoles of data centers. So everything was moving to clouds at that time, except the forensics, because forensics was supposed to be shipped with FedEx and DHL. So we were persuaded that if we want to...
make this technology available to enterprises. There is no way we can do this based on the traditional methodology. And the AV also, like antiviruses, also had a similar evolution. So first it was antivirus and then endpoint protection platform. And then they started introducing cloud antiviruses, which was, again, quite a paradigm shift because people were against the binary going to cloud. But then comparing it against the trade-off, I mean, do you want it to be safe or do you want an executable sent to some cloud? So people started to accept the trade-off there. So it was hard, to be honest. The first three, four years of binary was really hard because everyone was asking.
the chain of custody, like where do you say the data? And that's the reason we introduced our on-prem version, the same architecture, the same functionality. But if the enterprise is not ready for that mindset shift, then we were providing them with the on-prem version and it was running on their environment. But most of them, even the most mature enterprises, they started to ask for the cloud version themselves because they don't want to worry about the deploying a product, maintaining it, like running infrastructure. They just want the value that that product provides. So it was quite a shift at that time.
And now Gartner recognized this as a new category. And guess what? The first letter in this new category is cloud. So cloud investigation response automation. They call it CIRA. So it requires us a lot of time and resources to talk with the customers, tell them why it has to be scalable. It has to be running somewhere, either on our machines in the cloud or on their environments. But that was quite a mindset shift. Yeah. So I'd love to dig into this quite a lot. We've already sort of moved to the point of, okay, today, Vinalize runs on the cloud. And there's also been a mindset shift of sounds like a lot of companies by this point that this is the way it should be done.
And it's okay. And so long as they trust the technology behind it, that's kind of the key thing there. In terms of, I believe, okay, so before cloud, the by-knowledge proposition was the automation aspect to it, I sort of believe, as of what that could lead to in terms of time reduction for people like yourself who was in digital forensics generally. So what was the kind of catalyst the moment that you understood that what could be done in this sense? Like you thinking, okay, something that's taking me weeks even, it can actually come down to hours. Like what did that kind of look like in terms of a realization? Actually, the traditional digital forensics market was moving really slowly at that time. And it really felt like...
It's at the end of its evolution. And when we started, this is something we haven't covered, by the way. So when we started, our product was a bungle-based product. So it wasn't an enterprise product. We were just trying to solve the problem of collecting evidence and analyzing it from a single machine. And they're also used to it. Police officers are used to having a dongle. That's how they use all the traditional forensic products. So we started that way as well. But shipping dongles were really hard because we were getting orders from Australia, from the US, from all around the world. And again, we were waiting for preparing the dongle packages and then shipping them. And we were receiving a lot of feedback. And just for our listeners, some might not even, just in terms of age groups, dongle here is like a USB plug-in adapter, right? So this physical thing you plug in and it's effectively a USB drive. It's kind of a USB drive that also has some...
licensing unit in it. So it's both for saving the evidence and also activating the license. And law enforcement is very familiar with this approach. And then the customers started to ask, actually. Customers started asking, I mean, we really like the product, but can we run this remotely? And when you talk about running it remotely, then there shouldn't be any dangle. So then we released the first version that does not depend on, it's called soft licensing. So we called it dangle licensing and then soft licensing. And then the needs also started to come from the enterprises. They were asking us, can we integrate with our CM? And based on our previous experience, previous startup experience, listening to a customer was a big part of developing a product. The way I describe it...
Even now, if you go to our release notes, you'll see every release has at least two, three credits given to our customers because customers are asking the releases, like the features that we release, and we are giving them credits, release notes credits. So basically, the disruption was requested by the customers. So can we run this remotely? Can we integrate it with our CM? Can we run it with our SOAR? So these are the platforms that they were using at that time. EDR, XDR were not that popular at that time. So CM was the most popular product. So that persuaded us to see that there's disruption needed here. And also, I remember having NCASE certification books and checking the release notes of NCASE at that time. The product was basically not being...
updated anymore. So they were basically maintaining the product, not adding disruptive features. And also our advisors were constantly asking, can we integrate your anti-malware SDK with the forensic explorer? I remember that was one of the programs that they were using. Or this type of integration, because we're constantly coming from the advisors, which was also persuading me, there's something needed here. We need to focus on this. Yeah, I mean, it's a good problem to have when it's not for lack of people wanting to use the product or using the product. It's actually they're saying, we're using the product, but we'd use it even more if you could provide it in this other form. And I'll say that's kind of a nice thread that you were able to pull on.
