In this episode, Troutman Pepper Partner Sadia Mirza chats with Marsh McLennan Agency's National Cyber Claims Leader Matt Ross. They discuss Matt's journey from Chicago to Austin, and his transition from practicing law to handling massive breach claims.
Unauthorized Access, Troutman Pepper's privacy and cybersecurity-focused podcast, spotlights the human aspect of the cybersecurity industry, introducing you to the remarkable personalities that make the industry amazing. In the first episode of Season 3, Sadia chats with Marsh McLennan Agency's National Cyber Claims Leader Matt Ross. They discuss Matt's journey from Chicago to Austin, and his transition from practicing law to handling massive breach claims. Along the way, they muse about the data privacy industry, the importance of working in a service industry, the Austin pizza scene, and one of Houston's newest Mediterranean restaurants… that hits close to home!
Unauthorized Access: Ross Is Boss
Host: Sadia Mirza
Guest: Matt Ross
Sadia Mirza:
Welcome to Unauthorized Access. It's a podcast that focuses on the who's who in the cybersecurity world, but also just an excuse for me to catch up with my old friends and make it seem like I'm doing some work. If Kamran was here, he'd make a bad joke about how he's surprised that we haven't been canceled yet, and I'm sure he's still thinking the same. My name is Sadia Mirza, and I am part of the Incidents and Investigations Practice at Troutman Pepper. Today, I have the wonderful Matt Ross with me. Matt, thank you so much for joining.
Matt Ross:
Thanks for having me, Sadia. This is really great, and I'm really grateful that you asked me to be on.
Sadia Mirza:
Matt, you've been the best listener and the best supporter of Unauthorized Access since the beginning. I remember we used to do that thing where we'd give out a hoodie, or there'd be a question at the end. I think you won that more than anyone else. We probably owe you still a couple of hoodies.
Matt Ross:
I was going to say that I know that I am the first person to win the first sweatshirt from the very first podcast. I can't remember what the question was exactly. But yes, those sweatshirts, I wear them proudly. I have two daughters who also wear them proudly to school because that is the fashion of the day is oversized clothes, sweatshirts, all that good stuff.
Sadia Mirza:
I'm going to blame Kamran. He probably owes some people some gifts coming out of those where they answer the questions we didn't send it out. My latest hoodie, the Cyber Girl Gang hoodie, I got some from my girls too, so they wear them. One of them came to me because I had asked, I'm like, "Does anyone ever ask you what it means?" And she's like, "I tell them my mom's in a gang."
And I'm like, "Oh, good." No further explanation. Just, "Oh, my mom's in a gang," and so that's what people know. Gang affiliation related to Troutman. I'm sure they love that. Anyways, Matt, I'm excited to have you on. This is really all about the world, and I say the world or my base of listeners getting to know you both professionally and personally. I'm just going to jump right into it and say can you tell us a little bit about yourself?
Matt Ross:
Yeah, sure. Again, thank you for having me. So I am a Midwesterner transplant living in Austin, Texas. I moved here about nine years ago. I grew up in Northwest Indiana, about an hour from Chicago. I would say the Austin move was a little bit part of a midlife crisis. We lived in the city pretty close to Wrigley Field, actually, and just having two children and living in a townhome didn't quite fit our lifestyle, and we were busting at the seams. So, at the time, I was with an insurance carrier and requested the move. They didn't pay for it by any stretch. I just love the idea of Austin, of living in somewhat of a college town, putting away my shovel, my gloves, my winter coat for pretty much all but about five or six days of the year.
So that's what took me to Austin. I have two teenage daughters, 16 and 12. Shout out to Layla and Halleah. They would be devastated if I didn't reference their names. Having daughters is wonderful. It's a little bit of a challenge and different for me. I grew up with only a brother, a younger brother, Steve, who still lives in Chicago, but having girls, and especially now, one teenager and one that's bordering on a teenager. She may be 12 going on 22. They keep me on my toes and keep me laughing. As far as hobbies, I am a huge still Chicago Bulls fan, for better or for worse, basketball all day. I love it. And then music is actually my huge passion. I love going to concerts. I'm always listening to music.
