Martin Hinton (00:07.276)
Man.

Martin Hinton (00:19.05)
Real mercy.

Martin Hinton (01:19.124)
Okay, here we go. Pardon me. Sorry about that.

Martin Hinton (01:25.912)
Okay, here we are.

Martin Hinton (01:34.69)
All right then, welcome to the Cyber Insurance News and Information Podcast. I'm the executive editor of Cyber Insurance News and your host today, Martin Hinton. Joining me today is Raj Ananthanpillai He is the CEO and founder of Trua and he comes to that space from a background in building trust, something that we have a great need for in the digital space as many of you will already know. Raj, so happy to have you with us today. Thanks very much. How's your day going so far?

Raj (02:04.182)
Thank you, Martin. Thanks for having me on the call, the podcast. Yes, so far so good. I'm just waiting for the next breach to be announced.

Martin Hinton (02:09.46)
Excellent, excellent.

Well, I dare say it may be waiting for us once we finish, the pace of things particularly lately. Raj, you come to this moment with something in your background that many of our audience is going to know, and that's TSA PreCheck, which is another form of building trust. And I wonder whether you might sort of back us up from this exact moment in your career to the TSA PreCheck program and what it taught you about

identity and being able to, you know, trust people who are, they say they are.

Raj (02:48.312)
Yeah, thanks for again having me. TSA pre checked was conceived as most of you know after 9/11 And you know, long lines, long security checks, and and you know, we tightened the security, okay, right? Ultimately what led to s is you know how do we have less friction or less l long lines at the airport. So we came up with this concept called register travelers. That means you register once.

And then you can zip through any airport, any airline. So we piloted that in like five airports. I mean, we we were not part of the government, we were the solution to the government. so they used our technology and said, hey, this is great. So piloted was a wildly successful, especially the airports that had the busiest business traffic because they are the ones who are zipping through. I'm sure most of you know the OJ Simpson run commercial.

When you go to want catch a you know flight from Hertz. So it's a similar concept. They couldn't do it because the security throttled the entire traffic and people were missing flights and so on and so forth. So that's the reason why when it was successful, the TSA said, Hey, let's roll this out nationwide, and then they went through a rebranding and whatnot. So now we need to scale this to millions of people. And that's when they came up with the name TSA PreCheck, and then rest is history.

So I believe there are about either 20 to 25 million people now using it. now this has gone beyond business travelers. It has come down to frequent travelers, you know, and so on and so forth. And then you also have major credit card companies now saying, hey, this is the right thing to do. So they're giving you a hundred dollar credit in your statement if you get your TSA pre-check or the colon for global entry. So that's how it started. And that was in my previous company, and then

know, I'm sure you you know a little bit. So a company called Inf

Martin Hinton (04:50.079)
Yeah, I guess what's interesting about that is that in that moment, you touched on 9-11, we became increasingly concerned with the identity of people traveling by air, commercial airline travel. And this was a method to increase security without increasing the time you waited at the airport, right? To create a less-friction security environment.

by establishing people's identity one time in advance and that being done through a way that's reliable. That idea is something that you've taken now into the digital space with Truett. And you've written a bit about this book. And I just wanted to name check your book, How Big Tech Stole Your Identity and the New Model That Takes It Back. And you've also written quite extensively for Forbes. And there'll be some links in the show notes for all of that for anyone interested.

And you describe in that writing something you call a trust crisis. So building on the TSA pre-check idea, moving into the digital space, tell me what you mean by the trust crisis.

Raj (05:57.955)
so there are two things in the in the the digital world, right? And I'll get to the AI world in a minute. But the digital world, I've been studying that for a long time because some of the breaches that actually triggered my thinking in this space, including the Equifax breach, that I can talk about in a minute. so when you have these breaches, and then they when there was a congressional testimony

After the Equifax breach, which was the largest in the United States at that time, and somebody asked, why do you guys use social security number? And so, well, that's the key identifier for us. So if you t step back a little bit, the social security was designed and invented, quote unquote, for three things, right? Government benefits, taxes, and payroll, right?

So those were the only three things because they need a key identifier to put all those three things together. But somehow that became mainstream ID verifier, right? So people talk about data holding and whatnot. You know, who cares if somebody holds your Gmail account? First of all, it was free, nobody cares. You can get another email and do that. But the the thing that is sort of a

DNA in you is the social security number and your date of birth that you cannot change not do some of those things unless you go through some enormous effort. So those are the couple of things that are very, very important for people. So the data breaches started happening. I said there must be a different way to verify individuals. And then it dawned on me why don't we bring the TSA pre check to the commercial vault? Non-traveling public, right? So you verify all your information once

And then you get a a trust token number similar to a known traveler number that you gave the TSA preacher. And then you use that, A becomes an alias for you, and B, it is enriched with all of your information. And then you know, you can't just nobody can just hack it because it's gobbly gob, one, two, three, or whatever some random numbers are. So it's like an RSA token. So that is exactly how my journey started, and then the trust crisis is.

Raj (08:14.726)
in the digital world, either people not screen you and let you into all these kinds of platforms and have a lot of issues, or they go through enormous amount of friction in trying to get you. And the worst part is an average individual logs into or provides the information to at least hundred different access points, meaning, you know, hundred different things that you have, your number, your PII out there. So repeatedly giving out

And people trying in the name of verifying you, collecting it, ho keeping it on their premise and then worrying about and then paying cyber insurance on it and all of those kinds of so it becomes you know, ten million honeypots of your data.

