Josh Ray is the founder and CEO of Blackwire Labs, bringing over 24 years of experience in combating advanced cyber threats across commercial, private, public, and military sectors. As a U.S. Navy veteran and cybersecurity executive, Ray has consistently built and led high-performing teams to protect critical networks and organizations. His career includes key roles at Accenture Security, Verisign, Raytheon, and the Office of Naval Intelligence, where he drove innovation and built capabilities to defend some of the world’s largest organizations against a myriad of advanced cyber adversaries.
Josh’s blend of technical expertise and business acumen has been instrumental in driving growth and innovation in the cybersecurity industry. As CEO of Blackwire Labs, Ray leads the company’s mission to build trusted and expert AI cybersecurity solutions, leveraging his extensive experience to navigate the complex intersection of technology, security, and business.
Can you share what inspired you to start Blackwire Labs? What specific challenges in cybersecurity were you hoping to address with this venture?
The three of us – myself, Chris Clark CTO, and Andrew Maloney CCO – came together because we saw organizations struggling with the same challenge: they need AI to execute against business objectives and defend against sophisticated threats. However, the catch is they can’t trust or implement existing solutions effectively. Collectively we have built security products and capabilities for some of the world’s largest enterprises, we saw firsthand how smaller organizations face the same advanced threats but lack access to the expertise they need. We kept thinking about all the organizations that couldn’t afford large security teams but still needed protection. We truly want to help organizations of all sizes but we really want to build something meaningful that makes trusted expert-level cybersecurity capabilities accessible, not just the elite few.
Your career spans the military, public, and private sectors in cybersecurity. How did each of these experiences influence your vision for Blackwire?
We have a responsibility to serve and protect those organizations that form the backbone of our society. Each sector really has taught me something vital about what we really need to build trust and enhance cyber resilience. At the Office of Naval Intelligence and supporting JTF-GNO, I learned firsthand the criticality of having the right set of expertise at the right time, especially when you’re defending networks that protect our warfighters and national security.
At Raytheon and later at iDefense, I saw how the private sector was grappling with increasingly sophisticated threats, many of the same types that I saw during my time in the DoD. What became clear was that having siloed deep expertise wasn’t enough – you needed to be able to scale that knowledge effectively across an organization. This really hit home when I was leading Accenture’s Global Cyber Defense Practice, where we were protecting some of the world’s most targeted networks and the explosion of third party risk and supply chain attacks.
But here’s what bothers me: While the largest organizations could afford to build robust security operations, countless others were left vulnerable and the funny thing is they sit in the supply chain of those large organizations. I saw small businesses, healthcare providers, and state agencies struggling with the same advanced threats but without access to the expertise they needed. That’s really what drove us to start Blackwire Labs. We wanted to take everything we’d learned about building capabilities and defending organizations at the highest levels and make it accessible to organizations that need it most. By combining trusted AI with human expertise, we can help bridge that gap. It’s not just about building another security tool – it’s about delivering at scale the kind of expert-level cybersecurity capabilities that I’ve seen make the difference between a resilient security posture and a devastating breach.
Blackwire Labs combines expert-vetted AI insights with blockchain integrity through TrustWire. Could you walk us through how this fusion enhances the reliability of your cybersecurity insights?
We took a pragmatic and innovative approach. We’ve built a chain of trust that starts with our Cybersecurity Community of Excellence (CCOE) – seasoned professionals who collaborate with us to validate and enhance our knowledge base. We use a rigorous three-tier source evaluation framework grounded in intelligence analytical tradecraft. But based on Chris’s experience in the crypto space we’re able to take it to the next level. That’s where TrustWire comes in – our blockchain-based system that creates an immutable, cryptographically verifiable record of all our sources and AI outputs. Using zero-knowledge proofs, we can prove the integrity of our insights while protecting sensitive data. Think of it as combining the best of human expertise with cryptographic certainty. Another critical component of this approach is our Security Registry, which captures point-in-time snapshots of all cybersecurity analyses, including insights, sources, the user wants to save. Think of it like a system of record that provides a permanent, shareable record of your security decision-making process – something essential for explaining to your boss why you did something when it comes to audits, compliance reviews, and the incident response process.
Lexi, Blackwire’s AI, offers predictive prompting and customized guidance. How does this feature set help security teams anticipate threats more effectively?
Like most things in life, knowing “what” the right question is and “how” to ask it is key. Our predictive prompting isn’t just about suggesting next steps – it’s about enhancing human expertise. The system understands your role, your organization’s context, and your security objectives to guide you toward more effective analysis across a strategic, operational or tactical “choose your own adventure”, as Andrew calls it, set of prompts. It allows you to get more detailed insights faster by being able to account for multiple points of view that will differ depending on the organizational role (Think CISO/CTO- Strategic, incident responder/risk manager Operational, security engineer/SOC analyst- Tactical). It’s like having a seasoned security expert that can wear multiple hats, looking over your shoulder, anticipating what you need to consider next. But without the black box decisions or sources that can change or lead to dead links.
Blackwire is described as being “secure by design.” Can you elaborate on the specific measures that make your platform enterprise-grade?
Everything from our architecture to our AI approach is designed with enterprise-grade security and trust in mind. Our CTO Chris has been doing this his entire career and is adamant about this. Let me break this down practically. At its core, our architecture ensures complete data isolation between organizations, with strict tenant separation and configurable retention policies. We’re adamant about data privacy – we never train on customer data or queries, and everything operates on a private-by-default basis. Think of it like running your own secure enclave within our platform.
For access control, we’ve implemented enterprise-grade authentication with granular RBAC and MFA support. Each API key can be scoped precisely to specific permissions, giving organizations complete control over how their teams interact with the platform. We’ve paired this with comprehensive audit logging and security monitoring, creating immutable records for compliance and security reviews.
