#328 Kevin Tian: Exploring Doppel's AI-Native Social Engineering Defense Platform

AI is changing more than just productivity. It's changing what we can trust. In this episode, Kevin Tian, Co-founder and CEO of Doppel, breaks down how AI is enabling a new wave of social engineering attacks—from deepfake phone calls to impersonation across LinkedIn, YouTube, and search engines. The reality is this: Deepfakes are just one part of a much bigger problem. Attackers are now operating across multiple channels at once, using AI to manipulate people, not just systems. And as these attacks scale, the real risk isn't just fraud or data loss—it's the erosion of trust in everything we see online. Kevin explains how Doppel is building an AI-native defense platform to detect, map, and shut down these attacks in real time, and why the future of cybersecurity will be defined by AI vs AI. If you're thinking about AI, security, or the future of trust online—this conversation is essential. Stay Updated: Craig Smith on X: https://x.com/craigss Eye on A. I. on X: https://x.com/EyeOn_AI (00:00) AI Deepfakes & The Collapse of Trust (01:56) Why "Social Engineering" Is Bigger Than Phishing (05:20) Deepfakes, Misinformation & Multi-Channel Attacks (09:16) The Rise of Deepfake Phone Calls (12:43) How Attackers Manipulate AI & Search Results (14:39) The Origin Story Behind Doppel (18:55) How Doppel Detects & Stops Attacks in Real Time (22:55) Can Attackers Misuse AI Defense Tools? (24:26) How to Tell What's Real vs Fake Online (28:20) What Is Human Risk Management? (30:36) AI vs AI: The Future of Cyber Defense (34:04) What CEOs Must Do About AI Threats (37:18) Working with Platforms Like YouTube & LinkedIn (39:52) Can We Ever Fully Stop Deepfakes? (44:40) How Doppel Works for Enterprises

Speaker names marked ? are inferred from speaking time and the show’s known hosts — they are not voice-verified.

• 0:00Speaker 00

  But it's really that broader thesis of this is the existential threat with AI, right? It can manipulate digital reality.

• 0:06Craig S. Smith?

  Now, I don't believe anything that I see. Ultimately, what's eroding here, it's not the individual attack, it's trust in general.

• 0:15Speaker 00

  This deep fakes is actually just one part of the problem, right? It's just one vector and how you make execute a social engineering campaign, a fraud campaign, a phishing campaign. And so in order to have the capacity to combat them, you also need to be using AI, right? AI to fight AI. But again, it's just not scalable. So how do you actually deploy AI effectively to build up your own capacity? That's a business critical, mission critical problem to solve. Hi, everyone. Kevin, co-founder and CEO of Doppel. We are the AI-native social engineering defense platform backed by Drewson Horowitz Investment Venture Partners. Before all this, my background was actually in software engineering at Uber and Lyft. I worked on everything from dispatch systems to flying cars. Not quite the traditional cyber founder background.

• 1:00Speaker 00

  But I met my co-founder Rahul there and we started this company in 2022 as an AI company in response to him getting a sneak preview of ChatGPT. And since then, it's been, you know, an absolute ride. Our mission has been to tackle what we've seen as the existential threat with AI. And that's all things, social engineering, deep fakes, impersonation, phishing, fraud, you name it. And today, we're now blessed to be working with hundreds of enterprise customers scaling quickly to support some of the largest organizations in the world. We've got dozens of Fortune 500 logos. And we operate in multiple key areas around social engineering. So we're the first social engineering defense platform that enables you to detect impersonation attacks, whether they're impersonating your brand or your executive, take them down.

• 1:44Speaker 00

  And so that's traditionally been called the brand protection, executive protection products. And now even enable you to simulate and train against them. So we've launched red teaming and security awareness training products as part of our human risk management portfolio.

• 1:56Craig S. Smith?

  Okay, and yeah, I mean, this is certainly a problem. I'll tell you, I enjoy YouTube. I watch a lot of YouTube, but it's just filling up with AI-generated content. It's very frustrating. And actually, I'm surprised YouTube isn't, isn't doing anything about it. So when you, this term, social engineering defense, was that coined by you? Or is that a Gartner category?

• 2:24Speaker 00

  That's a great question. So we coined the term originally, actually, because you know, I think traditionally the space has thought a lot about phishing and you know, for example, you know, point solutions like email security, things like that, right? But in the age of AI, we're talking about something that goes much broader. And so that's why we came up with the term social engineering, the fact that, hey, you're not just going to be worried about email phishing attacks, but folks are flooding YouTube, right, with AI contact, uh, content. Folks are setting up personas on LinkedIn, shooting SMS messages, doing deep fake phone calls. And, and that's really the world that we live in today.

• 2:59Craig S. Smith?

  Yeah. And are, are your customers, enterprises, or individuals that are being, uh, whose likenesses or, or IP is being used? Or are they, um, are you working with the platforms like YouTube to identify deep fakes on their platform?

• 3:20Speaker 00

  It's a great question. So today we service enterprises and within those enterprises, we may protect individuals. So for example, Craig, if, um, you know, if, if we were to protect your organization, right, then you know, obviously you as an individual has incredible IP, incredible name, image, likeness, rights, things like that. And, and so very much that's part of our executive and VIP protection. But yeah, so today we protect, you know, everyone from C-level executives to athletes to actors and actresses on our exec protection and VIP protection products. But we also, of course, are protecting the brands themselves and the company. So, you know, think about your favorite Fortune 500 brands, right? How do we make sure that they aren't getting impersonated to, you know, either target customers or target internal employees as well?