Martin Hinton (08:58.079)
You, you, yeah. So, so you, touched on the 2017 Equifax, breach, which was 147 million people's records. That, that was a moment that sort of, you know, set you in motion. You know, one of the things that, that, the institutions involved walked away without a scratch and nine years on or so, what, what's changed in that space? You know, I, I, I know we discussed when we were planning this podcast, the recent breach of

Raj (09:04.696)
Yes.

Raj (09:09.559)
Yes.

Martin Hinton (09:27.531)
PII in Denmark, an environment much similar to the, American social security sort of environment. What's changed and what hasn't changed since 2017 in this space?

Raj (09:39.673)
So a few things there has changed. One is there's significant privacy consciousness. People say, hey, I don't want my information out there, right? So they're trying to put the genie back in the party, which you cannot, next to impossible. Yeah, you can hire somebody to scrub your stuff from online, go through each one of those players, platforms to have them delete your records and things like that. That's like a full-time job for a whole year if you want to do that. So and that's one thing. And then the second thing is the regulators are breaking down your neck.

And and I'll I'll I'll tell you what, that has zero bearing on anything because if the regulators come and fine you or you know it's a little risk slap in the wrist, yeah, you'll write up a little check or your insurance will take care of that. but you know that what they do is, okay, now to solve that problem, what do they do? They come up with a 10, 20 page terms of service anytime you want to access, that is three point font.

And nobody in the world ever reads those terms of service because you're in a hurry to get into the platform or hurry to download the app or whatever it is. So we are in this vicious cycle of you know addicted to this digital environment, but then they're also trying to cover up by you know popping it 10 page terms of service. You said, yep, yep, yep, scroll it and then do this, right?

In fact, some of them are getting a little bit cutesy. This is, you you can't just go to the last page. They have to scroll each page. Whether you read it or not, they have to scroll each page before you. I'm sure you've seen that in some docusign for major documents, right? So those are all gimmicry in my opinion, as opposed to solving the problem realistically. Give them the option. Unfortunately, businesses don't have an option, consumers don't have an option because that's how we thought about it.

And and the the trust crisis during the digital transformation or digital era started, right? All of these dot com platforms and whatnot. so they were giving away things for free and you consumers gobbled it up. it's free, it's free. They just did not realize that they're gonna collect all that data. And they they they became the product actually. The consumers became the product for all these big tech. And then how were they being rewarded? Eyeballs, if you recall.

Raj (11:58.485)
If you have sufficient eyeballs, your stock price went up. Say, hey, we are eyeballs from million to two million. What did you do? You just gave something for free for some to come to your platform. Right? Whether they provided any major service or not, I got eyeballs, then the whole premise was if I have enough eyeballs, enough data, now I can market to them and then I can sell it in the future. So that is how the whole business model worked. And people did not realize that, in my opinion, ultimately was the

downfall for trust in this whole ecosystem.

Martin Hinton (12:32.071)
So let's take a moment. What's Trua solution to this crisis? Break that down for me.

Raj (12:38.488)
So Trua a solution is basically getting a TSA pre-check type thing to the commercial world. That's what I I would think.  I had a non-company when I sold that company for five years, and then I said, you what? I it's for the betterment of the society, I want to bring the similar kind of TSA pre-check to the commercial world where everybody gets their all their personal information verified once. It's encrypted in a blockchain, nobody can ever hack it, it has two keys.

You have one key and the system has another key. And then you only give answers to the relying party. If the relying party says, Hey, I need to verify your identity and make sure you have a PhD in chemistry so you can tutor this candidate, right? I'm just making that up as an example. And that's all they need to know. They don't need to know the whole story about you. And you're not a criminal, right? So you can literally share that selective information.

To the relying party without disclosing your life story, and they will only get the answers. They don't need to collect your social, they don't need to collect your degree. They said, Yep, this is degree verified. your social security has been verified if they want to pay you wages or whatever it is, and/or no criminal record. And it'll also tell you how did you verify your identity? we did the government-issued ID, document document verification, like a passport or a national ID.

or a driver's license and then we verified the address, we verified the social, we verified the biometric, which is liveness detection. And then you can use that in the future for authentication.

Martin Hinton (14:13.623)
So the idea as a consumer, is this something I might get, not unlike a TSA pre-check number or a card and access, that I could then take with me in my digital reality that allows, whether it be a bank or any other institution to confirm that I'm who I say I am, or in the context of cybercrime, confirm that someone who's claiming to be me is in fact someone other than me, right? This idea is that it is...

Raj (14:39.277)
Yes.

Martin Hinton (14:42.519)
like holding up your ID for a bouncer at a bar in the digital world and organized and designed in a way that it's resilient to, you know, being cracked and stolen. Do I have that right?

