Cybersecurity and User Experience

Thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz.

And I'm Todd Wilkinson.

And today we're joined here by Matt Bellinger, who's the CIO of Republic Airways. So Matt, thank you for coming to the show.

Thank you so much for the invitation.

Would love to get a little bit of background on you. Of course, I know you, but some of our guests on our show may not know you. So give us a little of your story of how you got to the CIO role at Republic Airways, and maybe a little bit about how you were in and around cyber as you advanced in your career.

Oh, sure. Okay. So, so zooming way back, I started my career in the, in the late '90s at the height of the telecom boom. I, I, uh, started at Lucent Technologies and, uh, you know, big, uh, telecom, uh, equipment, uh, manufacturer at the time. And I started doing, uh, networking, you know, layer 2, layer 3, and, and layer 4 switching and, and routing and, uh, deep firewall, uh, work network and, and developing underlying protocols for the, for the switching fabric and about as deep in the tech stack as you can go to start. Yes. Yeah. Super fun, nerdy engineers, engineer sort of work. Um, and, and then, uh, the telecom bubble burst and, and that was, uh, that was a tough, tough time, right? A lot of exposure to, to a shrinking, uh, workforce and, and all of that stuff. And, and, uh, went from, Lucent to IBM. Again, started in the product group there, had a lot of fun, and eventually worked into program management, project leadership. And that was a very difficult transition, not something that I had originally anticipated doing, but really great opportunity to sort of broaden my breadth and scope there. And did several assignments and then got into merger and acquisition due diligence and integration, which was a really fun, high-intensity complexity, time, lots of exposure to cybersecurity items, infrastructure items, enterprise systems work, migration of systems and data, right? And all of that. And then became the divisional CIO for the analytics division at IBM. That was a high travel role, had folks all over the US, global team. Again, really enjoyed that role.

Let me guess, kid number one came?

Oh, that was— I had both kids. Yeah, we had two kiddos for a long time. And then my wife's family is from Indiana. And so we took an opportunity to move back here to Indiana and really enjoyed getting involved in the community here. Spent some time at a small privately held organization here in Indy and really helped transform their their technology infrastructure and all of the work we're doing there. Learned a lot about PCI compliance from a regulatory compliance perspective. That was really fun.

Was it fun? It was. I always say congratulations and condolences. I know there's both pain and insightful learnings as you go through the PCI journey.

Yes. Yeah, no, it is. It is truly interesting because there's so many different implementation options and you kind of look through and what— how does one auditor interpret a regulation or a rule and how can you kind of have that conversation to say, well, we think in our context this makes more sense to do this, right? And, and really kind of having those deep, rich conversations as opposed to just sort of checking technology boxes, right? And then, and then about a year ago, two interesting things happened. We had kiddo number 3 and, and the opportunity at Republic opened up. And so that was a really exciting, high-intensity time again and really enjoying the, the time at Republic.

Well, it's a little bit too late a year in to say welcome aboard. But, you know, I had to throw a pun in there, as I always do.

I appreciate that.

All right. Well, Matt, I think the topic that we picked or you picked to talk about is cybersecurity and the user experience and kind of the friction that can be solved. So we're going to take you through a journey in an organic conversation about the problem. Some stories of what the three of us have all seen on the corporate side. A couple of us are on the consulting side, but we've spent more time on the corporate side with you. And then I think we really wanna reserve a fair amount of time to get into the solution brainstorming, 'cause I don't appreciate the rant sessions that are like, hey, here's a problem, and then you're left with a summary of the problem. Like, I wanna get into like, how do we use this forum and this podcast and videocast to help others think about this differently? 'Cause I think that's what it's all about. So, I'll start with a little bit of the background of the problem statement. So cyber does have a fric— a challenge, both historically and in the future, of causing user friction, lacking clarity in when often we roll out things, missing the opportunity to explain how to do the right things.

Right.

I think a lot of times we're saying what not to do and not focusing on the business enablement or how to get to the right answer faster. And then most damagingly, I think a lot of times when cybersecurity is cumbersome or things get blocked because we're scared of them, users will find workarounds. And there's a term called cyber erosion where essentially what you're trying to block creates erosion of the intent and the workforce ends up doing something else, often that can be worse than the original thing that you were worried about.

Right.

So let's get into the discussion. What are some of the examples of user friction with cyber or challenges that you have had on the IT side or the cyber side and key initiatives that maybe haven't had the right focus on the workforce members that we support?