• 4:04Craig S. Smith?

  Yeah. And are you looking at deep fakes in particular? Or are you looking at, uh, I mean, I saw when there's a channel that popped up recently, I don't know how long it'll last, but they have, they've been doing Epstein stuff and they had a really shocking report, uh, that's, uh, showing emails purportedly from the Epstein files, uh, that talks about 20 million pounds that had been sent by Epstein. To former Prince Andrew's daughters. And you know, when I first saw it, I was like, holy mackerel, you know, that is a story, but I have that. I can't believe that hasn't been covered.

• 4:46Craig S. Smith?

  And indeed, it was completely fabricated. So it's not fabricating the likenesses. It's fabricating elements of the story. That's one. And then I've also seen, you know, personalities like Obama or others now who are promoting products. And you know that it's gotta be a deep fake. Um, they're very well done. So which of those, I mean, obviously the latter you would take care of. Do you, do you do any of the misinformation uh stuff?

• 5:20Speaker 00

  Yeah, misinformation, disinformation is certainly part of the problem. How we think about it is deep fakes is actually just one part of the problem, right? It's just one vector and how you make execute a social engineering campaign, a fraud campaign, a phishing campaign. So you've got your, you know, you've got traditional impersonation techniques, you've got deep fakes, you've got disinformation. Um, and it can happen across all these different channels, right? And so for us at the end of the day, when you think about it, it's, you know, it's really two objectives usually from these bad guys. It's go acquire money or go acquire data, right? And they're going to use every single possible channel and every single uh possible technique to execute that. Whether it's, you know, with deep fakes or whether it's through disinformation or whether it's through, you know, traditional impersonation attacks.

• 6:04Craig S. Smith?

  Yeah. And, and then how do you uh, how you address it? Uh, I mean, yeah, what, what do you do? How?

• 6:13Speaker 00

  That's a great question. Yeah. So we, we actually think a lot about what we call the social engineering attack chain, right? Like if I'm going to go try to defraud you, Craig, right? Or if I'm going to go try to steal your data, there's a whole sequence of steps that I need to do in order to successfully attack you, right? I need to prepare my attack. I need to then go get you uh fully ingrained in the attack and then, and then go actually execute the seizure of either monetary assets or data assets, right? Um, and, and so. We we we're actually building out a platform to stop every single piece of that attack kill chain.

• 6:52Speaker 00

  And and and today, we we're actually already a multi-product platform as a result. So today, right now, what we do is three key capabilities. One, we're scanning for impersonators of these attacks, right? So we we will actually, you know, there's the traditional, hey, maybe someone spun up a fake, uh, you know, let's take a look at the platform we're using right now, right? Someone spun up a fake StreamYard website, right? And it's actually, you know, you send that fake StreamYard website, it actually makes me download some malware instead of the actual StreamYard website, right? So that's one piece of what we do is we're constantly scanning all the new domain registrations. We're scanning everything on social media. We're consuming a whole bunch of threat intel feeds around, you know, fake SMS messages and phone calls.

• 7:35Speaker 00

  And uh, and we're scanning even, for example, YouTube ad platforms, uh, search results, right? And that's how we find a lot of the malicious activity that's happening. From there, we use our threat graph, connect all the dots and showcase that entire campaign uh, in real time. And then the beauty of this is we're not just showcasing that all, but we will then go take it down. So we are then issuing a take down request to YouTube. We're issuing a take down request to uh, the fake StreamYard website's uh, host and registrar, right? Uh, or the telephone numbers and um, and so that's key capability number two is that we're not just responsible for showing you all this stuff and proactively telling you about it. But we are proactively shutting down that tack before it can happen.

• 8:18Speaker 00

  So it may even be a fake ad, for example, right? Like, hey, if I go Google StreamYard and the number one result is um, a malicious StreamYard malware site, but because they're paying for Google Ads, that it's the top result, we shut that down. So that's, those are the first two capabilities. The most recent capability is we can now simulate those attacks. So if you've, you know, if you've seen the traditional security awareness training model, right? Where you get a phishing email and you click on it and it says you failed the training test, right? We can do that, but again, the whole story is that things are multi-channel now. So we're not just doing phishing emails, but we will actually do deep fake phone calls.

• 8:58Speaker 00

  So we'll, you know, for example, we'll send you a, a message, Craig, or we'll, we'll call you and it'll be a deep fake of me. And that, that deep fake voice will then, uh, you know, try to fish you and compromise you. So I can even showcase some of that today if that's of interest.

• 9:16Craig S. Smith?

  Yeah, sure. Uh, but, but before we get to that, um, a couple of broader questions. How, this obviously is becoming a problem. Everyone saw that was going to be a problem and it's now becoming a problem. How, which of those threat vectors, I mean, whether it's deep fake, uh, phone calls or deep fake videos impersonating someone to sell something? Or where do you see the most activity?

• 9:45Speaker 00

  Is a good question. So I'd say for example, in the large enterprise space today. Um, and really, uh, you know, even our smaller, uh, clients, really almost every, uh, one of our clients. Um, the biggest, I'd say there's two, two key recent trends. One is definitely the phone call attacks, right? Like if you actually take a look at how a lot of the top companies have been compromised recently. Um, you know, there's been some very public disclosures, disclosures about breaches of, you know, tech companies recently. And, um, basically these bad guys called shiny hunters, scattered spider, laps group, right? Um, they're doing phone calls. They're doing phone calls to customer support lines, IT service lines, HR lines.

