Technology Due Diligence Services: There is no substitute for experience

Bob Gourley April 28, 2021

I’ve spent a career evaluating the business impact of technology and building strategies that optimize the contribution technology makes to enterprise missions.

In my first career as a naval intelligence officer I was frequently called upon to find ways to leverage technology to enable our missions of all source intelligence analysis. Other times I was required to assess how adversaries were using technologies as they sought to gain advantage in their own decision-making. Later as an executive with TRW and then Northrop Grumman I helped shape internal investments that sought to create technology in support of critical government missions. Back in government as the Chief Technology Officer (CTO) of the Defense Intelligence Agency (DIA) I was part of a team that sought to leverage the very best technology in the free world to support agency missions of analysis, production and collaboration.

For the past decade I have continued to evaluate technology, including participating in numerous formal due diligence assessments. I have conducted due diligence assessments in support of private equity firms, venture capital firms, large companies seeking understanding before before purchasing other firms in M&A, and for other companies that wanted to assess their own capabilities so they could optimize their own value for a future transaction.

I have captured lessons from my experience in technology due diligence in a short presentation on the OODA YouTube Channel this link and embedded below:

These lessons are provided in a way that should be of use to organizations on both the buy-side and sell-side of potential transactions, and concludes with actionable recommendations including expectations you should have when selecting a due diligence partner.

Our hope in producing this short overview of lessons learned from technology due diligence is that you will keep OODA in mind for your future needs. In tech due diligence, experience matters, and we have that.

Additional Due Diligence Related Resources:

Latest CTOvision Assessments on Cloud Computing, Artificial Intelligence, Mobility, Big Data, Robotics, Internet of Things and Cybersecurity

OODA LLC: Helping clients identify, manage, and respond to global risks and uncertainties

https://ctovision.com/ooda-provides-technology-due-diligence-at-a-speed-that-will-support-your-decision-making-process/

Lessons Learned From a Career of Technology Due Diligence

Bob Gourley July 14, 2020

In technology due diligence, there really is no substitute for experience.

I’ve spent a career evaluating the business impact of technology and building strategies that optimize the contribution technology makes to enterprise missions.

I have captured lessons from my experience in technology due diligence in a short presentation on the OODA YouTube Channel this link and embedded below:

For more technology due diligence related resources see:

Technology Due Diligence Sensemaking: Due Diligence prior to an investment, merger, acquisition or other business event is best done with experienced professionals who have past performance. This is especially true when assessing the technology or cybersecurity of a target firm. Due Diligence professionals should also maintain a current understanding of the state of enterprise

A CTOs Perspectives of Technology Debt in Mergers and Acquisition: One of the critical factors which needs to be evaluated in any technical due diligence is the concept of Technology Debt. This report provides insights into technology debt from the perspective of an enterprise CTO turned due diligence professional. These lessons can help companies preparing for a future transaction to better position themselves for optimal outcomes. These lessons can also assist private equity and other investors in thinking through aspects of technology risk and identify areas requiring additional focus prior to a transaction.

Even The Best Cybersecurity Strategy Is Only Good Once

Bob Gourley March 30, 2019

No matter what the size of your business you should have a cybersecurity strategy. Yes that means if you run a part time business out of your home you need a cybersecurity strategy. And of course that also goes for every other business of every other size small to big.

There are plenty of lessons learned and resources that can start you on your way to creating a great cybersecurity strategy. Smaller businesses should see the new cybersecurity toolkit curated by the Global Cyber Alliance. Larger businesses probably already have a strategy and it could include multiple sub-sections covering topics like incident response, vendor/supply chain management, employee onboarding etc.

But one thing every security strategy has in common is that it is, at best, only good for a brief period of time. Your business is changing in ways that will require the strategy to change. Your technology infrastructure is changing in ways that will impact your cybersecurity strategy. And, perhaps most importantly, the threat actors are changing.

Agility is key!

To aid in your agility OODA produces a daily curated product capturing the latest in cyber threats, changes to the tech landscape and recommendations for you action to optimize opportunity in this dynamic environment. Sign Up Here.

And if you could use some external assistance in reviewing your cybersecurity strategy or incident response plans please get in touch. You can reply to any of our newsletters or Contact OODA. I’d love to help you out with your cybersecurity, CTO-as-a-Service, CISO-as-a-Service or Due Diligence Consulting needs.

