Which is harder—knocking out Antonio Banderas or fending off the cyberattacks aimed at a large company? There can hardly be more than one person in the world who can answer that from personal experience. Only our guest today.
Veselin Troyanov has worked as a stuntman on countless Hollywood blockbusters, alongside Jason Momoa, Scarlett Johansson, Gary Oldman, Ryan Reynolds and Antonio Banderas.
Today he heads the Bulgarian team of Check Point, a global cybersecurity company with vast experience. All while building his own platform for influencers.
Yes, we will talk about security and about incidents. About risk and caution. About stuntmen and the spectacular crashes anyone can arrange for themselves by not being careful enough online… And can there be such a thing as safety on the internet at all?
– Almost 200 people have been guests on my site—from a priest to a poet, from a designer to a conductor—and now here I am welcoming a Hollywood stuntman… What are the hardest and riskiest stunts you have done?
– I've been set on fire, which is quite risky and dangerous. I've jumped from tall buildings.
I have a pretty funny story with Antonio Banderas: I managed to knock him out. Not through any fault of mine, of course. We were doing a fight, they were shooting from behind me, and I had to throw a punch. Everything was happening at a safe distance and he was supposed to react, but at the moment of the shot he leaned forward—right into my fist. We've been very good friends ever since…
Other than that, I've been hit by a car, I've fallen from heights.
Plenty of stunts of every kind.
– You once told me there is a connection between cybersecurity and stunt work. Aren't they rather distant fields?
– Cybersecurity, put as simply as possible, is risk management, and that can be looked at from many different angles.
Speaking as someone with experience in stunts—in film, risk always has to be measured precisely. Why? Every production is extremely expensive and involves an awful lot of people. It takes serious planning and a strict schedule, and everyone involved has to be in sync, and there really are a great many of them.
Actors carry enormous insurance policies, and that's why stuntmen are used. First, they make the actors look like the superheroes being sold. And second, to make them look that good, very often
the stuntmen are responsible for the real movements, the details, everything that helps the scene look more beautiful.
Stuntmen minimize risk. However events unfold, nothing must happen to the actor, because what is being sold is his face and the image he has built over the years. He is good at selling emotion to people; the stunts are a job for the stuntmen.
I really like one example with Tom Cruise. He is a very good actor, but he can also be a very good stuntman—often, in films where he is the producer, he lets himself do various stunts. In the second-to-last Mission: Impossible he does a scene with Henry Cavill in which he runs off one roof and has to jump onto another. A shot that looks fantastic in the film. A scene rehearsed hundreds of times, both with stuntmen and with Tom Cruise.
But on the day of shooting, as he performs the stunt, something in the rope system fails, and when Tom Cruise jumps he breaks his leg. The scene later became part of the film itself; you can see him start to limp, because he is a professional and finishes the scene to the end. But it cost the film millions of dollars in losses, simply because Tom Cruise did the stunt instead of the stuntman.
That is the parallel I draw between cybersecurity and stunt work—precisely this risk management.
– Cybersecurity hardly will, but won't stunt work soon disappear as a profession? The effects keep getting better; it's no accident Hollywood went on strike for so long, and one of the main reasons was the right of background actors not to have their likenesses reproduced digitally.
– With the strike, Hollywood managed to achieve quite a lot. In our profession we believe, first of all, that however good artificial intelligence gets, it cannot replace all those human movements well enough. To this day, in post-production, if you look carefully you'll see the differences and be able to tell when something has been generated.
We think, though, that the profession is certainly not a disappearing one, because all these systems need people to operate them. And even if it does disappear, other professions will surely appear to take over the whole process.
– If we continue the parallel, let's say it's relatively easy to judge how expensive the actor we're protecting is. Is that true in cybersecurity? Because almost every company is now vitally dependent on how well it has been looked after. How do we assess that objectively?
– It's assessed very easily: will a given risk stop my business or not? Or if it does, for how long, if a given system goes down, if we face some specific situation.
This is where the business has to estimate what an hour, a day or a minute is worth to it, so that it can judge accordingly what a loss of data would cost. Or, if I lose this data, what would happen, what the reputational damage would be if a cyber incident occurred.
