Revolutionizing Cyber Defense Strategies with Mike Weigand

Mike Weigand:
You're going to have to have grit. This is one of the most difficult markets from an entrepreneurial perspective that you can work in in the United States. The reason that you should work here, though, is because it's some of the most rewarding and impactful work that you could do with your professional time and energy. Full stop, period. These missions are of the utmost urgency and importance to our way of life, and that's what gets me out of bed every day. We choose to go to the moon in this decade and do the other things, not because they are easy, but because they are hard. Through our blood and your bonds, we crushed the Germans before he got here. You and I have a rendezvous with destiny.

Bonnie Evangelista:
All right. This is Bonnie Evangelista with the chief digital and Artificial Intelligence office, joined by Mr. Mike Wagland. Did I get that right?

Mike Weigand:
Mike Wagend.

Bonnie Evangelista:
Wagend. I'm sorry about that. Who do you work for? What's your role?

Mike Weigand:
Hi, Bonnie. Thank you so much for having me on the podcast today. So I'm the co founder and the chief growth officer at shift five. We're a data and cybersecurity company that was initially founded by myself and Josh Lospinoso, both ex army cyber officers, initially to help secure our nation's weapon systems and critical fleet infrastructure from cyberattack. But now we have found ourselves at the center of a data infrastructure company that's really helping bring observability to fleet systems, planes, trains, tanks, satellites, in the near future so that we can extract data off of those systems, secure them, but then make that data accessible to increase their operational readiness or other important use cases.

Bonnie Evangelista:
A cyber background?

Mike Weigand:
Yeah.

Bonnie Evangelista:
Anyone who listens to this show already knows that's kind of my former stomping ground, so it's very exciting for me. How old is shift five?

Mike Weigand:
So, shift five is about four and a half years old. It was founded in 2019.

Bonnie Evangelista:
Do you still consider yourself a startup?

Mike Weigand:
I don't think we consider ourselves a startup anymore. We kind of consider ourselves in the scale up phase. So we elected very early on to take venture capital, and we've raised over 105,000,000 at this point. We've grown the company into an eight figure ARR business, and we've massively expanded. So I think we're through the startup kind of phases now, and we're trying to figure out how to scale as we deploy hardware and software onto multiple weapon system fleets across the Department of Defense and in commercial industry.

Bonnie Evangelista:
Are you only serving the government?

Mike Weigand:
No. So we're a dual use company. We put our solutions on commercial aircraft, we have our first hardware, finishing the FAA certification steps, actually, in the next couple of months. We've been working with the airlines now for over a year, doing off vehicle data processing for safety and security use cases. We've been working in the rail space for a couple of years, helping secure and pull data out of locomotives for the passenger and the freight rails, both for safety and operational efficiency use cases. And so we're really excited to be working with DoD, who is literally at the bleeding edge of weapon system cybersecurity, but also bring that technology to commercial industry, where it can have a tremendous impact on our national security, and at the same time, take operational readiness and maintenance use cases from industry and bring them back to the military so that we can employ the same solutions to increase the operational readiness level of a lot of our fleets.

Bonnie Evangelista:
Which service are you working with?

Mike Weigand:
So, Bonnie, we work with all of the services, I think, with the exception of the coast guard and maybe the marines, but we're excited to work with them in the near future. Our biggest customers are a couple of the cocoms, the air force, navy, and the army.

Bonnie Evangelista:
So, in my experience, and talking with people like yourself, usually companies are born out of. You're trying to remove friction or you're trying to solve a to. I'll get into your background in a second, but if I were to guess, what problem were you frustrated with that you kept seeing or something that this journey for you was born out of?

Mike Weigand:
Yeah. So, Bonnie, I observed this problem when I was in uniform, and I was so gripped by it that eventually I realized I needed to start a company, because there wasn't a firm that was building solutions that could be made available to the military or to commercial industry to solve it. And so that was why I resigned my commission and have taken this detour into entrepreneur land business. I hope someday to get back to public service, because I think that's incredibly important, as you've highlighted in your career. But the problem that initially I was so focused on solving was that our weapon systems today across the Department of Defense are increasingly automated. They're computer controlled. They use these special computers running embedded operating systems. So they're not like our traditional servers and laptops and desktop computers.

