Why do you need to look at the data first?

Yeah, absolutely.

Thanks for having me on the show, Stephen.

Um, so particularly from a quantitative lens, when someone comes to you with this product or this strategy and they say, "Here's a back test," you know, "This is how, uh, the strategy that we're proposing has done over the past ten years, twenty years, thirty years," you know, your next natural question is, "Well, what does that mean in terms of performance," right? How much am I going to get out of this? But naturally, I actually think the correct question that you should be asking is, "What data did you test this on?" You know-

What I'm trying to get to is, can you actually, using maths, account for the bias, the level of bias?

Yeah, and in certain cases it can be quite significant.

I mean, there's been studies that have shown, you know, uh, depending on the, the market you're in, uh, it can cost between 2 and 8%, you know, return year on year.

Uh, and what's also interesting is that, you know, we were just talking about regimes.

Why do you need to look at the data first?

Yeah, absolutely.

Thanks for having me on the show, Stephen.

Um, so particularly from a quantitative lens, when someone comes to you with this product or the strategy and they say, "Here's a back test, you know, this is how, uh, the strategy that we're proposing has done over the past 10 years, 20 years, 30 years," you know, your next natural question is, well, what does that mean in terms of performance, right? How much am I going to get out of this? But naturally, I actually think the correct question that you should be asking is, what data did you test this on?

What I'm trying to get to is, can you actually, using maths, account for the bias, the level of bias?

Yeah, and in certain cases it can be quite significant.

I mean, there's been studies that have shown, you know, uh, depending on the, the market you're in, uh, it can cost between 2 and 8%, you know, return year on year.

Uh, and what's also interesting is that, you know, we were just talking about regimes.

Can you describe those for our listeners?

Yeah, so I think just to set the context here, my experience with brokers and underwriters is that traditionally they assess cyber risk based on what they can see from the outside world.

And I akin that to a medical insurer basing their risk policy off of what clothes somebody is wearing.

That's how I akin this and kind of the thought process behind it.

So really what you want to be looking at is the scope of what's being done.

So asking about a pen test, fantastic.

They're taking it seriously.

Looking ahead now, where do you see the greatest challenges to cybersecurity for small and mid-sized businesses, say over the next three to five years? And how are you advising clients to prepare for the changes that are on the horizon?

Ethics is a lot more slippery, and I suppose that's where it starts to get quite complicated.

Yeah, absolutely.

Yeah, thanks for having me on the show, Steven.

And, um, that's where frameworks like ESG come into play, which stands for Environmental, Social, and Government-- uh, Governance.

And basically, that's, uh, uh, an attempt to try and assess a firm's, uh, investibility in metrics outside of stuff like traditional financial numbers, you know, like returns or, uh, you know, conventional risks because, you know, investors now, uh, are more and more wanting to have some sort of value alignment between where, uh, their money goes and the returns that they, they want to see.

And that demand isn't going away anytime soon.

Um, the question is whether you can systematize this or have some sort of, uh, rigorous regimental process whereby you can assess, uh, you know, uh, how ethical is this investment or, you know, is, uh, uh, compared to a different investment, say, in the same sector or a different sector.

Can you really build ESG and ethics into a formula like that that's based on numbers? 'Cause now you're trying to assign a value judgment a number.

Can you really build ESG and ethics into a formula like that that's based on numbers? Because now you're trying to assign a value judgment a number.

So there's a two-player system here.

There's the rating agencies and firms that actually generate these ESG numbers, and then there's how the funds interpret them and use them after the fact.

Normally, the numbers get generated in a process that starts with company disclosures.

So the various regulatory agencies around the world will require companies to disclose certain things.

They'll combine that with media packets and reports based around the companies as well as questionnaires that they send out to the firms to fill out and assess.

And where there's gaps, they'll build in estimates to try and fill the holes.

So at one point, it was sort of removed from an ESG index and then it was reinstated and it didn't actually change anything.

And what I wanna do is kind of if you could take us back to your first penetration test engagement, what that actually looked like, and how now it's different in the day-to-day penetration testing when you do a comparison from what it was to where we are today.