• 10:28Speaker 00

  And, and those phone calls are then how they get into compromising a casino, a tech company, a bank, an insurance company, an airline. So that's just been proven to be like one of the best ways to go attack an organization if you're a bad guy. Um, second, I wanted to call out, I mean, there's been a lot of, um, attacks around, um, social media. Like Craig, you've, you've mentioned YouTube. I, I think a lot about LinkedIn as well. Like that's actually one, another great way to do social engineering taxes. I'll spin up. LinkedIn account pretending that I'm part of the StreamYard organization. LinkedIn, you know, doesn't necess doesn't require that you verify that corporate email address. Right. And so that's another great way to go, you know, socially engineer someone.

• 11:12Speaker 00

  And then lastly, I talk about um, search engines. Like ultimately, people are using Google, ChatGPT, Gemini, Claude, et cetera. Right. To go browse through the internet. And so naturally you trust a lot of what gets returned there. But, you know, we call it SEO poisoning. We call it AI engine poisoning as well. But like, people can easily, easily insert malicious results into those queries. And that's another way in how a lot of these companies are getting attacked.

• 11:46Craig S. Smith?

  Yeah. And how, how are they doing that? Because that's uh, one thing I can see is, and I'm sure there's a lot of money being spent on this. If you ask uh, one of the big uh, foundation models, you know, ChatGPT or Claude or Gemini or somebody. Who are the top AI podcasters? For example, if I get enough data into the uh, enough, you know, you're basically, you want to fill the training data up with your eye on AI. And because it's looking at probabilities and, and it'll surface eye on AI.

• 12:28Craig S. Smith?

  If it's one of the most prominent AI podcasts in the training data. So is there, are people doing that? Just pumping stuff onto the internet to get captured by training data to skew foundation model results?

• 12:43Speaker 00

  Absolutely. I mean, when you think about it, sales and marketing is just really another form of social engineering. Right. And if you think about how you want to increase your digital marketing reach and things like that. Right. You're gonna, you're gonna post a lot of content right from my own AI. You're going to, you know, you're going to make sure that it's on trusted third party sites, things like that. To help really boost your search engine results and your, your credibility on the internet. And so, you know, just as you can, you know, execute those sorts of campaigns to increase your digital presence, so can the bad guys, right? They they will, like, for example, a couple of techniques we've seen is they will actually make sure a lot of their content gets posted on trusted third-party sites.

• 13:23Speaker 00

  So think about like review forums or or, you know, like, you know, third-party social networks, things like that. You know, maybe they won't trust the fake StreamYard site, but maybe they'll trust a legitimate, you know, software vendor review site. Maybe they'll trust a legitimate, you know, subreddit around video streaming platforms. And so that content will get upranked, and then that's how they can distribute the bad stuff. And then, of course, you know, just as you can, on the sales marketing side, it's not just the organic, you know, content marketing you could do, but you can go pay for ads. Right? So if I make so much money off reaching, you know, the biggest companies in the world, maybe I'll just pay twenty bucks for that ad click.

• 14:07Speaker 00

  Right? And and that's how I make sure my stuff gets promoted at the top. And I know the AI GPT engines aren't, you know, some of them are starting to experiment with ads or maybe turn off their experiments with ads. But the reality is they're also looking at other people's ads as a way of validation for, hey, this is legitimate content.

• 14:27Craig S. Smith?

  Yeah. So you built this, what was the the the origin story? Again, you were at Uber. And why did this catch your your attention?

• 14:39Speaker 00

  That's a great question. So I was at Uber, right? I met my co-founder Rahul. And in twenty twenty-two, he was actually roommates with one of the heads of research at OpenAI. And so he got a sneak preview of this little thing called ChatGPT before the rest of the world. And and it became very evidently clear, right, that, hey, if AI were to go destroy the world, right? It's the fact that it's it can manipulate any digital surface. And so that's where our mission around protecting the world from social engineering attacks every day comes from. But it's really that broader thesis of this is the existential threat of AI, right? It can manipulate digital reality. It can manipulate, as a result, anyone consuming that digital reality. And that's how AI will destroy the world, i- if not, not stopped.

• 15:25Craig S. Smith?

  Yeah, and I agree with you. I mean, as I was saying, you know, there's been a lot of talk about this for a long time. Ten years ago, people were talking about, or even fifteen years ago, people were starting to realize that social media itself, this is before generative AI, but social media itself is is going to be a threat by spreading misinformation. And now you have the generative AI capabilities and the agentic capabilities to distribute. And, you know, again, this is something that everyone's talking about, but you're just now starting to see, as I said,

• 16:03Craig S. Smith?

  with with AI-generated content on YouTube. I mean, in an example, it's trivial, but it's informative is, I, you know, on on YouTube, they run shorts now, and the shorts that get offered up to me, a lot of them are, you know, like, you've probably seen the one where a wolf, it's a doorbell camera video, a wolf comes to the door and and the the pet cat is on the back, or there's, you know, lions who are taking down elephants and things like that. And you have to click open the description to see the disclaimer, Right.

