Leigh Honeywell is founder of digital security company Tall Poppy and shares the highs and lows of building a tech company from scratch but what has piqued her interest in disaster preparedness and housing advocacy

Hi, I'm Dhruti Shah, and this is my podcast

Have You Thought About. Thank you for joining us for season

two. I'm a writer and I love to find out about what passions

people are pursuing. And also what makes them tick the

podcasts for those who are at a reckoning and tired of being

told you can really just have this one focus just one thing

that makes you you. In each edition, I'm going to chat with

someone who breaks these lines and who's managed to fit things

together in their life or profession that you might not

think of as an obvious match. You're about to hear me chatting

with Leigh Honeywell, a digital security expert, founder and CEO

of Tall Poppy, and someone who has a passion for disaster

preparedness and activism.

Now Leigh, you've got over a decade's experience

in computer security. And you've worked with some pretty big

names before setting up a very unusual company. So tell us a

little bit more about your background and journey Tall

Poppy.

I think the the thing that I love the most about

working on Tall Poppy is that it really combines my sort of past

day jobs and educational background and computer science

where I was working at big companies like Microsoft,

Salesforce, and eventually Slack doing somewhat traditional

cybersecurity work, although I was fortunate to get to do

pretty cutting edge stuff, protecting companies protecting

infrastructure, all of that stuff, super important and very,

like formative in my career.

And at the same time I was doing a lot of activist work has been

organising, and being able to combine the two in the way that

we work with individuals and in many cases, individuals who are

themselves fighting for social change and social justice. I

think that's something that I find really fulfilling about the

current work and the work that we do with Tall Poppy.

What is Tall Poppy, for people who think maybe it's

like something gardening related, what is this cool thing

that you've actually created?

So we're a cybersecurity company focused on

personal cybersecurity. So, you know, many people have done this

sort of like you work at a big company, and you have to do the

security training that's like, don't click on the phishing

email and get the company hacked. Our focus is really

making sure that people don't get hacked, and people don't

experience cybersecurity issues as well as more broad or

personal security issues. We originally came at it from the

angle of online harassment, that that was like the big like blow

up issue that people were dealing with these sort of

online mobbing things and cyber stalking all of this. People

sometimes use the term cyber bullying, which I've always

found it like, it's just bullying, it happens to be on a

computer, but it's, you know, it's and I think calling it

bullying, in many ways, also sort of takes away from the

severity of some of the stuff that we've dealt with where it's

very much like, full on like criminal stalking. I've never

been one to really like that, that sort of cyber bullying

thing, I think diminishes a little bit of the threats that

people face. So really, the focus is that sort of personal

cybersecurity, outside of the corporate firewall, protecting

people's personal accounts, personal information, and

personal safety.

But how did you make that move from taking

perhaps more secure roles? And being like, No, I'm gonna go

away and recreate this app create this thing that's

actually quite at the vanguard. There's not a lot of things out

there, like what you've created. So how did you take that risk as

it were

The fortune and the misfortune, I think the

fortune is that I was in a position where I'd been working

in tech for a bunch of years, I had some savings, I had a

network, I had access to venture capital. So in many ways, I was

very fortunate. And then the misfortune is, sometimes there's

an itch that nobody else has scratched yet, and you got to be

the one to scratch it. And I actually came up with the idea

that would eventually become Tall Poppy, all the way back in

2014. During the the GamerGate crisis, when all of these women

video game journalists and critics were getting attacked

online by like a horde of weirdos who really had too much

time on their hands. This sort of idea came to me that like,

how do we get leverage to support people who are dealing

with stuff like this? And you know, when you think about who

can be the sort of payor for stuff like this, it could be the

individual - that seems that sucks. It could be like

governments or agencies, sort of the nonprofit world, or when

it's people that have a job, shouldn't the employer have a

duty of care, to protect people who are dealing with these

personal security, personal safety issues in the course of

their job.

And that was the real lightning bolt moment was like, Oh, this

is something that like, companies should be paying for

to protect their staff. So came up with the idea all the way

back in 2014. But I was living in the US on a visa, and you're

not allowed to like start companies on the visa that I was

on. So I was like, Ah, I guess I'm just gonna, like keep

thinking about this for four years until I got my green card.

And then I got my green card in February 2018. And I

incorporated in April. So that was like, I was kind of like,

well, nobody else has done this. Clearly, this is something that

I still need to do. It's I've still been thinking about it. I

still see it as a need in the world. And the rest is history.