Mike Weigand:
They're what we call operational technology. They're running specialized operating systems, typically real time operating systems, and they communicate with one another over different network technologies than we're accustomed to in the IT world. Standards like mill standard 1553, a rink 429, serial data buses, in some cases, some really old school stuff. And despite all of this automation and increasing connectivity, as we modernize systems and make them communicate with one another to be more effective, there's no onboard cyber monitoring or cybersecurity. Just as a general statement on the vast majority of our weapon systems that are in the sustainment phase, new systems that are in development today have requirements for cyber protection, cyber survivability. But the stuff that we would have to go to war with right now does not have things like onboard antivirus or intrusion detection or intrusion prevention on systems like their avionics databus, the mission command systems and communication systems are typically pretty well secured. But the things that actually enable the shoot or the move functionality often don't have any cyber protection. And I was really gripped by that problem.

Mike Weigand:
I wanted to solve it. And as we dove into that problem, I realized that there was a foundational issue. And foundational issue all comes back to data. I know a topic that you and your audience are intimately familiar with was missing was hardware and software on these weapon systems that enabled us to access that operational technology, data without being able to access it and observe what's going on on the inside. We had no chance of doing things like anomaly detection. And you have to do anomaly detection and classify those anomalies as maintenance issues or cyber issues if you're ever going to defend a network. So that's what shift five has been focused on, is solving that data observability and data access problem on weapon systems, and then deploying anomaly detection capabilities so that we can secure them and solve other use cases along the way.

Bonnie Evangelista:
And the impacts or the consequences to the problem you're describing, you felt that during your time in uniform.

Mike Weigand:
Yeah. So my concern was that as we looked to pacing threats, that those pacing threats around the world, they can never compete with us in a dollar for dollar kind of defense spend. Right. We have the nation's best military industrial complex backing up the world's most professional and experienced military. Full stop, period. And so, as our pacing threats around the world look to gain advantage over us, they often look to asymmetric and hybrid warfare techniques. And because of our automation, because of our vast communications interconnection, we actually have potentially some vulnerabilities there that lesser funded adversaries could exploit in order to hold our systems at risk. And it's impossible for senior leaders today to judge what that risk is because we don't have the sensors monitoring what I see as critical cyber terrain within the fleets of weapon systems that we have deployed.

Mike Weigand:
And so that was the problem that kept me up at night and has really kind of compelled my professional journey up to today.

Bonnie Evangelista:
Tell me a little bit more about your background, your time in uniform, because this is all leading up to, I think, where I want the conversation to go. But it's important to understand, because, admittedly, I want to go into the cyber terrain part. But tell us how you kind of came at this intersection of understanding the things you're talking about.

Mike Weigand:
Yeah, Bonnie. My journey really started at West Point. It wasn't an easy journey to get in there. I have the distinct honor of being rejected by every service academy, but I just kept showing up and knocking on the door at West Point, they eventually let me in. Probably a mistake that the army made. But while I was there, I fell in with a phenomenal set of mentors and instructors in the computer science and electrical engineering department, and they really shaped me. When I commissioned, there was no cyber branch available, so the army saw fit to encourage me to join the infantry, and I did that. So I jumped out of airplanes and went to Ranger school, and I worked in what's called an armored brigade combat team.

Mike Weigand:
I was with tanks and Bradley's and all of our heavy formations. I learned the thing there.

Bonnie Evangelista:
Wait, I'm sorry to interrupt. Did you say when you were at West Point, you studied computer science, or were your mentors just of that?

Mike Weigand:
Oh, no. I was fully engrossed in computer science and cyber. I was the nerdist, skinniest guy that you could possibly imagine.

Bonnie Evangelista:
And then you went, okay, I'm following.

Mike Weigand:
God bless. Right. That's kind of the army for you. But it's the best thing that ever happened to me because I got to learn how the army fights, and it was the best leadership laboratory experience. I was just gifted to work with phenomenal ncos and combat units. Right. Bringing decades of experience, and every single day was a master class in how to lead troops in maintenance, in logistics. Right.