What makes our approach unique is how we’ve constrained our AI models specifically to cybersecurity domains while maintaining complete transparency. When you ask Blackwire Labs about baking a cake it will say, “I can’t build a cake but building a SOC requires a layered approach, would you like to talk about that?” This is because we’ve implemented very purposeful constraints. Every response must reference validated sources through our three-tier framework, and our Security Registry creates permanent, verifiable records of all analyses and decisions. This isn’t just about “checking a box” security features – it’s about building a platform that security practitioners can trust.
Blackwire Labs places a strong emphasis on being user-configurable. What specific customizations can clients leverage to fit their unique security needs?
In addition to what I spoke about earlier with predictive prompting and contextcraft, we’re developing capabilities for organizations to securely leverage their proprietary data alongside our trusted cybersecurity insights. Where users can incorporate their specific business context – whether that’s internal policies, architecture documentation, or industry-specific requirements while maintaining data privacy and trust. This ensures their sensitive data never leaves their environment while still providing comprehensive, tailored answers. Think about a healthcare provider needing to align security practices with HIPAA requirements, or a defense contractor working within CMMC frameworks. They can integrate their compliance documentation and internal policies while leveraging our broader cybersecurity expertise. The key is that all of this remains cryptographically verifiable through TrustWire, maintaining our commitment to transparency and trust.
How does Blackwire Labs’ “Service First” philosophy, rooted in your military background, shape your approach to customer relationships and cybersecurity solutions?
Our “Service First” philosophy runs deeper than just customer relationships – it’s rooted in our faith-based ethos of servant leadership. This means every decision we make starts with how we can best serve our community and protect organizations that need our help.
We’ve all grown up in this mission space, we understand the challenges security teams face because we’ve lived them. We’ve walked in our users’ shoes. We’re building solutions we would have wanted ourselves. The security community is small – everyone’s about one degree separated from each other and reputation matters a lot. That’s why we took a practitioner-to-practitioner approach, bringing in design partners, advisors and beta users (which eventually turned into the CCOE) early to test our assumptions. We wanted lots of folks in the boat with us early and often. “This product is built for you, help us make it really useful.”
We also know how security professionals are skeptical of vendors and in many cases rightfully so. That’s why we focus on solving real problems rather than marketing hype. When our users tell us something needs to change, we listen and act. This tight feedback loop with our community, combined with our commitment to service, helps us stay grounded and focused on what truly matters.
Cybersecurity is a fast-evolving field. What strategies does Blackwire Labs use to stay at the forefront of industry trends and threats?
Our approach draws from proven methodologies, particularly ones our CTO Chris Clark implemented at Palo Alto Networks in establishing their global threat R&D capability. Rather than trying to collect massive amounts of potentially unreliable data, we’ve developed a scalable, efficient system for knowledge management and threat intelligence.
We’ve implemented a sophisticated triage system where queries that don’t meet our criteria for being fully answered or sourced go through both automated and manual review processes. This creates a powerful network effect where gaps are addressed and knowledge becomes available to all users. If our system can’t provide a satisfactory answer, it automatically triggers an internal review.
What makes this approach unique is our focus on quality over quantity. Our CCOE members, who represent various industries and roles from CISOs to vulnerability researchers, help validate our knowledge base and fill expertise gaps. By covering general areas comprehensively, we can focus on edge cases and emerging challenges that truly require specialized knowledge.
The key is transparency – as I mentioned before our system is designed to admit when it doesn’t have an answer, which then prompts our team to fill that knowledge gap. Often, it’s simply a matter of rephrasing the question (or using the Lexi smart prompting to automatically create a more nuanced prompt that the user might not have the ability to create), which we can quickly address. This approach allows us to scale while maintaining high standards for accuracy and reliability.
With the rise of Web3, quantum, and space technologies, how is Blackwire positioning itself to address cybersecurity in these emerging domains?
We talk to and get advice from a lot of folks smarter than us. We are blessed to have advisors who are luminaries in the technology and security space like Matt Devost and Bob Gourley from OODA. They have shared insights and analysis with us on these topics and many others. We’re also fortunate to collaborate closely with folks like Rick Howard and his Cyber Cannon project – these are folks that many in the community look to in order to understand what’s next. These are folks who are members of our CCOE but also mentors to me. The fact that we’ve all been doing this for a long time and still have a very strong professional network, many who I consider close friends, are security executives that help us address both the here and now problems and what’s next. What makes this approach powerful is how it informs our platform’s evolution. While Web3, quantum, and space technologies are exciting frontiers, we’re focused on building a foundation of trust that can adapt to these emerging domains. Our TrustWire technology, for instance, already leverages blockchain and zero-knowledge proofs – core Web3 technologies – to ensure data integrity and privacy.
But more importantly, we’ve built our platform to be adaptable. We continuously integrate new insights and expertise as these technologies evolve. It’s not about chasing every new trend – it’s about having the right expertise and trusted framework to evaluate and respond to emerging threats across any domain and then help our clients operationalize the right solution.
What are your long-term goals for Blackwire Labs, and how do you envision its role in the future of AI-driven cybersecurity?
Our long-term vision goes beyond just building a successful company – we want to fundamentally change how organizations approach cybersecurity in the AI era. We want to do good and champion truth. We’re working to democratize access to expert-level cybersecurity capabilities while ensuring that AI adoption doesn’t compromise security or trust. We believe the future of cybersecurity lies in combining human expertise with trustworthy AI, and we’re positioning Blackwire Labs to lead that transformation. But we’ll do it thoughtfully, staying true to our principles of transparency, humility, trust, and service to our customers.
Thank you for the great interview, readers who wish to learn more should visit Blackwire Labs.
Credit: Source link
