Assurance Unknown with Kai-Fan Chang and Alan Marzec

Kai-Fan: Hi, thank you for watching this episode of the Assurance Unknown Podcast, where I interviewed the people shaping the high assurance security evaluation and certification industry. In this episode I interviewed Alan Marzek. This interview actually happened in May this year in Taiwan. We were at his company which is inside the Taipei arena. During our interview there was also a concert rehearsal ongoing, so I hope you You don't hear too much noise in the background. I do need to apologize for the noise that you might hear, which I think was caused by how my clothes was brushing upon the the microphone. This and the French accent might make this episode an excellent exercise for your English hearing test, but I try my best. To make sure that the subtitle is as correct as possible. In this interview, you will hear the full career of Alan, so I'm not going to bother you with that here. Alan is very unique in our industry as he has worked in the other side of the higher assurance security evaluation world, which is the functional testing side. There are not so many people who have the experience in both functional and security sides. And on top of that, he participated in two security startups in mainland China and in Taiwan. In the interview, we'll also ask him about the differences in starting up in a different area. Also in this episode, Aulan shouted out to two persons, one is Pascal from Riscure and the other is Junfong from OSR. I'm very happy to say that they are both the guests from the upcoming episode, so stay tuned by like and subscribe to the podcast. You can find the podcast on YouTube, Spotify, Apple Podcasts, Xiao Hong Shu and Billy Billy. And if you would like me to interview also people from the functional testing side, Please let me know by leaving your comments in the comment section below. Thank you for watching and special thanks to Narashima for the logo and Shichi for the music.

Speaker 2: Okay, let's do it. So today I'm still in Taiwan and for my second interview and and we have a special guest, Alan. And we knew each other I think after you moved to China. Yes. But you you worked in Europe before and even in Riscure which we know very well. so I'll let you introduce yourself first to to the audience. I know you have a long affinity to this industry already. So welcome.

Speaker 1: Thank you. Thank you for welcoming me to your podcast and presentation to Assurance Unknown. Very cool t-shirt. really

Speaker 2: Thank you.

Speaker 1: happy to here and reconnect and share a bit of what happened in our world for certain parts in my story. So, Alan Marzek, French, obviously, like everybody would say.

Speaker 2: I think I'll have another hard time editing the subtitle.

Speaker 1: Yes, yes, I'm not sure even AI can actually correct that or improve that, please do. Yes, so I've been in the industry and in many different countries for about 20 years and something, 20, 25 years. So I come originally from engineering background and like... RF background, radio frequency. my, actually I started my career at a company that at that time was called RFI in the UK, straight out of university, even before I graduated actually. And that became after UL, all that. So I started really as a RF engineer. And I was exposed to, let's say, smart card and smart card security during my second master. So I have a master in engineering and a master from law school, actually. And during that time, I joined the program, a master program that was managed by Mr. David Nakash, formerly crypto expert, crypto lead at Gemplus at that time. It was before

Speaker 2: Yeah.

Speaker 1: the merge. started there. Then right away went to UK to work for RFI and I started really as a RF engineer what we would say like EMV level one type of testing in a way.

Speaker 2: So was RFI already doing PCI type of things there already or not yet?

Speaker 1: So at that time, RFI was starting. So they started to implement, I think that was the workstation from Rambus. I mean, what was before, CRI. And they started to, actually when I was there also to get the accreditation, actually. So was in a functional team, but the security team was growing as well. So it was... was a big task. Also MasterCard, Visa and then PCI testing that came along. So that was the UK. Very interesting, especially as a French person. Like I always say, know, I thought my English was okay when I went there and right away I realized that's not the case. So it was a good experience. Then after that, moved after roughly two years, I moved back to France. mostly personal reason and I worked at FIM in Normandy. So again, functional testing and doing, starting to do also a of account management, especially because I had a bit of background speaking English, so you had to deal with clients in UK, US, things like this.

Speaker 2: Think FIM is the the biggest functional safety functional testing lab, right? In our industry.

Speaker 1: Yes, I think now they even grew especially since a few years with all the acquisition. So at that time that was pure, let's say, theme, let's say the traditional model they had with the previous team. But since a few years now, maybe roughly six, seven years at least with the acquisition from a US founder, I forgot, they acquired quite a few companies. And now they are really growing. are growing in consulting first, consulting team, which we initiated. I'll talk about that after in Asia. And it grows a lot and I think they are going into security also now as an M-POC lab in Australia. So one more player in Asia that we can talk about. So I was working there and simply put, I wanted to travel again and they ask, volunteers to go abroad and I volunteered and there are two choices actually. So one was Montreal. So at that time, Film was opening the, or opened a year before the office in Montreal. So one option was to go to Montreal and one option was to come and come to Asia, to Taiwan, Film Taiwan, and build the consulting slash R &D team. So that was a new team, so. thought the challenge was a bit more interesting to come to Asia. It was supposed to be for one year and we are 20 years after now.

Speaker 2: So so the always the question for that kind of story is what what's her name?

Speaker 1: Yes, yes, so so I remember I I came to Taiwan first time and you know thing and I like one box one bag and I'm married kid And a lot of boxes and stuff at home so score expansion, I guess so Really happy with that. That was a big decision but I Really like at that time also at him. It was with this team. So we started Maybe you heard about it, we started from Asia to sell the test bench for level one and do installation at the cloud.

Speaker 2: They already Because they Finn develop their own tools.

Speaker 1: That was 2006. So that was at that time test benches for level one that were designed by the scheme. mean, the design of the antenna PCDP ICC was from the scheme. But then you had some vendors designing their bench. They were pretty much incorporating a scope, waveform generators, all that. But that was still very much based on FEMA, the smart spy. But there was also a lot of micro-pros tools involved here even. So that was not like purely organic tools, but we are packaging all that, doing trainings. So at that time we started to travel a lot. So the team started to grow here. We were just two people at the start, then slowly five, ten people. And our big breakthrough, I think, with the team is when we started really also in Asia here. on a certification scheme set up in a way. And that's how I call it. But all this new scheme, like we worked on NSICC in Indonesia and PCI early, very early stage in India and even EFT Pulse in Australia. So that's when we really started to support new scheme into like test plan, specification test plan, test tools, and even building labs. So at some point in Indonesia, I was going there with the team to build a testing lab, install some tools, doing some quality training. And believe it or not, sometimes they even came to us. And that was really, cool. Like with literally the layout, the map of the buildings. And I think, should we use this concrete? Should we put this wall or something? And I was like... I'm not the building architect, but that was very, very interesting. And we were doing mock audit and all that. So that's when we really went from, for the consulting team in Asia, from like, let's say smaller deals to more like million size of deals. So that was a big step.