I mean, you see this so often, right? There are so many opportunities to engage in broad-based communication across an organization so that everybody really understands the change, the why behind the change, right? And they can really wrap their head around what it is that we're asking of them. It's easy as technology professionals to use jargon, to, uh, assume a level of knowledge, right? To communicate in a, in a, in a fast way that, that, you know, hey, we're trying to be brief, or I've already told you this, or, you know, whatever the case may be. And, and how do we, uh, do that and move on to the next thing, right? Instead of really taking a moment to understand where our users are and what is it that they really need to communicate, right? How many times have we rolled out a new MFA initiative, right, and not deeply communicated the why? Because we're changing user behavior, right? And so now they see an interruption to their workflow, or we're changing MFA from SMS-based MFA to a mobile app, and, well, gosh, why can't I just use my SMS, right? And let's talk about what that is instead of just prescribing, hey, you have 24 hours to comply and download this mobile app or you can't log into the system.

Right. Yeah. Yeah, a couple points from my corporate side is, and I was at a company that had a fairly public incident. So when you go through an incident, the good news is you get a lot of support and funding from execs, and that's both daunting as well as helpful at times. But also if there has been an incident, a lot of times, you have to be very careful of what you say. And I think within change management, real stories and examples that resonate with people in that culture are helpful.

For sure.

So I think sometimes it's easier than not to, you know, if, if there's a concern about a user behavior based upon an incident that happened, you might not be able to tell that story or tell it clearly enough. But I think wherever possible, like being able to share real examples help them understand the what's in it for me. And this isn't just some mandate from a best practice. This is because there is some specific thing that happened here that we need to take into account and change the way that we work.

Exactly.

Todd, any thoughts from your side?

Yeah, I found the big initiatives like, hey, we need to stop something, we need to block it. And if you can get that message out in multiple forms, in multiple ways, in a way it's like, hey, I'm sorry, this is going to be a disruption. People understand. They're happy to help. You just have to reach them. In the same vein is a lot of times there's little things that we have to do. I'm going to block this little thing. It's going to cause a message over here, but I can't really communicate that well, but we do it because we have to. Those are the ones that cause frustration because they don't know about it. They don't get communicated. And I've been there before going, hey, I have to block this. There's going to be this random error message that pops up on their laptop. I can't tell them much about it. It's just gonna be this thing, and they're gonna put tickets in. I try to communicate it, but those little ones are what cause friction, and then it causes people to get frustration. Or, yeah.

Yeah, so I'm gonna ask you guys each to share a specific story or example of where you faced some of the challenges we're talking about. But before I do, I think we hit most of these. MFA rollouts, alert fatigue, popups that aren't meaningful to the user. There's no clear action to convey or to act on, uh, rigid restrictions blocking cloud storage. How many CIOs do you know in the network colloquially that you're part of that have blocked AI?

Right.

Um, yeah, you know, that's a great example. We've got a couple clients that are still there. Most are now moving past it, but this is 2 years into kind of where we needed to be ahead of it. Your users are already using it, whether it's on a personal device or on your corporate device where you think you're blocking it. Complex policies that aren't clear, but maybe great for lawyers, vague, non-company-specific security awareness training that doesn't resonate within the culture or give you any meaningful how do we do this here messaging, and then lack of clear points of contact. Where does your help desk help with everything? Are there specific people you call on an incident? If those things aren't clear, it can all lead to friction. So we'll start with Matt. Uh, give me your best story of where, uh, you had an experience where maybe user experience wasn't prioritized or you felt some pain point in, in, in that.

Best story is a tall order, but there are lots of them.

Pick, pick one of the top 5.

Oh sure.

So, so, uh, good, good one. You know, recently, uh, you know, think about rolling out new, new technology, right? And you know, how do we get users to move from old technology to new technology, right? And that's a transition. There's a user experience that's part of that that's different on the new than the old. And it's so easy to say, well, hey, we have sent emails saying that this change is coming. We've sent emails saying this change has arrived. We've sent emails saying please use the new technology. And then we sent emails saying the old technology is going away, right? And then We get ready to take that old technology away and we haven't done the homework to see if anyone is actually using the new technology, or you do it at a superficial level and you say, hey, the new technology is in use and we can see that people are using it, and therefore we assume that all people are using it, when in reality that might not be the case.

And great emails probably reviewed by 3 levels of comms. How many people are reading email? Is that part of the root cause?