Raj (14:54.744)
So yes, it is ultimately to the consumers. But if you let's say you get it, but nobody's gonna accept it, right? Remember when Discover launched its card, right? people knew, there is a MasterCard and Visa, they didn't know anything about Discover. So you need to start enlisting the merchants. Hey, you only accept these two cards, you should accept this as well. So it was an easy thing. So you have to create that ecosystem. And now so there are multiple ways to do that. One is you start

banging on doors that or knocking on doors that is one too many like an employer to employees. They, you know, those who try to collect information, hey, you don't have to collect all this PII and worry about major breaches or you know increase your cyber insurance. Just get what you want without any of those things. And then once you get that momentum, which is what we are at, and then you start building the ecosystem. So

digital platforms, if you go tell them you don't have to worry about collecting data anymore and worrying about you know protecting it and hack getting hacked and buying c you know big time insurance on it. So it's easy because the analog to that is trade bureaus, right? Thirty, forty years ago, people were collecting information about all of your

behavioral financial behavior and things like that and stitching it together making a lending decision and the credit bureau came along and said, Hey, I can do all of that for you with one simple fee, and you don't have to build any of the infrastructure. You get an instant answer, which is a credit report and a credit score. Just give us the social. Right? It's the exact same analog here. Give them your trust token. They will get a a in this case they won't get a credit report, they will get a answers to your questions. And

potentially if you have a full background involved in it, you'll get a trust score. And by the way, all of it, one of the things that we did from compared to credit bureau is a black box. In this case, we let it open to the consumer because remember privacy and transparency is very important for us. The consumer gets to verify all of the data to make sure there's no confusion in the names, junior, senior, or transposing of digits in your social and all of those things. It gets verified and they

Raj (17:12.62)
are participating in this journey. That's why regulators love this.

Martin Hinton (17:15.351)
One of the reasons that... Say that one more time?

Raj (17:19.052)
That's why regulators love this.

Martin Hinton (17:21.399)
Yeah, I mean, it's it's it sounds to well it checks a lot of boxes in the way you described it one of the reasons this is necessary is because of the the data sprawl that exists just how many places our data is collected right your social security number is in Goodness knows how many? Places across the internet and a lot of these vendors are quite small I referenced the recent Danish hack and it was a two-person IT firm that was involved I wonder if you could sort of talk to me about the

underlying reality of how this data has been collected and it is now everywhere that requires this moment to be, you know, to lock it down. And I think I said to you when we were planning this call that one of the things that you'll note, most people will notice that technology since say the dawn of the internet in the nineties or so is been designed to work well, be efficient, be cheap to produce and security was always sort of an add on. And we've kind of come to a moment now as I've referenced many times in the podcast.

before of a bit of a midlife crisis where we sort of really need to because of the cost of cybercrime and the disruption of malicious acts on the internet. We need to lock down everything from, you know, patching things to identity governance. And I guess I'm a long way around to tell me about that data sprawl idea. So to put our heads around that idea of just how much it is. I think there's a line from one of your Forbes articles and I just read that to you.

The part of it, here it is. Sensitive personal data proliferates across countless company databases, creating massive targets for breaches. And you wrote that in April of 2026 in Forbes. And as I mentioned, there'll be a link. So if you could just sort of double click on this idea to give people a sense of just how many places their personal information could be found.

Raj (19:14.254)
It is hundreds, hundreds, if not thousands, okay? Because you have given your social in some cases even to a gym membership. we have to run a credit on you that you've given them, you know, and then they don't they're not gonna discard that, right? They keep it. They have to you know, if somebody comes and asks me so they know that. So people who do screening, KYC, KYB, all of those things are multiple hundreds of places over the years. So

The problem with that is that's the only option that businesses had to verify. They didn't have another option, right? So if you see the last ten, fifteen, twenty years, people have come up with different technologies, different point solutions. I gotta do this. I know how to verify your face. So I'll I'll do a liveness check to verify your biometric face, right? I know how to verify your social, I know how to verify your driver's license. So they're all point solutions, but then it involves giving multiple vendors and multiple places your information.

Right. So there is no what I call a a a you know a centralized decision making but decentralized data data encapsulation. So that's a problem that we have, right? I'd rather give it to consumers because now instead of having one business you know having million customers data and for million custom consumers.

I have million customers owning their own data, and business only has not one person's their own data. They don't have anybody else's data. So if I'm a hacker, I've got to go to million places to hack, not one business to hack. So business hackers know which businesses, they do their research, which businesses are in the business of accumulating personal data, right? So the cyber insurance started going through the roof only because of breaches and hacking and all of those things.

Not because of you know your IT practices and things like that. So when you start if you tell the insurance, hey, I have zero data in my premise, your insurance should drop by fifty percent in my opinion. And that's one thing that I I want people to start thinking about it because if you don't eighty percent of the businesses don't need your data on their premise. They need it only to verify you. But some of them they need. So we have gotten used to this giving out this data over and over again, unfortunately.

Martin Hinton (21:39.596)
I mean, one of the interesting things, and I wonder what you think about this, is that that information is not perishable, right? My social security, my date of birth, my name, these are things that are useful to a bad actor for a long time, right? In perpetuity, even. Do you think when companies store that data that there should be some sort of expiration on how long they can maintain it? Is that a safeguard or a guardrail that would make sense as an idea like yours came up?

Raj (22:05.1)
Yeah, then they're supposed to yeah, they're you they're supposed to flush it after a certain time. But then what happened was wrongful claims and litigation started going through the roof, right? then they have to retain those records. So the the the regulars, you gotta retain it for ninety days or a one year or whatever it is. So doesn't matter how long it is, even a day more than more than a day, hackers are just hovering around your business to scrap that.

scrape that. So it is very important. Yes, absolutely you have some places you have to by law you have to expunge some of those things and s depending on the industry and depending on the type of business you are. But that doesn't do anything. It can be hacked the very next day. The best thing is not to have it. Right. So even in our own case, when we give you a trust token which is like an alias for your social security, it is a dynamic token.

meaning it is valid only for that particular transaction and it expires automatically after a certain time depending on how you define it. Right? This is like an RSA token. RSA token goes for a whole minute. In this case it could be for a day, it could be for a week. But if they are an employer, for example, they're going to be working for you. It could be perpetuity. And but they have no data. They just have that information that you are still a a good citizen and stand good citizen and good standing.