Speaker 2: I think Fingmin Taiwan is now like fifty people or even more, right?

Speaker 1: Yeah, even more, even more between the lab, the consulting, I think it's growing, I would say 80, but to check with them, maybe for the next video. Yeah, it really grew and especially recently with the acquisition, mean, was consult type thing, I think, in a few years back and then recently the UL functional team. So not the security team, still puzzles me, but... So they went from, I think, 500 to 1,000 within one or two years with UL. Big challenge for integrating the team, actually. Which is interesting because I heard also when you have that kind of two big player industry merging, it actually creates space for new entities as well. So we heard even for other tool manufacturers or the labs to eventually... because schemes need some kind of options. You can't have a full monopoly there. So that creates also opportunities. We actually work a lot and quite often with them and with many different labs there.

Speaker 2: I think I think you you found quite a unique also a niche an angle in this industry as a privately owned separate entity instead of these big players. But we'll come to that later. Yeah, yeah.

Speaker 1: but it's a bit down the road. yeah, that was film. So, film Taiwan, I stayed seven years, I believe. Six or seven years. personal event, my son was born. I wanted to have more time with him as a baby. So, I resigned and I actually worked as a consultant for film. More time, good balance. And after a year... I mean, during that time, during that year, kind of consulting a year and a that's when I was going to, especially spending time in India, setting up this NPCI standard scheme at the beginning. yeah, so that was, was nice. And then I got the call from a rescue after a year and half. And that was very interesting. That's when really I switched to... too big switch for me. So before I was like engineer slash manager and functional world. And then at riskier, I really switched to the security world. So I'm not a security expert by trade or even by skills, but I switched to the security evaluation, assurance certification, depends how you call it, like business and from a business side. I was like.

Speaker 2: Yeah. And also you have to move all the way to the Netherlands.

Speaker 1: Yes, so going to Netherlands, small story. So I got the interview during the interview about the family to Delft and because it's important, you know, for people and your family to feel okay, especially coming from Taiwan back in Europe and in Delft. And we really liked it. So moving to Europe decision was quick and really joined the security world and My role was really business lead for, let's say, payment activity. So at that time, RISCURE, I'm gonna use the word RISCURE, not Keysight, I know this week.

Speaker 2: We're old school.

Speaker 1: But it was RISCURE when I was there. think it's a really cool company. I really like the spirit of this company.

Speaker 2: How many people were there?

Speaker 1: So at that time when I joined, I think it was like 60, 70. I recall already there was already a not so small team also in the US that people not necessarily think about but really cool team as well. So I think that was already that so the lab and the tool team that was one of the very interesting interaction at risk here. So you are you had like the floor with the tool team so inspector team and you had the lab above. and having this interaction of the analyst using Inspector, the guys below developing Inspector as a product, external product and internal. And you know how critical analysts can be about what they need, what they want to customize. So that was a very cool interaction. What was very interesting also at that company was all the knowledge sharing. That was new to me, especially when you are new to security, all this. lunch presentations, papers, conferences that even as business team you get encouraged to read, participate. It's a challenge obviously, not to the same level as analysts of course, but that was very engaging I found. So payment team that was new to RISCURE at that time in a way. So RISCURE was always of course like big expertise and already some relation with the scheme. it was a new activity to become a certification lab for payment. Good and bad.

Speaker 2: Yeah, because they when they left T and O or Mark Wittemann left T and O and founded was more more for tools and more for hacking and more for technology but I think at around that time they started to say, Okay, to be able to promote our tools we also need to be a a certification lab. Yeah.

Speaker 1: Labs using your tool is a very big marketing point and trigger for clients. Exactly, so it becomes somehow predictable. I would say you could try to duplicate in advance by the setup. So it kind of makes sense. I think that there was also like a lot of different setup of tools in the industry. So you had CRI and again, I'm not like an actual user of all this platform, but I think RISCURE was pretty good at simplifying maybe at first the interface and making it accessible. more than other platforms maybe. So depends on the public, but you could reach bigger market, I think. Universities, research institutes, developers, everything. So that was really, really a strength, I think, for the company. And for me, mean, the mission was really get clients from the payment industry. it was worldwide, but I was spending time, especially in Europe and Asia. So it was intense. And we did pretty well. So at that time, mission was to get first EMVCO project, get some CC projects. So we had all these pilots, so we did OK. It was not easy for the analysts. It was intense. the bottom line, I think they did very well. I believe also the strategy to become a certification lab was also in a way request from the scheme and vendors. I think there was a lack of capacity. Probably, especially in Europe, you have big clients with a lot of projects and they need capacities, new labs, and also the scheme, think, like the idea of, RISCURE was already, again, you will have to ask them also directly, but they were already contributing to schemes with research papers, some special assignments, I think the scheme really wanted them to be more involved in the, let's say, daily certification business, I think. Which I recall, I think you're gonna have few people on your video people saying if risk you become a Certification app or a CC lab I will quit right away And one of your next person to talk was his statement. I think so. Let's see what they say

Speaker 2: He made this statement.

Speaker 1: You made this statement, should I say the name? think it's very public.

Speaker 2: I can guess the name and I'll come for you.

Speaker 1: Pascal von Heimst, I think, is very famous in the industry. said at that time, like, if we want the day we become CC Lab, I will quit. That was even before my time, I think. And I think he stayed a long time after. So it was not that bad, I think. You should double check with him.

Speaker 2: 'Cause at that time CC has quite a bad reputation. Yeah. Because when I joined Bright Side, Pascal was my first manager. Yeah. And I think after a year he he left Bright Side to join Riscure. But at that time in Bright Side people think CC is really terrible. Because they merged two teams together. And it's the hardware security team with the C C team. So when the C C team is introduced to the hardware security, people think, What the crap is that? It's a lot of very difficult to raid documents and also the methodology and really people hate that and he lost we lost money on that. So I think Pascal still had that mentality at that time.

