CyberWire Daily - Steve Blank, national security, and the dilemma of technology disruption. (Part 2 of 2) [Special Edition]

Episode Date: September 29, 2024

In this 2-part special edition series, guest Steve Blank, co-founder of the Gordian Knot Center for National Security Innovation at Stanford University, speaks with N2K's Brandon Karpf about national security and the dilemma of technology disruption. Listen to part 1 here. In this series, Steve Blank, a renowned expert in national security innovation, explores the critical challenges facing the U.S. Department of Defense in a rapidly evolving technological landscape. From the rise of global adversaries like China to the bureaucratic obstacles hindering defense innovation, Blank breaks down the “dilemma of technology disruption” in national security. Learn how the U.S. can overcome its outdated systems, accelerate innovation, and prepare for the future of defense technology. Whether you’re interested in defense tech, cybersecurity, or government innovation, this episode offers deep insights into the intersection of national security and technological disruption. For some background, you can check out Steve’s article “Why Large Organizations Struggle With Disruption, and What to Do About It.” Learn more about your ad choices. Visit megaphone.fm/adchoices

You're listening to the Cyber Wire Network, powered by N2K. Air Transat presents two friends traveling in Europe for the first time and feeling some pretty big emotions. This coffee is so good. How do they make it so rich and tasty? Those paintings we saw today weren't prints. They were the actual paintings. I have never seen tomatoes like this. How are they so red? With flight deals starting at just $589, it's time for you to see what Europe has to offer.

Don't worry. You can handle it. Visit airtransat.com for details. Conditions apply. AirTransat. Travel moves us. Hey, everybody. Dave here.

Have you ever wondered where your personal information is lurking online? Like many of you, I was concerned about my data being sold by data brokers. So I decided to try Delete.me. I have to say, Delete.me is a game changer. Within days of signing up, they started removing my personal information from hundreds of data brokers. I finally have peace of mind knowing my data privacy is protected. Delete.me's team does all the work for you with detailed reports so you know exactly what's been done. Take control of your data and keep your private life private by signing up for Delete.me.

Now at a special discount for our listeners. private by signing up for Delete Me. Now at a special discount for our listeners, today get 20% off your Delete Me plan when you go to joindeleteme.com slash n2k and use promo code n2k at checkout. The only way to get 20% off is to go to joindeleteme.com slash n2k and enter code n2k at checkout. That's joindeleteme.com slash n2k code n2k. And now, a message from our sponsor, Zscaler, the leader in cloud security. Enterprises have spent billions of dollars on firewalls and VPNs, Thank you. that are exploited by bad actors more easily than ever with AI tools. It's time to rethink your security. Zscaler Zero Trust Plus AI stops attackers by hiding your attack surface, making apps and IPs invisible, eliminating lateral movement,

connecting users only to specific apps, not the entire network, continuously verifying every request based on identity and context, Thank you. organization with Zscaler, Zero Trust, and AI. Learn more at zscaler.com slash security. Welcome to part two of our special edition series with Steve Blank, adjunct professor at Stanford University and co-founder of the Gordian Knot Center for National Security Innovation at Stanford University. Now, if you're just joining us and you haven't yet listened to part one, I strongly recommend you go back and check out the first episode. There is a link in the show notes. Steve Blank dives into the complexities of national security technology innovation. In that first episode, he begins by highlighting the fundamental mismatch that while the U.S. used to dominate cutting-edge tech development, much of what was once considered proprietary can now be bought commercially, including cyber tools.

He emphasizes that the DoD is still structured for a world that no longer exists, with ultimately what are considered outdated processes, outdated acquisition systems that just can't keep pace with the rapidly changing world of cybersecurity and global threats. So it's a great episode, a great intro to the second part where we dive in deep on what the opportunities are and ways in which the community and the

technology industry can match critical capital to technology opportunities and his recommendations for how the DOD and ultimately the federal government can change to help increase the clock speed of technology adoption. So here is our part two with Steve Blank, adjunct professor at Stanford University. If you really think what SpaceX is doing, it's this. They have execution and they have innovation going on simultaneously. By the way, when you do both, both execution, that is sustaining innovation, disruptive, that's called an ambidextrous organization. That's a $20 word for being able to chew gum and walk at the same time. Right? I don't know anyone who can do that. Right. No, chew gum and walk at the same time.

