Podcast Trifecta - SSC, BKBT, CyberRanch

Welcome back to Simply Solving Cyber. This is Aaron Pritz, and today we are joined with a few different guests, and I will let George introduce us.

Welcome to a very special podcast event. We've called it the podcast trifecta. We have in the house and behind the mics, The hosts from Bare Knuckles and Brass Tacks. I'm George Kay with Bare Knuckles. We have Alan Alfred with the Cyber Ranch Podcast, and we have Aaron Pritz and Cody Rivers of Simply Solving Cyber. Why are we here? We are here because we got a bone to pick with October, also known as Cybersecurity Awareness Month. So we're gonna start with a history lesson, we're gonna air some grievances, and then we we are issuing a challenge to the community. So stay tuned as we embark on this adventure. Alan, I'm gonna turn it over to you, resident historian. Catch us up on the origins of Cybersecurity Awareness Month.

Well, if you go to cisa.gov/cybersecurity-awareness-month, you will find out that since 2004, the President of the United States and Congress have declared the month of October to be Cybersecurity Awareness Month. The whole premise behind this, what got it all started was we had a populace in general who weren't caught up with cybersecurity needs, right? And so the idea was the government was gonna try to kind of poke people a little bit and get 'em heading down the cybersecurity rabbit hole, if you will, and give 'em some basic prompts. And if you go to that website today, there are in fact 4 basic prompts still there. And I love them. Use strong passwords and a password manager. Turn on multifactor authentication. Recognize and report phishing, and update your software. Pretty good tips for the novice. Pretty good tips to sort of baseline a cybersecurity posture, if you will. And so I think the origins of the whole thing are not bad. I don't think they're bad necessarily in their own right, but I think that what we've seen is an evolution. And I think we've got some challenges now with how we approach Cybersecurity Awareness Month, both as practitioners and as vendors. Everyone knows I've been on both sides of that fence And I don't know if any of us are doing it right. George, what is your take on this as a practitioner?

Yeah, thanks, Allen. I can tell you this, since I got into this industry in like 2016, I find it completely insufferable. And the reason why is because, like, just, you know, real talk about it, guys. Like, there's no awareness month for secure operations, right? You're either building a good security culture you're not. Um, and you know, it's not just— it's not like Christmas, it's not Advent. We don't get a calendar, we open a piece of chocolate every day for like, oh cool, my password doesn't suck. Like, that's not how this thing works. Um, I think what it's turned into, and actually what it was even when I started in industry working SecOps, um, it's just an occasion for marketers to have a reason, to have a theme to be extra annoying when they're trying to push pitch. That's, that's literally what I— it's an industry-to-industry thing because if you if you talk to anyone else in like the normal world of people who have normal jobs that do things and gives them calluses in their hands, they don't give a shit about Cyber Awareness Month. The fuck does that even mean, right? It's just something that's like weird to us. Um, and again, you know, like I, I treat it more like it's, it's the— a Hallmark holiday for cyber sellers, right? It's like Mother's Day and Father's Day kind of thing, right? Which, you know, respect to our moms and pops, It's— yeah, like, and again, so it's, it's one of those things that I think it could be done better. Um, you know, and I was saying like, the reality is you should be working to build and reinforce a security-first culture at your organization all year round. Um, you don't want people to care about their cyber hygiene for one month of the year and then go back to using 12345678 as their passwords for the rest of the year, or just having the same password across their entire enterprise. I really, I'd be interested to see though what Aaron and Cody have to say as former client-side practitioners. And you guys are now working in the consulting game, whereas I started in the consulting game and I'm now a client-side CISO.