Speaker 1: I think so. I actually have a question about that because so there is indeed this let's say documentation part. Let's say that's really tedious and you have the pure technical part like AvaVan and all the pen testing and I wonder like if it gets easier after because we started to see the split later on at RiskQ and I've seen this years a more distinction between analyst and certifier and I wonder if it was already the case at the beginning or if we were asking analysts to do a certifier work. I wonder at the beginning how it was actually.

Speaker 2: Now in the beginning no one really knows how to do it and the only example they can follow was BSI.

Speaker 1: Yeah.

Speaker 2: So when we were giving common criteria workshops, we also always share reviewed report, C C report from BSI and you can and that's written by our CEO, our most at that time is the most experienced guy in C C in the Netherlands or maybe in the world. And he wrote the report he wrote was like all red by pen. Like this is not good, that is not good. So so at that time it's it's it's more that type of review. Even the a coma or a point they they will try to try to correct. But later, also here in the Martin one, we try to make it more modern by making it more efficient and quicker. And then it starts this this distinction for do we really need the documents? Maybe we don't need the documents and then there's very close and and the Dutch certifiers they became more familiar with C C and they they also start to discuss and say, Okay, no, if we have this kind of thing, we don't need the documents. If we have the source code, source code is itself a document, evidence. So we don't need another evidence to describe the s the the source code. So slowly you change it to to a smarter C C or faster C C and then that. So indeed at that time it it was not

Speaker 1: you

Speaker 2: It was more we finished and then give it to the certifier. Certifier finished and gave it to us and then it becomes a lot of friction. But later it's more developer, lab, certifier working together.

Speaker 1: And I think within labs also nowadays they have also the distinction like analyst and evaluator as well which tends to also have like two different profiles. I think the way labs hire now also are like different like that maybe trying to protect the analyst time purely on technical part which may help. I'm not sure but yeah.

Speaker 2: But that's always a fiction because it's more professional. Or or we call it professional, I'm not so sure because you at a certain time you want to make it like

Speaker 1: like the assembly line.

Speaker 2: So you have an analysis and then you say, Okay, do this test.

Speaker 1: Damn.

Speaker 2: But then the testers they are less involved in the analysis. And the analyses are less involved with the the the consultant. And it's more efficient in a way that if someone falls off you can always do it. Anyone can do the same job. But I think it's frustrated for evaluator. If they only see one part of the work and not knowing how it contributes to the evaluation. Yeah.

Speaker 1: I'm trollin' ya, maybe they don't have enough.

Speaker 2: So it can be good or bad.

Speaker 1: Okay. yeah, that time we worked on that. So for me between Europe, Asia a lot and that's the period really where I'm gonna call it, at that time we are calling it like all this HC type of project. I don't know if you recall that. which later on become like SBMP, so mobile payment evaluation. And this really exploded at that time. That's where we are like this new specification, HCE type of SBMP from Visa, MasterCard especially. And it really took off. And that actually good and bad commercially was great. We had a lot of projects, BES also at that time, know, all these.

Speaker 2: Because of you, of course.

Speaker 1: Well, we had one good strategy, think. So the strategy for us was because a lot of these solutions were based on white box crypto. For example, in general, we had all these companies that developing the white boss crypto tool coming for, let's say outside of certification type of evaluation. And they were selling all their solution to people developing HCE, SBMP kind of solution. So the strategy was, okay, let's be friendly with these vendors. and let's work with all their clients, so getting referral connection and all that. So we are actually pretty good at connecting these people and educating these developers. Second advantage was like because of that we had the heritage, at least maybe other lab too, but from the DRM world, set the box, all that. So breaking that kind of solution was, I will not say easy, but the team was super skilled on that. So in a way when people came to us, they were quite impressed about like, okay, you can break it, can, you know, I can improve, iterate. They were happy until it happens two times, three times and they're like, yeah, look, I would like to move forward. So it's good and bad, but we had the knowledge. So the team very quickly could discuss with all these technical experts and so good technical knowledge. good connection with the ecosystem and I think commercially, the approach was, they were different approach. They were labs that maybe it worked for them, but they were selling like big evaluation with a few rounds and you know, 100K, 150K, 200K project for that kind of solution. Our approach was more like, okay, we're going to be competitive on pricing and assume that anyway. if it's a two, three months project after two weeks, that's gonna be broken. I exaggerated it a bit, but we knew basically, okay, we're not gonna reach the point of this 100K equivalent of Mondays. Let's be a bit more pragmatic. And from the moment we break it, maybe, then we adjust. And when you are working with the clients already, then you iterate, it's okay, they already started. They can't get a slot at another lab to book or three months after. So that was the strategy. We were like commercially a bit more, I would not say aggressive, but we downsized a bit our offer on purpose. So it worked well. So we got a lot of projects. Not to brag, but the team did well. remember a lab meeting where

Speaker 2: Say you had quite quite a monopoly on on those kind of things. It's really ten times or twenty times more that's

Speaker 1: Yeah. So it was, we realized that at the lab meeting, I think it was with Visa where we arrived and we said how many projects we worked on and we were like a bit shocked. So which in a way is, it's not balanced enough because you have this meeting, you want other labs also to have experience. The industry need a lot of options. So good and bad. Team was really busy But yeah, it was great. It was great at that time to really, really grow there. No, would not say that. I we had a very good team of salespeople. So at that time... So Pascal was my manager at that time also because he took over the sales team originally. The payment team was more like segregated and then we all the sales team were integrated together and it was nice also work with Pascal and I think he was managing us quite okay. We work with team also that is still there, went back, yelled to very good spirit. So yeah, they did well in building the team. Yeah, so it was great.

Speaker 2: So so then why did you move back to Asia?

Speaker 1: So one of my clients at that time was OSR company from Dr. Fan, Junfeng Fan in Shenzhen. And Junfeng, at that time OSR was six, seven people, really startup style, small office. And he asked me, do you want to come to China to build the company together in Shenzhen? And I... At that time, I really liked Riscu. It was honestly a nice job, good city, they had a house there, good for the family. like I said to Marc, Marc Vitteman at that time, I my only regret... was not to be here at the beginning of risk here. So I arrived at risk here, it was already 60, 70 people. So great company, but you're like, wow, how did you guys do that? How is it to be at the beginning? And that was the reason for me to go to go to SR cause

Speaker 2: Really experience a startup.