Your passion - how did you make sure that it was

maintained? Because four years is a long time, especially in

the tech world.

If you leave it at that timeframe, there was an

election in 2016. That was pretty stressful living in the

States as somebody like as an immigrant, there was a lot of

things going on day to day, but I kept doing the work

fundamentally in my evenings and weekends working one on one with

individuals who were dealing with these like severe personal

security issues.

Whether it was because of activism, whether it was like,

you know, connected to an intimate partner violence

scenario or intimate partner abuse, we saw a real rise in

that time in a type of malware called stalker wear, which is

spousewhere, which is like an even creepier term, this is sort

of apps that people would installon their significant

others phones, either with or without their knowledge, and

then use them to surveil things like location. And there's also

you know, mobile devices have built in functionality that

allows for that kind of surveillance stuff like the Find

My, in iOS, like, you know, you can consensually share your

location with people sometimes that's like a healthy and good

thing, if it's like a parent who's trying to keep track of

like a small child, but in an abusive situation that can be

really, really scary. So really sort of tracking that arc of the

field, staying current with threats that people were facing.

And then when I had this sort of logistical opportunity, and the

time was right, for me, personally, I was able to, you

know, actually start the company and hit the ground running

because I had been keeping up to date. And I also spent a lot of

time, it's sort of cheesy, but like learning about

entrepreneurship, and like talking to other people who

started companies and learning all that stuff, so that when I

was actually logistically able to, particularly with the visa

stuff, I was able to start the company.

You're a founder, you're not a conventional type

of founder. So what's that journey been like?

Ups and downs but generally trending upwards.

I think the.. it has been harder in ways that I didn't

anticipate. And some of the things have been easier stuff

that's been harder has been things like fundraising, there's

an oft touted statistic that 3% of venture capital is raised by

women, which is pretty depressing, if you think about,

like, some of the big brands and names in the world that were

founded by women. And I think every woman founder goes into

this being like, Oh, I know, it's 3%. But it can't be that

hard, right? Like, I'm really good at what I do. There's

always this sort of, like, I didn't follow up on that one

email, maybe it's not, maybe I'm not dealing with bias, maybe

it's actually just that, like, I suck personally right? Then I

come back to like, 3%. That's pretty bad. That's pretty bad.

So I'm very fortunate to have some fantastic investors on, you

know, on my cap table that have believed in the company that

believed in me and my team, but I think the the fundraising

thing has been legitimately really, really hard.

Hopefully, by the time this podcast comes out, we'll have

some exciting news to share. So stay tuned. It's been a slog, I

think that's the technical term, the stuff that's been easier

that people I feel like constantly complain about, I

hear other founders being like, man, it's so hard to hire, it's

so hard to like, get the word out. And I think we have the

sort of fortune of this is an issue that people care a lot

about, and want to work on. And so, you know, when we've been

recruiting when we've been hiring, we've just had like, a

tonne of incredible, incredible people apply. I feel like, if I

had the budget, I could hire twice as like, I could double

the team tomorrow, which would be challenging for like other

cultural reasons.

But I think the I've been very, very fortunate that hiring

amazing people has been relatively easy compared to what

I hear from other people. And, and also just like, we've done

basically no marketing since day one, and we're doing like,

pretty good. And a lot of that has been that like people like

you want to talk about this stuff. And I'm really, really

grateful for that. So we actually have our first

marketing intern right now. She's been making TikToks It's

very exciting. Figuring out the things that are hard for us that

are easy for others. And the other way around has been a

really like interesting part of the journey.

You're awesome. Just gonna keep saying that

every so often. But how do people discover who you are? You

have a marketing intern now? Is it word of mouth? And also not

just people in terms of who need what tall poppy offers what you

offer? But the investors too? Is it a lot of cold calling? Is it

a lot of Oh, actually, here's one person who really believes

me? Can they recommend me to somebody else? Like how does it

actually work? Because it feels like connections are actually

quite important in this game, in the investor game.