And what I mean by SpaceX is, think about this. They're launching Falcon 9s every two and a half days from three launch pads. Operational excellence. No deviation from like the checklist because there are human beings every once in a while on top of those. And they're launching Starlinks. And they had in, what, 300 or 200 before they had a failure in the second stage. I mean, just an incredible track record. But at the same time in Texas, they have crazy people. They're building the next generation called Starship. And Elon's model was, if you're not blowing things up, you're not innovating.

And more importantly, if you're not blowing them up on a regular basis, you're not innovating fast enough. They've now been through three generations of Raptor engines. Now, everybody understands in that company that today's paycheck is Falcon 9. But tomorrow's paycheck is going to be that Starship. And no one is jealous of each other because everybody understands execution pays your salary, but innovation pays your pension. And more importantly, those two groups are not standalone silos. They're talking to each other. The Falcon 9 people are reminding the Starship people, man, did we screw up where we put the ground surface equipment plugs? You know,

when you build the next one, make sure their access panels are over here. And even though I said the Falcon 9 can't change much because it's operational excellence, the Starship people are reminding them, you know, you can crank up that chamber pressure by another like 100 pounds and people like haven't paid attention, but the payload capacity of Falcon 9 has actually gone up a couple thousand pounds. Well, taking the example you shared about an organization doing this well, which was SpaceX, you know, looking at that from first principles, I see two core components. And I'm curious your thoughts on how DoD can incorporate these components. The first that SpaceX has is a talent strategy, right? Understanding that there are different types of people needed for these two different modes of functioning.

One being the sustained operations of a highly reliable system, and the other is the sustained innovation of disruption. And those are two very different talent models. The second is, you also brought this up, an information strategy of intentionally sharing information between these two parts of the organization and communicating both lessons learned but also capability. And so, you know, from a first principles lens, first of all, what am I missing there in terms of those two components of the strategy? And the second, how can DoD actually implement those two aspects of the strategy? How can DoD actually implement those two aspects of the strategy? And remember that DoD has some enormous obstacles in that it has Congress, it has service secretaries, it has primes, it has, right?

So, where SpaceX, a single individual like Elon could say, here's what we're doing, and Glenn Shotwell is a great, probably the best operating executive in space we've ever had, manages to translate those visions into, okay, guys, this is what we're doing. That command and control, while in theory, you know, belongs to the secretary of defense or his assistant secretary, really is a lot more diffuse in a 3 million person organization with lots of stakeholders. But we've had two, I just want to go back to, and again, I might be naive, but we've had two service secretaries who basically figured out how to use advanced technology, private industry, as well as the primes to do this. One was Bill Perry and the other was Ash Carter, who actually had a vision about how to use both a whole of nation approach and to get the DOD to start moving. So part of this is, I'll go back to,

you know, the role of a Secretary of Defense is maybe number one, you know, letting everybody know what's the state of the world that we're operating in and what change needs to happen from where we are today. Maybe I've missed it, but we've really not articulated that to Congress, to the services, to whatever, and that they're not going to accept status quo and that there needs to be changes in force design. There needs to be changes, substantive changes about what we're buying and how we're buying it. Less so, here's what we should do

with shiny object X or Y, but it's pretty obvious, right? That things need to change and not like we need to divest of carriers or man bombers or et cetera, but we certainly at minimum need to be not just designing, but deploying hybrid things yesterday. And the problem with that is that the new things

are almost always worse than the existing things on day one. Of course. That's a big idea. That's an MVP. Yeah, but that's not clear to congressmen or their staffers. That's an MVP. plans um you know right and i'm not suggesting we but think about it ukraine had like five drone manufacturers at the beginning of the war they have over 200 um right you know the cycle time between uh putting up a com link and the russians jamming it is probably less than 10 days oh yeah most definitely right or maybe so so they're operating at a cycle time that is not impossible to imagine.

But you ask us, well, what have we changed to match what that's going to look like? And then you get these five-page reports and you get a 2045 plan. So what I mean by this, it's not like let's go buy shiny object X or Y, meaning let's not buy a million drones that look like X. But the smart people once given a mission that said, I don't want to see the same thing again. And we know you're capable of coming up. I mean, we have the smartest people in the world in the services.