Speaker 1: exactly like it's, it's, it's quite inspiring. Actually you're like, okay, can I try to do the same? So of course you don't want to do exactly the same different activities, but it's very good inspiration. Not only risk cure, many companies, but really that was a big inspiration. So that's the reason I gave them. was honestly the only one, of course, like OSR, the offering, Dr. Phan, everything's great, but the main reason to consider to leave risk cure was that. Can I try to do the same? So that was the reason that was 2016. move to Shenzhen, different life. Shenzhen is fast. Like the spirit of the cities, really this startup city, entrepreneur city. What's the motto of the city when you arrive at the harbor, you have this big stone, you know. mental says like time is money, efficiency is life. So you have this big thing when you arrive at Shenzhen, a Choco Harbor, you're like, okay, that sets the tone. And that's what it is. I mean, that's the beauty of the city. you're like, look, everything you meet people on the street, they say, what do you do? How big is your company? So it's driven. But at the same time, it's like we will say like Shenzhen is an immigrant city. It was. Nobody was from Shenzhen 40, 50 years ago, not many people. So the spirit is very friendly.

Speaker 2: Yeah.

Speaker 1: so I think I am the same age as officially Shenzhen, the grand start. I think it's 45 years where they had like this big policy to develop. So in Shenzhen, OSR was... bit different. So product company for me. So I joined OSR as a COO, so operations. So the idea was to help to grow the team. Processes, bit of sales also obviously. Sales, processes, operation, hiring, working with Junfeng and the team to grow as simple as that. So you do a little bit what's necessary to do. And Shenzhen at that time was mainly IP, so crypto IPs to sell to cheap manufacturers. Little by little, there was, we also developed this internal security lab, side channel fault injection, which was again, a very good interaction because you develop IP, you need to optimize your design and then you need to test it. And you have these two teams competing. in a way in developing the best, either you want fast, small footprint or secure IP or all of them, then you send them to the lab and they try to break it. So it was a very interesting dynamic in the company. On top of that, Junfeng Fan, Dr. Fan, you know him.

Speaker 2: Very well.

Speaker 1: super knowledgeable and in the community in China I think was very...

Speaker 2: He has a crypto background, so he's really suitable in this kind of very very business driven and charming guy.

Speaker 1: super smart, can process information very well. So that was very interesting. So we can really talk about like business one minute and then go deep down into the IP design review with the engineers. So that was brilliant. That was very intense. So I stayed four years, 2016 to 2020. And we grew, I think, from seven, eight people to, I believe it was 70. Wow. Yeah, 60, 70. Which, no,

Speaker 2: This Chinese speed.

Speaker 1: no, think Chinese speed, we should have been 7,000. But in our field, it's more, let's say, I mean, it's harder to grow, right? And you are always trying to keep your engineers not to be taken by. the big Chinese company, which happens, but it was also like big partners also, especially in Shenzhen. Yeah, it was great. So crypto IPs, it was interesting because at that time there were lot of investment in China, probably still now. But you know, like for each province to build their chip design and factories like fab in each province. So there was a lot of new companies or joint venture with foreign companies, you know, that kind of setup. So there was a lot of interaction, initiative and even. project, we started to get projects with that kind of companies for the IPs, laboratories, so TICs companies, mobile labs, security labs, because at that time also OSR we decided to develop our own tools. Yes, there was an agreement with eShard on the software part, the platform. It stayed for a few years and I'm not sure if that's still the case or they are fully independent now. But at that time eShard had this...

Speaker 2: Just to mention, if you hear any concert song music because we are sitting in the Taipei arena. Yes. I don't think it will pick up a a lot, but

Speaker 1: Yes, Jack Grannos, there is a concert hall. So at that time, the tool set up for typically side channel fault injection kind of attacks. the software was based on because Ishard has this Jupiter lab notebook type of platform, which was great. The target for us was give the user the ability to customize, see the script of the attack fully open. You have the libraries, you can change yourself, you can play with the interface. So that was, I will not call it open source, but it was a really open user interface. And we made this choice to switch to a eShort ESDynamic, I think the name was still ESDynamic, I believe, for the software part and hardware part was developed by OSR. Yeah, actually. And up until today, they grew, are still developing these platforms and sell and much more AI based type of interface. So I went there December 2025. So I was not at OSR anymore, obviously, but I went there to visit them. And now it's really like, I would say like a cloud or OpenAI. You send a prompt, you say that perform this attack on the target. and it's all automated, it's pretty impressive. I'm guessing you still need some processing behind sometimes to double check, but to be honest, it lowers the entry level.

Speaker 2: It's just a matter of time that you can automate most of the thing.

Speaker 1: is quite impressive. So four years at OSR, we grew quite a bit. Interesting experience also, we raised funds. So that was the first time I went through that funding round also because we had to grow, especially in China. you need to, all the investment, the tools, the engineers. So we raised some funds and that was an interesting process for us. to have all the meetings with the different VCs, finding the one that fits our industry. Because you can have VCs coming with a lot of money, but they're going to ask you crazy revenue growth, like 20%, 30%, every year 40%. And you're like,

Speaker 2: You cannot keep up.

Speaker 1: maybe we can make it a year, but from next year, you're going to get pretty upset. It's not sustainable, and it's not, in my view, not. the pace our industry grow. You just can't, even if the business is here, which was also even at risk at that time, like the growing pain. At some point, just to relate, at risk, we had some period where people were saying, they said people will stop selling. You probably had that also sometimes, like if you bring too many projects, you can't just onboard that many engineers and analysts.

Speaker 2: CEO is more like keep selling If if really something happens then I'll go to the customer to apologize. And he always say I've never apologized once. So you just push everyone to to sell but I think it's a bit different than than the tool business or or with a product business. No. Because evaluation you people see evaluation as a as a process. Especially in your software part that you mentioned you also have. Some things happen during the way and and both sides needs time to the developer needs to fix it or we need to find out something. So it's not like straight line forty hours a week work.

Speaker 1: Exactly. So you can eventually insert. So it becomes more of a planning nightmare. So you switch from project. I found the limitation maybe like that for the analyst to switch project too often. It's difficult actually. So

Speaker 2: Yeah. Yeah I remember because I did a lot of audits at that time. The most difficult is you probably go one trip, you have two or th three audits. But after two days or one day audits, we go to another site, which is a totally different developer. You can s mix things up. So I heard I I remember he the HR said this, but no the other company. So you have to be very careful writing things down and things like that. So it was yeah, I I think at that time was it was pretty

Speaker 1: Yeah, it's a challenge and then of course then when the developers like they make their update and they want to restart right away, you have some latency and things. it can be intense. Commercially probably was the easiest part of the job because you're like high demand. I would not say it was too easy to sell, but there was a high demand and I mean the labs have qualifications usually the... It's a small world. mean, this world was more like, it was competitive, but you know, all this embedded security, the kind of security evolution we were doing, it's not like at that time, like the SGS, the BV, which deal with like commoditized certification for all kind of world and industry.