I'm taking my daughters to see this band Queens of the Stone Age tonight down here in Austin. And then tomorrow, it's very rare for me to have back-to-back tickets, but I'm seeing the lead singer of this other great band called the Hiatus Kaiyote, which is a jazz funk band out of Australia. Very much her voice sounds like Erykah Badu. So soul music. On my Facebook page, I probably post almost a song a day. I love finding new music and stuff that's just all over the place, except for being in Texas, probably gas station sort of country music is probably the only thing that I don't gravitate towards.
Sadia Mirza:
Matt, I always feel like I knew you, but now I feel like I know so much more of you, and you remind me of, I don't know if you've ever met Ron Raether. He leads our... I've probably talked about him a million times because I love Ron. But he has three girls.
They're a little bit older, but he goes to concerts with them all the time. The sweetest thing having that relationship when they're older. My kids are little. I have three girls. They're eight, six, and two. I imagine being able to do things like that. It's almost like you have a friend now. They're your kids, but they're your friends.
Matt Ross:
It's great. We run a democracy in the car that we each get to play a song a piece. But I drive my oldest to school often, and I use that time as almost music education where I'm always trying to challenge her with just different sounds, old, new, and we really bond that way. It's a wonderful thing. Music is the best.
Sadia Mirza:
We never get to the questions that I want to ask because I always get so distracted. I want to know, does your oldest daughter, your 16-year-old, does she have an interest in driving or does she like having her dad drive her?
Matt Ross:
That's probably blame it on me. So she turned 16 last month and she still doesn't have her permit. She could get her license, but I'm not comfortable with her yet. She needs some more hours in front of the wheel aside from the park and a high school parking lot, which I've taken her to just to practice parking or parallel parking a little bit. We're not there yet, but I know that we're all chomping at the bit because then we can send her to the grocery store.
Sadia Mirza:
Yeah, yeah, yeah.
Matt Ross:
Yeah, we'll get there. And that is one other thing from the move from Chicago to Austin is that Austin driving, I find much more challenging than Chicago overall. Not to disparage or stereotype a particular driver, but the roads are crazy here. I have a little bit of hesitancy, and I'm kind of slow playing getting her into the DMV to get her permit and license.
Sadia Mirza:
When I went to Austin, it almost seemed worse than California traffic to me when I went there, but again, maybe it's just that the city is smaller. And so I looked out the window, I'm like, "Wow, that looks very bad." I was asking because I feel like now, with this generation, some of them are just like, "Oh, well, we can just Uber. Why do we need to learn how to drive?" There's different conveniences for them. By the time I was 15, I was desperately trying to get my permit so I could do everything. I feel like the urgency or the desire doesn't always exist anymore.
Matt Ross:
Yeah, I think that's right, and fighting people to drive you around. And then she's also pretty good at taking the bus if she's downtown or with her friends to at least get a little closer, and that's not something growing up in a smaller town that I really experienced before I moved to Chicago. So I think we're in good hands with this next generation in terms of being resilient and…
Sadia Mirza:
Yeah, I agree.
Matt Ross:
... just pulling to do things on their own, and COVID maybe has something to do with that too.
Sadia Mirza:
I agree. I think the kids are going to be all right.
Matt Ross:
They are.
Sadia Mirza:
Matt, so you said when you moved from Chicago to Austin, you were already with an insurance carrier. I believe you said that. So I was wondering how did you get started in cyber or in the IR space?
Matt Ross:
I took a non-traditional path, which is similar to many of us except for maybe the great Shawn Tuma. Shout out to a previous guest, good friend, great gentleman. I am a lawyer who just wasn't built for law firm life. I practiced law for a couple of years in Chicago before joining an insurance company where I was initially handling lawyers' professional liability claims, which I kind of loved because it was examining the claim within the claim, and no two claims were alike.
I really liked dealing with clients who had engaged counsel but maybe not yet filed a lawsuit so I could investigate the underlying claim, recommend a reserve, and then even negotiate a settlement, and that saved parties a lot of time and energy. I liked breaking the perception that insurance companies don't pay what they owe. I'll throw in too that I'm the son of an insurance agent, so I worked at State Farm in their claims department actually before I joined my big carrier working in a high-volume environment, got taught customer service, treating everyone with respect.
Then when I moved to a larger carrier, I was handling miscellaneous professional liability, got my first experience in tech community banks. I handled my first wire transfer fraud about a decade ago. But it was in 2013 when I was still in Chicago, I was asked if I was interested in handling the cyber component of a standalone policy that had tech media, and from the beginning, I just loved it. I was primary on some large, noteworthy incidents, excess on others, and just learned so much. I cut my first $10 million check in 2014 as part of a tower from a very large breach, and I just couldn't believe how big the numbers could be.