Martin Hinton (23:31.48)
You touched on in some of the writing and I mentioned moment ago is this small vendor reality and the idea that the way the supply chain works. And I think the 2026 Verizon data breach report put third party involvement at roughly half of breaches, which was an increase from third, part of me, 30 % or so in prior years. What about that part of this? And if I'm dealing with a vendor.

because we've touched on data sprawl and the idea that a company may have backups to PII databases that they don't even realize they have. We've done reporting on here. It's very easy to keep things digitally and then you lose track of where they are and you wonder whether or not they're being protected properly. What are some questions that you should be asking your vendors? Are there three contractor questions that you would want to know about how this information is managed to help protect?

yourself from liability outside of any technical things?

Raj (24:27.822)
So the first thing I would say is your supply chain is also if if not a same, it it some if it it's always more risk than your employee. Because you vet your employees as they're coming into the most of them they do as they're coming into the door. They're not they're not doing it continuously, but that's a different topic and disc discussion. They do it when they're hired and whatnot.

supply chain they rely on the vendor to do it and they place the contractor for example on premise to do some of the work or they have their access to their databases to a third party because they were vetted and whatnot. So the company was vetted, the company has insurance, but individuals may or may not have been vetted, right? So that is a huge risk. It's like saying okay, you know I I check the company as they come into the front door

But what about the employees that work for the company? Did you check them? Do you put the same owners that you put on your own employees? So supply chain is a huge risk in my opinion. So small companies cannot afford this big insurance, right? That's another big thing. Is small companies, so whether they are even if they have in a hundred people's for example, I'm a small gym guy running a gym and I have to verify to make sure they can pay their bills and whatnot.

The question is, you know, I'm going to have that data. I'm a small business. How am I going to protect the you know, if I want to have insurance? Right? It's going to go through the roof. So that's a cost of business has gone through. In fact, I talk about that in my book, which is some of these things where the amount of money that is spent by all these businesses in trying to verify you and screen you, all of those things, the cost of doing that, and then the cost of insurance, if you can

Drastically reduce that, there should be a meaningful economic output and probably making a dent in the GDP in the long run. Because that is a big chunk that people are spending billions, including breaches, you know, cost of breach, recovery from the breach, paying out people, all kinds of stuff, lawyers, legal fees. If you take all of that, you know, it is a big number. And because the numbers are mostly, if you think about it, people are afraid of.

Raj (26:49.538)
their own PII, not necessarily their email address or whatever this.

Martin Hinton (26:54.647)
Yeah, mean, you make a very good point. mean, one of the things you just said there, the trust crisis thing comes back to something we discussed when we were planning this, was that the idea that within business, trust is essential, right? You don't have to like people, but you have to trust that they're offering what they say and you're going to get what you say and live up to your end of the bargain. And we have all these phrases for that sort of thing. Establishing that trust is something that can happen.

Raj (27:09.016)
Yes.

Martin Hinton (27:23.905)
perhaps quickly over a handshake, but in the context and the scale that we're talking about here, it can't happen in that sort of intimate individual way. It has to be scaled as you said earlier. And the number of times you have to have your identity verified is extreme, right? The idea that there are all these different ways to do it. All of that, am I right to say that all of that in the phrasing that you just used is time consumed and friction in the economic process. And that inherently means

things get more expensive, right? It costs more to do things. Thus, you have to pass that cost on to consumers in some way, through your company, whatever it sells. And the value in what we're discussing today and what Trua offers is the idea that you can reduce that friction while maintaining that security. I wonder, do I have that right? Okay, so I, go ahead, go ahead, go ahead. No, no, you, you.

Raj (27:53.496)
It's

Raj (28:10.626)
Yes, yes. In fact, one more thing in the Yeah, go ahead. No, no, one more thing I was gonna lead to that is if you think about marketing, right? This whole new generation of marketing, they market to bombard it to a million people. And what is the typical metric? if I can get one percent, two percent to respond, that's my you know, golden tree.

Think about 2% of 100 people you market, 2% maybe respond. Instead, in the long run, it may not happen immediately. In the long run, when you start having your own data that you control and you manage it, right? And then you can say, hey, feel free to market to me. Okay? Because I don't want to be you know bombarded with, but you feel free to mark. So what you have gotten is a qualified buyer, potentially.

Right? Hey, I am looking for that pair of shoes. I am looking to buy a new computer. Feel free to market to me and I want to see all the deals. So now you have your customer acquisition cost from a marketing perspective is a lot less. I have directly curated list of people who want to buy my product ultimately. So that would be the dream. Right now we are so far away from it, but that would be the dream where my customer acquisition cost is nothing, basically, because I have curated customers who want to come to me.