Speaker 2: What they do is really a simple line.

Speaker 1: Yeah, this is like. certificate factory, not in a bad way. That's what their industry need. I think to some extent we might go towards...

Speaker 2: That action.

Speaker 1: Yeah, because things move really fast for them and consumer industry, consumer product, they... I mean, they change all the time. So we probably need to adapt to that. But yeah, at that time was still in a way controllable there and high insurance. lot of requirements. I mean, with the software part, we started to see like more pragmatic evaluation, time-based, one, two months, then you stop, then you rate, you quantify. And I think in IoT now we start to see it like much more. So yeah, so back to what I saw, February 2020, I think that was the start of COVID. We were skiing in Japan with the family. And really that's when COVID exploded in China. So we extended the ski trip, not a bad thing. And then at some point we were like, what do we do? And things were not super certain in China. So we decided to come back to Taiwan. It was easy for us. friends and things and we stayed here and at some point things were not going much better in China at first we decided to settle again in Taiwan. I was still working for OSL remotely but I was like look it's been four years we grew quite a bit it's also to be honest not the same skills to go from seven eight people to 70 and from 70 to 200, 300, I do believe it's a different job. I was like, yeah, I'm not sure that's gonna be me that should be contributing, you know, also as a foreigner in China, so you need to change the approach. So I think it was time also. Life was also good in Taiwan, so yeah, we kind of part ways and took a bit of time off, not much. And this is when I decided, like I had a few friends, future colleagues that became available and we decided to start a recon actually. So, and that's what we do since now. recon a bit because that's where we are now is so from 2021, 2022, let's say, tested the water for a year or two. And we were like, look, some of my friends and... colleagues and partner of FreeCon now, they were coming from certification background, design, and we're like, look, let's focus on helping vendor in pre-cert, pre-certification activities. The view was still very much like certification are getting too many standards, we do have many standards.

Speaker 2: Okay.

Speaker 1: They are complex. Labs are busy. So as a vendor, when you go to the lab, you better be ready because you might, you fail, you might need...

Speaker 2: Yeah, when you restart you need to wait for

Speaker 1: It's a month and two months and and we have this this this whole like requirements going like hey way and all directions and So there was the first things who are like look, let's let's provide Consulting for some pre-cert. I'll explain a bit after and we started by doing a design review very simple, so documentation base or code review So we are contacting people they were coming to us and so I need to prepare an EMV code certification, a CC certification or any other kind of certification according to these requirements. Can you help me to prepare? Design review. So, okay. So we started doing that. A lot on PCI products still today, PCI, PTS, M-POC are still very much our bread and butter because our core knowledge is still in device security, embedded security. We don't do much like network security. It's not really... who we are, DSS to some extent. you know clients are like, okay, okay, you do the design review, but now I need to do some testing. So we started to do a little bit of pen testing, software based. We don't do like side channel fault injection because setup is heavy and labs do it well. So whatever you do in this test, labs will have to do it again. It's expensive. They do it well. They can do it a bit anytime. So, well I.

Speaker 2: Also if that is a very important part for MPOC because MPOC just a big bit background, yeah. I I I believe it's it's that using your mobile device as a PCI device, as as a pay p both interaction and device.

Speaker 1: payment. So indeed that's the shift from using a traditional post terminal but you use a mobile. Everybody was familiar to pay with a mobile but to receive a payment that was kind of new so started as Cpok then now Mpok.

Speaker 2: Th the that is very messy in the way that before it reaches to the v PCI level, Visa has their own version for cards. Exactly. V car has their own version for cars. And then you have C P POC, S POC, and now POC. And for the on the card side you have the Visa ready or n I re I forget all the names. Yes.

Speaker 1: So there was like this confusion and still a bit now as of today. So confusion in a way was good for us, creates opportunity for consulting, but that was complex also. So now we do see quite a dominant position of PCI, which is well organized, especially since the new version of M-POC, the first one and CPOC was like heavy requirement for the old solution. Now M-POC is a bit more like modular. So now you can certify your SDK, a software, a full solution, an ANM, a test station and monitoring back end. At the beginning of CPOC was not really the case. You had to go all in on all. So for companies, it was very difficult to cover all requirements and also for labs to know like how do you actually evaluate all these requirements. So there was a pretty nice evolution of the standards until now. And now think we have something like quite modular, all the domains of requirements. And we mapped our consulting offer on that. So our clients first, were like, they needed guidance actually. Like what do want to do? Like what do you want to provide to your clients? The bank, you know.

Speaker 2: Well indeed I think in in the evaluation space, the consulting part and the pre evaluation part is something that is missing. On one side is that the labs, they are not the best service oriented person. Yeah. From from from the background. Of course they are now developing it. When I was in Bright Side I developed a lot for the Chinese vendors because they need to learn it from the very beginning. But on the other side there's always this friction as a evaluation and give consultancy. B basically it's contradictory. You cannot evaluate your own consult your own consolution but we explain to you how it should be more secure