Sadia Mirza:
Yeah.
Matt Ross:
So that's how I got my start. And then I moved into people management in 2016 because volume was really starting to explode a little bit just beyond a lost laptop, or papers being mishandled, or something being left on a printer with PHI maybe on it. And so I helped grow a team of handlers while ransomware and BECs were exploding.
And then, in 2021, the MMA position became available. I actually just celebrated my two-year anniversary, which is just crazy to believe, just a couple of days ago. My current role is I'm the national cyber claims leader, helping our various MMA regions. Phew. I'll take a breath there. That's probably more than what you have asked, Sadia.
Sadia Mirza:
No, no. That's great. Congratulations on the anniversary. I actually am interested more about Marsh MMA because I've heard people talk about big Marsh and little Marsh, and so I'm curious how that differentiates from the other parts of the businesses.
Matt Ross:
Yeah, sure. So MMA is made up of different regions and have had this explosion of growth from 2014 in the acquisition of a hundred-plus agencies. One of the great things about joining the MMA family is that we really tell our agencies that they are still autonomous, but they get the benefits of joining an organization like MMA.
In my role, which was, again, kind of a unicorn role when it was created, I support our various MMA regions. In the past two years, it's really... big focus has been just teaching or educating our different regions' clients about having the incident response process become a little less mystifying.
Sadia Mirza:
Uh-huh.
Matt Ross:
A lot of my job is on the front end, where a producer or even a claims team might reach out to me describing a scenario and being asked, "Should we or should we not report this to the carrier?" More times than not, probably 99% of the time, the answer is yes. You should report this to the carrier and start that incident response process, or at least report it to your carrier, have a discussion with them, and then pivot and get a referral to a law firm and talk through the incident, whether it passes the Spidey sense that what is going on here, is there any suspicion that the network has been compromised.
And when that happens, your own internal IT, although they are doing their best or service provider that might be involved and could be even responsible for not patching or doing something that they should have done, that there could be a subrogation claim down the line, you need to get a third party involved. That is a lot of my time. And then, with the scourge of ransomware, it's bringing the carrier, the client, all those vendors involved to make the best decision for the client at the end of the day because it is a business decision whether they want to pay a ransomware or not.
Sadia Mirza:
Mm-hmm.
Matt Ross:
That was always a business decision. Oftentimes, clients need to understand that making a payment doesn't just turn on the switch to be able to go right back to conducting business immediately. It doesn't mean that you're not going to have to notify employees, clients. Competitors are going to find out one way or another. And the way that you handle any incident can actually boost your reputation rather than hurt. It's very varied what I do, but I love it. I wouldn't have it any other way.
Sadia Mirza:
No, I think you just described my dream job, so maybe we need to talk about this. I love taking your experiences and then teaching others about the process because I think no one really knows that you've been in it and been in it in a lot of different ways, a lot of different scenarios.
That's what puts you in the right position to be able to provide that guidance. So Matt, based on what you said, I know that you're providing education proactively, maybe even right at the beginning of an incident where someone needs to decide what to do next. Then, it sounds like you're also involved as incident response claims come in throughout the response efforts. Is that right?
Matt Ross:
Yes. It can vary. I can come in at different points. I'm not handling each and every incident for an MMA client, although there are days where it feels like I am. But yes, definitely. I would say that clients engaging vendors without consent or notice under a policy, carriers are really looking at that with a magnifying glass.
Sadia Mirza:
Getting the pre-approvals.
Matt Ross:
Those pre-approvals and maybe sometimes there can be a nominal approval of having it at least applied to your SIR for a couple of days. Your self-insured retention. I hate when people use acronyms without saying what exactly they are. Yes. Then, working within the constructs of a policy because, again, I come from just a background overall and in my experience where insurance companies pay what they owe, and the wonderful thing about cyber and first-party coverage is that as long as you are reporting it and working and cooperating with the carrier, the policy does pay.
Sadia Mirza:
That was very helpful. One thing I'll say is that I've realized anytime you ask somebody about how they landed in cyber, they always say that it was a non-traditional path. I have yet to come across the person that says, "Yes, this was my traditional path." I don't think it exists anymore because everyone fell into it one way or another because the way that I think the industry emerged as well. If you were not in cyber, what would've been your alternate career? And this wasn't on the pre-approved list of questions?
