Techstrong TV - February 16, 2026

>> Okay. Great. Great. And actually I'll segue from before. I saw a a fantastic fit or opportunity to come um join um CIQ cuz CIQ uh is not only uh built on open source and I'll tell that history in a minute. Uh they are focused on on emerging and leading edge technology starting with an HPC background and now sort of reframing and and revolutionizing Linux. So when I had an opportunity to come here uh about a year ago um I jumped on. And now to tell you a bit about CIQ, really cool story. Uh, so our CEO and founder, Greg Kurtzer, who I know you've had conversations with, is one of the co-founders of CentOS Linux.

Uh, which for those that don't know, eventually went under Red Hat. Um, and while he was, uh, prior to and while he was founding Linux, uh, he was building out performant compute infrastructure, uh, for high performance computing for our national labs. you know, the systems that power uh our cancer research, our simulations, our our weapons armory um and really what a lot of people are trying to adopt with AI um today.

Um after building that out and um delivering some I think really impactful open source technologies like like Apptainer uh uh Warewulf um uh he founded CIQ and CIQ has a focus on delivering modern infrastructure for the gener for the generation of AI or the AI generation and you know we believe that um both with um building widely adopted um um um open-source platforms like Linux as well as being able to scale high performance computing uh in real production environments that we're we're in a situation where we have the skills, knowledge and experience um to build the modern infrastructure that people need for the next age of compute.

Now there's another interesting story as we get um to Linux where I think we'll drill in. Um you know IBM bought CentOS. Um, CentOS was really kind of uh the developers real. It allowed you to learn uh enterprise Linux. It allowed you to deploy enterprise Linux in your dev and test environments without um high cost. Um eventually CentOS was sort of shut down and move upstream as Linux as sort of its testing bed. Um so developers lost their their their dev stage environment, their testing ground, learning ground. I think within a week of that happening, um Greg uh went to uh the channels and said, "Hey, um let's start a new CentOS." Immediately people responded.

They named it Rocky and owed to one of his co-founders who was no longer with us. Uh and uh and so that's CIQ and that brings me here with CIQ um today. Um I I will add as to kind of uh lean in one of the thesis we have here at CIQ is that uh while Linux is widely adopted uh general purpose Linux um takes significant full-time engineer hours risk and iteration to tune for purpose workloads like security like container hosts like AI and uh we believe it's our responsibility and contribution to the industry and the Linux community to sort of build workload specific variants that close out at least 80% of that gap.

Um, so that people just have to finish off the bespoke 20%. >> You know, it's funny. Uh, 199899 I'm helping build a company, an early ASP called Interlant. We went public in I think 2000. Um and and we learned that lesson in the ASP world. >> Interesting. >> 25 years ago that >> the ASP world application service provider. Yeah. And uh in that out of the box complex applications at best can do 80%. >> Right. >> You you always need to fine-tune the 20%. >> Yeah. >> And it here we are 25 years later hasn't changed. >> The same thing. Yeah. I mean, even in SAS, right?

Sales >> SAS is the same thing. Yeah. Yeah. You think you're just going to log in and you're good to go, >> right? >> What do you think all those Salesforce consultants are doing? But, you know, all you know, all that aside, Brian, Rocky Linux has made a name for itself as a secure, a hardened kernel, if you will, a hardened Linux OS. Um, and in today's world, you know, where the attack surface is multiplying, you know, every day with AI and now all of that that that it brings, what a what a good time to have a hardening, you know, a really hardened OS here and a and a not only just the OS itself, but the the packages, the whole process around it that you can, >> you know, have something you trust Um, you probably saw this week Claude Opus 4.6 came out.

>> Within a couple days, it found 600 vulnerabilities in open source code >> for decades, right? Some existed for decades. Yes. >> If that's not enough to scare your pants off, what is, right? I mean, >> it's enough to keep you up at night and and just I imagine that makes a good, >> you know, it's a good reason to take a look at Rocky. >> Yeah. Yeah. Well, and you know to to tell you a bit about our relationship to Rocky to to set the stage is so um Rocky is downstream of RE. It is uh free and open source run by uh the Rocky Enterprise Software Foundation or RSF >> and um >> what that does is that gives sort of enterprise Linux um stability and base security that people can access for free, right?

Replaces Centas. Um now what what we found is that um still to take that and harden it and for many people harden means compliant. It means I I configure SE Linux. I um I run some open scap uh playbooks like disastig or uh or NIST 800-171 acronym soup right to kind of harden my system to be compliant and pass audits. All right. Um so we did realize that people need help with that cuz that in itself yes is important and takes a lot of time right but as you said Allan um I think the statistic is uh uh most uh software applications use something like 200 open source components um there are roughly uh estimates of uh you know in the area of 40 new um um vulnerabilities be being discovered across the whole open source ecosystem.

system every day. Um, and the time to remediate those takes anywhere from 47 days to 100 plus days. In some cases, like for some of our fenthro entities, you never patch or remediate those, right? So, now we enter the discussion of proactive hardening, right? We take Rocky, we give you your compliance check box, but but your Claude Opus story is a perfect example. There are CVEes that haven't been that will be CVEEs that have not been identified or or exposed yet. How do you protect yourself against those? Right? And that is it right there. Right? In a world where you know there's a clawed opus every day, >> right?