Speaker 1: Because as a lab, also, you see all the design from the vendors and how do you make sure that if you give advice to a vendor that you are not, inconsciently, I think people are always trying to be careful and honest and all that, but how do you make sure that if somehow you give a hint or discuss with an engineer that the original idea is not actually the IP of a different company? That's very difficult even for us, although we don't have the liability on certification, we always try to be careful. But also the distinction. is also in the time aspect. So let's say if your evaluation, your certification, security evaluation is in six months. We like to be like six months ahead and work during the design phase. and all the preparation of the documents, which our clients ask us after design, say, do you have doc template? And then of course I said, can you help us to write? Because they need help. So we develop all these package of training. But I always say, the closer we come to the evaluation, the more we should be involved with the lab, even us. We work, we ask our client, sir, think, did you identify the lab you want to work with? Because we need to think with them. And some people, they come to us and say, you know, my evaluation is in one or two months. Can you do an assessment? We can. But I also tell them, look, you are that close, check with the lab because the lab do pre-assessment checks and all that. And actually, if you are a month or two months from the lab, you might as well work with them. It's not consulting. It's not tailored to help you. modify your product, improve your product. But at that time, if you already booked the store, then you're getting closer. Go with them. They do it well. It becomes kind of predictable. I mean, if you fail, you fail, but you know why and you know how that's gonna be retested after. So we have this time factor. So we are like further ahead. And that's why we actually have a good relation with labs, security labs, because they do see people coming to them. and not being ready. So if they take project with that kind of clients with docs are not ready or design is still moving, it becomes unpredictable for them. And I think for lab, they need like, I will exaggerate, but ideally for lab, like you come, we test, certified, pay, go to the next one. Cause cost is, mean margin in labs I think are not. Great. Exactly. It's expensive analysis. They need to do research. You have a turnover also, so you are constantly training people. they need ideally some stable and recurrent kind of project. It's less surprise. And that's where we come in. So quite often we have labs reaching out. They say, I've got these clients. They are not ready. they will come to us in that many months. There might be an opportunity for you guys to work together to get them prepared. So that's our job, in a way. And more and more, and I think I'm gonna move a bit towards IoT and new type of scheme, but in our view, we see the scheme, it used to be like you have a closed project. smart card, a chip, closed interface. It's bulletproof, super secure, which is important for root of trust even as of now. I'm not saying it's not. And it gets certified for three years, five years, gets on the field maybe 10 years. So see you in a few years. But now it's more like, okay, mobile project, IOTs. You have a... update features, over the air features like update, firmware updates. So the products are not closed anymore. There is like constant communication, connected device, backend, whatever you have, you know. So the new standards and schemes in a way, we go from almost like a constant compliance process. So first for the companies internally, they have they need to have much more like CICD, DevSecOps, VNOPs now that we see with all these meat off things and so it becomes a continuous activity. I need a review and that's good I think. Meaning it's not like when I was student, you have an exam in two months. I'm going to prepare for it a week before, I'm to pass the exam and the next day I forget everything and see you next year in a way. So the student dilemma thing. So now you have to stay sharp all the time, maintain your process, maintain your security, including post certification. So that's what we call post certification and it's all these processes. So this is for us. where we try to be more and more involved, because if we work with our vendors and clients and partners in pre-certification, support during certification and helping them to understand the feedback from the lab, actually after they also ask us, if I modify my product on a weekly basis or monthly basis, in our industry it's probably not every day, but what's the impact?

Speaker 2: But but do you get some pushback from the vendor in the sense that they d also do not want to be too integrated with one from from lab perspective, I always see especially big developers that say I'm not going to integrate with this lab too much because sometimes I need the other lab. So for lab to develop post certification type of things I think developers are also a bit hesitant. if I'm too close or I disclose too much to the vendor, then they have me. They can ask high high high price and all the things. So I think that that balance to earn their trust to because that's the most efficient if you integrate with with them in their procedures. Yes. If you just have a digital trend to to just constantly watch out the vulnerabilities for them. Yeah. I I think it's Yeah.

Speaker 1: So in pre-cert and post-cert, actually it's interesting, one of the reasons people come to us as well is I prefer you guys to have a look first and prepare rather than giving too much to the lab as well. So being too close to the lab at first, pre-cert and post-cert. Because there is still this image of the lab, I mean, they are here to judge in a way and give not a stamp, but at least a report. So there is still this distance with labs also. When it comes to relation with labs also, saw, in IoT field, I would say, where there are many standards, many labs, maybe assurance level that tend to also be a bit lower, depends on the level, but you have entry level. So they are much less, I would say, loyal, maybe? Yeah. they will compare, will shop around. If I had to put some standard name there, like the SESIP type of evaluation, lower level, maybe we'll see that with CRL also, or JSEA Star in Japan, if it's for entry level, that doesn't matter where they go. Availability.

Speaker 2: And at that at that area you're fighting with the big big ones.

Speaker 1: Yeah, exactly. So we have now all these big players like SGS, Decra, which are like huge manpower, so investment power. I think these big entities still, they are not like at the same level as CoreLab. That's why SGS, I think, brought Brightside, you Keysight with Rescure.

Speaker 2: So so that's that's why I I think for for recon probably there is there's this gap between the super low and and the higher ones. There are some some things there that is vacuum still.

Speaker 1: Exactly, so for us, are going to... Our intention is to grow into like new standards and especially the IT field will be big for us. We believe in automation also. Maybe a strong statement, but I don't know how... If we take like a CRA kind of standards, so European Union, I don't know how many million projects should... products should be certified because... If you read it, it should be pretty much anything with the digital elements or software hardware. It's heavy. The big question is how do the scheme, the labs will cope with that?

Speaker 2: Let's say for a fact I think there is not enough evaluation power at this moment for that kind of thing.

Speaker 1: So in a way for us, we're also working on some initiative as every labs into like automation in a way. know, manual work from experts on very dedicated code review sensitive part, I think will always be there. But to be honest, when we see what's happening these days with AI and I know that's a big word, but even if... Even if we take vulnerability management, discovery kind of process, you saw what happened with METOS and all that. Our world of embedded security is not as impacted as, let's say, operating system and pure online structure SaaS product, but it will come. So we do see that. Will have a big impact. We are trying to automate actually on our side at most of our activities as an internal tool at first To augment our team. So the goal is simply put like if today we can take 10 projects How can we use AI internally offline and being careful to take like 20 or 30 project with the same team and To be honest, I think it will it we will have to go through it. the scheme level at the standard level and To me, there is always this debate, I don't know where you stand on security versus speed, security versus convenience. think security experts are always trying to push for, but if we want real security, we should still have like thorough review. I think there will be some traders who have to.

Speaker 2: Yeah, it's a very long time discussion about that. I think it also started with the security Obscurity and security. Like if you hide something people do not know, we call it security. But I think it's a Dutch scientist who said no, it's not real security because it's pure luck.

Speaker 1: It

Speaker 2: Sometimes I just lucky and found the way in. And sometimes I it takes me years to not find something actually is just right before my eye. Yeah. If that that's why we have this white box or a common criteria is white box because you can be more efficient if you understand the design and you just find if there are any attack paths to be

Speaker 1: You can actually try to quantify the robustness, right? If you get access, if you can really evaluate, if you're in a black box manner, yeah, mean, if you break it and then succeed, have an exposure, then you can say something, but if you don't, what does that mean? It's just like, okay, it's just a resistance indicator, but it's, yeah.