and move along to not dongleize, vinylize. So maybe let's sort of jump into more from a technical standpoint, just kind of actually what's going on here, like what's happening kind of semi under the hood. So am I right in saying that today, vinylize, the product we're talking about is called AIR? Is that that sort of? Vinylize AIR. Yeah. AIR, is that an acronym for something? It's Automated Investigation and Response. It was initially our product name, but now there are three products that has the name AIR in it. So it's kind of becoming a category name based on what I've been observing for the last few months. Okay. So, and this was actually a very interesting thing when I sort of first came into the space.
And, you know, admittedly, I didn't need to handle a lot of this side of things. I'm mainly talking about my time in Black Panda. You know, I didn't need to really handle any sort of forensic collection or incident response sort of directly. But I was made very aware of one of the challenges there is the, you know, cross-OS, you know, like across system architectures, is it, you know, Linux, Windows, Mac, Android, you know, iOS, et cetera. So how does AIR handle, you know, we're talking about automated collection. And I think that, again, that was almost an argument put to me as to why this was so challenging and could not be automated was the cross-OS aspect. So how does AIR actually handle that in terms of across the different?
operating systems so that was actually one of the selling points because we realized the fact that you want to be a good investigation platform we need to support multiple operating systems my background is also windows windows operating system windows eternal and at that time macros was getting quite popular in enterprise environments especially developers were using macros but it's really like much more common now and when we check the market reports macbooks were on the rise and then chromebook also like showed the same patterns and as far as i know they even like they were about macbook sales now so we were getting the signals i mean We are already really good on Windows. Now it's time to focus our resources on Mac OS, Linux, and also Chromebook. So currently we have Windows, Linux, Mac OS, IBM AX, Chromebook, and even ESXi. So this is one of the hard parts of digital forensics. And combining this data in a single, in a unified hub is also another challenge. So that was a need. And some of the customers were specifically choosing our product because of the cross-platform support. Okay. I mean, there must have been challenges, though, in being able to handle the different... Was it that it started with Windows, but I think you said moved to Mac OS fairly quickly? What kind of things, especially maybe just slightly higher level?
have to be considered when trying to create the same product in this space across the different operating systems? I think the biggest thing is, biggest challenge is macOS side because macOS is a closed operating system. So even when you, on Windows, you can get a lot of like details if you want to dig deeper into the operating system, architecture, the kernel, the forensic side of the things. But when it comes to macOS, it's not that easy. So even the books that are written on the subject are fairly old. So it regards like a lot of research on the macOS side. And then once we had macOS, Linux was much like easier for us because the architecturally...
So we developed two products. The first one was for Windows specifically, and then we developed Tactical Cross, which was collecting evidence from both Mac OS and Linux. And we used choosing the language, choosing the framework, and then making the research was the hardest part on that. Yeah. And I think just pointing to the recent cases like EG CrowdStrike and why was that such a problem? Well, as you called out, Mac OS is this closed system where access to the kernel is not possible, basically. And that's where Windows differs. And I think it's often been misunderstood as to why people say you don't get viruses on Mac, period. And it's obviously not entirely true, but it's more along those lines where Windows was just built with that.
From that standpoint of the kernel can be accessed, actually, and Mac can't. But yeah, inherently makes when people want to do good things and actually be able to investigate, it obviously makes your job a bit harder when it comes to actually creating a tool that's supposed to be figuring this out for, say, macOS. Yeah, and macOS was not targeted. When I was in malware research, macOS was not targeted as much as Windows. And even Android was much higher when it comes to malware numbers. So that was the reason. But currently, macOS forensics is a big need in the industry. Yeah, I think that's just a very interesting evolution there. In terms of forensic investigation, we're kind of talking about the difference of how quickly can we do this, but also then how thorough.
is that how many files have we actually pulled up and what we've gone through? How does, if we're automating that, how are you, you know, when designing the product, like how are you considering the speed versus the thoroughness? And is that a trade-off or would you say you've actually kind of figured out the win-win of being able to do it much faster and just as thorough? That's actually where the domain expertise gets into the picture. So if you try to collect everything from that machine, then you basically go back to traditional forensic phase. And then there's no point of like designing a new product because it's basically like getting your full disk image. So you need to find that balance that gives all the value.