Martin Hinton (29:30.296)
I mean, so I mean, the idea there is that with all the non-human identities, the bot traffic on say social media, companies might be spending a lot of money marketing to people who can't actually buy shoes because they don't actually have feet. And what we're talking about here is a way to confirm that if you're going to market to people, they're at least actually people who maybe have a credit card and an inclination to put shoes on their feet. I mean, that sort of gets me into the AI and specifically the AI agent sort of, you know,

Raj (29:30.338)
To buy.

Raj (29:40.238)
Yep. Yep, that is exactly right.

Raj (29:51.618)
Yes. Yes.

Martin Hinton (30:00.119)
access and the delegation of authority that we've seen. What do you think the impact of that is in this space? Because we've seen stories about banks restricting AI agent access and that they don't want to put the brakes on people utilizing this technology, but at the same time it creates a real security vulnerability. How do you see the artificial intelligence landscape impacting all this?

Raj (30:24.648)
it's gonna be that's one of my pet peeve is hey AI is gonna just exasperate this whole problem that we're already facing in the digital world because now you have quote unquote autonomous agent doing that. So there are multiple problems in that. Okay, I'll get to that. First problem is if you have if you are autonomous and you don't have a human attached to it, so to speak, you know, human verification attached to it, so I could be a sanctioned individual.

Right. I'm on a watch list. I'm sanctioned not to do business in the United States, whatever it is, right? I can deploy an agent and do all kinds of financial transactions, or I can do whatever that I'm not supposed to do using an AI agent. Who is accountable for it? Who's liable for it? Who are the you know regulators going after going to go after for doing business with a you know oligarch or whatever it is.

That's a huge, huge problem that people are going to face because that whole insurance industry is in chaos right now, unfortunately, because they don't know where to point to, right? If you can find the the the various pitfalls, say, hey, you don't have this, you have this, you k then you can do all of those things. But today it's autonomous. So I always say that because today, if you want to do an autonomous transaction, for example, or AI transaction, how do you verify it? It's gonna be very, very

friction frictiony so to speak if you want to call that right how do I verify that you're pausing it the whole purpose of AI is defeated right instead have an attached trust token that you have you have obtained and you can attach that trust token to that AI agent

And then that agent can act on your behalf. And you can say, hey, you have my today, if you're looking for a new briefcase, I'm just using that example, right? if you find a great one and these are my parameters, go find one and buy it. You can say, Okay, I'm gonna give you six hours to do that. I'm gonna authorize six hours. Today you can't do that, it just keeps going, right? If they do, or they have to kill the agent, right? So one of those things. So

Raj (32:30.274)
There is no means to do it. My I'm biggest concern is we're gonna come into the same situation that we came with the internet and the digital transformation. We focus on the top layer presentation layer, not the bottom layer, which is the trust layer. So there is no trust layer in the internet. The best way to do is have this trust token for everybody who wants to participate in the internet, ultimately.

Martin Hinton (32:51.767)
I mean, do you, one of the things we hear about all the time now is the idea that a lot of the traffic on the internet, more than half is non-human, right? And the idea that people on social media are arguing with strangers, maybe that's the low hanging fruit that you're reacting to a bot that's been designed to get a reaction out of people with a certain point of view about whatever it might be. That is sort of even one other layer of this where you could theoretically have a

a social media company that's akin to threads or blue sky or X where everyone joins and they use this token for their logon, meaning that you know everyone on this site is an actual human being who's been verified through this technology. And there is an argument there to be made that that sort of site would have a higher value to advertisers because well, at a minimum, they're actually real people here that are part of the economic process.

Raj (33:42.626)
Yes.

That is exactly my point, is yes, that is exactly my point, right? You have the blue check mark in the Twitter or the X, right? But that blue check mark is based on how much money you've paid, right? Or what kind of premium subscription, in my opinion. But they have not really, really that betting on you. So I say if you can have as you just said, that's an excellent point that you made, is once I have all these platforms with the verified individual, hey, if I'm going to market, I'm gonna use that.

market market to that audience and my CAC should be customer access and cost should be a lot lower. Right. Now I know I have a a defined targeted market. It's not going into Ether. It's not going to unnecessary people. So they they have opted into it. So the the whole opt-in opt-out kind of stuff is is the you know that's where it makes a transformational change.

Martin Hinton (34:37.857)
So I have to ask if the information exists somewhere and if we all had one reusable credential that proved who we were with various bits of information about us, what stops the place that's storing this information from becoming the next big target?

Raj (34:56.99)
because it is A, it's encrypted, first of all, and it's in a blockchain ledger and it has two keys. I always say that, right? Because that means, you know, when it's in blockchain, we use blockchain not for the fancy of the blockchain, we use it for security purposes, right? So it's not just one place you go and hang it. So they can never get any of those things. So and then raw data doesn't transmit at all. That's the thing. See, half the time, more often than not, a lot of these things are stolen because there's multiple places.

So we have taken all of the pitfalls of the current ecosystem, whether it's a credit bureau or whatnot. Yes, I'm not gonna say it's hundred percent foolproof. There's never no such thing because we don't know with AI how many hackers are sitting there and that's a full-time job in some foreign countries. Nation state actors are also there, say, okay, I'm gonna go after this. But if they do, there's not a whole lot in there because it is really, really next to impossible. So because we've

Did a lot of work in the public sector with the TSA pre check and some of the higher end national security initiatives. Security is number one for us. So we have put forth around what we build. Literally.