Seems Like We Should All Thank Cloudera, Tamr, Zoomdata, Trifacta, Kinetica For Helping GSK Help Humanity

Bob Gourley May 23, 2018

Jessica Davis just published a piece at Information Week reviewing an architecture Glaxo Smith Kline (GSK) put in place to help make drug development and fielding faster. Creating new drugs always takes years, and after they are created it takes years more to get them fielded.

Mark Ramsey is the chief data officer at GSK. He and his team have some incredible goals regarding speeding drug development times. They intend on helping GSK reduce what is normally an 8 to 20 year timeline to 2 years. The GSK approach has been to design in ways that break down data-flow barriers.

GSK has not achieved their goal yet, but are well on their way. The architecture they put in place to do it is based on great technologies, most of which CTOvision has reported on in the past. The foundation of the GSK platform is based on Cloudera. Others include Tamr, Zoomdata, Trifacta, Kinetica.

From Information Week:

Ramsey’s data and analytics stack includes multiple technologies, with the foundation based on Cloudera’s Hadoop
“That’s our primary data and information platform — the source where we store our curated data and our analytics processes.” The stack also includes Kafka and Spark. Other technologies include StreamSets for data ingestion (which has been completely automated with bots), Tamr for machine learning data curation, Trifacta for data wrangling, and AtScale for virtualization across environments. AtScale lets users leverage familiar BI tools for insights from the Hadoop environment. GSK also uses Zoomdata for data visualization, Docker for some of its containerization, Kinetica for GPU-based analytics, and Waterline Data for storage and search. The total solution amounts to more than 5 petabytes of data, all on-premises.

The community should keep watching this one for lots of reasons. One is that GSK is in business to help humanity out. So if their architecture helps them help us it is something we should all have an interest in helping improve. And to the extent GSK will share lessons on their architecture it is something others can replicate.

It is also good seeing which technologies were put in place by GSK. This public recognition of great firms with enterprise grade technology is something that all these firms should be proud of and all enterprise technologies can consider an endorsement by the market.

Stay in the loop and our other enterprise IT reporting with our Enterprise IT Newsletters.

We track Cloudera in our list of Big Data disrupters.

What The Board Needs To Know About the GDPR

Bob Gourley May 9, 2018

Executives in businesses around the globe have been tracking The European Union’s (EU) General Data Protection Regulation (GDPR) went into effect 25 May 2018. Those who operate primarily in the EU have had plenty of time to focus on this and no excuses for not paying attention. Those who operate primarily elsewhere also have no excuse to not be aware of the GDPR and should have already assessed how things should change because of these new rules. We have found, however, that many firms in the EU and the US and elsewhere are still not paying enough attention to these very serious rules. Admittedly our sample size is small and this may not be reflective of the majority of firms, but we have seen indications that many firms are adopting a strategy of putting their collective head’s in the sand or not really doing a serious assessment of the potential impact of GDPR on the firm.

The objective of these new rules is to improve privacy and security of critical personal information. The rules are also designed to harmonize many different rules active across Europe and this should make overall compliance easier. But still, for most, compliance will require changes be put into place for how data is stored and also changes put in place for how people can be put in control of their own data. Remember, the GDPR is not just about firms that operate in the EU. It applies to firms that have data on EU citizens. The GDPR requires that to collect info on EU citizens, the citizens must give their consent and the citizen also has the right to be forgotten. The data it applies to is broad, including even IP addresses.

At this point, just 20 days away from the compliance deadline, we recommend all firms do three things:

Read the rules yourself. They are not that hard to read and think about
Consult outside counsel. Pick a law firm you know and trust and ensure they have knowledge of the GDPR. Ask us if you need some recommendations.
Seek an external review of your technical architectures for compliance. Our firm, Crucial Point, is a good place to start here.

We recommend that boards (including Audit Committees for those that have them) should evaluate their company’s data retention activities and policies to see if they are in need of modification to comply. Boards should ask CEOs and the management team to assess where exposure to GDPR non compliance is greatest and prioritize actions to fix. Boards should ask questions to determine if line of business leaders realize they are responsible for compliance vice just assuming this is an IT function. And boards should know who the Data Protection Officer (DPO) is for the firm.

Here is more on the GDPR:

Fines for non-compliance are up to 4% of annual revenues.
Customers must consent for processing of their data
Personal data must be protected. This includes anything related to a natural person or anything that can be used to indirectly identify the person. This includes names, photos, email addresses, bank details, addresses, posts on social media sites, medical info, IP addresses
The rule describes a new position, a Data Protection Officer (DPO), which will be required for firms that do large scale monitoring or processing of sensitive data
Consent of users is required and it must be asked for and granted in specific ways before collecting and processing data.
Citizens are given new authorities over their data including right to have it removed (a right to be forgotten)
Data protections are expected to be designed into systems
If there is a breach of personal information, the citizen will be notified and impact assessments done
Transfer of data to other countries and organizations is regulated
Companies are expected to maintain a state of the art cybersecurity architecture and posture

We can accelerate your compliance with GDPR and do so in a way that helps your security posture. Contact us today and see if we can help you accelerate your compliance.