Exactly, exactly right. And are we willing to disrupt our users, take a business disruption, right? Or can we pause for a moment and make sure that the message we're transmitting is actually being received on the other side, right? It's so easy to just broadcast, and they, you know, they talk about you have to send a message 7 times through 7 different channels, right? In 7 different ways, right? How do you make sure that you're really resonating? How do you measure that what you expected actually happened.

So I'm hearing communication is tough. It's multifaceted or multilayered.

For sure.

But skipping it or assuming the basics are gonna be sufficient aren't gonna get it done in most cases.

Just because you put it out into the universe doesn't mean somebody else picked it up.

Yep.

Right?

Yep, good point. For sure. Todd, what is your one or two stories of pain?

Well, I was gonna follow up with that because you get that message out there, we tend to, in technology terms, we tend to be overly prescriptive. And so you get these long emails. And I've reflected now, most of us, we get our email on our phone. And how many thumb scrolls do you get before you stop paying attention? And I remember I challenged a colleague. He's like, I don't understand why people aren't reading these emails. I opened up the email. I had opened it on my computer. Now let's look at it on my phone. I had 9 scrolls to get through to read the message. I'm like, that's too much. Be brief, be concise, be quick. That's part of that challenge. But the one, and this is going back a bit, and it's a little less cyber, but it kind of fits into it, and that user experience of how do you communicate well what you're doing and why? And if you don't, it can have longstanding damage. And so we had an old paper process, but we shipped out a whole new mobile device, this whole new mechanism for filling out these forms out in the field. And it auto-populated the location data. And we thought this would be fantastic, but we didn't tell people what they were doing. And all of a sudden, these devices were coming back in a fairly large percentage broken, run over, caught in doors, a variety of things that, like, the number of broken pieces of equipment was pretty high. I'm like, this doesn't make sense. So I started reaching out to folks trying to figure out what was going on. Like, Todd, they think you're tracking them. And they don't want them. And I'm like, well, that's interesting.

It's like in the spy movies where people throw the phone into the birdbath because they think they're being tracked.

But that wasn't the takeaway. That's more just fun. And that was this particular audience. But what I learned is that perception did longstanding damage with trust down the road. And it's back to that notion. You do one negative thing. It takes you a lot of positive things to overcome that. And that little story, why it wasn't a huge audience, it was a small group, and it was a small use case, has stuck with me of like, I've got to reach out to avoid negative perceptions early on, you know, to try to make sure you can get, you know, get whatever the tech is or whatever the tools out to the field and deploy and just reduce that friction. So that was self-created friction on my part that I, like, yeah, I thought this would be fantastic. Let me add this little feature. Help them where they're at. Well, that had a lot of downstream impacts that I had not anticipated.

That's fair. Well, I have 3 pain points in my corporate experience. The first one kind of relates to monitoring, but data loss prevention. And I think I was at an organization that had, like I mentioned, some incidents, and there was a rush to curb data loss, right? So, and I've seen this even modern day recently at companies that maybe don't have an incident, but CIOs a lot of times will say, I need DLP. And I say, okay, do we understand data classification? Do we understand the— what we're trying to protect? Because basic DLP can control a lot of basic stuff like privacy data or banking data. But when you get into company proprietary data or, you know, what are the crown jewels within Department B or, you know, finance?

Have you built the foundation to make that effective?

There's some work that's not sexy for technologists that is required to make DOP work for you. So I think not involving the workforce, rushing the tools can have lasting damage. And I think InfoClass and DOP go together. There's modern ways to do InfoClass, right, that aren't government 10 layers of classification and complexity. And it really goes back to, you know, are we, are we being empathetic to the departments that we are trying to help and understanding their perceptions and their workflows so we can match our solutions and our policies and our processes and job aids to their experience.

Whenever we're leading with technology, right? That's, that's probably not that, not the right, not the ideal solution.

A lot of us say it, especially those that are more tenured, because we've all had the pain points. But I think there's still the temptation to go further with tech and get the most for the money, which can compete with slowing down a little bit. To do some of these foundational things that will allow you to go faster. And then my third one, we already alluded to it, but blocking things that you're scared of. So, uh, back at the company that had the incident that I was at, cloud storage was being abused and it was back before everyone had consistent, whether you're on Google or Microsoft and SharePoint was great. It was 15 years ago and SharePoint wasn't great. Um, so there were a lot of one-off cloud solutions that were coming up and our propensity to do the wrong thing and have a private account and download data, but By blocking it, it was kind of, we whacked the mole here and it swished up to other spots. So I think just being very careful on the blocking mentality and usually converting that to how do we find a safe way for these users or workforce members to do what they need to do. All right, so we've talked about the what, the problem statement, and a little bit of storytelling. Let's talk a little bit about why our industry and our cybersecurity IT is facing the problem. So, what do you guys think is driving these behaviors that maybe either rush to tool first or not spend the time on the right organizational transformation? Why are we in this place today with some of our organizations?