We just need to unleash them on a new strategy. And they are capable of doing that. But at the end, it really comes down to leadership saying status quo is not acceptable. And if you show up with that again, you're not going to be promoted. Or maybe we're going to, in fact, convince you you ought to retire if you can't adapt to the world as it is. We still have a lot of senior leaders who want the world to look like when they were in the academy, whether it was naval academy or west point or whatever it's not going back there anymore now and the longer we stay in the past the worst our future is going to be in fact that's a pretty good quote um it is

it is we'll pull that we'll pull that one yeah i just made that up right now. But truly, and again, it's not a lack of, it's not stupidity or malice. It's just that it's normal human beings who have done things for years or decades because this is the way it was done without realizing we're trapped by our own successful legacy. The Western Pacific was our lake for 75 years.

It's no longer our lake. And what's really interesting is, of course, I'll just pick on China, because China is replicating a lot of our systems and whatever, the same offsets. And force structures. And force structures, yeah. So we should be the one coming up with asymmetric, I mean, just like they did with DF-21s and other things and islands in the South China Sea and whatever. So our asymmetric, you know, things should be at scale, not like, oh, we got three black programs and we got X or Y. They should be showing up as like, you know, force design and in a massive number that like, imagine China woke up and went, oh crap, everything we put in the water is now obsolete. Right?

Or, oh my gosh, you know, look what's in the water between us and Taiwan. Or there's no way we could build enough DF-21s or DF-26s to sink all of these ships or drones. And I'm just, I'm not picking on the Navy. It's the same thing with the army, given, given the Ukraine situation, there's a ton of lessons learned here, but, but if it doesn't show up as a substantive change in the budget, then they're one off, whatever, meaning we're still focused

on spending money doing X and Y because we know how to spend money on X and Y, and everything else is kind of like, yes, but we have this secret sauce over here. I'm not sure that's going to be the determinant in deterring a war. Well, I want your thoughts on the money side of this, right? Because all of these capabilities, it's not just about buying capabilities, but the invention and creation of capabilities

requires resources. We acknowledge that the DOD budget cycles where we're planning five years in the future and beyond does not lend itself well to creative destruction and disruption. But then we also look at these grant programs, the SBIRs and the STTR programs, and a significant amount of capital is being deployed in the form of non-dilutive funding into private companies. I'm not sure, though, that we actually understand the

ROI of those types of awards. I mean, have we actually really figured out how to measure that success? It seems like the government is deploying a significant amount of money to try to stimulate this innovation. I'm not sure that the other side of it's actually delivering innovation that's measurable. Well, I'm not sure it's innovation that's measurable. I'm not sure there's a acquisition budget that's connected to those innovations, right? So, I mean, listen, you point out something pretty important, but I'll say we've built a dam across half the river. Good point. Meaning we have the front end of the funnel.

But unless you figured out, well, how does this stuff get deployed at scale? So when we teach a class called Hacking for Defense, you know, everybody comes in with a shiny object. They're taking problems from the DOD and IC. And great, we've got this great demo. And our point in the class is, no, figure out what color of money is going to fund this thing. You know, who's the saboteur from the prime?

Who's going to say over our dead body? You know, how does this get in? Is this an OTA or does it go through the pump, right? And it's not that we're not figuring that out, but the whole programs need to be oriented on deployment, not just demos. And it's a funnel, not a pipeline. So most of them will fail. But unless you have an, you know, this is what I see in the commercial world all the time. And your DoD example is just a point to this.

In the commercial world, every CEO wanted an accelerator inside their company. And great, you know, you get bring your dog to work and you get beanbag chairs and lots of posters and coffee cups. In the military, you get lanyards, right? And challenge coins, right? That's the only two differences.

But then in the commercial world, now map this to the DoD, I go ask, so how does this get fed to the sales force? Right, yeah. And how do you deal with channel conflict? Because this competes with their, oh, yeah, sales hates it. Or marketing says it screws up the brand or, you know, and then you say, well, how many of these have actually, you know, increased revenue or profits or market share? And they go, look at the beanbag chair and the whatever. And so, yeah. And they love it. They're over there doing innovation.