without slowing down the investigation. So that's how our product is able to deliver the investigation times from weeks to hours. So there's a balance there. I mean, you cannot collect everything. It should be incremental. It should be like gradually, like increasing. You should be able to, but you shouldn't in the first stage.
that's how i define it yeah okay makes sense especially you know in today's world what if any you know in terms of machine learning does that play a part in building up i mean this is not a area product that i'm like super familiar with from a pure technical standpoint so you can help us out here like this is a case where you are able to bring in machine learning and then sort of have these i guess like catalogs of understanding of what's bad what's good and etc i mean talk to us about that yeah exactly so that's actually one of the biggest differentiators because in traditional forensics you have a desktop-based product that runs on a single image by an individual analyst. So like there is one-to-one-to-one relation in that investigation. But in our case, in modern approach, you can have access to thousands of machines in a single platform. That gives you a baseline to like what is normal, what is not normal. When I see something on one of the machines, is this also like the case in the other devices as well? So you have access to this. And based on this information, you can easily use machine learning or even like AI now to get an understanding of like much faster understanding of what happened on that environment. Because we're not talking about a single machine anymore. It's an enterprise problem. So you need to have access to all the assets that may be involved in that case.
And that's also sort of touching on the cloud component. And with, I think, when you were talking about sort of the concerns around clouds, you know, when you were thinking through the move or shifting the product to be able to run in cloud, basically the big sort of pushback is around anything to do with data privacy and compliance. How do you handle that? And, you know, you're vacuuming up effectively all the data off a machine. And, you know, there has to be some pretty sensitive data there. How do you work with that when it comes to cloud? Sure. So basically the regulations and certifications, as long as you have these certifications, then you don't face that much of an issue. But still, there are always some questions. But when it comes to which one is important, so business continuity?
finding the root cause, finding the root cause, or having our data in the cloud. And especially with the migration from traditional on-prem-based entire viruses to EDRs and now XDRs, almost all the XDRs on the market are cloud-based. So they already started that shift. In our early days as a startup, it was hard for us to train, increase the awareness, educate the potential customers. But with the XDR, the shift to XDR and CM products, this is already happening. So these are already cloud-based products. And the customers started to ask, can we get a cloud version? Can we get a SaaS version of your product? But when they ask this, you need to provide them with these certifications. And as long as they see that...
It's not that much of an issue now. There are still some enterprises, especially government and military. We also have military and government customers. Some of them, they still prefer to have on-prem environments, but that's not that common now. especially in the last year. Yeah. When we're talking about cloud, is the majority on your cloud, on private cloud? Is it a pure mix? How does that look? They mostly ask us to host it because they don't want to deal with maintaining a platform. It's really very hard for secret operation centers. And MSSPs also. They're fairly compact teams. So we're not talking about hundreds of people on MSSPs because we have two types of customers, MSSPs and enterprises. And on enterprise, it's even a bigger problem because it's really hard to find people for the secret operation centers. And it's hard to retain them. So if you ask them to maintain a platform, then it becomes even a bigger problem for them. So they just want to be doing what they're supposed to do.
rather than maintaining a platform. So that's why they generally ask us to host it. Which is an interesting point where I think a lot of people assume the products like this, the customer is going to demand that it is run either on-prem or on private cloud. And actually, for all the reasons you've just said, when smart people and these customers actually think about it, they realize, yeah, they're creating more headaches for themselves often. So long as, again, it comes down to the product itself, do they trust the company, the product, et cetera. But that should be one of the big value propositions is that, you know, you as Binalize know how to run the product in the most optimal way on cloud. And so if you let you guys manage that.
That makes a lot of sense. And you touched on enterprise and obviously selling to enterprise is very challenging. You do seem to have quite a lot of enterprise customers just from your website, et cetera, testimonials. So, you know, they clearly sort of adopted, obviously in relative terms for SaaS, it feels like enterprise has adopted Vinalize quite quickly. And yeah, like what sort of surprised you about of how enterprises are actually using Vinalize? That's a great point. And that was one of the things that surprised me, to be honest. So in my previous company, we were evolving from, we were like making our product from a consumer-based anti-malware product to an enterprise product. But the fact was,
we had many competitors at the time. So when we introduced our enterprise antivirus, we had almost 50 competitors on the market. And I guess that number is not even higher. So 70, 80, maybe antivirus. So it was really hard because you had to be like superior in everything and also in terms of pricing. So I was expecting something similar here, but something I forgot was that we didn't have. Now we started to get like some competition on the market, but when we started with the enterprises, we didn't have a strong competition. So it was quite surprising. And especially I have like several funny stories about this, but like one of our...