Matt Ross:
Goodness. I was an English major in college.
Sadia Mirza:
Oh, me too.
Matt Ross:
I love creative writing. I also find it very hard to be serious, so I gear towards comedy. So being a writer involved in comedy or secondarily back to music, I would've loved to have done something in music, whether that is a manager or maybe not a DJ, but curator. Or the alternate was my brother is a chef. He just sold his restaurant in downtown Chicago, and the timing, unfortunately, just perfectly awful in that he opened his restaurant right as I moved, and I probably would've saw myself working with him more, maybe front of the house.
Who knows? That could have maybe turned into a full-time gig because I don't want to spoil any future questions, but I am a huge foodie mainly because of my brother and his love of food. I love taking pictures of food. Once I had, John Mullen told me, "You need to stop taking pictures of food," and I said, "Well, I love it. It's so pretty."
Sadia Mirza:
You don't need to stop doing that. Those are the only pictures I truly want to receive from my friends. I just want to know what you're eating. Don't text me anything else. My main question is always, "What did you eat there?" What kind of restaurant did your brother have?
Matt Ross:
It was a brunch spot in Lakeview, about a mile south of Wrigley Field. It was a high-end breakfast and brunch place, so we had foie gras, French toast, a king crab benedict. My grandmother, she loved to cook, and so he had a couple nods to her with some Hungarian dishes. It was a good place. He did close about a year ago.
He made his way through COVID. He was open for five and a half, six years, but he took a different direction. We missed the restaurant, but it was exciting and just admirable. That is a hard gig to own and operate a restaurant, and he was still in the kitchen often because it was only about a thirty-top restaurant.
Sadia Mirza:
My family opened a restaurant when I was 16, and my mom, her nickname is Tata, and it was called Tata's Kitchen, and it was a Pakistani restaurant. And I remember I was working at Washington Mutual at the time as a teller. Every time I'd get off work, I'd go to the restaurant, and then I'd help out there. It takes the entire family to run that. Anyway, it ended up closing down, I think, like a year and a half later just because I think it was a lot for my mom. It was fun while we had it. It was great, but my dad recently opened up a franchise called the Crazy Pita in Houston a couple of weeks ago, and I'm having all of these flashbacks and memories.
The restaurant business is very tough, but every day I call, I'm like, "Okay, how's it going," and want to know the number of customers that go in there, and it made me realize how important it is to help local businesses, right, when they're starting off. You don't appreciate it until it's like your own local business and you're thinking about the foot traffic that came in. No, we say, "Alhamdulillah, it's been doing good." So that's now back in my life where we always talk about the restaurant and what's been happening day-to-day.
Matt Ross:
I worked at a Spanish restaurant in between college and law school. I'm a firm believer that everyone should work in the hospitality industry-
Sadia Mirza:
Yes.
Matt Ross:
... at least for a summer. My daughter now works at a smoothie shop on the weekends. And just dealing with customers, learning patience, smiling through distress at times, it teaches so many great skills. The first... This is kind of a funny story, and I'm having a flashback. But my first night of working at the Spanish restaurant, it was flamenco night, and they had flamenco dancers there, and I'm bringing out a pitcher of sangria, and I spilled the entire pitcher in my dad's lap.
Sadia Mirza:
Oh, no.
Matt Ross:
Couldn't have been a better person to do it because he was really awesome and understanding about it. That was the one time I spilled. First night. Fortunately, I didn't get fired, but it was a great experience.
Sadia Mirza:
That's a very good job to have early on in life because it develops a skill set that I feel like you won't get in many other places. Well, we've talked about food a lot, but I think it's an important question because you are a foodie. If someone were to go to Austin, what's the restaurant we should go to?
Matt Ross:
This might force the relinquishment of my Chicago card officially, but my favorite pizza place in Austin is a restaurant called Via 313, which used to be a food truck originally. And there's a huge, wonderful food truck culture in Austin, but it is Detroit-style. 313 is the Detroit area code. It is crust-like garlic bread. It almost is a deep dish.
One of those types of pizza that you can only... if you finish two pieces, God bless you because that's a tough thing to do. But Via 313 is my favorite here in Austin. I love tavern style. I look like a crispy crust too, but that is one thing that Austin needs. So if this cyber thing doesn't work out, maybe that's what I'll do. I'll open a tavern-style, crispy-style crust pizza place.