They're doing innovation. And so this is the, the sum of this is innovation theater, right? Where, where, you know, you kind of forget the goal is not demo, but in whether it's the commercial or military, the goal is deployment. And if you haven't figured out- And the goal should be accomplishing a certain mission for a commanding, for the decision maker. Right. And so if you haven't figured out that end to end, the problem is, and in the military, it's worse, in the commercial world, a CEO and an exec staff can make a decision about how you get that plumbing correct. But if you think about where all these innovation activities, and out of Heidi Hsu's R&E group,

there's a great diagram of the hundred or so innovation activities. Truly, she came in and asked the right question. How many of these things do we have? Too many. Think about this. R&E and A&S are two separate organizations, just in OSD, let alone in the services. So how are these connected to a budget? And problem sets, et cetera. Some of those innovation activities clearly are.

Most of them are not. And that's the problem. And again, that's not hard to fix, but it starts from the other end of the telescope. It doesn't start with a shiny object. It starts with what problem sets do we either have or what things can we come up with we haven't even thought about that would be a force multiplier or be an offset strategy against an adversary. Great. You know, how does that get into the hands of the warfighter? And when? Sure. And how do you actually allow an organization who's building a technology and innovating to survive long enough to even get it there, which kind of relates to your damming half the river, which is they're either going to swim and they might drown trying to get to the other side.

Now, something that I think... Before I forget, I'm sorry to interrupt. We built something inside of one of the national security agencies called hacking for the... Actually, it was called I-Core inside of Agency X. And it basically allowed innovators to take almost a TDY internally and work on some of these problems. And they would build, take six weeks and work on some real problems they had encountered but their organization wasn't working on and build MVPs and had great demos. And they'd go back to their organization. And their mid-level managers would go, well, that's not on my budget or schedule. Get back to work. Or even if it actually got to a senior leader, it would have to go across the transom to a capability organization who would say, you know, not only this is unbudgeted and scheduled, but because you're throwing these over the transom, you're actually a denial of service attack on my core capabilities. So the system had not been designed for a parallel process other than those requirements

that were coming down from the top. There was no process that was end-to-end. We built a great process for the innovators, but we forgot that without the leadership understanding how this tied in to actually creating new capabilities, it truly was a denial of service attack and was a waste of time. But we put thousands of people through the process. And I think at the end, we created probably a couple hundred startups because those innovators left frustrated. Seriously. seriously. But it was a great experiment for me to understand that unless you have an

end-to-end understanding, having these innovation activities and getting these innovators excited without some path to actually see it deployed or some criteria of what an innovation pipeline should look like, it's a waste of time and talent.

The analogy that I recently had a conversation, and we published this with Justin Finelli, and the analogy he used for this situation was, we have someone throwing a ball, but unless we have someone set up and ready to catch the ball, it's just going to fall on the ground. And that's really the problem that he's trying to solve. So, you know, in terms... And Justin is one of the Navy's greatest assets. I mean, by the way, the organization he built is competitive with anything in the private sector. And to do that inside of the DOD is just a miracle.

I mean, you look at some of the zero-trust architectures he's built. I mean, he truly gets it. And you kind of go, how did you pull this off? And for your listeners who haven't spent time looking at some of the Navy innovation efforts in software and digital should really pay attention to this. We'll be right back. Do you know the status of your compliance controls right now? Like, right now.

We know that real-time visibility is critical for security, but when it comes to our GRC programs, we rely on point-in-time checks. But get this. More than 8,000 companies like Atlassian and Quora have continuous visibility into their controls with Vanta. Here's the gist. Vanta brings automation to evidence collection across 30 frameworks, like SOC 2 and ISO 27001. They also centralize key workflows like policies, access reviews, and reporting, and helps you get security questionnaires done five times faster with AI.

Now that's a new way to GRC. Get $1,000 off Vanta when you go to vanta.com slash cyber. That's vanta.com slash cyber for $1,000 off. And now, a message from Black Cloak. Did you know the easiest way for cybercriminals to bypass your company's defenses is by targeting your executives and their families at home? Black Cloak's award-winning digital executive protection platform secures their personal devices, home networks, and connected lives. Because when executives are compromised at home, your company is at risk. In fact, over one-third of new members discover they've already been breached. Protect your executives and their families 24-7, 365 with Black Cloak. Learn more at blackcloak.io.