It's been super interesting, seeing how the word

of mouth and networks work in this field, a couple of the ways

that we've gotten the word out, I used to be very active on

Twitter R.I.P. And so certainly like social and the social

presence, a lot of referrals, we've worked with a number of

particularly trust and safety teams. So these are the teams

that tech companies who they ban the like internet Nazis or

whatever the sort of current mode of nastiness is, those

teams are the folks that do content moderation. And one

thing that we found is that the trust and safety community is

very tightknit, everybody knows each other. And so when we ended

up working with a couple of like, major company platforms,

whose names start with T, the sort of diaspora of folks from

those companies, who now work at other companies tend to like

bring us in in subsequent roles. So we've seen a lot of business

come that way as people move around in these various roles,

doing sort of media talking about what we do, I think has

been really useful in terms of just... a thing that I learned

in the sort of like, as I'm learning how to do say, like,

I'm a security person I, computer scientist, like I'm not

a business person by training and learning how to do sales has

been a big piece of like, what I sort of didn't even know what I

didn't know, going into this.

A big thing has been this sort of like idea of educating people

about the thing that we do even exists, right, I think that's

one of the really interesting challenges of building something

new is that people don't even realise that there might be a

solution to the problem that they're having. So just

literally just like talking to people talking to like you about

what we're doing is one of the most important things that we've

been doing in terms of the sort of like promotion of the thing.

So one of the other things that we've been doing is engaging in

the sort of civil society efforts around fighting online,

there's different terms used in different places, I think the UK

is using online harms a fair bit as a sort of catch all term.

Other places use online violence, and online harassment

is the sort of traditional term, but all of these different

things, there's a group out of the International Women's Media

Fund called the coalition against online violence. And

we've been highly engaged in that for the past two years, we

have sort of regular calls and talk around what are the

different efforts in the world in like civil society, nonprofit

land around combating online harms, that's been a really

important way for us to like, give back, because, you know, we

are a commercial for profit company, although we're not

profitable yet. But being able to participate in that dialogue

in that discourse, and be a resource and service provider to

that to that community in the various communities that they

support has been really important to us.

So just to make sure that we break it down for

the audience. Like if you're an individual, can you download Tor

puppy? Or is it something you have to get your company to sign

up for? And then just again, very quickly, what happens once

you log on? Like, how does it help you?

Yeah, so we currently only sell to

businesses, we really don't want to be charging individual

consumers for the work that we do. So our like official product

is something that we only sell to businesses and organisations.

The other things in terms of the participation in the ecosystem,

we work with a number of groups that provide public and free

resources. Back in the summer, we released a new guide to

staying safe online on the Feminist Frequency games

harassment hotline, website. So that was actually a guide that

was originally produced in 2014. And this was the first big

update of this guide in quite a few years. And we're really,

really proud of having been able to contribute to that we did the

sort of tech editing of it.

We're also involved in a number of other projects that that

provide public resources for individuals who aren't

necessarily like coming through a company. One of my favourite

resources along those lines is the Consumer Reports security

planner, this is a free public tool that anyone can use to

improve their overall personal cybersecurity and personal

safety practices. It's really like the best product on the

market for the general public. So I highly, highly recommend

checking that out, I believe, at securityplanner.org.

And then we have an extensive public resources page, where we

link to all of this different stuff, a whole number of

resources, both from the sort of tech support, like how do you

keep people from hacking into your stuff, but also the sort of

psychosocial support because I think that's one of the things

that I mean, you can say cybersecurity very broadly, but

also specifically talking about stuff like online violence. We

don't talk enough about how like upsetting and frankly

traumatising, some of this stuff can be even if it's just like

just a scam, or just some sort of like untargeted attack, it

can still be like really upsetting to people. And I think

making sure that folks have that sort of psychosocial support and

resources is really important to me.

So to your actual question of like, if somebody works at a

company that we work with, what is the process, we do two

things, we have a web app that can scale to like an entire

company, it walks people through protecting themselves

proactively as well as if you do become the target of online

harassment, what are the things that you can do to mitigate and

reduce the harm, we also provide Incident Response support within

the context of our like customer base.

So you know, folks can obviously self serve through the app, or

we will get on the phone with them and walk them through

threat assessment, potentially working with law enforcement, if

that's something they're comfortable with all the sort of

asterisks of law enforcement like really struggles to deal

with this stuff. And also, lots of people do not feel

comfortable interacting with law enforcement for many very valid

reasons. So we've got this web app that we built, we roll out

broadly, we also do a sort of executive service where we go

over one on one with folks and typically this is, you know,

going by the name its executives is particularly high profile

people within an organisation and it is a more expensive

service because it requires a human to like interact with the

person. So we don't tend to roll that out super super broadly

within organisations, but we do two big things there.