Yeah, you know, the- there's an interesting thing.

You've got the Closed Door Security penetration tests, which really, if you look in the grand scheme of things, only goes back six years ago.

And then you go, you've got my first penetration test.

Um, uh, a- and my first one was back in the day when OSCP was a real certification that you actually had to do some hacking in, um, you know, when it had the buffer overflow in it, uh, you know, back in the good days, no training, nothing.

Um, my first ever one was actually on HackerOne, roughly when it first started, once the US Army got on board with it.

Um, and I was doing some, uh, bug bounty on that, found a blind SQL injection on, uh, one of their web apps.

And so I wanted to get into that as well because, um, something you've talked about a- and I wanted to dive into it here, uh, about that precision.

And what I wanna do is kind of if you could take us back to your first penetration test engagement, what that actually looked like, and how now it's different in the day-to-day penetration testing when you do a comparison from what it was to where we are today.

You know, the- there's an interesting thing.

You've got the Closed Door Security penetration tests, which really, if, if you look in the grand scheme of things, only goes back six years ago.

And then you go, you've got my first penetration test.

Um, uh, a- and my first one was back in the day when OSCP was a real certification that you actually had to do some hacking in, um, you know, when it had the buffer overflow in it, uh, you know, back in the good days, no training, nothing.

Um, my first ever one was actually on Hacker One, roughly when it first started, once the US Army got on board with it.

Um, and I was doing some, uh, bug bounty on that, found a blind SQL injection on, uh, one of their web apps.

And so I wanted to get into that as well because, um, something you've talked about a- and I wanted to dive into it here, uh, about that precision.

Mm

... effectively you will be losing, you, you have a, a higher likelihood of losing over time than winning, or the amount that you lose will, uh, basically erode your capital to the point where you can no longer participate.

So that's baked into the math.

You can't go, if above, if you go above a certain point, yeah, maybe there will be times where you could win really big, but on the whole, if you continue to play over time, you'll eventually lose everything.

And even though that's baked into the math, it's, if you've got a, uh, if you've got a very high conviction idea-

Mm

... of risk on a certain number of ideas, as well as things like, uh, um, volatility targeting, where, you know, you want to say, okay, if you've got an idea that's especially volatile, it's moving up and down, you know, quite a lot as opposed to being very stable, uh, by nature of its performance, uh, or its volatility, uh, that needs to have a smaller position as opposed to a larger one for a more stable idea that's more, uh, dependable so you can h- you know, bake in capital preservation.

And lastly, it's the same thing that, uh, you know, Ed Thorp, uh, did with, um, uh, fractional, uh, uh, you know, uh, fractional, uh, Kelly size-

What happened? So

this was actually a guy by the name of Bill Huang who set up basically a family office with his own, initially starting with his own funds.

It was about $10 billion, very wealthy guy.

And he had some, shall we say, very oversized positions in a number of stocks.

And, you know, he's also able to leverage those positions to the extent where his market exposure was above 100 billion at a certain point.

And the other thing he was able to do was he was able to use derivatives by certain banks that meant that they would hold the stocks for him.

So there was, you know, it wasn't really clear just how exposed he was.

What happened to him? His story is almost

What is that? [laughs]

So that's basically when we said the professionals do a whole bunch of math to try and figure out how much to bet.

That's the, that's the foundational math basically that describes how much is the right amount to put into an investment.

And I won't go into too much of the details around it.

It's got quite an interesting story.

It actually has nothing to do with finance.

It originally comes from a guy called John Kelly, who, uh, was a physicist working at Bell Labs in the 1950s, and he was studying the amount of information you could, uh, extract from a noisy telephone signal.

How do they manage it?

Mm

... effectively, you will be losing, you, you have a, a higher likelihood of losing over time than winning, or the amount that you lose will, uh, basically erode your capital to the point where you can no longer participate.

So that's baked into the math.

You can't go e- b- if you go above a certain point, yeah, maybe there will be times where you could win really big, but on the whole, if you continue to play over time, you'll eventually lose everything.