Additional reading:

What The Board Needs To Know About Artificial Intelligence

Bob Gourley March 31, 2018

No matter what the business, Artificial Intelligence (AI) is going to have an impact. It is changing the way consumers consume, changing the way companies create and changing the way industries generate value. It is also improving how givernments function including both service to citizens and national security missions. The bad news is that AI is also being used by criminals and hostile governments. It is a component of the rise of cyberwar and the growing cyberthreat.

C-suite executives and members of boards are rightly concerned with assessing what about AI they should accelerate into their companies and what impact it should have on their firms to beat the competition in delivering value.

Frank Chen of a16z is one of the great visionaries and explainers of artificial intelligence, especially around the AI with potential for real business impact. This video on “Artificial Intelligence: What is working” captures his thoughts on the current golden age of AI (which is really more accurately described at machine learning, deep learning and other distributed computing).

Like every golden age, there is promise and peril to be seen. And there is a need to determine what is hype and what is real. There is also a need to know what is actionable and relevant now and what is coming in the future. All of this is captured by Frank in this succinct video:

This video hits so many hot topics. The bottom line: AI has come roaring out of the research labs and is in business now. Now it is your turn to decide what to do with AI inside your organization.

You can find more insights into the nature of this critical megatrend in the CTOvision section on Artificial Intelligence. And track the most important tech concepts for C-suite executives at The Boardroom.

What Executives Should Know About Ethereum

Bob Gourley March 11, 2018

Bitcoin was the first implementation of a working blockchain technology. The idea has been built on with several other implementations. One of the most exciting is Ethereum. In some instances Ethereum’s coin, Ether, is compared with Bitcoin, and you see both cited in cryptocurrency value listings. But Ethereum’s implementation of blockchain goes far beyond the one behind Bitcoin.

Ethereum is also a way of running distributed applications. Applications can be programed to leverage the Ethereum blockchain in ways that bring the power of an open and secure distributed ledger and data store to bear in very powerful ways.

What Should Executives Know About Ethereum?

At a minimum, we recommend everyone, especially executives, know that Ethereum provides a fabric for distributed applications. For most it will also be good to know a few other details, but that is the most important point.

What Should I Know About Ethereum?

Ethereum is an open-source, public, blockchain-based distributed computing platform and operating system featuring smart contract functionality. There is a cryptocurrency built on this framework called Ether that can be bought/sold/traded and mined like Bitcoin, but Ethereum is an environment that can also be used by any programmer to create coins or other applications that leverage the power of the global Ethereum network. This is what is kicking the world of distributed computing into high gear.

In general, there are three types of players in the Ethereum ecosystem:

Users
Developers
Miners

Users: Anyone can be a user of Ethereum. You can buy and sell Ether at Coinbase, can trade Ether or other Ethereum based tokens on coin exchanges, and can interact with smart contracts and functions of companies that offer Ethereum-based functions like smart contracts.

Developers: Most anyone with some programming or CTO experience can be an Ethereum developer. The language of Ethereum distributed apps (Solidity) is very easy to learn and there are many tutorials to get you started.

Miners: Miners are those that have decided to provide computing power to make the distributed apps work in return for rewards of Ethereum (Ether) or other crypto coins.

Some recommendations:

Open a Coinbase account. It is easy to do. And if you use it to invest at least a small amount of funds it will motivate you to track the dynamics of cryptocurrencies. It will also make you more fluent in many aspects of Cryptocurrencies.
Sign up for an account on the cryptocurrency enabled Earn.com. The reason to do this is their tight connection to the cryptocurrency startup community. Leaders in the community are looking for savvy users to inform of their startups and are using Earn to find thought leaders. They pay you to read their messages (you can donate that payment to charity or keep it yourself). My view is that any startup that is vetted by Earn and will pay to have me read a message deserves to have the message read and so far I have not been disappointed, it is a great way to learn what is going on in the community.
Read over the main page at Ethereum.org. It does a great job of describing what is possible in a very clear way. And if you are feeling daring, work through some of the tutorials there (if you build a coin let me know, I’d love to see it).