One is what we call the digital footprint assessment. In the

digital footprint assessment, the sort of like joking way I

explain it, but it's like pretty accurate is we basically like

cyberstalk you with your consent. So if I was really mad

at Dhruti, what would I find about her on the internet?

Too much

We do that, walk through people's like

online profile, use a bunch of tools to figure out, you know,

what kind of data breaches has your email address been. And

therefore I can find out your like, Neopets account from 2014,

or whatever, hey, you might want to reset the password to that,

because I found the password and it reached up and stuff like

that. So that's the digital footprint assessment. And then

the second piece is an advanced security review. This is where a

deep dive one on one interview, where we go over, like how to

use technology. And then we make customised recommendations based

on how you're currently using stuff, and and what you could do

to secure the stuff that you already use.

See, it's so weird, because a lot of what you say

makes common sense. But you are at the vanguard of a lot of this

in terms of like the company itself in terms of the way that

you've been thinking in terms of the conversations that you're

having. So that's the let me sort of segueway a little bit,

you're clearly multi talented, multifaceted, how do you not

break with so many ideas with such a big brain and so many

different things going on, and also the fact that you're

working in security, and it's quite, it's not necessarily the

most positive space to be in constantly.

I think a big thing for me has always been in

terms of making this work sustainable and not too crazy

making is really like identifying what is the small

chunk of the world that I can break off and fix in a very,

like, small contained way. And I do have a zillion projects on

the go. Or at least on the planning board, I feel like

being able to make like little bits of progress on all of them

makes me feel really happy. Even if I'm not like getting

obviously top hobbies my day job. That's like the thing I'm

the most focused on.

But my other sort of like hats that I'm wearing right now are,

I'm on the board of a local nonprofit that's doing housing

advocacy. So we have a housing crisis in Canada, which is

bonkers. So much space, every time I say that out loud. I'm

like, this is the most ridiculous thing ever. But the

reality is that Canada has built the fewest houses per population

of any country in the G20. I have been an immigrant in the

States, I very deeply and I strongly believe in immigration

to Canada.

But there's something about like, if we actually want to be

welcoming, we have to build houses, I've been really

involved in this local nonprofit and literally talking about like

changing little tiny bits of the world. I show up at these like

zoom housing consultation meetings for like an 18 unit

apartment building that people are like up in arms about, oh,

you're gonna cast a shadow over my backyard or like, this is

going to add all this traffic on this, like really high traffic

street. And I was like, Hey, we are in a housing crisis in a

climate crisis. Can we get this building built, please. And one

of the really powerful things that I learned about housing a

few years ago, which honestly just was one of those, like,

total mind blowing moments is the people who are already here,

they are the ones that are showing up at these meetings to

say like, I don't want this, I don't want more neighbours. The

people who are not yet in those 18 units, we don't know who they

are, they don't know to show up at that Zoom meeting. And so it

is the responsibility of those of us who are already here who

know that this is a problem to show up and be like, No,

actually, we need to build this building. One of my big hobby

horses right now is housing.

Can I just throw something into the mix? Because

actually, I'd quite like to hear your thoughts on this because I

was at a conference very recently, where you mentioned

climate and people were talking about something similar with

nature. And people being a voice for nature, like representing

the rivers or representing particular elements of nature in

those meetings, whether it's planning meetings, or like

government meetings, but what you're doing is at a smaller

scale for particular components, yeah, housing. But it's

interesting that there is that movement going on where people

are stepping up beyond who they are, specifically in order to be

able to represent not necessarily the voiceless, but

those who don't actually know what's going on or can't be

there, even though they're the ones that are subject to it,

Or just like physically aren't there yet. A

couple of years ago, I read Kim Stanley Robinson's The Ministry

for the Future, which is sort of near future climate change

science fiction, and I highly highly recommend it kind of

content note for the first couple chapters describe like a

unsurvivable heatwave in India and it's really really like,

it's a it's a rough scene. So I always like caveat that so that

people don't dive into this book and they're like, oh my god, it

because I was definitely like sobbing by like the third

chapter, but it's worth it. Super worth it. The book is

amazing. Going by the title Ministry for the Future, the

sort of conceit of the book is that the United Nations sets up

a ministry to engage in like the legal defence like through

litigation and stuff of people who have not yet been born. And

this is actually a like legal strategy that is being tried in

the real world. And as you you mentioned, the defending the

lakes and the rivers. There has been I think, Greta Thunberg,

the climate activist. She's one of the folks that has been, like

advocating for this strategy of like, literally children suing

governments and polluters and all of these different folks

that are like messing things up, because there's a future harm.