• 16:43Craig S. Smith?

  if there is one that this has been produced with AI. But that erodes, it's to the point now where I don't believe anything Right. that I see regarding animals interacting or, you know, and that's, so what, right? That's silly content. But when that gets to the level, as I said, with this report on Epstein-related report, when that gets to the level of real, serious news, and and and people can no longer, I mean, but we've already got a problem with a president who lies constantly. But when when that gets to the point where you just cannot figure out what's true and what's not true,

• 17:29Craig S. Smith?

  that's, you know, destroy the world is a is a big statement, but it's. Certainly going to erode public discourse and and the ability for democracies to function.

• 17:41Speaker 00

  Right. Yeah, I mean, erode public discourse, you know, and then when it's targeted, right? You can even just start manipulating individuals, right? So that's that's why I do speak to like the gravity of potentially world destroying capabilities, right? Like, hey, if you can manipulate someone to get you nuclear codes or get you access to, you know, whatever sensitive system, right? That that's that's, you know, world changing stuff. So, but yeah, I mean, I've seen it as well. I think everyone has, right? Like, you know, literally just this past weekend, fake news about layoffs, fake news about, you know, I don't like even something a little more innocent, right? Like sports news with NFL free agency starting.

• 18:23Speaker 00

  You know, you could see it very quickly happening and, you know, see it coming from a whole bunch of different perspectives.

• 18:30Craig S. Smith?

  So you built your your product. And and is it a platform? You say you scan all these different channels. How, what percentage of channels? I mean, there's a huge number of of places where this stuff can appear. Do you have any metrics to talk about coverage?

• 18:55Speaker 00

  Yeah, yeah, I mean, I think now we're at the point now where we're covering upper 90% of business communication channels, right? Or or and when I talk about business, I'm not just talking about internal intra-business communications by X,

• 19:10Speaker 00

  by external as well to customers or third parties, et cetera. You know, the reality is actually there's much, you know, that number is, you know, impressive sounding, but there's actually much more that we want to build to get even to get even tighter into those channels and be integrated to stop these attacks in real time as well. But we're covering everything from, for example, there's the traditional domains and email attacks to, you know, we see stuff on WhatsApp and Telegram. We see, of course, the YouTube attacks, the paid ad attacks, the LinkedIn attacks. And and that's really a lot of the power that our platform. Has is oftentimes folks would have to buy multiple solutions here, right? Hey, we've got a social media monitoring solution. We've got a dark web monitoring solution.

• 19:52Speaker 00

  We've got a domain monitoring solution and Doppel enables you to do that all in one. Shut it down and then also now even simulate them as well. So it's not just phishing email simulations, but it's really multi-channel AI native simulations.

• 20:04Craig S. Smith?

  Yeah. And is is under the hood is this? Are you using a bunch of different models, maybe tuned to different things for scanning? And how much do you have an agentic layer?

• 20:19Speaker 00

  Yes, so.

• 20:21Craig S. Smith?

  Yeah.

• 20:21Speaker 00

  Yep. So there's a couple of things that we do on the AI agent side. One is definitely around the scanning, the threat analysis, threat hunting and the takedown. So that's one piece of the platform and and that's agents. You know, there's a public case study around this that we've done with one of our model providers, OpenAI, where we've shown how, you know, we built one of the very first security agents with them to go autoanalyze these attacks and take them down. The second agentic capability that we rolled out with our most recent products is we call it vibe phishing. So if you're familiar with the term vibe coding, we our product basically has this chat GPT like interface where you can go prompted to go attack anyone, right? So you could tell our Doppel agent, hey, let's go attack Craig, right?

• 21:06Speaker 00

  And it will then spin up, you know, the phishing email. It'll spin up the SMS message. It can even spin up a Telegram message and then of course do a deep fake phone call. So that's, you know, the capability where right now, on average, people are talking to our AI agents for six minutes when they get a phone call from it. And so that's how good the AI agent is today. It's like, you know, a lot of times people think that deep fakes, people could figure it out. But the reality is if you're calling people on customer support lines, you're calling people on help desk lines. Like those people are trained to pick up the phone, satisfy the requests, right? And and those are the people that are getting targeted by the bad guys.

• 21:43Craig S. Smith?

  Yeah. And is this all in one platform that a user logs on to and has all of these?

• 21:51Speaker 00

  Same login. And then it's it's you see the. Different products on the left and then within each product, you've got different modules. So for example, with our VIP protection, right? Say we're protecting you, Craig. You you've got your exact protection product on the left. And then when you click into it, you you see our ability to impact PII data broker removals for Craig, our ability to shut down Craig impersonators on YouTube. Maybe there's some mumblings on the dark web around Craig and how, you know, folks are trying to target Ion, etc. And so all of that can happen via one platform. Instead of, again, you having to go buy a dark web solution, a PI data broker removal solution, a social media monitoring solution and a security awareness training solution.

• 22:34Craig S. Smith?

  Yeah. And on the red teaming, how do you prevent Doppler from being used by attackers? If it can, you know, spin up a deep fake voice attack, why wouldn't a bad guy subscribe to Doppler and Doppler and use it, you know?

• 22:55Speaker 00

  Yeah, it's a great question and something certainly that keeps me up at night. So thankfully, we've got a tremendous head of security. I want to give a shout out to Kendra Cooley and her job is to protect our platform integrity, right? And ensure that, you know, we don't leak anything we're not supposed to leak to ensure that, you know, people who are using the platform are using the platform in the correct ways. And so that's something that, you know, is a key program that we invest a lot in. But it is scary, right? Like if if someone, you know, let's say they weren't even to use Doppler. Like the reality is like people can use AI agents in general, right? Try to go, especially if I'm a bad guy, hey, I just need an AI age to focus on my specific use case.