>> Or someone's and and it's not just the good guys that are going to use it. You know, thank God it's the good guys that found these 600 vulnerabilities, but the bad guys are using it, too. Yeah. Well, >> and they'd be better. >> Yeah. And I well so um I hadn't looked at the latest uh 5.3 codeex yet but I was just reading news that open AAI as uh uh safety commission in California I believe it is feels they may be in violation of AI safety laws because they are the first ones to publicly release a model that has a high level risk because it is good enough that it can be easily used by bad actors to exploit systems.

So on that note, I just saw a flash come across my screen earlier that Anthropic announced something about that anthrop that Claude can be used for heinous crimes or something to that nature, which sounds similar to what you're talking about. >> Yeah. Yeah. >> And um look, they probably all can, Brian. I mean, you know, this is But when did people ever stop for security? It's full speed ahead here and the securityurities we're gonna have to play catchup as we always do. >> Yeah. And I think you know what you highlight um and I'm just preparing a couple of uh sort of things numbers I want to site but you highlight a key thing about um uh what is sweeping over technology especially in this AI age right is the technology sector and the technology space at this point is dictated by speed.

who can move the fastest, right? But what we are not necessarily doing and have not figured out is um how can we move faster and identifying security threats, protecting ourselves against those um um so we can stay ahead of the bad guys, right? So, how do we balance this fact that we have this wide attack surface, the attack rate is increasing at astounding rates? We're being told we need to ship yesterday. So, we don't have the privilege to sit down and button down all of the hatches. Well, you know what we believe um uh we you need to do is you need to practice what we call proactive hardening.

We no longer can um deploy a system and then sit and wait for alerts to bomb us and tell us that there's a potential risk. go out, evaluate that risk, analyze where it lives across our infrastructure, and then stop everything to go patch it, right? Um, what we need to be able to do is know that when we install this foundational piece of our infrastructure, that thing that lays beneath beneath um um our hardware, our compute, and the rest of our workloads, we need some level of assurance or protection that if somebody gets in, they're going to be stopped. And so that's what we're building with Rocky Linux uh from CIQ Harden.

This could have been a um uh I honestly say Al All and us having known as each other for a while. Uh I think this is going to turn out to be one of my prouder moments of my career being able to be part of the team that delivered this. >> You know what? We're going to come back to this day sometime in the future hopefully. >> Yes, >> Brian. And you'll say, "Hey, I told you I did. I would." And I did. >> Right. >> So, I I hope that happens. You know what? We're we're running a little low on time, but for people who want to get more information about CIQ, maybe even information about Rocky, I realize, you know, it's different, but where where can we send people to get smarter, Brian?

Oh, please send them to ciq.com. Um, and uh and uh you know, everybody go take a look at our resources and blogs in particular around some key vulnerabilities and how they're mitigated. uh if you're interested in rocking Linux from CIQ hardened and ensuring that you are protected against unknown vulnerabilities in zero days um or you just need to become compliant um uh reach out hit the contact us uh and and let's have a conversation. I I do Allan before I get the hook I want to call out as an example here there's a number of vulnerabilities one that recently in 2025 I think it hit around uh April May of last year was publicly disclosed is something called BPF door and many of us in the sector probably heard about the SK Telecom brief breach um there was a vulnerability that lived in SK Telecom's systems for 5 years undetected.

Where that thing lived and stayed resident was in the kernel and it was able to sort of activate when needed for BPF door, inspect that P packet traffic um and take actions. Um we did some investigations, we did some tests. I have them running on my system now. And this is a case where if uh five years ago SK Telecom had installed the Linux kernel runtime guard that our own solar designer builds into Rocky Lance from CIQ hardened, chances are they never would have been affected by uh BPF Door. And and just to drive home the importance of that, not only was a bunch of personally identifiable information compromised, um estimates for what that cost was for Estee Telecom are somewhere between $610 million and close to $900 million um just for that single breach alone.

>> So So there's value here. >> Agreed. Agreed. Brian, hey man, it's great to have you back on here. come back and visit us again soon. Keep us posted. Okay. >> Okay. Thank you, Alan. It's great to see you again. >> Great to see you. Brian Dawson, director of product management Linux at CIQ talking about you. If you're looking for real hardened systems, especially hard and rocky Linux system, ciq.com. Brian, we'll see you soon. That's it for Techstrong TV.