So shifting a little bit, and I want to talk a little bit about access to capital and funding sources. Because we are in a little bit, now looking from the private sector side, we seem to be in this renaissance of defense tech investment, where numerous VCs and private equity firms are now interested in deploying, actively deploying capital. I mean, over $9 billion already this year alone has been deployed in defense tech and dual-use technology companies. Now, looking at the structure of a venture capital firm, I'm a little concerned that they might not be the right people to actually invest in this. And the reason being, I see VC models and VC funds as having a 10-year horizon, right? They're looking to return capital to their

investors within 10 years of making an investment. Defense technology, you know, some of these companies, some of these contracts with the existing system take much longer to come to fruition than 10 years. Do you see a problem there or is that kind of, okay, capital's capital is going to continue to find its way through the system? So the last time this happened was the beginning of this century when VCs decided that not only climate tech, but industrial climate tech at scale was a great area to invest in, this whole green tech wave. And what they discovered was that, you know, unlike software ventures, where you could find startups getting profitable within years or at least getting acquired, you know, industrial scale

stuff took decades, which is, back to your point, didn't match the life cycle of their funds. And, you know, a good number of them, in fact, almost all of them got burnt and basically pulled back for a decade or two on green tech investing. The good news and bad news is, you know, a lot of the VCs that are starting up in defense investing are doing it not just for returns, but for the sake of the country. A good chunk of them are ex they still need to make money. And how they make money is their companies generate revenue, meaning getting orders, and are profitable and or go public or nowadays get acquired at a multiple, meaning at literally multiple times the revenue that make the VC's investments profitable. Well, we kind of laugh if we just think about this. What's the acquisition cycle of the DoD? You know, in the commercial world, you shake a hand and you get

an order maybe six months later or maybe three months later. I mean, you know, when I ran an enterprise software company, it was somewhere between three and 18 months was kind of the average was about nine months to get a multimillion-dollar order or sometimes tens of millions for the first orders. That's not the DoD innovation cycle. And that's why I talk about there's a huge impedance mismatch, not only on initial orders, but again, getting startups and scale-ups to be part of the DoD acquisition process. Remember, it took lawsuits from SpaceX to get the Air Force to adopt them. It took lawsuits from Palantir to get the Army

to kind of stop what they were doing on their existing system and deploy it to Iraq. We're seeing the same thing. So think about it. Palantir, SpaceX, and Andrew required a billionaire, each one of them, to kind of bridge that gap between spending and revenue we're now seeing you know good news is companies like vannevar labs and others are getting orders capella space all of them which by the way started in my class um but but no no but we're seeing the nature of dod acquisition finally paying attention so

that there are resources and assets outside the building the pro the the question i think is unresolved is the one you just asked is is this going to happen fast enough with enough revenue and profit to keep vcs investing in startups or are are they going to go, well, that was great, glad we did that, but these funds themselves are unprofitable and they won't be able to raise money for the next generation just when we need them. Or more importantly, won't be able to fund them to the next series, right?

You go from a C to series A to B with increasing dollars because the startups need them because they're burning cash to build capability. You know, the DoD, there are acquisition people who kind of understand that, but they've not understood it at scale. We've still not changed how we deal with this part of the ecosystem. This goes back to my thing about whole of nation approach is that, you know, China and Russia have integrated. I mean, Russia just appointed an economist, for gosh sake, as the head of the DOD. They're operating with their entire economy. You know, we tend to think of DOD budgets as zero-sum games. You know, Frank Kendall's line

is like, well, my biggest problem is a lack of money. And my line is, no, the biggest problem is a lack of imagination of where to get the money. Well, think about it. The largest satellite manufacturer is no longer a prime. It's SpaceX. The largest payloads to space is by 100x. It's SpaceX.

Right, 65, 70% of every satellite operating in orbit is SpaceX. The amount of DoD investment in that versus the amount of commercial investment in that is just negligible. Not zero, but negligible. Literally, they're probably recouping their lawsuit costs right now. But the point is, is that if we had a little more imagination, it wouldn't just be VCs we'd be getting in the game. just be VCs we'd be getting in the game. How do we get hedge funds who write checks of tens of billions or hundreds of billions of dollars to build the next generation shipyards or drone factories or some of the other industrial infrastructure that we need for the military?

How do we build them? We're dependent on TSMC and others to build semiconductor plants. How do we get other plants and things that we need by, you know, I just keep asking the question, how many economists do we have in the Defense Department working on that problem? That problem, right. Not how many do we have in CAPE. You know, we have plenty of economists, you know, with green eye shades and arm bands. And I don't mean that as a majority, but they're inward focused.

