Cybersecurity and Food Systems

Thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz.

And I'm Cody Rivers.

And today we're here with Kristen DeMourenville. She is the CEO and founder of Ensign Sage and also a podcast host of Bytes and Bytes, which I'm excited of, but on both of those, excited to learn a little bit about that. And actually deep in writing a book, we were chatting about 6 months left on a book called Securing What Feeds Us, and excited to talk about that. And speaking of talking, Kristen is active on LinkedIn. It's a great platform. She's very out there and mentioned, warned ahead, if you talk to her, she will respond and interact. So fair warning and opportunity, I guess, one and the same, but Kristin, welcome to the show, and we're excited to get to know you a little bit. And let's start with a little bit of your story kind of coming into cyber.

Thanks. I love being here. You guys are a great team. Obviously, I'm friends with Bronwyn, so this works out really well for me. I get to see her briefly too. Awesome. I am. Yeah, she is pretty cool, right? Maybe we should just have a whole episode about her.

Just talk about Bronwyn. Just skip the whole podcast and talk about Bronwyn.

I feel like I could do that for at least 15 minutes straight without, you know, breathing. So it works out. I know she's laughing on the other side of this. Anyways, yes, I am Kristen DeMarieville. I am the host of Bytes and Bytes. I am writing a book. Oh my God. And I do, I am CEO and founder of Anson Sage. I also am CEO and co-founder of a SaaS tool called Anson OT, which is sort of still in stealth mode. So I'm not, I'm going to get into it. My partner does a way better job of describing that anyways, because it's his baby and I'm just here.

I have a quick question, really important question. Bytes and Bytes, which one's first? Is it by order of priority? I wonder, this is, this is important to me.

So bites like you bite something and computer bytes. So thank you for clarifying that because people get very confused. And obviously, I do love my play on words. Actually, Anson Sage is a play on words as well. Anson is the word for secure, safe in Japanese. And sage is obviously the herb or the herb if you're over the pond and a wise person. So it's kind of like, you know, like that.

That is ironic. We do a lot of cybersecurity program workforce development programs, and we actually named one of our characters for a large oil and gas company, Sage, for a couple of the same reasons that you mentioned.

So that's a cool connection. Yeah, that's great. I have some growing in my garden that I haven't killed yet, so we're doing good.

Nice.

I probably should have said something about that on the podcast at some point, but I haven't yet. So the podcast actually came up out of having similar conversations over and over again. And I was like, I should just record these. Like, we should have a larger platform. People don't know how their food gets to the table. People don't understand the people that are making their food or, you know, trucking their food or doing anything with their food, keeping it safe, for example. So I had this brilliant idea to have this podcast. And it won an award last year right along with Prodwin, actually. And it was pretty awesome because I didn't expect it at all. And that was amazing. And then, yeah, we're at 12,000 downloads and I think— my goodness, I'm at like episode 38 or something or something high up there now. So it's actually been going around for a while. So I have guests that are food safety experts, professors, I have farmers, I have OT people, I have IT people. I have, oh gosh, I've had marketers on there, you name it. I've had people on, data scientists has been a big one lately as well. Um, how they're using AI to start, you know, making more sense of the data that's coming out of the farming industry and agriculture in general. Yeah, some really fun stuff, some really depressing episodes like, uh, agro-terrorism. That's a fun one.

Mm-hmm.

That is still killing me slowly thinking about that. And yeah, there's more to come too. I'm about to dive into like the seafood industry because that's a wild, wild west of, we don't know what's going on over there from a security It's nuts. Yeah.

Yeah.

So it's—

So Kristen, I wanna hear about, I was gonna say, I wanna hear about your journey into food, but maybe before we do that, we, you know, at Reveal Risk, we start, we like to start with risk and why it matters to the business. So give us your take on the food and agriculture business. And, you know, obviously there's a linkage to critical infrastructure, but what threats are out there? What are companies that are dealing with this facing? And then obviously we can back up from there and get into how did you get into this specific niche? Because that's awesome.

