Security as a Process an interview with Paras Shah, Founder of LAMR Group

We interviewed Paras Shah, Cybersecurity Expert and Founder of LAMR Group.

Question: Paras, you’ve been involved in security now for more than two decades. How has it changed?

Almost everything has changed. Technology has changed– smarter, faster and more comprehensive coverage. People have changed– it is no longer a niche community. Security awareness and skill have permeated throughout every pillar and level of organizations. Policies have changed– technology has invaded every part of our lives – social and commercial. This has led to far more encompassing security policy in nearly every market and geography.

Question: What is your focus at LAMR Group?

With respect to the enterprise, we focus primarily on software security services; provided on a project and staff augmentation basis. We are a small firm with an emphasis on quality and a select network, so it is not always possible, but if a client has needs outside of software security we do our best to meet the requirement. This could be something like a SOC analyst or technical writer. My personal career started in professional services and ended running enterprise sales for small and large security vendors, so at LAMR we also offer advisory services for $0-$10M security startups; product market fit, pricing structure, and sales recruiting.

Question: What is the role of AI in cybersecurity?

Not dissimilar from the ways AI has impacted other software solutions. Current iterations of AI make many existing (and new) security solutions smarter and faster and more efficient at building baselines, recognizing deviations and building new patterns. In short, AI is making security solutions better at sorting through ever increasing alerts and correctly identifying real threats.

Question: How can security companies differentiate themselves in Marketing? In other words, is it all about inducing fear in the customer?

I am not a marketing professional, but speaking from the buyer’s perspective, which I do understand, inducing fear is almost never a good idea. Enterprise security buyers are smarter and more informed than ever before. They make decisions informed by a great deal of research and self-learning. Fear might work in rare corner cases, but clear, concise and use case specific messaging will be a better differentiator.

Question: Does the increasingly fraught geopolitical situation increase the need for cybersecurity expertise?

It definitely has not decreased the need for cybersecurity expertise. The battle against malicious actors has always been global and shifting political dynamics does not materially change that. But what we do see in the short term, at least in the United States, is reduced spending by the federal government on direct cybersecurity spending and basic research. This has the compounding impacts of ceding a research edge to other governments and causing some of the leading cybersecurity resources, at various US based three letter agencies, to find alternative employment.