A few of our large enterprise contracts started with a single line of email. A few of them, just one line of email, can we get a price code for 30,000 assets? Some of these, I ignored them because being in an enterprise sales environment in my previous company, I know how hard it is, how hard it's supposed to be in an enterprise environment. Seeing a personal email asking for a price code for 30,000, 50,000 assets didn't make sense. We were lucky because our previous SVP growth.
took one of these emails and replied, and they became a customer for five years. So it was kind of surprising because the competition was not there yet, and we were solving a real challenge that they were trying to implement themselves. So in general, when we meet with an enterprise customer, the moment they see the demo of the product, they generally say, this is exactly what we've been trying to solve internally for the last two years, but we had to give up because it got too complex. And they generally do this for one operating system, and then they need to do it for the other operating systems as well, and then they need to build a lot of other features on top, and then they decide, okay, this is a product, this is a profession on its own, we had to stop. So it was surprising for me. I was expecting it to be harder.
And just, I mean, like that example, you know, you get an email of, as you say, one line, what's the price for, you know, a large number of assets? How, in your mind, how were they discovering finalized back then? So this is one thing that most startups do not embrace. They generally think about, okay, we release a product, let's price it, let's charge it. I think that's one of the things that we learned in our previous company. Again, as I told you, we learned what not to do as well. What not to do is a startup, I mean, there may be exceptions, but this is how we perceive, this is how we see it. So the product should meet the potential customers without thinking about any pricing, licensing, revenue, et cetera, because what matters is what the customer thinks. Is it solving a real problem? And how much of that problem is that product solving? Because there is always more to solve. So what we did was...
Before releasing the first version of our Dungle-based, USP-based product, we first created a join waitlist six months before the initial announcement, and we started collecting emails. And then we released the first version, IREC Free Instant Response Evidence Collector. It's IREC. IREC Tactical was the paid version. But we waited for, I guess, around six months before thinking about pricing or subscriptions and so on. And then we released the tactical version with additional evidences and additional features. So customers were basically downloading the free product.
And they were testing it on their individual machines. And they were asking questions. Can I run this remotely? Because remotely, it was basically a window-based application. So there wasn't even a command line, like argument option, because it was just you run it, you select some checkboxes, and then click start collection. So they were asking these questions. That's how they learned about Finalize. We didn't have any adverts. We didn't have any paid advertisements. Nothing. It was just a website with some keywords. And they were finding it themselves. Yeah, that's very cool. And in terms of, you kind of just mentioned there, people would download it. And then they would say, how can I run this remotely? Or so on and so forth. But otherwise, once...
people were sort of, you know, handsing on with the product, what have customers taught you in the past and what are they teaching you now that sort of has actually made its way into the product? And maybe, you know, let's just say not to do with just, oh, move it to cloud, but what maybe feature-wise have kind of customers taught the team in terms of, yeah, features that are now in there today? I think the biggest input we received from customers were the investigation hub. So collecting evidence and analyzing it on an asset basis, like per asset basis, was already in the product. But we decided to prioritize the consolidation of multiple reports. And the second one was integrations. So that made us realize that these guys already have everything money can buy. But still, they are spending a lot of time understanding what's happening. And that was the moment we decided to prioritize integration with CM, EDR, and XTR products. So that's the reason we have support for all major products on the market. So those two things were the things that we learned from the customer. Nice. And I guess then looking at the other side, what has been, from a technical standpoint, what's actually been one of the hardest?
problems you actually have to solve, whether that's something that has been suggested in or just something that you, as a team of thought, this needs to be in the product, but what has actually been one of the sort of big technical nuts to crack on the product. It was actually about the release cycles. So we had to spend a lot of time and resources because enterprise is not a SaaS platform. So in essence, it's a SaaS platform, but the product you develop is running on 32-bit Windows, 64-bit Windows, Windows 7, MacOS, Azure, Cloud. Like, I mean, it's basically running everywhere. So you need to have a very robust quality assurance and continuous integration, continuous delivery pipeline. So our team has spent a significant amount of time on the testing of the platform. And I'm really proud that this is, again, like based on our previous experiences as well. So when you change a single line of code in our product, there are like thousands of tests running in the background.