Well, I'll throw one out there. I mean, many of us will work, our job is to defend. That's typically how we think. That's the priority. That's the approach that we need to focus on. So that's where we spend our time. It's not that user experience. Let me put myself in other shoes. It's about let me get the block in place or the protection in place, and then I need to move on to that next list or that next problem I need to tackle. I think that's the first one. There's another piece of it that in some cases we are on the forefront of trying to solve problems before the tools are ready to do that. So the— we may only have the hammer, we may not have an elegant tool to fix it. So it can be messy when we're turning these things on. And sometimes you have to wait for the technology to catch up to what you put in place. But those are a couple scenarios that I know we're stuck with. Matt, I'm curious what you're seeing.

You know, I would, I would think back to, you know, training and development, right? When, when you're learning, right? What are the things that you know, how are you receiving that instruction, right? Is it a technical focus, right? Hey, here's how you think about these sets of, uh, uh, approaches to solving problems, to implementing this technology, right? Here's how we go about doing the— right? And so you enter the workforce with a particular set of tools in your toolbox, right? And oftentimes the empathy, the communication skills, the broader sort of engagement around user experience just is not part of the toolbox when you're entering in. And then as you go through an incident, right, if you're, if you're in the heat of the moment, it's super easy to trigger back into that amygdala response of, oh gosh, I've got to do this and I've got to do it now. And this is the domain that I'm operating in and I'm not thinking about the bigger picture, right? And I don't feel the freedom. I don't feel the ability to just pause and calibrate with someone else that I trust to say, well, here's what I'm thinking. Does this make sense? How could it be better, right? Is this really what I'm seeing? Is this the right tone that I need to get across, right?

Yeah.

That's great. I've got maybe one to add, and this is a question or a theory, and I'm gonna bounce it off you guys. You can tell me if I'm wrong, but I've probably been saying this for 10 years. I feel like IT and cyber to a certain extent, but sometimes they're all one and the same from a leadership standpoint. I feel like IT and cyber often rewards net new implementation and innovation versus going back and fixing or improving or improving the experience of the tools of yesteryear. And yesteryear, not 20 years ago, like the thing we did last year before we moved on to this year's priority. So what, Matt, as a CIO, like, do you see that being maybe a challenge within Kind of the IT field. For sure.

Think about all of the ways that people think about projects, right? I'm going to do a new project. I'm going to get new capital, right? I want to go off and do a new thing. I can increase my score in this domain if I deploy this tool, right? And I would extend it beyond even an IT or cyber domain. Think about the replication crisis in science, right? Like, people don't want to replicate a study because that's already done. Let's go on and do a new thing, right? Whereas— so it's, it's— there's a little bit of human nature to that, right? We all want to go off and do a new thing versus, you know, challenge ourselves to really understand something that exists today or, or refine or make an improvement there.

Yeah, I think it's going to take a change in the reward system or within a company culture to say Hey, we're going to intentionally— CISO of a company— we're going to reward a UX capability. And it's not only going to include the new technologies that we're rolling out, but the ones that are still very relevant that are in play today. And to your point, capital— it takes money, it takes project priorities. And those may be tough trade-offs if you're— especially if your budgets are getting cut or you're on a flat budget. You know, how do you prioritize making the workforce experience better so your tools can be more effective in, in use.

Think about all the, you know, application development space, right, where your options are to build and launch new features versus address tech debt.

Yeah, right.

Like, how often do we see a giant backlog or we can add a shiny new object? Yeah, right.

Good point. Good point. All right, let's jump into solving this. So I've got a series of kind of prompt questions to kind of help us think through and hopefully We've not rehearsed this, so hopefully we come up with some new novel ideas, and we'll probably follow up in the comments of the post if there's something that really catches fire. So, given the problems that we've talked about, the why, the what we're seeing from our examples, how can we as leaders foster a culture of proactive and positive workforce-enabling security?