• 23:38Speaker 00

  They could easily do a lot, a lot of malicious stuff with these AI agents, right? Spin up a thousand AI agents to phone call, you know, a custom support center and, you know, DDoS it essentially, right? And it's it's it's very scary stuff. And again, it's that's why the mission is so important. It's the realization that, yeah, AI could really destroy a lot of things right now. If you if you are a really motivated bad guy.

• 24:01Craig S. Smith?

  Yeah.

• 24:03Craig S. Smith?

  So we're entering a world where digital identity can no longer be assumed authentic.

• 24:09Speaker 00

  Right.

• 24:10Craig S. Smith?

  From the, from, you know, the DOP then protects someone, protects their real identity from deepfakes. But is there something that individuals can do to ensure the authenticity of what they're looking at?

• 24:26Speaker 00

  Right. I mean, there's, there's a lot of like tactical things that I think individuals can do that, you know, don't require, you know, technology, things like that. Like, for example, Craig, how, how would you verify that I'm a deepfake, right? Or not right now on this podcast? Or how would I help verify that you're real or not? Right? And so a couple of the like tactics that I've learned from, you know, just chatting with security customers, like you could ask, like I could ask you, Craig, to put up your phone and then with your phone, you know, show the selfie view, right? So like if you're deepfaking through this software, you're not necessarily going to deepfake on, you know, the camera view. You know, I could ask you, you know, about some random topics, right? And see if you've got pre-canned AI answers, like, you know, we could chat about the Cowboys in Texas and, you know,

• 25:09Speaker 00

  see if you pick up on the Dallas Cowboys or if you just start talking generically about Cowboys in Texas, right? And, or even ask you about fictional places that AI models may have been traded upon. You know, see if your kids are enjoying Hogwarts or not at their college. And, and so that's, you know, those are just some of the, you know, individual tactics that I've heard from security practitioners. I think the other reality is like, it's important because the attacks are multi-channel, right? They may be hitting you with a fake email. They may be hitting you with a fake phone call. The key is then the defense has to be multi-channel as well. And obviously that's reflected in our product architecture. But even again, technology aside, what that means is, hey, let me call Craig's no number to verify that this is Craig, right?

• 25:51Speaker 00

  And let me, you know, maybe also message Craig on LinkedIn, right? And so it's one thing for me to go impersonate across LinkedIn or a phone channel or a video channel. But it's, it's harder to do it across all the different channels. And of course, if you could pull that off, that's what makes an attack so scary and that's what we combat. But it is important to have out of band verification. Channels so that you know if if Craig got compromised in one area you you could you know suss it out from another channel.

• 26:20Craig S. Smith?

  Yeah, I mean ultimately what's eroding here it's not the individual attack it's trust in general.

• 26:27Speaker 00

  Right.

• 26:28Craig S. Smith?

  And trust in in digital digital media.

• 26:32Speaker 00

  Right.

• 26:33Craig S. Smith?

  How how yeah, talk about that. I mean, you know, most organizations are relying on security awareness training, but from the consumer's point of view, where do you think how damaged do you think societal trust will become?

• 26:51Speaker 00

  Right, well, we can we can already start quantifying it right in the sense that we're seeing consumers lose tens of billions, if not hundreds of billions of dollars today to things around fraud and phishing and social engineering. So that that's one way to already look at the problem and put a number to it. Second is, yeah, I mean, I think like, again, just even numbers aside, just anecdotally, right, hearing the stories like yours, Craig, around, you know, the your YouTube experience, right, or or mine about just some of the disinformation campaigns that are happening about layoffs, for example, in the tech industry. It's it's a very real threat and you know, the reality is that it's also just getting started as well.

• 27:34Speaker 00

  Like, over the past three or six months, we've seen it ourselves, how much better the AI models have gotten at deep fake phone calls, right? Like, I think everyone's probably seen deep fakes for a couple of years now, but in the past six months, it's not just scripted deep fakes, it's interactive deep fakes now that are very good. So I don't have to, you know, hop on a call and get a deep fake mask put on, but I'm still the one who's the brains behind it, speaking and thinking. I can now, like, we actually have team simulation capabilities where, you know, a team's call can get generated and it's not a person behind it at all, but it's an AI agent who's thinking, responding, has natural pauses and ums and, you know, acts like a human and that's that's what is really scary is that AI keeps getting better at that.

• 28:17Craig S. Smith?

  Yeah, what is human risk management?

• 28:20Speaker 00

  So it's a human risk management is a Is a category recognized by security analysts. But we think about it as a very broad platform capability from the double side. So it's, you know, traditionally, there's been security awareness training and that's a huge part of human risk management. Right? Like, hey, if I'm going to reduce human risk, I really need to train my workforce against. But we go beyond that in a sense like there's other capabilities such as like real time interventions to prevent folks from, you know, maybe sharing that, sharing that Google Doc or that Office 365 document, right? With the, with the whole world. And then also we think a lot about the red teaming side as well, where it's like, if you're going to manage human risk and really reduce it, your job isn't just to train, your job isn't just to do these real time preventions,

• 29:05Speaker 00

  but your job is to really pen test your whole human program, right? And understand where the gaps are like, maybe, maybe we've got some significant gaps with our workforce in offshore locations. Right? Uh, maybe we've got some significant insider risk where, you know, there are folks that that can be bribed, right? Like if I want to get access to your, your YouTube account, Craig, my best bet is probably go bribe someone on the YouTube customer support side. And so that's what we mean by human risk management is how do you holistically evaluate all the different risks that are opposed to the humans on your side, the organization, train against that risk, test against that risk with red teaming, um, and then put in proactive interventions.