Mike Weigand:
Which is super critical in these heavy formations.

Bonnie Evangelista:
Yeah. How the army runs.

Mike Weigand:
Oh, my gosh. Yeah. What goes into moving an armored formation? It's mind boggling. The amount of fuel and ammunition and spare parts and the attention to detail and the maintenance. It's incredibly complex. I never would have appreciated all of that. And it's actually there that I started to learn. Wait a second.

Mike Weigand:
There's all these computers under the armor in our vehicles, and they don't work without the computers working. That was where the AHA moment actually was sparked. Was probably somewhere on a training range back at the time we called it Fort Hood, probably during a live fire exercise, like, late at night, I was like, oh, my gosh, if my current mission processor doesn't work, my vehicle is deadlined, and I'm out of the fight. So in 2014, the army established the cyber branch, the first new branch military occupational specialty collection in the army since special forces, I think back in the 70s or eighty s. And I was super lucky to be one of the first officers to get pulled in and to help build that branch up. So I was in the right place at the right time, and it was through the access and the opportunities that were provided, being an early officer in that branch, that I got to work with senior leaders and share this observation that I had about our weapon systems being so cyber dependent, and yet there was not ready ways for cyber protection teams to show up and suck data out of many of our weapon systems and immediately kind of execute these mission essential tasks that we had. Right. Our missions were on the defensive side, to conduct incident response, to conduct active hunt, and on the flip side, that, hey, wait a second, there's a tremendous opportunity to hold cyberphysical systems at risk, and it's a very different set of access, persistence, and capability development problems when you're going after vehicles or military equipment than when you're going after it systems.

Mike Weigand:
So I think largely because of those interests, kind of shied toward and tried to specialize in that area.

Bonnie Evangelista:
So when did you decide to separate and transition? And actually, it's part of your story, as, when you separated, is that when you started the company, or was there a period of something else happening before you started the company?

Mike Weigand:
Yeah. So I think I made the decision around, like, the seven, seven and a half year mark for me. I wanted to serve eight years, and I did that right after I got my DD two, five, four, sorry, what do you call it? Your DD 214, your discharge paperwork. I literally drove from Fort Mead, where I was working at the time, to a single office that we were running here in Roslyn, right next to Arlington National Cemetery for, like, a dollar a month from another startup. And got to work, like, that day because I really knew what I wanted to do, and I had a plan, and I had really phenomenal co founders with me, and we had already talked to, during my terminal leave, had talked to some investors, and we found some national security focused venture capitalists that understood the problem that we were trying to solve in defense and its criticality to commercial critical infrastructure, like transportation. And they were willing to kind of stake us and quite literally give us the monetary means to take care of our families. While we were figuring out the business plan and trying to get started. So that was a really exciting and stressful time.

Mike Weigand:
I don't have an MBA. I've learned all of the lessons the hard way by crawling across the business battlefield. And you just try and fail forward constantly.

Bonnie Evangelista:
Yeah, I can feel that from you. I'm laughing a little bit. One of my favorite questions to ask people like yourself, you jumped into something not knowing, which is great. And then I'm like, so what was that like when you were trying to grapple with the acquisition part of selling to the government? What was that startup journey like for you? Learning and diving into or navigating that space?

Mike Weigand:
Yeah, well, I had a plan, and I think that that was part of the service training that I had received. Right. I had a plan. We had contingencies and everything like that, but to a certain extent, I didn't know what I didn't know. So running into the acquisition. Buzsaw buz. Yes, it was a moment. I was like, holy smokes, this is complicated.

Mike Weigand:
But I learned some fundamental lessons in Ranger school and as a platoon leader and as a company commander, I think are universal and really helped our approach. Number one, read the manual. We had this phrase, RTFM. Read the blank manual. It's difficult, but you have to read and understand the federal acquisition regulation. You have to read and understand policy directives, and you have to empathize with the constraints of mission partners, acquisition officers. If you don't understand that stuff and take the time to really get to know the process, you're going to be doomed to fail, and nobody's going to do that homework for you. It's not incumbent on the government or the military to explain to you how the acquisition system works.