So, so that, that's like the question, the big question. That's, that's a big question. And, and for me, a lot of it is sort of extending the, the expectations, right, for our cyber professionals. So it is true that you need to have technical expertise, you have to have mastery of technical domains, perhaps depth across multiple technical domains. And, and there's a great conversation here on T-shaped skills and, and all of those things to, to grow your cyber career. That is necessary. It is also necessary to have empathy, to be able to put yourself in the shoes of others, to develop communication skills, to be able to, to think about what the, the person on the other side is, is thinking and feeling and saying and doing, and, and, and to really be able to, to, to translate and to be able to build those relationships. Because when you need to leverage those relationships, they need to be in place. It's not the time to build a relationship when you're actively working an event, right?

So maybe double-clicking on that, and there are classes and certifications and like OCM, ADCAR was one that I went through.

Yeah, yeah, yeah.

But how, how do we help? Yeah, across, across the IT and cyber organizations, there's various types of cyber people at various tenures of their career, right? Sometimes as we delegate down, you know, engineers, architects, individuals that are not proficient in those skills are put in situations where they're trying to drive change and they don't necessarily have these arrows in their, in their quiver or quivers in their arrow bag. I think I got that analogy wrong, but how, how do we, how do we address this without like taking a pause to send everyone to, you know, a, a one-week bootcamp on this topic? Maybe Todd, if you wanna start.

This one has been helpful for me, and I've used it when coaching others or asking questions. It's the, all right, you're rolling this out, you're using a new tool, pick the topic, right? Follow that lifecycle of how they're gonna use that or how they're gonna run into issues. How do they get help or how do they turn the thing on? Where's it likely to break? And when it breaks, can they call somebody and how do they get it resolved? And you think about that full cycle of how they use that, where those challenges are going to come from. Now all of a sudden, you're not thinking about how do I get this out and rolled out in production? It's the service lifecycle of that tool or that process going, great, I've got it out there, but I'm going to have to make a change. I'm going to have to communicate people. I've got to get the help desk ready to take calls. Who does the help desk call when they need help?

Right.

And how do I start to make those updates and then start to eliminate the calls they're going to get and help them do their job? That way the person sitting there, their job isn't to use that tool. They actually have a job. The tool is just one piece of it. How do you make the tool become not the problem? Right. And thinking of it that way, even for the most technical of people out there doing the work, it gets a better product, it gets better engagement, and it lowers the stress on everybody once you start doing that a few times.

Yeah, well, and there's a lot of just communication across the organization, right? Like, here is the expectation, right? The expectation is that we're going to have clear communication, and the expectation is that we're going to hit the 7 channels in 7 ways and do all the things and then be willing to be out there and share what good looks like, right? And provide that feedback and engagement and recognize that it's not a penalty environment, right? The notion of blameless postmortems, right? When we go through and we attempt our communication and we do these things and we'll learn. So how do we circle back and take the learning from that communication and roll that into the next time in a way where the individuals and the team share in that learning, but that it's not viewed as a punitive exercise, right? This is not something where you are less of a person or you're less good at your job. This is our journey in learning and growing in this way, right? Both individually, professionally, and as a team as an organization, right, so that we can deliver better products and better services to our constituents and stakeholders.

Yeah, no, the anti-punitive thing is real for me. I've had both on my corporate side as well as clients I've coached, I think probably 8 to 10 times I've been asked the questions of how can we involve HR and what should be the punitive— Right, right, right.

For us.

For clicking on phishing messages.

Right.

And it's like, well, gosh, Phishing unfortunately dominates a lot of what workforce awareness is. I don't agree with that.

Right.

But to have the cyber teams only face off to the business, be a test where you pass or fail, and there are escalating HR consequences up to, in some cases, termination.

Right, right, right.

That's not a good look for the cyber team who's trying to influence positive change.

Exactly.

So next question, how do we borrow some concepts from UX or user experience design thinking in security tool and vendor in this whole space of the challenge? And is this a corporate opportunity or a vendor opportunity? Because you could say it could be happening at the tool level from the vendor, but there's also a piece on the corporate side. So is it one or the other or both? And how do we really get into that?

Yeah, so I'm a big fan of design thinking personally, right? I love the notion of both understanding the user, right? Building empathy with the user. What is that user thinking, feeling, saying, and doing, as well as deeply understanding the problem space, right? Fully exploring that. And so often it's easy to rush, oh, hey, we have these 3 choices, we like this one, and go, right? And not sort of diverge on the possibilities before we converge on a final solution, right? And really explore that. It's the old adage of if you've got an hour to chop down the tree, do you spend 50 minutes sharpening your axe, right? Before you chop the tree down and really align with all of the other stakeholders, right, around, hey, here's, here's how we understand the problem. Here's how we propose the solution. What ideas do you have going on that journey together, right? So that they have equity and that they, they're invested, they're bought in with you and come along on the, on the journey.