Martin Hinton (36:04.919)
I just wanna hat tip that your willingness to not say 100 % because my favorite line from one of the Star Wars films is that absolutes are only for the bad guys to paraphrase. So I just think that in this dynamic of the space we're in with AI and then you look at quantum computing coming online depending on who you talk to in a year or two or maybe more, there is this reality that we need to maintain this idea that the solutions we have now

may work, they may be fundamentally fantastic ideas, but there's a perishable nature to security, right? The banks we used to use in the wild west with safes were not banks that we would employ now to keep our money secure. again, I think that idea that there is an ongoing adaption and evolution required in this space is something that, you know, I think we are just coming around to ironically. I think when we introduced the password, everyone was like, everything's secure. And lo and behold, that was about as far from the truth as could be possible.

I wonder, sort of moving this into an insurance point of view, an organization require vendors with this kind of access to carry cyber insurance? mean, what do you think about that part of this?

Raj (37:14.712)
So you know, if we we have cyber insurance too, but you know, we explain to our insurance, see insurance companies have not had a head realigned with this whole new thing that's going around because they are struggling with you know the digital evolution and the AI evolution, right? They don't know how do you determine the risk and the threats and you know, but they just throw a big number and hopefully it'll stick for some some fe for somebody. So we always explain to them how we do it.

And they scratch their head. my God. Okay. So if I fundamentally tell people is if you don't have to keep people's PII, everything else is perishable. Everything else is you know worthless in my opinion, right? As I said, email you can get a new email, you know, telephone number, you can do that. But some of the PII, it's very near and dear. You know, there is a

is an organization nonprofit called Identity Theft Resource Center. they actually help identity theft victims. They have education programs. They do this annual survey and you know the the the latest one is 80% of them had there were human toll in box people committing suicide because they lost everything in their possession and assets were gone and so on and so forth. It is just mind-boggling. So you want to make sure that you have nothing to

be hacked. So once you have that, the insurance company should say, Hey, wait a minute. I am going to either you know, not necessarily endorse any product, but hey, do you have these practices in place? They should ask this fundamental question as opposed to describe to me your company and I'll give you a number for your policy. Right? Okay, what is your policy and what is the business you're in? Why are you collecting this? If it is a marketing company, this is our business to collect all the information, you should tr quadruple and

you know, tenfold increase their cyber insurance because they are a prime target. But if they're in the business of providing, I'm just saying, you know, selling you s briefcases or or suits or whatever it is, they don't need your social date of birth and all of that PI. They may need your email, that's for different reasons, but they don't need that. And if you're collecting that because they're you're verifying whatever it is they are verifying, they said, hey, don't do that. If there is an alternative way to do it, do it. So

Martin Hinton (39:38.569)
I mean, I mean, it.

Raj (39:39.366)
That's education has to happen a little bit and unfortunately they need to pick up their speeds faster because AI is really, really breathing down their neck.

Martin Hinton (39:48.952)
I mean, what I'm hearing you saying, I've read some of your writing, is the idea that if a company is more disciplined in controlling the data, it maintains. So let's say for marketing, they maintain your name and your email, to your point. And they don't keep the credit card you use to buy something. They don't keep whatever else might have been something that you would have asked for once upon a time, even date of birth, right? Now,

There's an argument there that companies that have a discipline where there's real limited time with which information is held and they don't maintain backups that they forgot about on some server they didn't realize existed. There should be a benefit in their insurance coverage for that's a premium reduction for those sorts of good practices like there are with, you know, say MFA or phishing resistant MFA. Is that right?

Raj (40:34.594)
Yes.

Absolutely. So if you don't have information or you flush it down or you don't do or use a different method to do all of those things, their s drastic the the insurance should drastically be reduced because there's nothing to steal there, right? So a lot of small businesses struggle with this, unfortunately.

Martin Hinton (40:58.007)
Well, I I can tell you from talk to them, think, you know, one of the things that small businesses struggle with is the running of the business. All of this other stuff, like how things are organized and the sort of the hidden parts of it are where it becomes a greater challenge because it does take time and it is kind of abstract. You know, one of the things that's come to my mind as we were discussing this is that we're seeing a lot of class action lawsuits, the sort of long tail of litigation that exists.

And I guess it occurs to me that if you're a company that maintains data, even if it's encrypted for that matter, and you're the subject of a breach and that information is stolen today and then not acted on for 18 months or two years, that is an enormous problem that can come out of nowhere with little warning or surprise, because a lot of companies wouldn't even realize they'd been breached. Tell me about that idea that, you know,

This idea of not maintaining this information, of really being thoughtful about what it is you have that could be stolen and then used maliciously by someone reduces liability and A, the cost of, say, cyber insurance, but also the potential payouts that could come as a result of any kind of litigation. I mean, what about that part of this?

Raj (42:08.782)
Yeah, because that that that is a very great we you know you can get sued, but you can say, hey, we didn't store any information. So we it is not our problem. I don't know how it happened. If we didn't store, if we did store and hackers are hackers don't act on data right away when they hack. They are they have a five year plan for you. Okay. So they steal something today, they're doing something two years down the road, as you said. They're not going to do anything tomorrow.