Sure. That's a great question. So they're facing everything else that every other industry is facing. It's nothing special in that regard, other than when you disrupt food and ag, it has a more cascading effect, not from the financial side, but from a global perspective. So the global supply chain gets damaged in some regard, whether that's a few days or longer, or you have questions with food safety at that point. So that can trigger recalls or foodborne illness. The consequences are more severe in my mind than just paying out a lot of money to fix it or a ransom because you don't know how long and how fast it's going to cause that disruption or ripple or how it's going to affect health. It's such a complicated system. And if you aren't a systems thinker, it becomes really difficult to deal with. And if you are a systems thinker, it's very difficult to deal with as well because now you're realizing, oh goodness, everything is broken and now what do I do? So companies really are facing this crisis, if you will, it's not because of the legacy tech, as I'm so tired of people talking about that. It's not just because everything is connected. It's because nothing was done with security in mind when it was first put in. And that's kind of the rollback we're going through right now. If you look at any of the major breaches that have happened recently, whether that's the automotive or the retail side or any of that, they are doing their due diligence now where they should have done it years ago, you know, ingress, egress and, and asset inventory and things like that. So I'm— that's where the industry is at the moment. Now we have we have different layers to this. Obviously, you have the big corporations that have full security teams and probably a SOC and a NOC and all these other fun things. They probably have all the latest tech, all the intrusion detection, all the things like that. And I go, and we can go all the way down to the farm level. And what is a farmer going to do if their GPS tractor just starts acting a fool or drives itself in a way that it's not supposed to? Or is it, what about the privacy of that data? Who owns that data? What happens when a dairy parlor goes crazy and he gets hit with ransomware? What is the farmer supposed to do? More more than likely they're going to roll back the system and just do a standard factory reset. But that's going to take a tech because nobody knows how to do that on the farm because they don't employ security people necessarily. It's, it's such an interesting space because it's been so— I don't want to use the word neglected, but just not paid, not really paid attention to for a long time. CISA didn't add it to the critical 16, well, now 16, until 2020, which is such a weird moment because we've been eating since the dawn of time.

Yeah.

And as I do research for the book that I'm writing, I've realized just how ingrained food is in so many other levels, societal. We've gone to war over spices. There's so much platform of security awareness or me going in and doing strategy or whatever it takes, cuz I wanna make sure that I don't look at my spinach with suspicion every morning like I do right now. I want to actually start having a better relationship with my food and stop the misinformation, disinformation campaigns as well, because that's just part of the deal too. And that, that's a lot of what's been going on.

I was saying, I like what you said about like going to war over food. And especially now, like, you know, it's not so much I got to go over to your land with a knife or a gun or something. I can sit in my own office and pop in digitally and, you know, you can kind of wreak havoc or chaos in a different location just by hitting the food supply chain.

Yeah, it's, it's crazy. And the stereotypes are so ridiculously strong in certain parts of the industries where people literally think hackers are hoodies wearing hoodies in their mom's basement and probably male. And I keep saying, no, you got to watch out. It's a 17-year-old blonde girl in the coffee shop. Like, it's No joke. And trying to get people to, um, to deal with that is really interesting. It's— I'm trying to break past the stereotypes because remember, farming communities and agriculture in general are really tight-knit, and they are distrusting by nature because if you're not part of their community, they don't know you. So they don't— if they don't know you, they don't want you in. But that also gets turned on them. I've had farmers tell me that if anybody came on to their farm and requested their Wi-Fi password, they'd probably just turn it over. And I was like, don't do that. Like, you need to just don't trust anybody. You wouldn't just let anybody into your house. Same concept. If you can't let— you can't eat at everybody's house kind of thing. You just don't know what's happening. And again, you have to kind of have a healthy suspicion, but you can still be friendly. I mean, it's just how you roll. And that's— it's been a lot of that kind of conversation as of late too, of, have you thought about this? Did you think about this? Well, security's in our minds, but we don't know what to do, is what I get a lot. And that's a, that's a scary place to be.