Speaker 2: So I'm also interested in you kind of founded companies both in China and Taiwan. How how did you experience this? Of course it's all Chinese so it's a different language, but how do you experience the the vibe or the culture in this startups in Taipei?

Speaker 1: and in Taipei. speed and scale, that's the first one. So, Shenzhen and China in general. When I arrived in 2016, like you had a lot of VCs, a huge amount of money available. At that time, there was a, we were in a tech area with new buildings in a software park, Nanshan Software Park, all new. And every week you had a new office, a new company is doing blockchain. And that time was not because there was mostly blockchain technologies or anything. And you could tell like the country really invested so much in funding like per province and VCs and all that. was, we always joked about it, but we are like with at OSL, we're like, maybe we, you know, we. We still do our IP, but we should just make a PowerPoint with blockchain to get some money and invest in the IP because it looked like you could really get a lot of money in it. So that was a big difference. The scale of the funding and the research, the number of universities, I would say

Speaker 2: Engineers

Speaker 1: the engineers, no, engineers in China, pretty good. And there is a huge competition in universities. So it's just huge scale. You know, people speak English as well, read all the papers in Chinese, in English, whatever, go to conference. it was a massive like speed. And Shenzhen, because I know a bit more Shenzhen, was also dispirical. So if you wanted to do something, you could. So, fundings, resources, engineers, and working hard. The 996 in a way, nine to nine, six days a week. I'm French, so maybe I shouldn't say that. us, French people would kill me if I said 2 to 4. it's...

Speaker 2: With some strikes.

Speaker 1: Traditional stripes, maybe September, October, after the summer. it's, I mean, at the end of the day, for us, where I remember that, like when we are developing new products and working hard, so we tend to come to work on Saturday also. And actually, for me with the family, I was not coming all the time, but I knew there was always some engineers. You don't even have them. So I'm not saying it's only China. People work hard everywhere, but at that scale, that was impressive. And there was this willingness to make great product. I have seen that also in engineers. They were also proud of their product. Shenzhen, China. We were collaborating with Huawei and other big companies, and I think there was this pride also. Maybe compared to Europe or other areas where it depends. So that was a big drive there. Taipei is a bit different, it's a different scale. People work hard also. I think China, mean, Shenzhen and Taipei is at different stage, I think. Taipei, Taiwan in general, like already grew a lot, like the past 20, 30 years with the previous Taiwan miracle in a way. I think that's what happened in China. So now probably, you know, China is just too fast. So here it's just the speed and just the scale of the founding. Obviously, think it's true for many, many countries. It's not at the same scale as China. So it's just the means. So that was a big difference. The rhythm, the speed, the growth.

Speaker 2: Yeah. So but indeed indeed I I think in a way I was discussing this about this with Triple I and and and my other guests from last episode and they were saying in a sense it's Taiwan's role is now also becoming a bit better because it we we went through a few years of the software base and a lot of things rely on software. But now we see the the the the cycle again go to hardware and and because nowadays you need hardware to make sure that the AI can run, the inference can run, and that puts Taiwan industry again more on on on the table. And I I think in security it should also push more security because when this hardware subsystem chips when they are builded into edge devices Someone needs to look at the security of that.

Speaker 1: Exactly.

Speaker 2: because it will it has so it will have so much impact on your life and and if if if if vacuum cleaner goes rogue, it will not hurt too much. But if a human sized droid or robot go rogue, it can kill you. So it's really important nowadays.

Speaker 1: So like you say, it's true. It kind of come back. When I came back 2020, security was, I mean, from a network, know, EDR, XDR, all this monitoring system, detecting threats on network infrastructure. think it's pretty strong. In Taiwan, you have a lot of companies. Embedded security, cheap security. It's interesting that it should be like, my view, like much stronger in a way. because the industry, like the semi-con industry, is so strong. So why that? To me also, there is a bit of, okay, we know the political landscape. I don't want to go too much into that. But I think when it comes to international standards, common criteria and all that, like, you know, like Taiwan cannot have the same set up as other countries. I think there might be an impact also, like in the growth of these skills and having like, for example, more labs. It's not a huge population also. So that might be that, but hopefully yes, the hardware heritage and grows there can be a new vector of growth. We do see, I think, since a few years, the push for like startup ecosystem innovation. I think there was some new rankings being published that Taiwan is a top 40, I think, in the world, location for like startup growth and investment. That's all kind of dimension. I think there is still room to grow. Definitely.

Speaker 2: I think t what Taiwan lacks is is the ecosystem because there's not so huge security industry in Taiwan because of all different reasons from the from previously. And also the Taiwanese business model is more that's just do things when we are asked and security is a cost, we don't do it. And in that sense there are not so many security university specializations. And if you don't have this many graduates on security, then they first will go to the big companies. And then you don't have a lot of people that work in different various parts of security. Yeah. So you cannot become real ecosystem or real chain. Security business chain.

Speaker 1: That's the risk in a way like are we gonna see I don't know like AI might change that a little bit We'll see AI security or AI based security but the risk indeed is I mean if everybody put some name, but if all the security experts go work for Nvidia, that's not gonna work, right? We need this ecosystem of like startups, universities. We start having actually good partnership with universities, so I think it grows, having more profiles in different field. Yeah, so hopefully this hardware can bring the revenue. and the funding, so we hope that's gonna spread into software security and all that comes with it, testing, tools, eventually this automation aspect for compliance and evaluation, which we think should be the way. yeah, we'll see. think AI might balance that a little bit more because in a way, if you had to create your own hardware company, it's also a heavier cost, it's bigger risk. So now if you go to a software, AI, you can do a lot. Eventually you already have access to GPUs in the cloud and develop your own startup, your own product. I think that might help.

Speaker 2: Yeah. Like you said, there's the secrecy and security problem. So the the the term I was looking for is with called security by obscurity.

Speaker 1: By obscurity, yeah, exactly.

Speaker 2: So you you mentioned AI, but as a small company it's also difficult for you to build a AI you know, the big big infrastructure to do it. And you cannot put it online because people say it's not secure.

Speaker 1: Exactly.

Speaker 2: so I think that's also a kind of contradictory there.