And at the end of the day, we are having a release. And we know that there's a very strong automation running in the background. And the biggest thing was, it's an emerging category. So you shouldn't be releasing any version every three months, every six months, which can be sometimes hard for our customers because they are used to other renders that are releasing four releases a year, which is not the case for Vinalize. Vinalize releases every 15 days, we release a new version. And then we announce it publicly at the end of the month. So this was the thing, I guess, like setting up the infrastructure.
so that we can reduce the release cycle, so that we can listen to customers in a much shorter feedback cycle, and then fix the product, add a new feature to the product, and then release it to the market. This was the hardest part, in my opinion. How does that work in practice? Let's take the person who asked for, let's just say, 30,000 assets. If we're thinking, okay, every 15 days, a new version has to go out to, in theory, 30,000 assets of very varying operating system types. I imagine the percentage of actual update, let's just say, on the day after it comes out is not 100%, right? So then you're working with...
30,000 assets across quite a different spectrum of previous version and current version, I guess. What's the challenges come with that in terms of why I'm thinking about sort of backwards compatibility almost? Exactly. Yeah, yeah, yeah. So initially, we didn't want to deal with that until we started to get the product deployed on environments that are like 100,000 assets. So that's when we decided to prioritize the backward compatibility. So you don't need to make it like...
big roll-ups or environment, you can do it incrementally, because most of the time, the features that they're adding are on the console site, not on the responder site. So that's why our team prioritized that one, and I think that was one of the learnings, because that's not something we did in our previous products. And to be honest, it's easier for a startup, you know? Like, in our startup phase, it was easier to have one product that has everything in site, so rather than, like, thinking about the communications protocol between the assets and the console, but that's not the case anymore. Yeah, I think, you know, in my mind, that's kind of what set yourselves apart. I basically had to do kind of vendor assessment on products, you know, in your space, and that's when I became aware of Vinalize, and yeah, it just seemed, you know...
fairly evident, fairly quickly. And also getting, we actually spoke, I think it was about two years ago at this point on a call. I'm going to throw in a funny anecdote here, which is I genuinely hadn't maybe done my research exactly on how large you were as a company at that time. And I think I remember asking you, oh, so, you know, is it just you and your co-founders? And you said, no, we have like 200 employees. So I said, oh, right. Okay. So slightly misunderstood the size of the company. That's a great point because we were laser focused on the product side. Again, something that I've been a firm believer, make a great product and the growth happens. When we started seven years ago.
People are asking, even in our first investment, how much budget are you going to spend on the marketing? Zero. No marketing budget. We'll fully focus on the product side. And even when our VP marketing started, she said, my first responsibility is to take the company out of stealth. Because even in our fifth year, sixth year, we're still in stealth mode. So it was all about developing the best product on the market. Not making that much noise. Not making ourselves that visible. We want a product to make noise. We want a product to make people talk about, not even about the company. We want people to talk about the product. Spotify is a great example. I deployed Spotify to all my family, all my friends.
I was in love with the product. I was able to listen to any music I wanted. That's why we didn't spend that much effort to promote the company and the team. It was always about the product. Yeah, I love that. Really like that approach. And as they just kind of showed when we did have that call two plus years ago at this point. And, you know, looking forwards, how do you just sort of see automated forensic collection and like changing? I mean, you know, any hints to sort of what's on the horizon with Finalize? Anything that you can share?
Even hearing this question excites me, by the way. And the reason is, so far, Vinalize received more than 10 M&A requests, mergers and acquisitions requests. And these generally came from traditional forensic vendors and also endpoint security monitoring vendors. And so it's going to be our seventh year. And we said no to all of them. And we'll keep saying this because it's not even 50% of the roadmap. So when we started seven years ago, we had a vision. And we are just about to introduce new use cases that are not available on any other product on the market. And that's because I see this as... Our product is kind of like similar to James Webb Telescope. So James Webb Telescope...
allows us to discover a water molecule in a planet that is a million light years away. I mean, it's unbelievable, but it does that. And how? Because it has different cameras, different spectrum scanners. So it has that visibility. And when you have that visibility, then it's not about finding a planet, finding stuff inside that planet that probably we will never be able to touch in our lifetime. So I see Rinalize Air as that kind of a platform. So this is just the beginning of the journey. And on top of this, we'll be building new use cases.