In other words, everything depends on that. The business has to sit down with the risk management specialists and work out
how critical a specific threat is for the specific situation or for the business.
– Do you think this happens widely enough and often enough?
– In Europe it happens more, in the north and the west. In Bulgaria it's mostly practiced by larger companies that have become familiar with specific situations or have had an incident. There are two kinds of companies—those that have been hacked and those that will be hacked at some point.
In Bulgaria, small and medium-sized businesses are not sufficiently aware of what the risks are.
First, that's the Balkan mentality: everyone thinks it can't happen to them, until it does. And when it does, they start thinking about certain reactive measures to help restore operations. Once it has happened, everyone will give anything to get their data back and restart normal work.
– Can you give some examples?
– In the public sector the examples are clear; the data leak from the National Revenue Agency, Bulgaria's tax authority, is well known. There are often companies that don't say anything about such a situation. The latest case that became widely known was the theft of data from online stores.
A company that has run a stable business for 20 years can collapse in a week.
Because when hackers steal data, they have many different ways to exploit it. The first method is to ask the company they stole the data from whether it's willing to pay so that the data isn't released, if it has been encrypted. If the company pays, they may give it some kind of key and it decrypts its data.
The second way is to say, “We can sell the data to your competitors and you'll lose ground.” Information like that often surfaces on the darknet—certain data belonging to a given company is put up for sale.
The third way is to go to the partners you work with and start blackmailing them one way or another.
– It isn't even always about an attack and making a profit. CrowdStrike was a telling example of how easily the system can fall apart. And on top of that, the problem came from an antivirus platform whose whole purpose is to protect us.
– It's important to note that the CrowdStrike case was not a cyber incident. It was an update they released, which naturally didn't affect all computers. There was also some degree of risk on the part of the companies that updated their systems, and that also made the damage greater.
But it's a fact that a company like CrowdStrike lost serious ground, customer trust and a lot of revenue. Its shares fell dramatically, and all of it happened in a single Friday afternoon.
– That shows exactly how the system is built—in today's online world we constantly have to trust external libraries, vendors and platforms without realizing in time how dependent we are becoming on their next mistake. The way we run the software industry, and software in general, seems insufficiently thought through to me.
– Absolutely. I've seen it very often—when a specification is drawn up for any kind of software, people discuss features and how it should work, but the cybersecurity aspect, that is, how well protected the software is, is rarely touched on.
In other words, people rely on the programmers being good and prepared enough that there are no vulnerabilities.
One example is the case of Microinvest, a Bulgarian accounting software company; it's public. A company you trust completely comes along, installs accounting software for you, and attackers can get in through it and carry off all your data. In that particular case it wasn't related to Microinvest's software but to a specific version of Windows Server that they installed.
– Can a company be absolutely sure it covers all the risks? That it's protected from every kind of attack?
– Technologically, you can put in countless solutions, but you always have to talk about staff training too. For the simple reason that attacks coming through messages, from supposedly legitimate sources, are becoming more and more frequent. The latest one I saw involved a huge company. I saw it with us too: people had started receiving WhatsApp messages from the company's owner. The attackers had simply bought some numbers, put up a photo and started writing to employees they had found in advance.
We had the same situation inside Check Point: colleagues started receiving messages supposedly from the company's vice president. This is increasingly common, and training people is essential—on internet hygiene, on the types of files that can be opened, on the email that comes in. Because
technology is technology; it can protect and minimize risk, but in the end comes the human factor,
and a human can always click on the wrong thing, including on a personal phone, and corporate data can be compromised that way.
– Has progress in artificial intelligence changed the cybersecurity picture in any way, in your view? Has it made attacks easier, or did we only think it would?
– Attacks haven't become easier, but both hackers and the makers of cyber defense solutions use AI. The forces always balance out. But here too it depends on the people using cybersecurity solutions. I haven't come across statistics on it; there may be some growth, because the better the computing power, the easier it is to generate all sorts of messages, even videos, to make someone believe in something that never happened.