I'm sure as practitioners you hear this and go, ugh, you know, cuz it's Yeah, well, yeah, to Aaron's point earlier, I think earlier about we do a lot of workforce awareness and there is definitely there's that education portion before the empowerment because to your point, they may not know. And I think the farmers are a good example of like some of the manufacturing areas. There's a corporate entity over the top of it that kind of can help govern and provide that oversight of that, you know, the education piece. But I'm assuming, I don't know, it's not my area, but like on the farm side, they don't have that corporate entity behind them all the time that's providing that oversight or that education. So it is a friendly, here's the password and as you see in OT, it's a lot of machinery with a foundational, you know, tie to the internet. So it's a lot of questions.

So Kristen, I want to get into the convergence of physical and cyber and farmland and all that, but before we do, let's maybe take a step back and get into how you got into the food industry at a high level. What was your journey to kind of form around this, this focus?

Yeah, so I started in food service pretty early on when I was in my first years of college, the more corporate side. So I got like the food safety trainings and understood how to handle food. And I say that because food safety and food defense go right along with cybersecurity. Now we're kind of partners in this journey. We hold hands. We've got to get through it together because tech is constantly being used and touched by food as well as to test and regulate our food. So I'm glad I learned that early on. I also know how to make a great latte, so that helps too. What ended up happening was I went to school to get a degree in environmental management. And, um, I originally got the degree cuz I thought it had nothing to do with technology or security or anything. And joke's totally on me, by the way. I know that now. So, obviously the water sector became very interesting to me and I'm very fascinated by it to this day. And I have great relationships in the water side. I love those people. They're great people. And they're also going through the same struggles that food and ag is going through, you know, um, not enough people working. There's too many issues. Everything's critical, but nothing's critical kind of vibes, alert fatigue, those kind of things. And then I went to work for a bakery company and it was, it was in Atlanta and it was a really interesting place to work because it was just acquired. So there was a lot of change and digital transformation. I got to see SAP completely break a company. So that was fun times. But within that I was doing IT, but I was also doing OT and I didn't even make the connection in my head until somebody said one day, oh yeah, you're doing OT work. And I was like, oh, I guess I'm an OT, you know, kind of thing.

Welcome.

I know, right? It was like, it was sort of a weird induction, like, kid, you've been doing that for a while. Why didn't you realize that kind of vibes? And I shifted into security when I was there, um, kicking and screaming, because I originally didn't really appreciate security. I thought they were kind of annoying and just dumped things onto the teams and didn't actually help and then went off to whatever they did. Um, and when, right before I left, I actually ended up leaving as the unofficial CISO because my boss had left and we had our first breach or my first major corporate breach. Of course, happen at a holiday weekend, the whole thing.

Always.

I got to experience like the crash teams and, you know, the late-night pizza and the whole thing. And actually, I just had drinks with my old corporate lawyer from there a couple months back, and we were reminiscing about that. And he's like, "You were brilliant. I would've never known that was your first breach." And I was like, "Why, thank you." I feel like that was the best compliment ever.

Only gets better from here.

Yes. And then I left to go work for Sony, and Sony didn't really have any factory security knowledge like I did, and which is kind of strange to say to to this day. I hope they do now. They had a big issue with WannaCry, and that caused some issues where we had to deal with it quickly. So, I ended up kind of shifting my risk role, which was risk and policy, into more of a factory security at the time. And when I left there, I had entrepreneur my way to Intel Cybersecurity Director, and I was running the factory security program for Japan, and that was pretty cool. And then I left to go consult because that's what we all seem to do in security for some reason. We just jump in. And then I started working through cosmetic companies and, you know, consumer goods and more food companies and pharmaceutical because that's, you know, just a little bump over from food in a lot of ways. And that's how I cut my teeth. And by the time I left consulting, I was standing actually at a conference, a food safety conference, actually. They invited me to speak. I think I was on a panel. I don't remember. And it was like the light bulb went on. We're, we're doing the same. We're fighting the same fight, like food security and food defenses. But just differently, we're on the tech side and they're fighting it on like the pathogen side, because pathogens are really just hackers if you think about it in a very layman's way of looking at it. So I had this incredible lightbulb moment and I was like, why aren't we doing more with food? And then by the time I left the consulting world, I had started my firm and I was like, we're going to— I'm going to go straight for food and ag. This is amazing. My agricultural ties have come over the time I've been consulting more. I love the ag community. People are great. It's such an amazing place, how people feed us, and they— we don't even know that they're doing the work. And I really want to give as much as I can to that community. So that's like the most high-level version of how I got into food ever.