• 29:45Craig S. Smith?

  Yeah. Uh, and you're, that's, that's in your company, that must be a never ending process.

• 29:52Speaker 00

  Yeah. And, and it's a never ending process and you'll actually see us launch some more products this year as well to add more real time intervention capabilities. And, um, and that's really the power, power of the social engineering defense platform, right? It's like, we're the first platform that enables you to, you know, there, there, there are products out there that enable you to do the individual pieces, but there's no product out there that enables you to do, hey, we could find these attacks, we could take them down. Uh, we could do real time interventions now. You're going to see more and more of those products this year. And then we can, you know, really train and test against these attacks as well.

• 30:26Craig S. Smith?

  Yeah. And how do you initiate an attack? I mean, what, what, what is an? AI native defense actually look like in in practice?

• 30:36Speaker 00

  Yeah, the AI native defense in practice is, I mean, we chatted about our two agentic capabilities, right? The agent that enables you to analyze all these attacks and shut them down in real time. Um, that's critical because if you're just throwing bodies at the problem, right? You're not going to keep up with the AI threat. Uh, second is the AI agent that enables you to simulate and test against these attacks as well. Um, so you know, essentially the defensive agent and the offensive agent, right? And that offensive agent, um, it has the, you know, if you've seen like the whole craze around open claw and uh, how AI agents now can interact with the rest of the world through any digital means. Like that's what the offensive agent can do. It can do texts, it can do phone calls, it can go, um, you know, do phishing emails, create fake websites.

• 31:21Speaker 00

  And and that's a real, real scary capability of AI.

• 31:24Craig S. Smith?

  Yeah, uh, but for you guys, when you are simulating an attack, uh, how do you make it as uh, as close to a real world attack as as possible?

• 31:35Speaker 00

  That's a great question and um, and that's, that's a big reason why this platform has developed. It's like our first product started off on the threat intelligence side, right? And the executive VIP protection side and the brand protection side of the digital risk protection side. So we're seeing these attacks happen in real time for all of our customers. We're shutting them down in real time for all our customers. But because we know how the bad guys are pretending to be you, Craig, that means we can then make our simulation very, very, uh, you know, real world scenario as a result. Because we actually are the ones also protecting against these attacks.

• 32:09Craig S. Smith?

  Yeah, and where is this going? I mean, as I say, it's, it's, people have been seeing it coming for a long time. It's now hitting, it hasn't yet hit in a way that is causing mass confusion. But we've got elections coming up.

• 32:24Speaker 00

  Yeah.

• 32:25Craig S. Smith?

  Uh, and there's a lot of concern about that. Uh, where do you think this is going in the next three to five years?

• 32:31Speaker 00

  Yeah, so, um, we actually got to work with the elections on both sides of the aisle, of course, uh, in 2024. Um, so we work with this nonprofit, nonpartisan organization. Called defending digital campaigns and you know, just from that one time experience, we already kind of got a sneak preview, a lot of different things that were going on, everything from, you know, what we suspect was AI generated campaigns in ways to like pull people into certain content and certain social media groups. And then it suddenly pivots right into messaging.

• 33:02Speaker 00

  Um, we've seen, you know, fake organizations get spun up, um, and, and those get linked to certain individuals. Um, so you know, you talk about the next three to five years and, uh, at least within the U. S. A. A. Major, major election cycle in 2028. Yeah. I mean, it's, it's, it's definitely something that, uh, we're apprehensive about and thinking a lot about in terms of how to, how to help protect. I think the biggest thing is from, at least from what we could control on the double side is, and that, that this is what informs our product roadmap is, hey, we got to have integrations with as many channels as possible, have, give you as much visibility as possible, real time, um, defense as possible, inline solutions, and then also proactive threat hunting solutions.

• 33:43Speaker 00

  So, um, it's really about, hey, how do we enable you to get the full view of the problem and then also the full capability to stop it?

• 33:51Craig S. Smith?

  And do you think enterprises are waking up to this threat? Uh, or what would you advise enterprise leaders, CEOs and CTOs to think about in, in the next five years?

• 34:04Speaker 00

  I, I would say yes. Um, you know, based like, and, and it's certainly a big part of our growth here at Doppel and why we are, uh, one of the fastest growing cybersecurity companies in the world now. Um, is that, you know, at the board level, at the C level, we're talking about, um, AI transformation, right? We're talking about deep fakes. We're talking about, um, these bad guys like shiny hunters, scattered spider and social engineering. Um, we're chatting a lot about executive and VIP protection, especially after a lot of public incidents over the past 12 to 18 months. Um, so that's certainly happening. And my message to, uh, large enterprise C levels and, um, you know, really any business out there, right?

• 34:44Speaker 00

  Is that this is the problem to solve for, uh, on the AI side and the security side. Um, again, when we started this company, we didn't even necessarily start this. Security company. We started this as an AI company and it's with the vision that hey, this is really the problem solved with AI. And when it gets to the point now where you can deep fake anything, anyone and do it in at scale and in real time, things get really scary. So, you know, our, and our commitment, of course, to these folks is that we're going to continue to build more and more to give them more and more capabilities to stop that.

• 35:16Craig S. Smith?