So because they their pipeline, they're building their pipeline, so to speak, just like you know, salespeople build their pipeline. And and so it is very important to distinguish between what is required and what is not required. If your business requires something, because you're regulated, banks are required to keep some. In fact, one of the examples I want to bring was a bank what OCC or SEC, I forget, one of the regulatory agencies, they have now

said hey we're not authorizing it but if you're using your digital driver's license, right? Mobile driver's license they call it mobile MDLs, and you're using that to verify somebody for a KYC, we are okay with it. Until now it had to be physical. Now they're okay with MDLs. Because MDL is s it's a twenty-two states people are using it. So

As you can see, the evolution for even the regulator regulated industries, yep, they are willing to look at mobile driver's license, and that's only a matter of time you could say, okay, you can use the you know mobile token, trust token, for example, right? So you don't have to have collect all this data and be worried about it. So regulatory reasons, you're still trying to collect some of that. Healthcare is another big, big issue.

People are collecting. I go to my optometrist, and you know they still want to see all of my my copy of my driver's license. He scans it and I said, For God's sake, what the heck are you going to do? And my wife always says, Don't argue with the messenger. So he's just doing his job. But I'm very paranoid. And as you know, three months ago, two months ago, I I wrote a post about it. 156 million driver's licenses were breached. Your driver's license and my driver's license, probably in that breach. Okay.

Martin Hinton (44:11.969)
Yeah.

Raj (44:26.178)
Because they were collecting exactly that in all these places and it got hacked. Why do they need that?

So first question, ask those questions. I mean, it is just mind-boggling because they have no other means to do it unless you provide them a different means to do it. Right? So an internet was built for trusting people, right? If you go back to the around internet, right? DARPA and other places, you know, I'm sure I I went to CERN to do some research actually to find out as as part of writing this book. I said, How the heck did this internet happened? Why didn't they know? So it turns out

Martin Hinton (44:34.901)
What? Go on.

Martin Hinton (44:45.217)
Yeah, I mean, it is,

Raj (45:04.766)
Berners Lee was the scientist there he was in charge of the CERN lab he wanted to distribute his research to a lot of people academics and you know other scientists all over the world and that's who he built WWW which is World Wide Web and then you got Netscape to put an interface on top of it for browsing so that's how we evolved but it was always for a trusted party two parties we have come a long long way from that you know there's no more trust

It was trust but verify now. Absolutely verify first and then maybe trust. And AI is going to exasperate that situation.

Martin Hinton (45:39.681)
I mean, you.

I mean, you touch on an interesting sort of reality that there was once upon a time, even into the early days of the social media, that this was going to bring the world together and become this sort of, you know, lovely place of communication and sharing ideas and information. that, while still the case in some respects, is outweighed in many ways by the cost of the crime that's been taken advantage of because security was a secondary concern.

One of the things that you touched on, and I wonder if you could tell me a little more about, is this idea of how I possess this ID, right? This ID travels with me and it's in my possession, not unlike a driver's license in my wallet. And I guess I want to take a moment to try and sort of give a real world sort of existing example of how, you you put your driver's license in your wallet, you put your wallet in your pocket,

You keep it secure. If you lose it, it's a problem. You have to get it renewed. This idea is that in the digital space, it's much harder to comprehend these needs for security for a lot of people. And what we're talking about is a very, very similar thing. That is, you know, if not government issued, recognized and certified as official in some capacity that allows you to, as a business, deal more quickly with the fact of verification. And as a consumer trust that only you can execute

commerce on your own behalf, right?

Raj (47:13.656)
So the two things, right? So the wall we we say this the trust credential, the trust token. It goes into your digital wallet, right? It could be on your phone and it could be on your Apple wallet or Google wallet or whatever it is. The key thing is it is not tied to the device. It is tied to the human. If you low if you do lose the device, no big deal. Nothing can happen. Because you get your your do your your trust credential or the token it goes with you.

That is the best part about it. So that's why I said when I said we studied all of the current systems and we said, okay, what are the various problems? Could have, should have, would have, and all of those things, and said, okay, let's solve all of those things, right? Including the opportunity for you to verify your own data. Nobody has ever done in the industry before making a decision. He said, we want to do that. Yes, it is a sub you know, we are t putting the consumer first.

But they cannot change anything, but at least they can, hey, this was my dad, junior, senior, confusion and whatnot, as opposed to me. Right? So those are the things people are being affected downstream, and the decision made by the Equifax had another problem. They got the wrong credit scores for about five million people about a couple of three or two or three years ago. They paid a hefty fine for that because they were denied loans, car loans, and other loans, because their score was all wrong. So

Th this is what happens. And I challenged all the three credit bureaux. Open your freaking credit report to people so that they can look at it and say, hey, this doesn't make sense. First of all, you stole all my data. I never gave you permission to collect my data, right? They they collect data from your telecom bill or utility bill, mortgage statement, bank statements, all of those things. They because you sign that consent when you open up a bank account, when you sign a mortgage.

You know, after you see the hurt statement, you're excited to close on the deal and then they ask you to sign fifteen more forms. And that gives them the right to sell your data to these credit bureaus and they're collecting all of it for free and the businesses are making money. You are the product in that case. That has to stop, in my opinion.

Martin Hinton (49:20.437)
Yeah, well, I you touched on the line of if the product's free, you're the product, right? That idea that, So we've been talking about 50 minutes or so. I wonder if there's anything that we didn't get to that you had something to say about that you think's important for people to hear about?

Raj (49:28.898)
Yes.