And even though that's baked into the math, it's, if you've got a, uh, if you've got a very high conviction idea-

Mm

... of risk on a certain number of ideas, as well as things like, uh, um, volatility targeting, where, you know, you want to say, okay, if you've got an idea that's especially volatile, it's moving up and down, you know, quite a lot, as opposed to being very stable, uh, by nature of its performance, uh, or its volatility, uh, that needs to have a smaller position as opposed to a larger one for a more stable idea that's more, uh, dependable.

So you can h- you know, bake in capital preservation.

We're talking about that, right? We're talking about understanding what happens when I press the buy button.

Absolutely.

And I mean, basically most investors will interact with the stock market, as Keir correctly said, you know, through a broker, be it, you know, if you're an institutional investor where, you know, you have an institutional broker that you deal with or it'll be through a broking app.

And effectively, when you press the buy button on your app, the app isn't the one that executes the trade.

That trade makes its way through to the relevant exchange, be it locally.

It could be something like the JSC or, you know, the New York Stock Exchange, even if it's, you know, you're doing international trades and things like that.

But the thing is when your trade actually enters the exchange, it gets loaded onto an order book, which is effectively for a given instrument a list of all of the various buys and sells that are made on that instrument and the associated price at that point when it was made.

So in other words, when you buy a large number of shares, what happens? Why does size matter here?

Mm

... uh, if you're an institutional investor where, you know, you have, uh, in, uh, an institutional broker that you deal with, or it'll be through a broking app.

And, um, uh, effectively, when you press the buy button on your app, the app isn't the one that executes the trade.

That trade makes its way through to the relevant exchange, be it locally, it could be something like the JSE, or, you know, the New York Stock Exchange, even if it's, you know, you're doing international trades and things like that.

But, um, the thing is, when your trade actually enters the, the exchange, it gets loaded onto, uh, an order book, which is effectively, for a given instrument, a list of all of the various buys and sells that are, uh, made on that instrument and the associated price at that point when it was made.

And in the exchange, there'll be an algorithm that will match, you know, a relevant buyer to a seller at a, at a price-

What is the bid-ask spread?

So, um, this is actually one of those, uh, areas that, uh, can trip up, uh, retail investors if they're not, you know, fully, uh, familiar with what they're dealing with.

Mm.

Uh, if you're an institutional investor where, you know, you have, uh, in, uh, an institutional broker that you deal with, or it'll be through a broking app.

And, um, uh, effectively, when you press the buy button on your app, the app isn't the one that executes the trade.

That trade makes its way through to the relevant exchange, be it locally, it could be something like the JSE or, you know, the New York Stock Exchange, even if it's, you know, you're doing international trades and things like that.

But, um, the thing is, when your trade actually enters the, the exchange, it gets loaded onto, uh, an order book, which is effectively for a given instrument, a list of all of the various buys and sells that are, uh, made on that instrument and the associated price at that point when it was made.

And in the exchange, there'll be an algorithm that will match, you know, a relevant buyer to a seller at a At a price that, uh, most appropriately matches the two.

And, uh, that happens in a matter of milliseconds these days.

I mean, there was the Flash Crash in twenty-ten because of what one fund's algorithm did.

We're talking about that, right? We're talking about understanding what happens when I press the buy button.

Absolutely.

And I mean, basically most investors will interact with the stock market, as Keir correctly said, you know, through a broker, be it, you know, if you're an institutional investor where, you know, you have an institutional broker that you deal with or it'll be through a broking app.

And effectively, when you press the buy button on your app, the app isn't the one that executes the trade.

That trade makes its way through to the relevant exchange, be it locally.

It could be something like the JSC or, you know, the New York Stock Exchange, even if it's, you know, you're doing international trades and things like that.

But the thing is when your trade actually enters the exchange, it gets loaded onto an order book, which is effectively for a given instrument, a list of all of the various buys and sells that are made on that instrument and the associated price at that point when it was made.

So in other words, when you buy a large number of shares, what happens? Why does size matter here?