My appeal to people is to really check their information,
to call the people they know, to check everything twice, even three times, if it involves transferring money.
– Except they don't, ever since these attacks took the form of phone scams. Check Point is an Israeli company, and it turns out that many of the big players in cybersecurity come from that country. Why do you think that is?
– Israel is a small country that has always had rather unfriendly relations with its neighbors. As you know, even women serve in the army there, and the service isn't short at all—from one to three years. Everyone goes through some military training.
Cybersecurity and defense are naturally based on military methodology.
And for a country with such a strong awareness that everything should be militarized, it's natural, in my view, that many cybersecurity businesses start right there.
Just as the other type of business starts there too—spyware. A well-known case is the Pegasus software, which tried to collect information without the person having to press anything on their phone; they managed to easily install software to eavesdrop.
– Along those lines, Bulgarian hackers used to be very famous. Lately I haven't heard of any serious attacks carried out by Bulgarians. Have we lost our form, do you think, or are they into other things now?
– I think they've simply become more cautious and don't show themselves as much; people are learning to be more and more careful. But Bulgaria today has a terrific cyber defense team—young guys developing in that field. They're on the good side of the coin and they're truly very talented.
– What does your experience show—what makes a person cross over to “the dark side”?
– It's always about money. Hackers are like any company—they want to generate the highest possible profit with minimal effort; it always comes down to that. But it's a fact that cybersecurity specialists are among the best-paid professionals. And since the pay is high, more and more of these people have no reason to cross over; they stay on the side that fights the threats.
– Do you think Bulgaria could somehow become a regional cybersecurity hub? Given that we have a strong IT sector combined with a certain tradition in hacking…
– There are quite a few companies in Bulgaria starting to work in cybersecurity, and they operate on foreign markets too. Again, Bulgaria is a somewhat peculiar, difficult market. The Balkan person is convinced it can't happen to him. We in Bulgaria especially are Doubting Thomases.
It can certainly happen. But it's important to establish the model in which cyber defense and IT are completely separate.
The cyber defense people have to confirm and regulate the decisions the IT teams make.
That's how it is by the book and how it's recommended—the specialists responsible for protection should report directly to the CEOs rather than be part of other teams. Very often in Bulgaria they're in the same department, and that blurs responsibilities.
– What qualities do you need to succeed as a professional in this field?
– First, you have to find it interesting once you see how the process itself works. Many people end up disappointed because they've watched movies about what hackers look like. In recent years, I think, cinema has created a false image in people's minds of what a hacker is. And the moment they face reality and the whole process of creating malicious code, they see that maybe it's not the job for them.
In other words, people have to be curious, to want to see how the whole process happens, and only then start picking at it.
But curiosity is definitely the first quality you need.
– Along with caution, perhaps, so you don't quickly end up where you shouldn't…
– So you don't go too far. In connection with everything said so far, NIS 2 is coming soon—a European Union regulation on minimum requirements for information security. That may push more people to start thinking about the subject.
The regulation is supposed to take effect from mid-October, but it's not known when it will be adopted at the national level here.
I believe this will be the moment when Bulgarian companies start paying more attention to cybersecurity,
because besides the companies that fall under the regulation, there will be others that are part of the supply chain, and they too will be subject to very strict oversight.
– Has anyone ever hacked you? Gotten you to click on a link you shouldn't have?
– To tell the truth, I did have a very interesting scam happen to me, and I fell for it. My wife had gone onto the popular platform Etsy—she had just been setting up a shop, and apparently the scammers had found her. They had sent a link, she had clicked it, and a platform opened that looked exactly like Etsy.
At some point she called me over and said she couldn't complete the payment; I was puzzled and I fell for it. In the end we transferred 150 euros to them, which, thanks to the bank, I managed to recover.
Only after I had completed the payment did I realize what a foolish thing I'd done.
So far that's the only time I've fallen for something like that, because I try to look carefully. With attacks like these there are still signs, and if you pay attention, you'll see that some tiny thing isn't right.
– The important thing is to be careful. And to realize that no one is protected. But, as we said, even Antonio Banderas can be caught by surprise… Thank you!