Mike Weigand:
It's all written, and a lot of it's in Us code and policy directives. Everything's accessible. So that helped us kind of navigate. Our first stop was to try and get some acquisition vehicles, some contract vehicles. And we realized early that the small business innovative research Avenue was highly attractive and is the key to success there is to get in and out of the Siber program as fast as humanly possible. Don't be what some people call Ciber mills, where you're just living off of ciber phase ones and twos. It's a disservice to the taxpayer and to the spirit of the program. Get that phase one initial contract, which gives you a license to go talk to service people.

Mike Weigand:
Figure out what the problems are and the solution that you can bring. Pitch and secure a phase two contract. That gives you a little bit of money, right? A million and a half in a year to kind of demonstrate initial minimum viable and then immediately use the siber, phase three acquisition authorities to go secure real funding, real appropriations dollars to actually extend or mature the solution and work into and through that valley adapted to the TPE process. Yeah. So that would be my advice to any company starting.

Bonnie Evangelista:
How long did that take you? I'm guessing you got a siber. How long did it take you to get your siber that you're.

Mike Weigand:
Yeah, so we got a phase one and increased it to phase two. We also got a direct to phase two and we won an army innovation day contract all within the space of about, probably in our first twelve or 18 months thereafter, we started developing teaming agreements with system integrators and oems. That's key especially for us where we're putting hardware and software on weapon systems. You have to work with people that actually build the systems and you have to bring value to them in addition to the warfighter. It was pretty shortly thereafter that we started developing and implementing strategies to work directly with pmos and get on their forecasts and built into their palm cycles. And that's a multi year journey and you have to start that as early as possible.

Bonnie Evangelista:
Did I hear you say you do have a phase three with the army?

Mike Weigand:
We've executed probably close to a dozen phase three contracts at this point. And phase three is really just means that somebody else was able to use other monies in order to gain access to the capabilities we built earlier and deploy it. Yeah.

Bonnie Evangelista:
So that's pretty impressive to me. So I would say you crossed that quote unquote Valley of death. That term has a lot of baggage, I think I'm going to first ask what does that term mean to you? And then I would like to know what that was like going when you realized, I'm in the valley of death. What was that like? And scary. Yeah, you're like, oh, no, it's that thing I heard about.

Mike Weigand:
Right, Bonnie? To me, the valley of death is that time period between when you get an initial small little seedling funding R D project that lets you gain access to warfighters, iterate, do spiral upgrades and really figure your product out. Between then and having a product that's ready and solves a need, solves a requirement, but where there is not funding available from the appropriate program office that needs to buy the thing and sustain the thing, that period of time is the value of death, and it's usually a minimum of three years, because that's what the palm cycle is, the amount of time it takes for a program office to write you into their budget and get that budget approved, funded by appropriators in Congress associated with an NDAA, and then back down. What a lot of people don't anticipate is that you also have to bake in the tremendous amount of time that it takes to get through the contracting cycles, and you have to plan for six to twelve month contracting negotiating periods. And also because contracting offices, they have a tremendous amount going on and you're probably not going to be their top priority. So that can take a long time too. So four years is usually about how long it takes. You shortcut that by ensuring effective communication and championship all the way across the stakeholder chain, from the user community and the warfighters, up through requirements officers to the contracting office, senior leader support, and then ensuring that the congressional affairs side of things are also tracking and that they're ready to receive, and that they're not surprised when DoD shows up with requests for funding.

Bonnie Evangelista:
What piece of advice would you give anybody who's going through a similar journey as yours? Because everything you've described, for someone in my seed, it's kind of the norm. And of course, someone like me is also looking for ways to kind of break through this construct we've built for ourselves. But in the meantime, there's still people trying to break through. What advice would you give them?

