• TL;DR: Back in December, I took a job as head of strategy and technology for a candy-importing company called Dorval Trading. To explain the move I dusted off the confessor structure, and also performed a POPE evaluation of the opportunity below. I’ll be teaching at Black Hat this summer, so I hope to see many of you there. Otherwise you can always reach me at my Securosis email, at least until Rich cancels my account.

It’s another sunny day in the spring. Mike walks into the building. It’s so familiar, yet different. It’s been over 4 years since he’s been here, and it seems lighter. Airier. But the old bones are there. He takes a look around and feels nostalgic.

Mike knows this is probably the last time he’ll be here. It’s a very strange feeling.

He steps into the booth, as he has done so many times before. He came here to talk through pretty much every major transition since 2006, as a way to document what was going on, and to consider the decisions that needed to be made and why.

Confessor: Hi Mike. 4 years is a long time. What have you been up to?

Mike: It’s nice to be back. I’ve kept myself occupied, that’s for sure. As we recovered from COVID, Rich and I were faced with some big decisions. DisruptOps was acquired, and Rich decided to join Firemon and lead the Cloud Defense product. I was initially going to keep on the Securosis path, but I got an opportunity to join Techstrong and jumped at it.

Confessor: So you and Rich went your separate ways. How did that work out?

Mike: Yes and no. Although we don’t work together full-time anymore, we still collaborate quite a bit. We’re in the process of updating our cloud security training curriculum, and will launch CCSKv5 this summer. So I still see plenty of Rich… (Mike gets quiet and looks off into space.)

Confessor: What’s on your mind? It seems heavy, but not in a bad way. Kind of like you are seeing ghosts.

Mike: I guess I am. This is probably the last time I’ll be here. You see, I’ve taken a real turn in my career. It’s so exciting but bittersweet. Security is what I’ve done for over 30 years. It’s been my professional persona. It’s how I’ve defined my career and who I am to a degree. But security is no longer my primary occupation.

Confessor: Do tell. It must be a pretty special opportunity to get you to step out of security.

Mike: Would you believe I’ve joined a candy-importing company? I’m running strategy and technology for a business I’ve known for over 40 years. It was very unexpected, but makes perfect sense.

Confessor: How did you stumble into this?

Mike: Stumble is exactly right. You see, Dorval Trading is a family business started by my stepmother’s parents in 1965. She’s been running it since 1992, and as she was looking to her future, she realized she could use some help. So I did some consulting last year after I left Techstrong, and it was a pretty good fit.

The company has been around for almost 60 years, and a lot of the systems and processes need to be modernized. We don’t do any direct e-commerce, and since COVID haven’t really introduced a lot of new products. So there is a lot of work to do.

Even better, my brother has joined the company as well. After over 20 years in financial services doing procurement operations, he’ll be focused on optimizing our data and compliance initiatives. So I get to see my family every day, and thankfully that’s a great thing for me.

Confessor: Candy?!?! No kidding. What kind of candy? I’m asking for a friend.

Mike (chuckling): Our primary product is Sour Power, the original sour candy, which we’ve imported from the Netherlands since 1985. We also have a line of taffy products, and import specialty candies from Europe. If you grew up in the Northeast US, you may be familiar with Sour Power. And now we sell throughout the country.

Confessor: So, no more security? Really?

Mike: Not exactly. I have been in the business 30 years, and still have lots of friends and contacts. I’m happy to help them out if and when I can. I’ll still teach a few cloud security classes a year, and may show up on IANS calls or an event from time to time. I joined the advisory board of Query.ai, which is a cool federated security search company, and I’m certainly open to additional advisory posts if I can be of help.

Learning a new business takes time, but I’m not starting from scratch. In the short time I’ve been with Dorval, I’ve confirmed that business is business. You have to sell more than you spend. You need to have great products and work to build customer loyalty. But there are nuances to working with a perishable, imported product.

I also leverage my experience in the security business. I learned a lot about launching products, dealing with distribution channels, and even incident response. In the candy business you need to be prepared for a product recall. So we did a tabletop exercise working through a simulated recall scenario. The key to the exercise was having a strong playbook and making sure everyone knew their job. The recall simulation seemed so familiar, but different at the same time. Which is a good way to sum up everything about my new gig.

It turns out the biggest candy conference of the year was the week after RSA, so I couldn’t make it to SF for the conference this year. I did miss seeing everyone, especially at the Disaster Recovery Breakfast. I will be at Black Hat this year, where I’m teaching the maiden voyage of CCSKv5. I look forward to seeing many old friends there.

Confessor: So this is it, I guess?

Mike: It is. But that’s OK. I’ve preached about embracing change throughout my time here. Not to be afraid, and to look at every opportunity as a way to learn and grow. Not to just do things because you’ve always done them. But to move forward decisively and with intention. And to know that decisions are usually not final, but only different paths in the journey of life.

The candy business represents my future, and I couldn’t be more excited. Godspeed to you and everyone in security. It’s a noble profession and critical to our increasingly tech-centric world.

Oh, and one more thing. I couldn’t wrap things up without visiting the POPE for a quick analysis of my new job.

• People: Dorval is a small company with 16 people, but it’s a family, both figuratively — and now literally. Many of the team have been with the company more than 15 years. We have many different backgrounds, but we each have a role to play and job to do. We laugh a lot and have fun. We sell candy, after all!
• Opportunity: Confectionary is a multi-billion-dollar business. Our segment, non-chocolate confections, is the fastest-growing segment in the market. We’re not recession-proof, but we certainly get our share of discretionary income. Candy makes people happy, which is not a bad way to spend each day.
• Potential: Dorval is a 60-year-old company, but in many ways feels like a scrappy startup. We sell mostly through distributors, so there is great potential to tune and accelerate our Amazon presence and sell directly to consumers via an e-commerce site. Last year we introduced a new Taffy product and are also awaiting a shipment of a new sour gummy product, so introducing new products will be key to reaching our potential.
• Exit: The thing about working in a family business is that there is no exit. You just try to set up future generations to carry on if they want to pursue that path. Of course you never say never, but contemplating an exit was not part of my analysis.

With that, it’s time to get back to my day job. Both time and candy wait for no one.

[Mike leaves the booth and strolls off towards the horizon. The confessor looks down and notices a few packages of Sour Power Straws and Taffy Stixx on the seat. Of course, there are…]