Speaker 1: So that's interesting because that's one of the challenges we have because we develop our AI assistant or AI analyst if you prefer security analyst in-house and we're like I mean you you're like what kind of data set we have unique we have our own data set that we're building but that's you know for the training that's a very small data set compared to whatever the giant tech are doing At the same time, do you want to connect to train your models, train on data, public data? How do you scale? The chance we have is we don't need to process terabytes of requests every day. So that helps to balance a bit. But that's a real question. How much you can put online to go faster, to be better, or how much you need to keep secure offline. There is a big question for the industry. I think there will come the time where we will need to accept some risk for like security versus speed. It's a bit of early debate and I'm not sure what the answer but if we take the vulnerability discovery world the past few weeks. we also like metals finding like hundreds of vulnerabilities instantly and things so that's on the attack path. how do you do like that means okay so far we can automate vulnerability discovery triage But not yet like really the analysis and rating eventually, but at the end of the day like you have like somebody checking The end result of the analysis the automated analysis with the sim and everything and the threat But then you enter into patch management release and that So far it's not automated. So what do we do now? being like, bound, depends on the product, but being bound with new vulnerabilities discovered, new input that we can't really process. So I think there will come a time on the knobs, but in general also for assessment that we need to accept maybe to compromise a bit on security, but to gain speed. We need to have a continuous process that maybe like, okay, I'm gonna make some release. might not be perfect, but I know I'm gonna do continuous scan and as soon as there is new input, I'm gonna push an update and I think we'll need to be a bit pragmatic there if we want to cope, especially in new fields where you have millions of different type of product being released. So I think...

Speaker 2: In Chin in Chinese there's a saying for Kung Fu. So there are various Kung Fu, but the only thing that will not be broken is speed. So if you're fast, you can have different vulnerabilities in your way of of fighting. but because you're so fast people cannot get use that vulnerability. I think that's that's also what you were mentioned.

Speaker 1: That's a good one.

Speaker 2: Even if it's public But because we patch it so fast, we found it so fast, patch it so fast, we don't leave it twenty years on on the machine or in in the system. Yeah, please. Then it doesn't matter anymore if it's public or not.

Speaker 1: So I think we need to go... The worst thing would be we stay in between. We get attacked constantly with new means, but we don't react accordingly. So we'll see. We'll see how it goes.

Speaker 2: So to close up after this twenty something years, what is what is your your feeling? I I think you start a company so you're hopeful for the security industry.

Speaker 1: Yes, yes. So we believe in security, think. First, mean, it's a field where you meet experts, meet nice people. And there is still this, and there will be this spirit of, you know... the cat and mouse game and people really want to help and improve. This is always interesting because security is not something you really sell. It's not a feature. Like you don't see Apple saying that my iPhone is secure. Maybe a bit on privacy.

Speaker 2: Media privacy.

Speaker 1: people, are like, yeah, but how many pixels is the camera? I said, okay. But still, we see engineers, see people improving, and it's a nice environment. So we believe in that. We see, honestly, yeah, the AI thing, see how it's gonna shape the industry, but we believe in that. I think it's a good step forward, and that's gonna bring a lot of new discussion, actually, in that. For us, that's where we are going. We are going into expanding into more markets. Not only payments, IoT and other ones.

Speaker 2: And now also you're not just in Taiwan, you're expanding over in in Asia.

Speaker 1: That's true. we have people in India, little bit. We opened an office in Japan, Tokyo, end of 2025, and we are going there. We are really happy. Japan is a great market even already for us. think there is this conscious decision in Japan to really work on, you know, owning again like and which is really many countries you know the design the engineering and all that so We see we see good growth there We hire our colleagues in Japan because Japan is also a different way to do business Which I'm still learning obviously and I will keep learning Europe and us and America's in general are where we want to grow more also It's not Obviously, I'm in Asia for 20 years and most of the partners in the company and the colleagues are also in Asia for a while. that's where we have most of our activities. But Europe makes sense for us to grow. I don't know, I'm getting older. Maybe I'll find my way back to Europe to grow the next office. Maybe it's possible. It's something we want to do. We have a few things where we want to stay close and maybe collaborate even more with the labs. A few ideas also for us still to be independent. Our positioning is to stay independent. We don't plan to become a lab. People do it well, but how can we support the lab? Maybe in automation, maybe in aligning what we do even more to help the lab cope with this high demand. So that's where we want to go.

Speaker 2: I hope I'll come back to you and let's make it a regular thing. Talk

Speaker 1: Yeah, yeah.

Speaker 2: about your observation.

Speaker 1: define a target and see if we make it? Yeah, no, are happy. We grow, you know, steady, slow, but we will grow and we want to grow if it makes sense. We don't want to grow because we have to grow, you because that's what people do. That's not really our style. We grow by doing things we like. working with people we like and we'll see what that takes us. we're

Speaker 2: Yeah.

Speaker 1: happy in Tokyo, in Taipei, in India, everywhere.

Speaker 2: So before I forget, this last question that I have to ask. This time I did I don't forget. So I always ask about if you have anyone in mind to suggest me or I do to say to

Speaker 1: for the next to pass the baton. Yes, yes, I think it would be really interesting to go visit Dr. Junfeng Fan, Junfeng from OSR, CEO of OSR. There was also a lot of people I thought about at Rescure, but I think you will connect with them anyway. So I think Junfeng is really, to me, somebody that built a great company. He has this business sense, he has this technical sense, and that's China, and he has the vision of studying in Europe and China. I think that should make it a good episode, I think. Definitely. So find your way there, and you know him very well as well.

Speaker 2: I really want to do a a serie in China. This is what I am for because I work in Europe. But most of my network and how I where I did business was in China. Okay. we started there were not really third party evaluation security evaluation in China because it's all government labs. But at that time we also see this kind of emergence of third party labs. So that would be very interesting.

Speaker 1: I think it would be a cool stop. They are in Beijing, are in Shenzhen everywhere.

Speaker 2: Maybe I should go to Chandu with him.

Speaker 1: That's a good idea. Pandas, hot pot and good food. would

Speaker 2: Yeah that's

Speaker 1: be good. Maybe do an episode like walking in nature

Speaker 2: Yeah.

Speaker 1: and outside, outdoor episode.

Speaker 2: But I go I I need a new team or

Speaker 1: I'm not worried.

Speaker 2: Yeah, but Alan, thank you very much. Thanks for taking this interview.

Speaker 1: And thanks for welcoming me and I'll keep watching your videos and you're welcome to come back anytime. Yes. Thank you.