We have much more to write about cryptocurrencies, blockchain and distributed apps. Be sure you are on distro for our newsletters so you don’t miss the next update. Sign up at CTOvision Newsletters.

What Should Executives Know About How Blockchain, Smart Contracts and Cryptocurrencies Are Disrupting Business?

Bob Gourley March 2, 2018

One hundred percent of board of directors and other executive leaders I interact with know of the blockchain. Not all are fans of cryptocurrency, but all seem to be deeply interested in exploring the business impact of the distributed ledger that makes cryptocurrencies work.

There are quite a few interesting use cases out there. Some may hold great potential. But there are also lots of interesting ideas that once you start asking questions don’t make so much sense.

To help you ask the right questions, this article provides some executive level context on what the blockchain is.

At a high level, consider blockchain technology as a system that lets you distribute a ledger that records data and, depending on how it is implemented, can let everyone see the data in ways that prove its accuracy. Some blockchain technologies can do even more than that. Some solutions can provide blockchain capabilities just inside an enterprise. Some can provide ways to program contracts and monitor their execution.

What that as an introduction, here is my view of the things every executive should know about blockchain enabled technologies:

Executives should have at least a basic understanding of how the technology works, including the technology of the blockchain behind bitcoin and the blockchain and computing fabric behind Ethereum, which is much more powerful in producing smart contracts. There are some good books on this topic. One we recommend is: Digital Gold: Bitcoin and the Inside Story of the Misfits and Millionaires Trying to Reinvent Money
Executives should have a clear understanding that investing in cryptocurrencies is different than investing in blockchain solutions for your business. Investing in cryptocurrencies is a special topic and may also interest you (we recommend everyone open a Coinbase account and put at least a tiny bit of money into some of the currencies there), but for most companies the big investment you will want to make is in developers who can program blockchain enabled solutions (get your tech team learning the tool called Solidity).
Executives should know that the use of the term “smart contract” in a blockchain context refers to computer programs that can be written to directly control the transfer of value when certain conditions are met. Smart contracts digitally facilitate, verify, or enforce the negotiation or performance of a contract, all without third party involvement.
Although the blockchain will disrupt many industries, the one which may see the biggest impact fastest is the financial sector. Executives in this industry already know this. But all of us who are their customers also need to be thinking through this disruption. We can have a voice in how our financial services providers serve us and should be pushing them to do so smartly with blockchain enabled solutions.
Executives should also be on the lookout for new capabilities from venture capital funded companies that can leverage the blockchain to accelerate or improve business functions for your own company. If your competitor works with a firm like this but you do not you could be losing out. If you leverage a partner before a competitor does you can beat them in the market.
Consider the impact that blockchain technologies can have on your current company strategy. This is especially important if you are a board member or CEO. You should ensure your entire management team is smart enough on what the concepts are to be able to have intelligent discussion on coming opportunities and threats.
Consider ways that smart contracts and blockchain technologies can improve your internal systems. Developers who know how to program blockchain solutions can provide applications that work inside your firm but deliver similar strong benefits as those that run on the public blockchain. We have seen proof of concept solutions like this already and are also seeing a rise in new commercially supported solutions that will soon be available for HR, Admin, Supply Chain Management and even cybersecurity.
For executives in technical domains (the CIO, CTO, CDO, CISO), you will find it easy to work through tutorials that show how to build blockchain solutions yourself. I’ve built my coin and learned quite a bit in doing so. Building a coin has become the “hello world” of the new blockchain coding world, and doing that will give you more food for thought.
As hinted about above, executives should also be ready to ask questions regarding any proposed solutions that leverages a blockchain technology. Ask, for example, why it is better than a solution that involves a modern database with smart encryption.

Maybe the most important recommendation for executives: View the blockchain with excitement! And channel that excitement into action to improve your business.

CTOvision will be providing more context on this topic in our newest category, Cryptocurrencies and Blockchain. To ensure you never miss a post, be sure to sign up for our newsletters and you will be alerted when we publish.

Recent Reporting on Bitcoin:

What You Need To Know About Bitcoin: Including potential new business models to consider

OODAloop nails it again with reporting on Bitcoin price manipulation

From Crowdsourced Militias to Dread Bitcoin Pirates

Today Every Company Buys Electricity, Tomorrow Every Company Will Buy Ethereum

Smart Cities Cybersecurity Challenge

Blockchain Templates: Amazon Making Technology Mainstream

How Cryptocurrencies will go from The Technologically Savvy, into the Everyday Transactions of Consumers

What Executives Should Know About Ethereum

Cryptocurrencies and their promise for enterprise technology professionals