Mike Weigand:
Well, Bonnie, I think the first thing that I would tell them is you're going to have to have grit. This is one of the most difficult markets from an entrepreneurial perspective that you can work in in the United States. The reason that you should work here, though, is because it's some of the most rewarding and impactful work that you could do with your professional time and energy. Full stop, period. These missions are of the utmost urgency and importance to our way of life. And that's what gets me out of bed every day, is an opportunity to continue to work on really cool, sexy mission, if I can say that, and to work with incredible and impassionate people across the spectrum, uniformed, dedicated service and department civilians, folks on Capitol Hill that wake up every day trying to figure out how to fund and set policy to make DoD as effective as possible, and other contractors and support personnel that share that vision as well. The second thing I would say is you need to plan for the long run. If you're venture backed, you need to take on more money than you think you need.

Mike Weigand:
You need to give yourself more time than you think you need. Things will go wrong. You need to learn how to operate under continuing resolution. We've spent more than half of our life existence under CR and understand what that means. And you need to work with investors that are going to have the patience and the professional experience already, understand the challenges that you're going to face, help guide you through, because this is not an industry where you're going to build a thing that instantly solves an urgent and important problem and then instantly be able to scale within weeks to months like you could in other industries, because you have to account for developmental and operational testing, safety assessments, you have to account for if you're building hardware, all of the certifications that are going to have to go into that, if you're building software, AI algorithms, the new eo, right? How are you going to test and certify that this is going to operate in a safe and expected manner? Because the consequences of getting it wrong in this industry are not service denial. They could be life and death. And so you have to bring a completely different game face expectation and level of care to this industry than I think you do if you were just building like a software app.

Bonnie Evangelista:
Yeah. When you mentioned this is a space that you're in for the long game, quickly scaling something isn't as easy as you might see it on the commercial side. This might be a heavy question, not meant to put you on the spot, but it's something I think about, because I am really passionate about getting startups and actual real bleeding edge technology in the door. And I wonder if what you talked about, that whole kind of, that mission driven passion is enough, do you think that's enough of an incentive or motivation to keep our supply chain healthy on an emerging technology front?

Mike Weigand:
It's not. I think that when we think about innovation, competition, we have such a tremendous advantage here in the United States. If you're the best entrepreneur or engineer anywhere in the world, you want to come here and participate in our marketplace of ideas, in our marketplace of opportunity. I think that the department can do more in order to accelerate the identification and integration of novel technologies into the department. What that looks like, to really be specific, is giving more white space budget to program management offices, shortening the PPBE and palm cycles, ensuring that we're more comfortable taking risks. And I'm not talking about risks in the hundreds of billions of dollars level, it would be tremendously impactful to give pmos, give contracting and acquisition officers the ability to take risks in the two to $15 million range where a $10 million contract to a startup that's in a series B series a kind of phase in DoD is such a tremendous signal to that company and to their investors. They can go out and mobilize incredible private capital in order to continue to sustain their mission. But it shouldn't take congressional marks to get that ten or $15 million white space to a pmO, which might take 18, 24, 36 months.

Mike Weigand:
So I think that that's how we can create more incentives, take advantage and mobilize venture capital smartly. I think that this is understood by many of our senior leaders. We hear a lot of senior leaders across DoD talking about this. It hasn't quite filtered down through the frozen middle, and it's not being implemented at the scale that the DoD needs to really compete in the innovation space against some of our pacing threats and the marketplaces that they're building.

Bonnie Evangelista:
What other things are you looking forward to in your journey? I won't say you've reached the summit, but you're on a path. You've done some hard things, like getting through the acquisition on a previous episode. We called it the acquisition labyrinth. And now you've got multiple phase three. You're delivering to customers across the services. What does that next step look like for you?

Mike Weigand:
So one of the really exciting things we're focused on right now is we've taken hardware and software, we put it on an initial fleet of aircraft. We upgraded the first manned aircraft fleet in the history of aviation with a real time onboard cyber monitoring solution for its avionics. And we're now expanding the use cases with the ability to tap and suck the data out. We're looking at how can we make that data accessible for maintenance use cases. How can this data serve digital twinning and enable predictive maintenance modeling? Not looking at fault codes, looking at the actual communications between the digital systems on board, which is not something that's been done before. The next summit for us is scaling out and deploying this onto multiple fleets of increasing fleet size, and that poses its own set of really exciting challenges. When you move from a fleet of 20 to a fleet of 100 aircraft, and then you're looking at a fleet of 500 ground combat vehicles and then a fleet of 5000 ground combat vehicles, that's the journey that we're on right now. We're trying to compress all of that down so that we can get these cyber sensors and these edge computing devices out to address maintenance, operational readiness and cyber monitoring solutions as fast as possible.