  Yeah. And, and do you have a use case? You don't have to name the person or the company that, that was being targeted and, you know, you were able to, are you able in these cases to, to completely solve the, the deep fake misinformation problem? Or you get like 97%, but there's still going to be stuff that you can't stop.

• 35:44Speaker 00

  Right. I mean, I, I think in the game of risk, right? Well, I, I shouldn't necessarily call it the game, but in, in the framework of risk, right? And that's really what a lot of us think about on the security side. There are attacks that we totally shut down and totally mitigate, right? At the same time, will we ever say that risk is 100% prevented all the time, every time, right? I don't think anybody can claim that any, any vendor, any company. The reality is it's an adversarial, it's an adversarial industry, right? Where as you build more defense capabilities, the bad guy is building more offensive capabilities. And so it's a, it's a rat race. So I'll give you a specific case story around, you know, an attack we, we really shut down.

• 36:26Speaker 00

  We saw a case where people had spun up a fake LinkedIn account pretending to be part of an organization. We actually saw a phishing email come through from that person. But we took that email address, we found the LinkedIn account it was tied to. We found all the adjacent LinkedIn accounts that are connected to that LinkedIn account. Their email addresses, their telephone numbers, right? And so we saw this whole attack happening in real time with that threat graph. And then we shut it all down, right? Like you actually would see the LinkedIn accounts disappear just within hours. The, the telephone numbers and emails also getting shut down quickly. And so that's an example of a case where, hey, we were able to shut down an attack that was targeting their offshore operations and do it before any real damage was done.

• 37:09Craig S. Smith?

  Yeah. And are the platforms like LinkedIn, YouTube, X, are they cooperative when you want to take something down?

• 37:19Speaker 00

  That's a great question. So a lot of our work on the doppel side is to build relationships with these platforms, right? Become trusted reporters, get access to APIs, hotlines. And so the quick answer there is yes, in the sense that like, because we've been able to develop that reputation and earn that trust as a trusted reporter. That's how we're able to effectively coordinate and partner with a lot of these organizations. I do think that without those relationships, right, is harder, it's slower, it's less successful. And, and, and again, that's the reality of a lot of the work that we do day to day is to build those relationships and earn the trusted reporter status.

• 37:58Craig S. Smith?

  Yeah. Is scale a problem? I mean, if, if these attacks are being, being done at scale.

• 38:05Speaker 00

  Yeah.

• 38:06Craig S. Smith?

  I mean, not just a few discreet deepfakes on YouTube or Twitter, but if they're, if they're flooding the zone.

• 38:15Craig S. Smith?

  Do you have the capacity to head that off?

• 38:18Speaker 00

  Right. It's a huge problem. And we talk about like, there's, you know, there's just increased volume when it comes to AI, right? A lot of folks debate, hey, does AI really bring new attacks or it's just more of the same stuff? And I think at a certain point, it becomes semantics, like there's no question, it just increases volume. There's no question increase the velocity of these attacks and how quickly they can be spun up. There's no question that, you know, the kind of the pride and the fidelity of these attacks are also really, really high. You know, that's why we give it a three Vs framework. And so in order to have the capacity to combat them, you also need to be using AI, right? AI to fight AI. And, and that's why the AI agents we've built so critical.

• 38:56Speaker 00

  Like you could, for example, test your team by manually calling into, you know, every, every employee and every customer support line and every help desk line. But it's just not scalable and you could manually have security analysts look at every single impersonation alert and try to take it down. But again, it's just not scalable. So how do you actually deploy AI effectively to build up your own capacity? That's a business critical, mission critical problem to solve.

• 39:25Craig S. Smith?

  And do you think that you'll grow or your industry segment will grow to the point that it'll keep ahead of the misinformation and deep fake and prevent it from eroding societal trust? Or do you think that we'll never get ahead of it? It'll be kind of like cybersecurity has been all along, whack-a-mole, you know, cat and mouse game?

• 39:51Speaker 00

  Well, our job is to make it not whack-a-mole, but to be, how do we be strategic and proactive? You know, that is our mission, right? Is to solve this problem. I think the mission is never ending in the sense like, yeah, it's not, again, because it is an adversarial cat and mouse game, you know, even if we get to level X, right? Then the bad guy just will focus in on getting to level Y. But I, so I'll say this is absolutely our mission to solve this problem. I strongly believe that we're already doing things and we are already building things that give our, our clients a significant leg up. And then it's our continuous investment in that platform that enables us to stay ahead.

• 40:36Craig S. Smith?

  Yeah. Why don't the various platforms, I mean, why don't you sell to them directly? Or why don't they develop this kind of technology? So that the stuff never appears, or if it appears, it's only up for a couple of minutes?

• 40:53Speaker 00

  So I do think the platforms do invest a lot in this space already. You know, to varying degrees of success, of course, like the reality is like, there's certainly a lot getting through. But I do believe that a lot of these platforms are investing in, you know, trust, safety teams, integrity solutions, things like that. We have an advantage where, you know, our business model is different, right? We don't, we don't make money off ads, we don't make money off views, things like that. And then also because of our business model, we, we get to learn what grand truth is from every company in the world, right? And that's, so that's always a challenge, right? Is, you know, if you're one of these big social media platforms, you operate with billions of users. How do you know what's real, what's not?