Raj (49:40.365)
Yeah, so it is a very simple you know, don't have your data P PII on your premise if you don't have to. And then if you don't have, when you have to buy a cyber insurance, for example, make sure you communicate that to the don't just describe your business. They will assume standard practice by everybody, okay. I'm gonna have, you know, allocate million dollars for this particular breach or two million dollars. So tell them you don't have carry so the premium should go down for many of the people.

Right. So that is the best, especially SMBs are the ones that are struggling with this sky high cyber insurance. So we need to have that. And then it's a very simple thing. Put your head around, you know. People say, we need to have everything frictionless for midi, many, many transactions. A little bit of friction is okay with me because you're validating the transaction. We have lots of money is being exchanged or many sensitive transactions being executed. So friction should be there if you cannot.

You know, if it's easy for a for you, it's going to be easy for the hacker. So there should be a little bit of friction. So TSA Precheck is a great example. You spend five, ten minutes to get your credential once, and then you operate in this new world. So I think having this trust token and then having the trust bureau, which is anal analogous to the trade bureau, is the future because it's gonna protect even AI transactions.

Martin Hinton (51:04.759)
I mean, when you and I spoke originally, one of the things we discussed was this idea that frictionless used to be the thing. And Steve Jobs is famous for that line with regard to the iTunes store. But in this moment, a bit of friction is safety, right? And you touched on the idea that if you're dealing with a bank transfer and you get asked like 11 questions in order to verify that you're who you are and you should be doing this and you have the authority to do this.

that sometimes you get bank tellers and I've been in this situation I didn't mention to you where, you know, the bankers like I'm really sorry to have to take to go through all these steps. And I always say, and you said the same thing. No, no, no, I completely understand why you're doing this. And thank you for taking the time because I don't want someone to be able to take money out of my account or someone else's account or some strangers account. And right now the best solution we have for it is to add layers of friction until we were to sort of widely implement some kind of technology like this. I mean, what do you think about that?

Raj (52:02.344)
Yeah, a absolutely because AI is gonna really mess up. People don't seem to get it. They you know, Muse announced it, I wrote a post about it, you know. Yeah, it's Muse we are trusting Facebook or Meta with our security. Remember their Cambridge Analytica problem they had. I read about it big time. I mean they mean massive breaching of your trust and security. And then now Muse is going to help you. I mean, I don't know when people are gonna learn.

You know, say, hey, this is the same company that compromised all your data previously without your knowledge, and they got slapped in the thing and they got back into a business. Right? So they it think about it, Google, Meta, they I I always look at their you know financial statements. Where are they drawing their biggest revenue? Advertisements. What do you need for advertisements? Data. They're gonna suck your data no matter how.

They may the you know, I always say, hey, don't sell my data, whatever it should be top of the screen, not at 13th page, where you have to find it and then do it. That's why I like Apple sometimes, right? They give you really right off the bat option to turn off ads and you know all of those things, right? And if you see their revenue statement, 35 plus percent is on devices and hardware and other things, you know, not in advertisement.

Martin Hinton (53:26.273)
Yeah, that's a good point. mean, your point about the terms of service is I think I forget which company it was, but it was one that if you wanted to read the whole thing at a normal reading pace, it would have taken you like 19 hours to read. I mean, you could finish like Gone with the Wind or War and Peace in that amount of time, depending on your reading. I mean, which is...

Raj (53:43.195)
War and peace. Yeah. Yeah. It's the same thing, right? Yeah, go ahead.

Martin Hinton (53:48.63)
No, I was going to say it's not like they're written particularly well, which, you know, maybe down to lawyers writing them or making it hard for you to understand. Raj, is there anything else we haven't touched on?

Raj (53:53.942)
Lice, nice.

Raj (53:58.393)
Because the businesses b yeah, businesses sort of collude with the regulators, right? They hire lobbyists and say, Hey, I need this fixed. The lobbyists will go with the regulators and meet and say, Okay, how about if we put this language in our terms of service? And then they review it. Okay, good. Okay, then let's make it two point font or the smallest font possible. And they got their you know, they stop breathing around their neck. So regulators are the same thing, you know, they like to get things off their plate.

They have never solved a problem. They are good at introducing new legislation, new regulation, new statutes, but none of it has solved the problem.

Martin Hinton (54:36.328)
Yeah, yeah. Raj, anything else we need to talk about today?

Raj (54:39.626)
That that's it. You know, they can read my book, you know, and every dollar every dollar of the book is going straight, I don't getting a not penny, go a string going to a straight to a nonprofit that is helping identity theft victims. I really want to help them.

Martin Hinton (54:54.497)
Well, Raj, a link to your book and a link to a bunch of the Forbes articles that you shared with me that we use to prepare for this are gonna be in the show notes. So you can find additional information there. And if you wanna look into Raj's book. Raj, if you've got nothing else, I just wanna say thank you very much for the time today. I really, really appreciate it. Just again, Raj Ananthanpillai the CEO and founder of Trua.

Again, there'll be links in the show notes. You can find him there. Raj, again, thank you so very much. Everyone else.

Raj (55:26.607)
thank you, Martin. This was pleasure talking to you.

Martin Hinton (55:29.047)
A pleasure as well. Thank you again Raj. Everyone else, thanks for watching and listening. I'm Martin Hinton, the executive editor of Cyber Insurance News and Information. If you've got a comment or want to share this, we'd certainly appreciate it. It helps us reach more people. Again, thanks for watching and listening. Enjoy the rest of your day.

Raj (55:31.758)
Thank you.