48 Hours from Total Chaos: The Cybersecurity Conversations Cloudflare Isn't Afraid of Having

48 Hours from Total Chaos: The Cybersecurity Conversations Cloudflare Isn’t Afraid of Having

In this episode, Triad’s team welcomes Chris O’Rourke, Director of Cloudforce One at Cloudflare, to discuss the company’s new partnership with Triad and how Cloudflare protects organizations of all sizes—from small rural municipalities to large federal agencies. Chris shares his unique background, including offensive cyber operations for the U.S. government and multiple startup exits, before explaining why smaller organizations are often prime targets for threat actors. He dispels the myth that only “big guys” get attacked, sharing a real-world example of a small municipality being used as a pivot point to access state and federal networks. Chris highlights Cloudflare’s commitment to transparency, its free tier offerings, and the importance of incident response retainers for organizations with limited budgets. He also addresses the dramatic rise in DDoS attacks, the role of AI in scaling threats, and the hidden dangers of cheap IoT devices. The conversation wraps with a focus on mental health in cybersecurity, the value of community and networking, and why trust and transparency are the foundations of successful security partnerships. Chris’s core message: security is a team sport, and Cloudflare is here to help—whether you’re a customer today or not.

If It’s Free, You’re the Product: Why Smaller Organizations Are Targets

“I was always told growing up that if something is free, it’s because you’re the product, right? And I kind of think about that here, you know, when it comes to these smaller organizations, yeah, there’s no money there, but that’s because you’re the product. Your network, your infrastructure, your relationships… if you’re power, utilities, or something like that, obviously shutting that down is quite valuable, or sometimes it’s just using you as that relationship gap… at Cloudflare, we work with everybody, small to large, and we have different services and plans, all the way from our free tiers up to enterprise-type levels… it doesn’t really matter who you are, where you are. We’re here to help, because we do see it… the technology has changed, but the risk hasn’t. It’s still there, and it’s still quite pervasive.”

From Threat Actor to Defender: Why Small Targets Are the Easiest

“The size, again, doesn’t matter, because in this interconnected world with the internet, we all play an important role, whether we’re one person or 100,000 people… as a former quote-unquote threat actor myself, those are the exact kind of targets I want, because the controls often aren’t going to be in place, the security’s not going to be in place, and I’m going to be able to sit in low, lay low, and be quiet, and kind of just hoover up what I need to do… what’s interesting about that is I think most of the listeners will probably concur, is that once you start sharing these stories, you kind of break down that wall of defense, and people start opening up and going, yeah, we actually have had issues like this.”

The Under Attack Button and Incident Response Retainers

“The simplest solution that we offer a lot of times is, first and foremost, if you’re under attack or having any issue, you go to Cloudflare.com, and right there at the top, there’s an under attack button. Hit that, that goes to one of my teams… but the thing that I find that most of our customers benefit from the most in these smaller organizations is rather than focusing on buying a bunch of random products, it’s buying something like a security incident response retainer, right? It’s having somebody on call… the playbooks have already been put in play. You’ve got somebody who’s already come in and done a secure audit of your infrastructure to tell you where the gaps are… what we do that’s different than some of our competitors is that we include that security risk assessment… we come in, we help you build the playbooks, we help you figure out where those gaps are up front.”

48 Hours from Chaos: The Reality of DDoS Attacks

“There’s DDoS services online. You can go to these DDoS services, and they’re run like a small software-as-a-service platform. They’ve got three tiers—silver, bronze, right? You’ve got customer support, you have SLAs. I mean, it’s chaotic what the criminals have built… If you can disrupt phone service, you can cripple a business, you can cripple a country, you can cripple a city, right? What happens if 911 goes out? What happens if we don’t have an ability to reach the security, the fire, the medical help that we need? It’s absolute chaos… they always say, you know, we’re 48 hours away from absolute chaos. Well, what happens if that gets shut down? Sometimes it takes 48 hours to reboot, if you’re lucky.”

90% of Security Is People, Process, and Trust

“It’s exactly that. It’s the trust and transparency. I mean, it’s the thing that’s most critical. You’ve got to know that you can trust… internally, you’ve got to trust and be able to communicate with your leadership. You’ve got to be able to give them the truth, and hopefully they’re going to be receptive and not get mad at you if you have to tell them the baby’s ugly, right?… 90%, 95% of it’s people, right? People and processes, and that trust is the first way to kind of mitigate some of those security risks.”