So that's the reason, like I say, we have just said it all the time because we literally have just said it. So this was just building. I mean, this doesn't mean that we still have stuff to do in order to capture the market. Our product is already like at least two and a half, three years ahead of the competition. So the closest competitor in terms of feature set, like when you take a look at it from a competitive Intel point of view, I can see that they're developing, they're implementing the features that we implemented two years ago. But this is just the beginning. Like there's many, a lot of stuff on the horizon. So even thinking about it, it excites me. Yeah, this is very exciting. I mean, the way you're talking about it, it reminds me a bit of Shopify actually, where I'm quite familiar with that platform from a past life. And, you know, I was familiar with that platform.
the very early days and you know when they were seven years in and saying to people we're just getting started and people didn't believe them whatsoever like yeah come on no it's done now you know yeah yeah you come on the cloud great well done you've done it and like we're done here and of course they were not even close you know and i just and i knew that was the case like i you know i'm a big fan of toby lucay the ceo and i met him a few times and it was just so obvious that when he said it it was true and i think i'm just hearing and feeling the same from yourself like you know this space and when you say we're seven years in and only just getting started like that just sounds like another another case of this so i think that's incredibly exciting Just kind of wrapping up here, you know, thanks so much for coming on. And I'd like to just ask like a couple of questions just to sort of you, you as Emery, like looking back on things, you know, if when you kind of started out in, well, you know, you're in the military for a while, but, you know, if you could sort of tell yourself something now, but to yourself back then of like, whether it was of how, anything to do with technology or just something to be aware of, thinking about sort of how you approach your career, like what might that be? I mean, I'm learning every day. That's the fun part. So that makes Plenalize even more exciting than the years we started.
And I think the biggest learning I had in the last, like, almost seven years now is the balance between mind, body, and soul. In the early days of Vinalize, it was all about, like, working super hard, not sleeping. But now I learned that I can work, like, much harder by also, like, meditating, breathing, finding that balance in a much more, like, productive way. So I think that's the biggest learning I had in this period. So for the new founders or, like, people who are going to be, like, CEOs, I suggest them to, I mean, even if you suggest them, they want people to because everything happens at the right time. But this is my biggest learning. So, like, spending time to sharpen your blades.
so that you can perform better i like that a lot yeah maybe my version of that is in sports generally i've traditionally been more of a sort of just called a sprinter effectively and over time i've learned how to elongate that and actually become more of a let's just like use broad terms your middle distance is probably the easiest way you know and cycling is a big sport for me but being able to kind of change the mindset around this is not a sprint it's a marathon effectively has been hugely helpful and i think that's kind of what you're what you're getting at as well as being able to be able to perform at a very high level but consistently as opposed to you know pulling all nighters and then you know feeling terrible the next day kind of thing Exactly. And if that's not your question, you cannot continue. So it's that finding that balance to perform even better and longer, that's the biggest learning I had. And I think finding a philosophy that helps you analyze things, helps you understand things, and all the challenges that is happening in a company are natural. That's how disruption happens. So if everything is normal, then if there's no crisis, if there's no problem, then there's no growth. That's what I learned, especially in the last few years. So there should be a lot of problems, and we should be prepared to handle them. That's how growth happens. That's how big companies become big companies.
I think that's a great one to end on. Yeah, you know, just always leaning into problems or not. Someone else said, you know, it's not failure, it's feedback. And I think that's always a great way of looking at things. So thank you so much, Emery, for coming on today. I think, you know, we've learned a lot here, you know, and I really do just think that Binalize as a product is one of these few products in a category that is just light years ahead of anything else. So I really recommend people to check it out, whether you're in this industry and needing the product or even not and just checking it out. Where's the best place, you know, for someone just to kind of check it out and get started? Just Binalize.com. There we go. So Binalize, that's B-I-N-A-L-Y-Z-E.com.
So again, thank you so much for coming on. I hope we get to do this again in the future and catch up with where Vinylize is next. Thank you so much, Gregor. Looking forward to it.