We like to do things backwards. So yes. Awesome. So a couple of things. I do think that there's some big opportunities and some big challenges here. I think First of all, I agree with you on, and George, I think this is your, your passion bailiwick, and I won't steal all of your thunder on the marketing and sales side. Absolutely. It's a usurped holiday for extra spam marketing. And I don't know that that's the spirit of awareness, which is not helping cybersecurity people understand the basic commodity awareness things. It's to help non-educated end users that are not IT people and not cybersecurity, if they don't already know the basics, to maybe get more interested in it. But I think we're missing the get more interested in it because we're spraying them with extra phishing messages and extra, you know, before or Proofpoint SaaS awareness tool modules. It's really just not making that much of a difference. Now, I will say, let me take a step back. When I was on the practitioner side and I guess was unlucky or lucky enough to be at a very large Fortune 500 organization that had a very public insider threat arrest with the FBI and, you know, a come-to-Jesus moment with the workforce needing to do something very different than relying on IT buried in the literal and proverbial basement. To quote unquote protect them. So I think for me, with a front row seat to that and trying to drive, okay, how do we make cybersecurity and more specifically insider threat something that scientists and marketers and all of them can play their role? Because like my front row seat learning was, hey, there were good IT controls in place, systems were locked down. Insider threat-wise, you got credentialed people that have legitimate access that are doing things either inadvertently or intentionally and compromising the company. And the only way to get underneath that is to help people understand what your crown jewels are and how to know if something feels off in an interaction and so on and so forth. So bottom line, I guess I was, I, I'm gonna go with lucky enough. To experience that and have a lot of senior leadership support for doing some really provocative and significant and avant-garde things in the awareness space that aren't commodity. So I like to joke with clients now on the other side of the table that I'll never see that level of budget again. And I may, and I hope that the companies that we work with don't get to that same level of budget from the perspectives that we did. Which was we got to throw a lot of money at a problem. But we try to, you know, now I try to recreate like, how can you do it more economically with some innovative methods that aren't spraying out more white noise? So I'll leave it at that. Turn it over to Cody, who's kind of come from the tech side and, you know, had the pleasure, I think, of joining some kind of big large corporation awareness things and maybe share some of those tactics or innovative approaches that aren't the things that I think, Alan, you alluded to that just don't work, or George, you know, things that, you know, are annoying. And let's separate the marketing side. And George, we'll get back to you on the marketing side because that's a whole different bone to pick. Yeah.

Yeah. No, absolutely. And like we always say, like awareness, like done right, is a comprehensive, like year-round program. You leverage it with other business initiatives within the business. If your goal is going to be cultural change, you've got to involve the culture in the movement versus, to your point, just like spraying them with a simple video or some phishing or password. But we've seen things like building champions programs, getting other functional areas involved in the business, getting them educated. You see the character and the branding, building campaigns that go year round that are going to tie more into InfoSec initiatives, but again, getting out of the fundamentals and kind of Aaron's point, the commodity things, departmental challenges, gamification. But a lot of those things create the intrinsic driver within the culture. You know, why does this matter to me outside of at work or at home with grandma, with cousins? And that's what we've kind of seen work a lot better. That's, you know, to get that cultural change versus you sign a check for a piece of software, you know, it's usually a high number. You don't see the change you want. The tool goes away. You spent money, no results, no one's happy, you know, and then you're kind of left, you know, hold the bag.

Yeah, Alan, I love that there's the federal government involvement in Stay Safe Online. But, you know, the last few years, and I think you pointed it out, like, it's the same 4 topics reskinned with a different variant, but it's phishing, it's basics, it's all the stuff that is the lowest level. And I think people, one, either don't care, that's the stuff that they've got every month already. You got to hit them with something different. You got to hit them with something that resonates with their family or within the job function that they're in. And they're like, "Oh, wow.

I get it now." And Aaron, I think too, we were talking the other day or actually yesterday about that, but it's like, we'll give you the same old thing with phishing or ransomware or something, but Nothing on reporting concerns. So here's all the things that could go wrong, but let's not tell you what to do if something happens, who to report it to within the company that's tailored to the organization.

Yeah. The SaaS tool doesn't tell you that out of the box. That takes a little extra work to like, hey, is it an email box? Is it a phone number? Is it a Slack account? Yeah.

Yeah. It's a comment box in the basement. Just fill out a 3x5 card.

It's like we're talking now about like actions on incident response processes, like Part of security awareness, if we're going to have a substantive conversation, talks about what happens when this scenario occurs. There's an entire industry of TTX now, which part of it, which is, I think I consider a subset of security awareness training. And I think the biggest problem— I was talking to another CISO a few days ago and I was just like, man, are you not finding that you're spending most of your time really just reworking and building process problems across the company? Like we're not even doing like security anymore. It's now about like, how do we guide different functional groups to not making a mistake? Or how do we give them the right protocols? So if something happens, they know what to do and they don't just freak out and not say anything.

Yeah. Yeah.

I love that, George.

Go ahead, Aaron. All you.