And I think that's it. You know, I'm not I'm not a lawyer,

although I was raised by a pack of lawyers.

But I think it's a really, really interesting strategy, a

good segueway to the other little chunk of trying to fix

things that I've been thinking a lot about, which is really

around like emergency preparedness.

This is a Thursday we were supposed to record on a Tuesday.

And I had to reschedule because my internet had been down

because we'd had this huge storm and the power's out for a couple

days. And that's like the second one this year. And last year, we

had a derecho, which is something I only learned about

recently, but it's basically a tornado without the twisters.

It's like that degree of storm. But there's no funnels that

touch down. And so we had this direct show in May 2022 in

Ottawa, which took out I think, about a quarter million people's

power.

We were without power for nine days. And thankfully, like we

have a generator, because we've been thinking about this stuff.

But that is like, we were very lucky to have a generator. We

didn't have internet for nine days. So that was, that was

challenging. But just thinking about all of that sort of like,

you know, as we're dealing with this increased frequency of

weather events, I grew up in Ottawa, we did not have

tornadoes, and I was growing up, that was just like, it was not a

thing. And we've now had two this year so far, and the

derecho last year, this is like, very, very different. And so

anytime that people are like doubting climate change, I'm

like, are you do you not see what's happening? Like I did not

grow up in a place with tornadoes. So that's kind of

So building that sort of community resilience is

wild. But when I was living in San Francisco, before I moved

something that I've been thinking a lot about. This past

weekend, we had this other power outage, my neighbor's fridge was

plugged into my garage, because we had the generator running. So

home to Canada, I went through a programme called NERT, the

making sure that people are like talking to their neighbours and

identifying like, hey, who in the neighbourhood is an elderly

neighbourhood Emergency Response Team. And this is a programme

person who's not mobile? Can we make sure that they're okay in

the wake of this storm, or whatever. And then you've got

that was set up in the wake of the 1989 earthquake, where they

the additional challenge of like you're in a high rise or like

multi unit buildings? How do we make sure that, frankly, that

the laws require those buildings to have generators, so that

realised like, hey, let's actually get a whole bunch let's

somebody who's less mobile is able to like get out of the

building, if there's any sort of incident, we have this nine day

build surge capacity of individual members of the

power outage, if you're on the top story of a tall building,

you're stuck there, if there's a medical emergency, that can be

community who want to learn the basics of first aid, the basics

super, super scary.

So some of this stuff can be done in the like, super

individual community level, some of this stuff has to be done

of like, we call the earthquake, eyes, look at a building, see if

from like a regulatory framework, because, you know,

some random apartment building, they're not going to instal a

generator on like, the goodness of their hearts, you have to

it has unreinforced masonry is it going to fall down now that

regulate them. But my dream is that everybody should have

something like the neart programme in San Francisco and

we've had this earthquake identifying, like, where's the

like, there are programmes like that around the United States.

But as far as I've been able to tell, in Canada, there's only

natural gas shut offline, so because when in the '89

like the 72 hours of supplies kind of level of community

preparedness. I want to go a step higher than that and like

get people talking to each other, get people learning these

earthquake, all these houses caught on fire, because the gas

skills. Although, thankfully, we don't need to learn the like

earthquake goggles as much here doesn't take that much work to

lines broke, and so you got to be able to let's go turn off the

do this kind of emergency preparedness, but it takes

knowledge and like access to the information. And that's I think

gas, the gas outputs.

the big thing that I think is missing right now.

And that was the amazing Leigh Honeywell, digital

security expert, founder and CEO of Tall Poppy and helping you

get prepped for all emergencies. Do you have an interdisciplinary

life because I would love to hear from you. And perhaps we

can chat on this podcast that goes in my newsletter, which is

called Have you thought about and can be found via

www.dhrutishah.com. Please join me next time for a fun

conversation with another guest who likes to mix up lots of

things in their life. If you like the podcast, do share rate

and review. It's an independent podcast and if you find it

helpful, then let people know. Thank you to Rian Shah for the music.