That is, how many of, I mean, the most innovative thing we did with an economist was when Jason Rothke and Eric Fulmer created the Office of Strategic Capital, right? You know, they came out of AFWERX and then said, hey, could we create something with SBA that allows the DOD to have a loan authority of a couple billion dollars

to venture capital firms and companies? That was one of what I think should be 100 activities, because my goal would be, how do we create $100 billion of virtual DOD funding that doesn't show up as a line item? Well, that might seem insane, but at least that's how Silicon Valley thinks. How do we use the whole of nation rather than operating with one arm tied behind our back? And you know what? Even if it's a crazy idea, it's like it would cost us five or 10 economists. I mean, that's it. Why don't we run the experiment, talk to CFOs of hedge funds and go, what tax breaks would you like Congress to give you to invest in X, Y, and Z. How would we make that happen? Well, looking at the situation

we have now, which is early stage investors investing tremendous amounts of capital and dedicating funds right now, starting probably about two years ago and today. So in six, seven years when most of those companies probably, given the state of DOD funding, haven't delivered the type of returns those investors are looking for, you know, we will need something to close the loop. Maybe that is the hedge funds. Right. Or maybe, you know, we, you know, maybe that's when primes go in and scoop up all these, you know, undervalued things and the country loses. But imagine there was an incentive for primes that says, no, if you buy something at multiples X, multiple X, and deploy them within three to five years, not just buy them, but the incentive is to deploy them. Deploy them, right.

Right. So, I mean, if we're thinking about creative incentives, right, rather than perverse incentives, why don't we think of positive outcomes that, again, I keep going to the end. Listen, I love the shiny object thing, but I also think the outcome should be what we're focused on. Commander's objective, right? What are we trying to get done and accomplish? We start with the end state in mind. There we go. And so if you just start thinking about, okay, well, need in a and and and by the way what i remind my students if your ideas don't make you giggle they're not big enough right right and i don't see too many people in the pentagon giggling enough i mean yeah amen you know both not only what can we do to accelerate our stuff but what what can we do that that an

adversary wakes up in the morning and goes, fuck, not today? You know, that's the thing. General Mattis lectures in a class every year. And that was the thing that of all the things he said that has stuck with me, his job was to make Z wake up in the morning and go, not today. Not today. You know, that's, you know, it was a classic line out of Patton, you know, the opening scene where he basically says, people think the greatest thing you could do for your country is die. And he says, no, the greatest thing you could do for your country is make the other son of a bitch die for your country. And I now go back to say, no, actually, I would say the other thing is to make sure that no one dies,

is that we figure out how to deter, because winning a war is kind of the last objective. And even though as a 19-year-old, you might think that the thing is the heroics, no, the thing is actually to make sure we could preserve the peace and preserve the Western democracies in a way that lets us sleep safe in bed. And that's just, we're not heading in the right direction. Well, from your voice to God's ears. Steve, I could talk to you about this literally all day. We will have to have you back.

I want to be sensitive for your time. So I would just like to say thank you for spending this time with us and we will definitely have you back on. Well, this was fun. Thank you very much. It has great questions, Brandon. And I'm happy to help any way I can. Your feedback ensures that we deliver the insights that keep you a step ahead in the rapidly changing world of cybersecurity. Now, if you like the show, please share a rating and review in your podcast app.

It helps other people find the show. We're privileged that N2K Cyber Wire is part of the daily routine of the most influential leaders and operators in the public and private sector, from the Fortune 500 to many of the world's preeminent intelligence and law enforcement agencies. This episode was produced by Liz Stokes. We are mixed by Elliot Peltzman and Trey Hester with original music by Elliot Peltzman. Our executive producer is Jennifer Ivan.

Simone Petrella is our president. Peter Kilpie is our publisher. And I'm Brandon Karf, executive editor of N2K CyberWire. Thanks for listening. Your business needs AI solutions that are not only ambitious, but also practical and adaptable. Thank you. Your AI agents connect, prepare, and automate your data workflows, helping you gain insights, receive alerts, and act with ease through guided apps tailored to your role. Data is hard. Domo is easy. Learn more at ai.domo.com.

That's ai.domo.com.