Well, that's great. And just maybe a couple connections. So myself and a couple of our other leaders have spent a long time in pharmaceutical side, on the corporate side. And then we have one gentleman, Todd Wilkinson, who I think Bronwyn has introduced you to, who was from animal health. And, you know, some of the stories he shared about going into the farms from a pharmaceutical side of animal health, you know, but just the questions I had about like, who helps the farmers? So it's great to hear that individuals like you have a specialized focus on them because I do think your point is valid that it's probably a, you know, a catching up community of, you know, even getting the support that they need to, you know, some of these farms are huge and industrial and everything's connected.

Everything's connected.

You mentioned incident and obviously at one of the companies, but I guess from a, agriculture standpoint, what, what are, what are some of the most common examples of a real-world cyber incident within food and ag, and which ones matter most? What are you most concerned about as you think about your client base?

So I would say that everything that's hitting every other sector is hitting food and ag. There's no, no, the special— I'm sorry to say that.

Ransomware, DDoS.

Mainly it's ransomware and phishing that's been hitting the food industry the most, and which again is very prevalent everywhere else, and, and/or they're tags for each other. Ransomware ends up being particularly nasty in the food and ag industry because it takes a very long time to unravel. I mean, JBS is like a super great example of that. You know, the largest meat company in the world got hit. You know, it was to the point where USDA couldn't even put out the price of meat because they couldn't determine what it would be because they couldn't slaughter for the other markets were so affected. It was a mess. So Canada, Australia, they got punched too with that. Australia had empty shelves. We had a little bit of empty shelves. And then how do you explain to a consumer that it's a cyberattack that's causing this issue? And don't get me wrong, this has been happening more frequently. There was a milk shortage for that. Everybody blamed it on avian flu this year. It wasn't. It was actually a cyberattack that hit distribution. And because the dairy industry specifically is getting punched the hardest because they are the most connected. If you think about it, everything to do with a milk parlor is connected. Cows can literally— they wear trackers on their ears or they have collars on that literally they can go get milked whenever they want. They can just walk straight in, have their day, and then walk out. What a life. Yeah, I mean, actually, yes, it is quite the life. But the dairy industry, it's actually a very dangerous industry because cows don't care about human beings. They'll crush you and run you over. They don't care. So it's like, you have to take what it is. It's, it's cool, but like, oh my gosh, yes, yes. So they've been getting particularly hit with ransomware lately, um, and what I mean by lately is the last few years, um, to the point where it's resulted in cow death and calf death. It's, um, it's really devastating. And this is a global problem. This is not just like indicative of the United States. Um, Canada's been getting hit pretty heavily. Different other places in Europe are getting hit. But like I said, it's because it's so interconnected and it's attacking the PLC on the line. So it's definitely OT and it's definitely happening. And again, the farmers aren't equipped to handle this and they don't even know who to call. That's the worst part. I only know of one other firm in this, in the US that's doing actual like tech work on the ground. And we just met last week. Wow. That's pretty wild, right? Like there's nobody doing this. I can only be so loud and I can only hop up and down so much. And it's really hard because you have to, have a certain level of empathy to work inside of food and ag because it's, it's someone's life. They've mortgaged their house, you know, they've, they, they're taking out loans. It's really an industry of a mental health dance, and suicide is very prevalent in the industry as well. It's a lot of things. And then there's all the succession planning with farms, and that's a global problem. So we really, yeah, we need first-gen farmers, but we need to hang on to what we have. And if you have a really bad cyber attack, that's going that's going to devastate a farm. And obviously, like, a big corporation probably will be okay. They'll get through it. They'll have enough— they'll have cyber insurance. They have things like that. They'll probably help bounce back. But these smaller farms and these medium-sized farms, they're the ones that are gonna— they're gonna bleed. And that's hard to watch. So I— again, as I learn more and I'm into this and everything that's happening, I just— it's like I want to stand on top of the mountain, just start yelling, like, start caring about where your food comes from.

