Before I started Vetric I thought the harm in cyber came from a particular kind of company, the kind you could point at and stay away from, and I was wrong about that. The same firm can help one customer stop an attack and, somewhere else, help a government find the people protesting against it. So there were two options, and they are not really a spectrum. Stay blind, which is comfortable and defensible and what most of the industry does, or be the gatekeeper. We chose to be a gatekeeper, which means that if you want to work with the most serious organizations in the world you have to act as if you have a massive compliance department, whether or not anybody is making you.

That decision costs us deals, and this letter explains why.

‍

‍

Let's start by talking about our critics as they are right that the intel we provide can help sort people by information that should never be used to sort them, for example, by political opinion or religion, by who they pray to or who they love, by whether they are in trouble with money. That is a real capability, and pretending otherwise would insult anyone who has looked at this industry honestly.

But, where the criticism goes wrong is on where the harm actually comes from. Most of what goes badly on social platforms needs nothing from companies like mine, because a scam needs an account and a conversation, and a fraudulent campaign needs an advertisement and a link.
None of that requires us, and none of it would stop if we disappeared tomorrow.

What sits on the other side is harder to write about, because work that goes well leaves nothing behind and nobody reports the threat that did not arrive, so I will describe it by what our partners spend their days doing instead. They find the people involved with human trafficing or minor abuse, and they find them while it still matters. They map the networks moving drugs and weapons before those networks reach anyone, and they identify a campaign being built for something that has not happened yet.
All of that runs on visibility, and we believe that this visibility has to come from somewhere.

What gatekeeping actually means

First, when we speak with our partners, we ask them to turn their cameras on, which sounds small until you notice that a company unwilling to show you its face in a first conversation is telling you something, and in four years that has never once turned out to be nothing. Then, we look at whether the people behind a company exist in public, with real profiles and real histories and previous employers they are willing to name, because in the parts of this industry doing the work you would not want done the people are in the dark and there is no history to follow. You do not want to work with people who are in the dark.

For example, we turned down a company registered in the United States whose staff, when we looked deeper, were almost entirely somewhere we cannot serve. And while they told us it was fine, we believed otherwise and couldn't continue with the partnership.

And we are replacing our vetting with something considerably heavier than a form, because boxes get checked, which means several pages of free text about what you will do with what you find, which capabilities you need and why, whether you are looking at populations or at particular people, who your use cases and which countries they operate in, signed by an official representative of the company putting their own name to the answer.

The test I gave my team was to stop asking what our industry requires and start asking what a compliance department inside a major platform would want to know before approving this applicant, and then to go one step past that. We should be more conservative about this than the platforms are about themselves, and if that is a strange thing for a company in our position to aim at, it is still the only version of this business I want to run.

Where it stops

None of that makes the problem disappear, and I want to be precise about the limit, because there are three kinds of companies in this industry and they are not equally guilty.

The first did the work, with real vetting and real refusals, and can still sell to a police department in a functioning democracy where an officer might use it personally to look up his ex-wife. That happens across the industry, even if the provider did everything available, the headline might still say that the problem is the technology itself.

The second says it does the work. It has a policy and a form and it has arranged not to look too closely, because looking closely is expensive, and this is the most common of the three and the one I watch for inside my own company, because from the inside it never feels like dishonesty, it feels like being reasonable.

The third builds things whose value is mostly in the bad use, and you can identify those by asking what the product would be worth with its worst customer removed, because for some companies the honest answer is most of it.

I would like to tell you we have only ever been the first, but I know that the second is a live risk in every company including mine, and that passing this test is ongoing work.
‍
Eventually, beyond our direct customer there is another layer, and then another beyond that. Honestly, if anyone in this industry tells you that the number of times their work ended somewhere they would not approve is zero is either lying to you or has not looked.
We don’t assume it is zero for us, which is why we keep looking.

What would count as proof

A statement is not evidence, so here is what I can say. We will publish a yearly review of the number of prospects we declined and the number of customers we terminated work with, based on the methodology I described. We will do it every year so that the numbers can be compared (without revenue figures, because revenue turns this into a story about how much we gave up and that is not the point).

I will be honest about how the conversation started internally. When I brought this work to my team the first version of the discussion was about how to do it without losing deals, which is a reasonable question and the wrong one, because the goal is not to lose less money, and a process designed around not losing money is a form rather than a standard.

Eventually, we're certain that we might lose even more in the upcoming years, because asking people to describe their work in their own words instead of checking a box is a difficult task with most of them writing around it and not being direct enough. Which means - we can't work with them.

What I actually want

Major platforms can't monitor every threat on their own, so an external ecosystem has to step in. Yet, the public position is still to pretend no one should be doing this at alleven while those same platforms rely on us when they need intelligence.  

Ignoring the demand doesn't make it disappear; it just creates shadow workarounds. We choose to operate in the light. We hold ourselves to tighter conditions than required, strictly vet who we work with, maintain the right to say no, and remain accountable for who gets access to our intelligence.

Omer Bachar, Co-Founder and CEO, Vetric