Great point. Todd, you're a man of many stories and you're also a designer, both from some of your IT and cyber experiences as well as, you know, building your own 3D printer. I bought mine, you know, just to jump to the outcome faster. But any insights from a design standpoint?

Yeah, I can say this. So there was a period in my career where I was building a lot of applications and deploying them across the globe. And I had to fight for funding for user experience.

It did.

It was a very analytical organization. So numbers and functionality mattered most. But what I found consistently, consistently is that the tools that I took the time and the funding and the exercise and to sit through and go, what does this look like? How are we going to use it? How do I make it a little smoother, reduce some of that friction? Those are the ones that clearly had the most success. And I usually had to fight to get that time because it was a mathematical-based organization. So give me an Excel spreadsheet and that's all we care about, which was fun to work in, by the way. I love that group. But consistently just spending that time to go through, have some education cycles, and more importantly, getting that feedback from the people in the field. Not everybody wants to give the feedback, and that's fine. But you have a few folks out there that you can solicit and they'll send that message to one. They become your advocates too. Exactly. The other part of it. Now you're not just trying to push this thing on people. So you get that feedback. You get those iterations. You get that time and back. Not only that, and to be fair, user experience caused you to go back and do a few cycles and update it. So all of a sudden the product's just better. It's easier to use. And I've taken that to heart. I'm going to fight for that where I can. You may not always get it. And that's, that's okay. But I don't know if that's, that's the one that stuck with me every time I've done it.

So that's what my, my, my impromptu takeaway so far in this show, in this discussion, is this is not Talladega Nights. If you're not first, you're last. This is a you might have to slow down to go fast. You might have to brake around that first turn so you don't smash into that wall so you can power down the straightaway. And really, I think technologists that really wanna do things and turn on features as quick as they can and not, and skip some of these steps that we're talking about might be into that wall in the first corner. Whereas the person that was a little bit more feathering of the brake might be, you know, leading the pack. So I think that's really what it's gotta be about. I'm gonna ask one final thoughts question and it kind of really connects to the name of the show, Simplifying Cyber. How can Simplifyin Cyber benefit the companies that you work at now or the clients that you support now? What's your one takeaway for the audience as they think about the users and how simplicity might be their best friend? So, toss-up, jump ball, whoever wants to go first.

I mean, go ahead.

I was just gonna say, if I can combine a secure solution that gets the whole lifecycle of the problem, So, it's not just this one little pinhole thing, but it's the, hey, we've made it easy to use the tool, we've made it easy to share the information or do the function, we've made it easy to do it quickly, and we've thought through that experience from beginning to end. People tend to want to use those tools. So, cyber becomes the accidental thing on the side that both we secured it, we got people using a repeatable process, which means you don't have them trying things on their own on the sidelines that you have to then clean up. So, your data tends to become big, become better. People are using and following the same processes, so they're communicating the same thing. So, if you combine cyber with a process that you want to, and it's that full stack, you can improve business outcomes is what I have found.

My quick win will be, I've had a number of, on the corporate side, projects where I got to truly get into the business process as part of the solution. And it goes to the, you know, part of the design thinking is like you, empathy that you talked about, is you are living the life of that user so you can understand their experience. But my biggest wins, the most memorable ones, is where I found a way unrelated to cyber to make their process better or faster that made it not just about securing the company or protecting the data, but about making their life better. And I think wherever you can find a win in any initiative like that, you're going to get more stakeholder buy-in.

I'm totally with you. Yeah, it's—

it—

to me, it's, it's about two things, really. One is, is reducing friction, right? How do we reduce friction and enable our users to have a delightful experience at every level? And the power of and, right? It is so often, so often you hear about the trade-off, the trade-off. Do we want to make this secure or do we want to make this easy to use? And the answer is yes and, right? It is a requirement to both be secure and easy to use and straightforward and we're going to reduce friction, right? We work until we get that and, or we haven't come up with the right answer yet.

Right.

Right? It's that simple.

Well, Matt, I'd like to thank you for coming onto the show. Good luck in getting to those ands as you continue on your journey at Republic Airways, and enjoy simplifying cyber as you progress in your career.

Well, thank you both for the opportunity. It was a really great conversation.

Thank you. Awesome.