Yeah, cyber. I think you're right. A key term we see a lot on the corporate side, like resilience, because it's, you know, it's going to happen at some point. And so like, it's how resilient are you or how much can you withstand an attack? And to your point, if there's a real low resilience, the if or the when is going to happen at some point. And low resilience, to your point, would cause catastrophic damage and then, you know, sometimes unrecoverable.

Yeah. And I love that you guys are training-focused in a lot of ways because that is the way to empowerment. And I find that that's what I have to do a lot is I sort of— the other day I was telling someone that I'm not really cyber or anything anymore.

I'm a risk person.

I just train, like, that's what I do. I talk to people, but in all reality, that's not my career. But however, I do find that the more people are aware, the more they'll, they'll think about something, they'll hesitate before they do it, or they'll, or they'll talk about it with others and things like that. I, I think I've done more training in the last few years of just even the conference talks that I do are some type of enlightenment of, hey, maybe you should care about the soybean because it's connected to all other industries. This is why, and this is how it relates to cyber and that kind of thing.

So Cody, as you mentioned, resiliency, obviously similar similar to myself and my background in pharmaceuticals, like operational uptime and producing product and manufacturing. For farming, it's producing animals, keeping them healthy, you know, supply chain of food, fans that cool, uh, you know, a barn that might be the difference of life or death on a really hot day. Kind of beyond the operational effectiveness, resiliency, keeping the farm running, and this may be at the bigger kind of food health corporations, but are there any like industrial espionage and data theft concerns? And I, the only one that I know about that, you know, is kind of the hybrid seed, you know, hybrid seed is technology with research. And I went through the FBI Citizens Academy and I think that's where I learned one of the cases where farmers are kind of recruited to plant specific hybrid seeds that are in testing hidden in the middle of fields. Only they know, but there's been a lot of espionage to try to obtain this technology from abroad. So I'm just curious, like, how does that intersect with the world that you are in in ag? And do you see that as a prominent top-of-mind threat, or is that more for the big corporations producing the technology, less so from the farmer standpoint?

I don't— I haven't heard anybody talk about that on the ground, really. I think that that is in the realm of conspiracy theorists. So people stay away from that kind of conversation with me, generally speaking. I do think that they are concerned about their data because they've kind of unintentionally air-gapped themselves. Farmers, it's weird. There's data everywhere. And the question of who owns it and what happens when something happens to it. There's been a lot of data breaches in co-ops. So the New Collective, New Cooperation, there was a seafood co-op that went last year or the year before. They want to get information about their customers, essentially is what it's coming down to. Just like any other data breach, more data, the happier they are. So I think that there's concern about that. Also, because the generation is a little bit older in farming, the median age is, you know, roughly around, I don't know, 58 to 63. Hmm. Obviously we all know scams are huge and that's a big concern for them too. There's been a lot of them that have fallen for the scams because if they get an invoice for like a million dollars for like their feedstock, let's just say for their cattle, they're just going to pay it. They're not going to think about where it came from or what it is. So there's a lot of that type of, oh God, like, what have we done? You know, kind of thing. That, that could devastate a farm as well. And then there's a lot of disinformation, misinformation, and this goes right along what you're saying, Aaron, that's coming out of nation states and it's being fed into radical extreme activists. Now I'm going to make it very clear, I have no issues if you are vegan, if you believe in animal, you know, as sentient life, that's great, I'm happy for you. However, if you radicalize and get violent, that's when I have a problem. And this is what's been happening a lot lately. This is, this is agroterrorism and a little bit of ecoterrorism mixed in. They will dox families. They'll deepfake. They'll, um, fly drones over after something has happened. They'll make them look like they're horrible people and it will tank a small farm or it will cause conflict in these larger farms to the point where animals get slaughtered or they're letting animals go, or they're, you know, essentially just— the worst part is they pose as interns and they'll take pictures. And this is why I tell people you have to cover up your stuff, like like, take some duct tape, I don't care what you do, cover up your things, change your default passwords, don't let everybody on. Because that espionage, that type of espionage is happening, but it's for a radical extreme ideology, and it's happening. And people are talking about it. And, um, I actually just recently wrote an article about it on my Substack and on LinkedIn, talking about how the USDA National Farm Security Plan mentioned, you know, extreme versions of this, but on from a— not on domestic, but from international Whatever you want to say about China, whatever's happening, great, sure, we got to pay attention to it, but we're not dealing with the domestic issues that are happening here. And they're so frequent that for every farmer I know that I've ever spoken to has either had a death threat or knows someone that's had a death threat. What the hell? Like, that is— it's crazy. So that espionage stuff is actually more around these radical extremists than the corporates trying to sabotage or international trying to get in there. And I'm assuming they're probably just ducktailing on the back of that, let's be honest, because everything is interconnected in the world. So there's that happening as well. And that's, that's what's scary. That's really scary, actually.

