The setup
One day Craig Schultz showed up at my office and told me that he and Jeffrey Starr believed cybersecurity was a huge potential market, and they wanted to build in it. The two of them were a formidable pair to say that:
- Craig Schultz, ex-Lawrence Livermore National Lab, deep in analytics and grant-funded national-security work, and a specialist at helping teams get funded. I’d met and worked with him around the RMS period.
- Jeffrey Starr, a national-security and intelligence heavyweight whose credits include Project Sapphire in 1994, the operation that removed ~600 kg of weapons-grade highly-enriched uranium from Kazakhstan. See RAND and The Diplomat.
That conversation became NeoPrime Solutions, and it’s where my career turned decisively toward cybersecurity. NeoPrime opened a lot of doors. The engagements that followed largely flowed from it: Qatar/QCRI, a counter-WMD red-team exercise, the Smart-UPS firmware research, and others.
My role
Cybersecurity consultant on “scan and plan.” I helped build the assessment model, the data sources, and the scanning sources, and gave feedback on their Monte Carlo simulations and the combinatorics for computing risk probabilities. On top of that, I supplied the security domain itself: CVE databases, patch and vulnerability feeds, and the kill-chain and vulnerability-mapping model. Craig’s team brought the mathematicians, and I brought the security model and the real-world data and scan sources that fed it.
What I built / did: “scan and plan”
Craig opened by asking what I saw as the biggest challenge in cybersecurity. I’d been to B-Sides Las Vegas, ~2012 to 2013, the same week as Black Hat and DEF CON, with speakers from both. I also worked these events to drive interest in Triverium. At B-Sides, a demo of a Maltego-based tool mapped a successful exploit path across multiple hosts by chaining several vulnerabilities together. My answer was that firms don’t know what to patch. They lack end-to-end visibility of attacks, the kill chain, and how vulnerabilities map onto it, so they can’t prioritize. That exact insight comes back at Nike years later.
Craig and his team of mathematicians turned that into “scan and plan,” which I helped design and code, and for which I fed the security domain: CVE databases, patch and vulnerability feeds, and the kill-chain/vuln-mapping model. The product was a “black box”. Picture the OBD-port dongle an auto insurer plugs into a car to score a driver’s risk, but for a company’s network. It would scan the network, inventory hosts, and read vulnerability and patch status from the central consoles. Then it would compute, in effect, the RMS exceedance-probability curves, but for cyber attacks: the likelihood-and-severity curve of a breach for that specific firm.
Net result
They marketed the black box to cyber insurers, successfully, and eventually sold the product to one. More broadly, NeoPrime is the hinge that turned my career decisively toward cybersecurity and opened the doors that followed. QCRI/Qatar, a counter-WMD red-team exercise, and the Smart-UPS firmware research all flowed from here.
The story
The genesis is above. Two national-lab and national-security veterans, Craig ex-LLNL and Jeffrey Starr of Project Sapphire, decided cyber was the next market and pulled me in as the builder, off the back of a B-Sides demo and a one-line thesis about patch prioritization.
It was a brilliant bunch: Craig; Jeffrey Starr; John Nitao, the dual-PhD mathematician; and John Compton, PhD linguist. But I was the key asset. I knew computers and cybersecurity in ways they didn’t, and they couldn’t build the product without that. It’s the whole case for experience over credentials, lived out. A room full of PhDs, and the indispensable one was the engineer. They all had enormous affection for me and my insights. I was the practitioner they leaned on: under-credentialed on paper, but smart, deeply knowledgeable, and genuinely plugged into the real cybersecurity world in a way an academic pedigree doesn’t buy. That “real world” connection has deep roots. I learned hacking in the early-’90s Arizona scene, as the Origins entry covers.
What I learned
- The hardest problem in security is prioritization, not detection. “What do we patch first?” means mapping vulnerabilities to real exploit paths and the kill chain, then ranking by actual risk. That thesis started here and recurs directly in my Nike work, patch prioritization at scale.
- A risk model is a risk model. The exceedance-probability curves at the heart of RMS mapped cleanly onto cyber risk at NeoPrime. Same math, new domain. Career through-line: RMS, then NeoPrime, then Nike.
Key people
- Craig Schultz, co-principal and the one who brought Paul in. Ex-LLNL, later Newline Ventures and RapidAscent. linkedin.com/in/craig-schultz-607b2b25
- Jeffrey Starr, PhD. National security and intelligence; Project Sapphire, 1994; SecDef Threat Reduction Advisory Committee.
- Dr. John Nitao, one of Craig’s mathematicians on scan-and-plan. Craig met him at Lawrence Livermore National Lab. The NeoPrime/NPSI deck confirms him, listing him as Senior Modeler / System Architect.
Technologies used
Maltego-based attack-path mapping, with kill-chain and multi-host exploit chaining; CVE databases and patch/vulnerability feeds; reading vuln/patch status from central security consoles; network scanning and host inventory; a hardware “black box” appliance; exceedance-probability risk modeling applied to cyber, the RMS math re-pointed at breach likelihood and severity.
Patents / awards
None.