I was just going to say I'm deconstructing the phrase Cybersecurity Awareness Month. All of us picked on month. Everybody thought a month ain't enough, right? All of us agree on cybersecurity and all of us are challenging the ideas of awareness and what those might be, right? Is awareness simply putting some posters on a wall? Is awareness marketing spam? Is awareness that deep-seated need to really figure out the cyber implications of what you're doing, right? And so now we're even challenging cybersecurity itself. To George's point, I'm a practitioner, right? I've been a CISO 5 times. I find myself very often doing not cybersecurity work as part of my quote unquote awareness. Right. So, so it's almost like all three of the words in Cybersecurity Awareness Month aren't hitting the mark anymore.

Not the right words. Yeah. And George, I was going to say, like, the whole, like, finding business challenges, like, I've done tons of cybersecurity technical assessments. I find very few organizations that are doing business process assessments. But when we do them, we found that— find that there's more ahas and more, oh, shit, IT doesn't control this risk for me. I'm handling stuff in PowerPoint and Word and unstructured data, and it's going over email, and it's going over, you know, other channels, mobile devices, chats. And until you trace the data through a business process and pick your critical ones, like start at the top of the pyramid, you are just handling the commodity-level stuff. You're not getting in. And a side note, when you review the business processes, Alan, to your point, you actually add business value. I've had assessments where it's like, hey, did you know that out of 20 different touchpoints in this, only 5 are needed and it's never been challenged over years? Oh crap, we just saved $1 million because there's waste. So like, that's it. That's like the cybersecurity practitioner's dream. If you can add dollars and cents values and, you know, fix some security things, that's a win-win. But I think a lot of groups are born out of IT and they're doing IT systems and let's stay in our lane, let's stay in our lane. Go where the risk is, go where the data is, find your crown jewels. I'm still surprised that I walk into companies and ask them what are they protecting and they're like, they can't even articulate the business that they're in.

Right. It's crazy to me. We're, we're talking about ultimately needing more than cybersecurity, more than awareness, and more than a month.

Yep.

Let me ask you guys this then: how do you define the ROI on a security awareness training program?

We're back to the ROI on awareness, period, right? And I've got, I've got a rant I've given about this before. There's a famous blog out there that picks on a certain demographic of people, and one of the, one of the subjects of the blog is this idea of raising awareness that we've all embraced as this big, critical, meaningful thing. I can raise awareness about cancer, but that doesn't mean I'm doing the research to fight it and destroy it. I'm just selling t-shirts and bracelets, right? And, and there's a certain amount of that for cybersecurity awareness with me too, that, that we're, we're talking about it. We're not doing something about it. We're talking about it. And, and so the ROI on awareness in general, to me, the only cybersecurity awareness that has a measurable metric that you can actually demonstrate has an impact to the bottom line is if you're doing anti-phishing training and you're reporting not on the negative stuff but on the positive reporting rates. If I have 1,000 fake phish emails come through my shop, and when I started my awareness campaign, 2 people clicked a report and said, hey, this looks like a phish, and by the end of that reporting cycle and the end of the awareness campaign, 100 people have clicked and said it's a phish, there's some demonstrable progress. I don't know if there's any other ROI on awareness that I can point to.

Yeah, I— we do a lot of metrics and reporting projects in general. To your point, I think if you're not measuring everything you're doing and figuring out if it's working or not, you should stop doing it. I see a lot of these metrics that we're measuring a lot of things, but there's no decisions being made on that. So I think specifically to awareness, every, every workforce intervention that you're doing, whether it's champions or, you know, marketing type campaigns that go out to employees or creative videos that are trying to catch people's attention, whether it's measuring impressions or engagement, like, are people responding to it? If you're gamifying it within a department and saying, hey, let's pit departments against each other, look for the actions we're trying to drive behaviors on. And measure the volume of like, how many times are we doing it? I think it's not always dollars and cents or ROI from like a CF, what the CFO would be concerned about, but it's, are you getting the behaviors that you want to see? And are you, are you sustaining those? Not like, I just did it once and then I'm going back to my same old, same old, right?

I did my awareness campaign. I'm going to bed now.

That's right. Check that box.

CISO is sleeping.