Yeah. We, we do a lot of stuff like that called insider risk, but a form of risk, right? You got to figure out if it's external or internal, um, you during, uh, you know, um, from an employee or something. But to your point, uh, didn't, didn't think about that. So interesting, interesting, uh, knowledge there and definitely something I wasn't aware of.

Yeah. So let's talk about—

oh, sorry, go ahead.

No, I was gonna say it's— I have to tell people to make sure they check socials and figure out where people's, you know, run the background checks, but also include looking at what people are saying and posting because people post about everything. You know, I stubbed my toe today and this is how I feel about it kind of thing. But if they're talking about like, oh, hey, I really think that, you know, eating meat is wrong and maybe you shouldn't have them work on your farm with animals. If you're like a full produce farm, maybe it'd be okay. But like those kind of conversations need to be had.

Yeah.

So let's talk about like where the pain points from a physical and operational technology standpoint point within the farms and communities that you work with? Is it outdated infrastructure? You mentioned you do a lot of teaching. Is it lack of awareness? They don't know where to start. Like, where do you typically feel like the low-hanging fruit is for these conversations and for these farmers to make some early progress, you know, quickly?

So I have two answers. I have, I have, let's just say, the boots in the dirt answer, and then I have a little bit of a different answer, and I'll start with a different answer first. I think that agtech companies need to stop being so predatory into these farms and also start having security by design in mind. And I know I'm not making friends when I say that, but you people cause a lot of problems that don't need to be there. And I really would like to start seeing security-minded individuals who are creating this incredible, well-used, well-loved, sustainable type products come in with security by design. And I realize they're never going to do that till it's regulated. So that is one problem, right? Because we do have secure tech that's hitting these areas. The second problem is, is literally they just don't have time and they're not aware of it. And I think that what I've been doing is rolling into safety checks. So it's part of your safety process now, it's part of your business continuity, it's part of disaster recovery, whatever you want to call it for the farm. It's your oh shit plan. You need to start looking at it just like you would assess for fire or for chemical, because there's an incredible amount of chemicals on a farm. They have all kinds of great security physically, like dogs, cameras, lock dates, things like that. It's just a matter of kind of taking the mindset and moving into the digital space a little bit because again, we're dealing with cyber physical devices. So there's a physical device that needs to be dealt with as well as the fact that you've got to tie up your digital end. And it just comes down to they just don't know. They think it's secure coming out of the gate. And that goes right back to the AgTech conversation. I can't even tell you how many default passwords I've seen or really weird passwords. And it's, you could tell that it was like the 15-year-old kid down the street that probably did it for them, which is fine. And that's this community and that's the beauty of this. But it comes down to they just don't know what they don't know and now it's being exploited. That's the easiest way of saying it.

Yeah. Connecting some dots, I mean, we do a lot in healthcare and connected devices in healthcare, kind of the same thing. Lots of old tech, you know, security by design flaws. I think healthcare has been in the spotlight for probably, you know, actually amplified in COVID because of such of the swarm of impact on healthcare devices. And really, when ransomware threat actors started targeting healthcare, they kind of avoided it for a while and then just went full at it. But I can only imagine within farming, like, it's the same problem with similar equipment for different use cases, but probably further behind than healthcare because they haven't had that giant spotlight shined on them yet. Or maybe it's starting to, and that, that catch-up is occurring.