Mike Weigand:
And doing that poses tremendous logistics challenges. And so we're working through all of that right now. So I'm really excited to just help build the team that's going to solve those problems so that we can get these capabilities out, proliferate them, so that our warfighters can secure and observe all of this cyber terrain and then simultaneously scale this in the commercial markets, which have their own set of regulatory challenges and commercial aviation. Right. Tremendous certification challenges there. So I don't want to stop until every commercial airliner has onboard cyber monitoring. I think it's crazy that we fly today on aircraft where there's nothing that tells a crew chief or a pilot that like, hey, this box underneath the cockpit doesn't have the correct software on board. I want to bring about a world where we have cryptographic and secured software update wants to set to avionics.

Bonnie Evangelista:
Is there anything else you would recommend in terms of resources that were helpful to you? Any part of the journey, whether it was the business op side, the navigating the valley of death side, how to find the right vcs, even like you were talking about? I understand that's super important on both sides, vcs, I think they're looking, and I think that's a compliment to you because vcs are often looking for the right person, not the right product or thing they're looking for. Who's going to have that grit and resilience that you talked about earlier to take this all the way home? Anything that was super helpful to you that you want to share with others?

Mike Weigand:
Bonnie? I think my last piece of advice to others looking to get started is to make sure that you're reading the defense strategy and the policy documents that are published routinely at the OSD and at the service level. If you can't tie the service or the product that you're trying to bring to the Defense Department back to the objectives, mission and be able to communicate it in senior leader terms back to these policy documents and strategy documents, then you're missing a really key communication opportunity. And that there should also shape your thoughts on how to approach prospective customers or mission partners. And it's that communication throughput and reading and understanding that I often see as missing, especially with younger companies who maybe just don't realize that that's out there or they underappreciate the value and really the need to do that to operate in this space. Okay.

Bonnie Evangelista:
And now we're going to flip the coin. Advice for public servants, practitioners like me, because you've been on both sides, now you've walked in multiple different shoes. I would say different roles, different perspectives. What would you give those of us on the government side? What's landing for you in terms of the message you want us to hear right now?

Mike Weigand:
I think if you're on the acquisition or the contracting side, please get more familiar with the Siber phase three authorities. It's an amazing and incredible way to save yourself time and money. If the companies want a phase one or phase two siber, they've been pre competed. They have a sole source and special acquisition authorities, and you can use any color of money to engage in them. But when you decide that you want to engage with them, try and do so quickly. One of the things that these small businesses really struggle with as they're entering the defense market, and actually, I think even the big businesses is forecasting. And for anybody that's on the capture side, forecasting is incredibly difficult. But if you can help get contracts through in 45 days or less, and it's totally easy and possible to do, but if you can hold yourself to that internal standard, you will help them ultimately help you, because they will forecast effectively to their investors.

Mike Weigand:
They'll bring additional resources to bear. But when contracting actions get strung out three, 6912 months, you're literally killing them. And they don't have the wherewithal to sustain that kind of negotiation period.

Bonnie Evangelista:
As an example, awesome advice. I should do a podcast just on sivers in the spirit of that. So I have one more because you're full of good insights. So in the spirit of the defense mavericks community, what does that mean to you? What does it mean to be a defense maverick?

Mike Weigand:
I think somebody that's going to throw full afterburner and is going to get after it and is going to, as a community, overcome whatever the obstacles are, somebody that's gripped by the mission, that's fully committed to advantaging our nation with the best capabilities and is going to run through whatever the bureaucratic or logistics challenges are to get there. That's what a defense maverick has made.

Bonnie Evangelista:
Awesome. Thank you so much for your time today. This was truly a pleasure.

Mike Weigand:
Thank you, Bonnie. And thank you for everything that you do for our community. Awesome.