• 41:37Speaker 00

  Well, our business model is based off working with each individual organization, which means then we know the ground truth for every individual organization. And that scales up the more customers we sign up, the more ground truth data we have, the more revenue we have. So I think that's it. And then to answer kind of the last question there is like, well, why don't we sell directly to the platforms? It's for those reasons aforementioned, right? One is like, there is actually a real technology and business model advantage when you're selling directly to the individual organizations. It's, it's, it scales up the ground truth better.

• 42:12Speaker 00

  Second, we have tried exploring selling to the platforms. And what ends up happening is that they all have very unique and customized requirements. Just because like, yeah, if you're working with YouTube, right? That looks different than LinkedIn, that looks different than Facebook in terms of the data models and the even, even, you know, even the, even the people organization structures, right? Things like that. And so we've found it's not a very repeatable product for ourselves. So we, we think this is the most efficient way for us to partner with them is to be that trusted reporter, work directly with the organizations getting infected. So we collect that ground truth and, and basically augment what they're already investing in.

• 42:53Craig S. Smith?

  Yeah. Do you think that eventually this problem will go away because

• 43:01Craig S. Smith?

  the, the detection and intervention of strategies will, will improve to the point that you just can't get a deep fake onto

• 43:12Speaker 00

  Right.

• 43:13Craig S. Smith?

  social media platform?

• 43:15Speaker 00

  Right. It's a great question. You know, I'd love, I'd love to get to that point, right? Of not having to, you know, need to monitor those specific platforms. But the reality is like, even if that were the case, right? Let's say even if they were impossible to manipulate a particular platform, what we do see the bad guys who say then go pivot to a different platform. And, and so we've, we've seen that, for example, with our own defense capabilities. Like we've, we so successfully shut down an attack that we saw the bad guys complaining about. On Telegram like, hey, you know, this, this, this technique is not effective at all. Doppel keeps shutting it down. Um, but then, you know, what they did is like, all right, we're going to do a totally different platform.

• 43:56Speaker 00

  We're going to just focus on a totally different platform, totally different organization that doesn't have Doppel. Um, and so that's, you know, I, I think that's just the reality of it. It's like, again, the bad guys are always evolving as well. Um, it is an adversarial, uh, back and forth and, um, and our job though is to make it really, really hard for them. Make it really expensive for them and discourage them from ever doing it again.

• 44:20Craig S. Smith?

  Yeah. And how do you guys work with, with customers or enterprises? Is it a subscription and, you know, you, you turn it on and, and, and then, uh, Doppel takes care of sort of monitoring all the various channels and the enterprise doesn't have to worry about it or?

• 44:40Speaker 00

  Yeah. So it's, yeah, it is a subscription. Um, and really this offers out for any listener, right? We could turn it on in the span of 24, 48 hours for anyone really like, hey, um, you know, if StreamYard needed, uh, was curious, right? We could immediately turn on that protection, show them what's out there and show them what's already being taken down. Um, and, and then, yeah, that's, you know, a lot of the value that we add, right? It's like that peace of mind that you've got this capability across all these areas. You know, we're a full white glove partner as well. For example, we will work closely with, you know, our customer security teams to tune uh, policies to tune, um, you know, automatic capabilities to their specific business environment. And, um, and that, that's a lot of, you know, ultimately what we sell, right?

• 45:25Speaker 00

  Is that, that peace of mind, that white glove service and that, and that partnership, right? So that when the bad guys do evolve and we have to go build something new, uh, we're, we're making it happen.

• 45:34Craig S. Smith?

  Yeah. Is it affordable for individuals or is this really an enterprise grade product?

• 45:40Speaker 00

  We're, we're working on, um, in an individual products as well. Like it's, it's today's still through enterprises, how we protect individuals. So for example, um, you know, if Ion were to protect Craig, right? Then like Ion's helping cover that. Um, so we're going to work. On some individual solutions that will come out. But as of today, you know, we we work with a lot of different organizations of different sizes of different scale. And it's it's really that holistic solution, right? And and we work with athletes, we work with politicians, we work with, you know, folks in the entertainment industry, right? And and it's all part of the same platform.

• 46:17Craig S. Smith?

  Yeah, you know, big companies like, you know, any big, big, particularly consumer brands having insurance against reputational

• 46:29Speaker 00

  Right.

• 46:29Craig S. Smith?

  Damage that do you work with insurance companies? It seems to me that insurance companies might require.

• 46:36Speaker 00

  Yeah, yeah, we're definitely from a go to market perspective, always happy to partner, right? So insurance companies or credit card companies or, you know, a lot of different ways that, you know, folks consume our products. So that's definitely always a creative option.

• 46:52Craig S. Smith?

  Yeah, but do you think as this deep fake ecosystem expands? Do you think it'll get to the point where any responsible CEO will ensure that they have somebody like top protecting their their brand or their personnel out on on social media channels?

• 47:15Speaker 00

  I'd say yes.

• 47:16Craig S. Smith?

  Yeah, yeah, I mean, I'm surprised, as I say, I'm starting to see public figures selling stuff. And it's obviously deep fakes. And and what is like YouTube's policy? Do they, you were saying that a lot of the business from your point of view is building relationships. So they trust you and when you guys contact them to take something down, it gets done. But are they generally eager to take this stuff down?

• 47:49Speaker 00

  I mean, I I certainly can't speak directly to YouTube's specific policies. But I would say in general, though, like, you know, the partners we work with are very willing partners. The reason why they built these programs, right, is because they want to consume this intelligence. They want to, you know, shut down these campaigns. And I I think a lot of the efforts by these trust and safety and integrity and security teams is to help protect the world from these attacks.