Yeah, I don't, I don't think that they haven't had a big spotlight. I mean, JBS is pretty bad, and there's been several after that. In fact, people are now paying attention to food and agriculture, which I greatly appreciate. But if you're going to come in this space, please recognize that it's still an evolving space. It's not, it's not as well-rounded and robust as like finance, for example. Part of the problem too is there's no regulation around cybersecurity or anything to do with the tech inside of food and agriculture. There's a few things on the food safety side, but it's like an interpretation type line, like you should secure the tech around food safety equipment or, you know, that kind of stuff.

Pretty high.

To me interprets that you should have security controls around that. But then again, to a person who's not a security-minded individual, they'd probably just be like, cool, I just need to lock the door, you know, that kind of thing.

Yeah.

So I think that there isn't— so there's legacy tech, sure. But the problem is, is there's never been security around it. So they— why would they do it now when they haven't been hit? But the thing is, is people are getting hit more regularly and more often, and people are talking about it and they're— they don't know what to do. And that And that's, it's, it's so gutting cuz it's like, you know, you just, it's one of those things like just 5 things you could do really quickly kind of thing. Like, here you go. And it wouldn't cost you anything. You just, time. And that's another currency that farmers and the ag community in general and food don't have is time. Making that time is hard. But I've, like, I've, you know, repeatedly said and will continue to say, and I know both of you have probably said it, it's much more cost effective to deal with cybersecurity upfront than after an attack. And I keep reminding people that, like, I know this feels like garbage right now, but you're gonna get through it. And then you're gonna be more resilient to use the words that we've been using go through it because they're going to get hit. It's just a matter of when. And that's, that's hard to get that mentality in their minds because they've been so trusting in their whole lives, you know. Hey, I trust this tractor is going to go forward and not be a problem. Hey, I trust that my chicken houses are going to stay healthy and the right temperature and the feed's going to come out at the right time and all these things. And the fact that hackers can go down to the level of introducing nutrients, the wrong nutrients, to flies that are fed to chickens is wild to me. Nothing's off limits anymore. Nothing's secret. Nothing's safe. You know, it's everything is just everybody's out for it all now. And that's probably why the healthcare industry took a while because people just expected people not to touch hospitals because why would they? But it's the same with food. Yeah. They may eat that food, but they don't care.

They're just going to, whatever barrier was broken, the water flowed and it's not coming back, unfortunately. So I want to spend a little bit of time talking about your podcast, Bites and Bytes, and learning a little bit more of that about, and then make sure we talk about about your upcoming book, Securing What Feeds Us. So maybe let's start with the podcast and give us a glimpse of what our listeners might be able to obtain from your show.

Yeah, the podcast is great. I'm still getting used to people telling me that they listen and they come up to me and they're fans and they really have learned something or it's helped them in their academic career or their career. I'm so humbled every time someone even mentions they spent time with me because I sometimes feel like I'm ridiculous. So I mean, it really is wonderful. The podcast is, it's a lot of me chasing my own curiosity, I'll be honest, because I kind of get into these conversations with people that are on the, in the food side and the ag side. I'm like, hey, I really want to talk about this on air. Do you mind? That kind of thing happens. Tell me what you're doing. Tell me about the things you're working on. So I'm really peeling back the curtain of the food and ag industry to talk about different sectors that people haven't really figured out before. And I obviously add the tech and cyber lens because I'm I mean, I can't help myself, but it's really great hearing about these different incidences that I didn't even know happened. The Peanut Corporation of America, for example, if you don't know what that is, go look it up and we'll talk about it. It was pretty nasty. And to me, that's an insider threat on a whole level. Reminds me a lot of the Boar's Head incident, those kind of things. I am now 100% that cybersecurity kind of a-hole a little bit now, as well as a food safety a-hole at the same time where I go into a restaurant, I won't sit in front of the open kitchen. In fact, I was just at a place the other day and I was facing the open kitchen and I was like, I need to move. Like, and people are like, what's wrong? Is there something going on? I'm like, no, I just don't want to watch because I'm going to, I'm going to start heart palpitations watching whatever's happening back there. So that's, that's changed me as a person as well because of the podcast, because I talked to all these different individuals.