Sadia Mirza:
Matt, I'm already looking at the menu online, and it looks delicious. All of it looks delicious. But is this your favorite pizza place, or is this actually your favorite restaurant in Austin?
Matt Ross:
There's also a lot of farm-to-table restaurants here in Austin, and so Odd Duck is probably my favorite restaurant in Austin for that reason.
Sadia Mirza:
Okay. Well, I am going to look that up as well. Every time we record these, and I know people at Troutman are helping us record, and they listen in. I always imagine that they're thinking, "Why on earth they let me have this podcast," because we talk about nothing related to work. But you know what?
These are the things I enjoy, though. And then you said that you were an English major and enjoy comedy. First of all, I think that I'm hilarious. I was also an English major, and I think that if I wasn't doing this, I feel like it would be in marketing. Is comedy marketing an industry because that's what I'd want to do. I just throw that out there.
Matt Ross:
I love that. Absolutely.
Sadia Mirza:
Okay, so Matt, these podcasts, I say they always go really fast, but the whole point of these podcasts really are to highlight people in the industry, specifically the people that I love, and maybe at some point, I should also invite people I don't know so I can get to know other people. I wanted to ask you, if you could highlight anyone in our industry as just being a star or someone who shines, and it could be professionally, it could be personally just because they're very kind, who is that person in your mind?
Matt Ross:
This is a tough question, and I just want to say that I love this industry. I love all of the vendors and the people that come with it. I've been just so lucky to be able to get into cyber and be in it for the past 10 years.
Sadia Mirza:
Yeah.
Matt Ross:
And that rule of be kind to everyone because you never know. There can be a lot of movement and a lot of people joining different firms that you might have gone up against in one way, shape, or form, who then you're on the same side or someone that you need a favor from.
So the golden rule always applies. But to answer your question, I got to go with claims because, again, I'm claims through and through. I think that claims folks have the toughest job because you have to balance so many things from a customer service standpoint, from engaging vendors, from making payments, reserving, all the different coverage parts that can get triggered by one cyber incident that people don't realize.
You can have triggers just, bam, at the snap of a finger. To cut to the chase, who's my favorite person? The person who came to my mind instantly was Bolanle Akinrimisi, a claim manager, and you can call her, email her at any point. She'll redirect me as appropriate. She'll laugh at my joke. She has the most wonderful laugh. That's another thing that I love about Bolanle, just a dear, dear person. I just appreciate her so much.
Sadia Mirza:
Matt, I know that many people would agree with that. I think you've met Karla on our team now. She was at Beazley before, but she always talked about Bolanle and says wonderful things. So, I think it's a sentiment echoed by many people, and maybe now Bolanle is on my list of people who I want on the podcast, so we'll have to give her a shout-out and maybe invite her on next.
Matt Ross:
I think that would be great.
Sadia Mirza:
Well, Matt, thank you so much for your time. It was wonderful having you on. I'm going to echo what you said in terms of about this industry. It is the reason I feel like I'm able to survive in Biglaw is just because of the industry that I'm in. I don't know if I would love Biglaw if I wasn't doing what I'm specifically doing. But it's the vendors, the people, all of our friends that make this job much more enjoyable. You obviously being one of those people, so thank you again.
Matt Ross:
And back at you. Thank you, Sadia. Thanks for all you do. I really appreciate you having me on.
Sadia Mirza:
And to all of our listeners, thank you so much for tuning into Unauthorized Access. If there's anyone you think we should be highlighting on the next episode, please feel free to send me an email at sadia.mirza@troutman.com or always use our hotline incident.response@troutman.com. Thanks everyone for tuning in.
Copyright, Troutman Pepper Hamilton Sanders LLP. These recorded materials are designed for educational purposes only. This podcast is not legal advice and does not create an attorney-client relationship. The views and opinions expressed in this podcast are solely those of the individual participants. Troutman Pepper does not make any representations or warranties, express or implied, regarding the contents of this podcast. Information on previous case results does not guarantee a similar future result. Users of this podcast may save and use the podcast only for personal or other non-commercial, educational purposes. No other use, including, without limitation, reproduction, retransmission or editing of this podcast may be made without the prior written permission of Troutman Pepper. If you have any questions, please contact us at troutman.com.