You know too much now.

Yes. And it's led to me into some amazing conversations and partnerships. And having a podcast is great. I mean, you guys know this and it, it's, it's such a great place to, to learn and it's safe and it's, I love it. And the thing I love about the show the most is actually the beginning of the show. I ask everyone the same two questions, your favorite food and your favorite food memory. 'Cause I want to humanize and also it's a great icebreaker. People relax very quickly when they start thinking about their favorite food memory. And I've had some beautiful memories come out and then I've had some like questionable memories, but it's okay. Okay. And generally speaking, people have crazy food fixations. I got pizza a lot. It's really hard to rift off of pizza. Like, people always say pizza, and I'm like, what am I supposed to say about this now? But I just talk about toppings and we go there. Um, and then it's just really great so people can share the work that they're doing and things like that. So it's been fabulous. And I have a lot more farmers coming on now, which has been— and ranchers and things like that. So it's been really interesting to hear their side of the story of how they think and feel about tech. Um, a lot of them say, I don't think about it. And I'm like, well, you have a phone. And they're like, yeah. And then they go, oh, that is tech. And I'm like, yeah. So we kind like go down the line.

Yeah.

And it's really, it's really fascinating. And, and also hear why people do it and why they still do it and why we should really be thanking farmers every day. Um, and then I have a lot of people from food production and we talk a lot about that world and the craziness that's there. It's, it's so, it's such a great show. I really enjoy it. And I'm really excited for whatever next season is going to look like, because it's going to change and evolve every year, of course. So everybody get ready. I don't really know what that looks like yet.

Oh, well, speaking of that, give us the little— give us the book preview. Give us a little, little insider knowledge here.

Sure. Securing What Feeds Us. I'm writing it with Wiley Publishing. So they're the ones that do Books for Dummies. My book is not a book for dummies. It's a business book. But, and I think this came from the podcast as well, to be truthful. That's probably how they found me. It is a first of its kind book because nobody's written about food and agriculture and cybersecurity. Before, which, you know, zero pressure there, obviously, like absolutely zero pressure. And I've started with— it's going to be done in different phases, so it's going to talk a lot about different industries as a whole, but then I'm going to break it down in different sectors, like why you're gonna have to pay attention to it differently here, dairy versus seafood, you know, food production versus agriculture, that kind of stuff. It's going to be a book of practical information but also the history of how we got there. So how do we go from rubbing two sticks together and cooking our meat to like where it is now? Like, let's have that conversation and how it evolved and why need to evolve alongside it. It's going to be heavy operational technology. Sorry, everybody, this is my world. Cyberphysical. But we're also going to talk about the human elements of food and why it's different. I am really enjoying writing it. It is difficult to write. I'm a first-time author, so yikes is what I'll say to that. However, I realize as I'm writing it how important this book is and the information in it and why we need it now, because we really are on the cusp of something really disastrous happening, like a foodborne illness or some type of food safety scare. With a cyberattack. And I really hope that this book will at least inform on a business level, you know, what things can be done or things to look out for or pay attention to. It is not going to have a checklist. Everybody can relax. I've had some people tell me if there's a checklist in it, they're going to scream. It will not have a checklist. It's going to just be baked into common sense knowledge and a lot of systems thinking, hey, if something's wrong over here, you probably have this problem over there. So lots of anecdotes, lots of stories, lots of my sass. So if you know me, you know that it's there. And yeah, thanks. Yeah, I'm really excited about it. So it should be out in like autumn of 2026, roughly, is what we're targeting.

So about a year from now.

Yeah. So stay tuned for that. I'm sure there'll be some book signings and other things that I can't believe I just said that out loud kind of thing, like all kinds of things. So I'm really excited.

Awesome. Well, Kristen, we've loved unpacking the history of your career and journey through food and food, physical security, OT, Good luck on the rest of the book. Really appreciate your time. I'm going to go check out your podcast, Bytes and Bytes. I'm excited. I'm a foodie myself, so I'm excited to connect those dots into a couple of things I love— cyber and food. Appreciate you coming on the show. Awesome.

My pleasure. Thank you.