And I would say too, the behavior change from the standpoint of getting other functions involved. So with like the Champions Program, you've got someone in finance or operations who before was like, great, I have InfoSec, don't care, I'm not worried about, you know, about our risks. Once you show them from a standpoint what the crown jewels are, what risk do they own, there's a lot more aptitude and a lot more, you know, movement from their side to be involved and say, okay, if I own this risk, Okay, now I'm going as an ally to this CISO asking for additional dollars and budget to help fix the risks that I own InfoSec can resolve. But I think you get more motivation from the business leaders if they are educated and aware of what their crown jewels are and the risks they own and the threats to those things. You're going to get them a little more open to talks with the CISO or with InfoSec to address those and have some movement.

Yeah, um, I guess I am the odd one out on this recording. I, I am on the vendor side, and I feel very seen at the, the level of vitriol directed at vendors. But I, I wanted to, to chime in to say, when I got into InfoSec and people were saying, oh, we should do something around cybersecurity awareness, I will tell you, as the relative outsider, my initial take was, why would we do that? Aren't they infosec professionals? Like, why would I try to teach CISOs, the idealized target buyer, who we can debate whether that's true or not, like what ransomware is? Like, don't they deal with this shit every day? Like, I think they're kind of tired of it. And yet the whole, uh, competitor Twitter feed at the time, it was Twitter, was all of that. It was like all this 101 stuff. So to your point, Alan, it— and George, it sort of like mutated from what would these cybersecurity companies be doing to basically educate their own families, the general public, and, and somehow got distorted into like, let's direct that fire hose at the buyer, even though it literally makes no sense other than the fact that it has the word cyber in it.

Yeah, George, I would say now on the, you know, we're consulting and we have a pretty big social focus. Like our thing is like content marketing and give back and like put some stuff out there that helps others. But I would say like our social media person that coordinates everything for us, like gave this, you know, stay safe online info and it's like, hey, here's the same stuff. Let's come up with some stuff. And I, Actually, to be honest, after prepping for this conversation, I'm like, we are not going to give any basic information. Now, I will say some of our, our followers are small business leaders, and we do some specific programs tailored to that. So I do think, like, depending on the company, if your target market is a broader audience that's not a cybersecurity professional that's buying your tool, you know, there may be still some value. But you look at some of these very large hardcore technical tooling companies, and they're only selling B2B to cyber professionals. So like, yes, they're not going to influence, you know, Joe, you know, uh, small business that just happens to be coming across their feed and like, oh, I should pay attention, right?

So, uh, out of a perverse curiosity, my question to you all is, can you name like the most annoying or cloying Cybersecurity Awareness Month marketing that you've gotten? Does anything stand out in recent memory of like, why are you sending this to me?

Can't think of one in particular, but mine is always like, you know, what's the cost if you don't do it? Like the age-old, you know, fear-mongering, do this or, you know, or, or lose your job.

Oh, I, I got one. That, and it's not even just a for the awareness month thing, it happens all year round. Every once in a while, some marketing person or some BDR will take a recent breach or compromise that occurred and basically send you the equivalent of, you don't want that to happen to you, right? And it's just like, I got friends that work there, right?

Like, yeah, you know that place that's on fire? Buy us and you won't be on fire just like that. Yeah, by the way, those are my friends burning, right? I love that one. My favorite one of all the Cybersecurity Awareness Month specific ones, the bullshit that they send you— and I get to say bullshit on this show, I like that, I can cuss on this show— um, they send you what looks like a decent free package to distribute to your users. In other words, they're not insulting me, the CISO. They know it's my users we're talking to, and they know it's Cybersecurity Awareness Month. Here's this great plethora of tips and tricks. And then you actually watch the material, look at the slides, or watch the little video, or whatever 2 things wrong. Number 1, they're giving bad advice, and number 2, it turns into a hardcore sales pitch at the end.

Oh, the bait and switch.

The bait and switch, right? But, but on top of that, it's bad advice. Like vendors that are coming to me saying, share these materials with your users and they'll participate in Cybersecurity Awareness Month thanks to our free stuff that we're not charging you for. And then it's like, you know, make sure you write your password on a sticky note.

Do you guys think it's going to be worse this year with ChatGPT? Like, yes, as marketers find the cheat code to, yeah, you know, come up with materials, do we think it's going to be more mindless dribble? Yes.

Yeah, marketing unfortunately defaults to early adoption of automation technologies to do bad things faster in general. In the, in the main, a lot of martech, like all the outreach email automation is just do the bad thing, but do it at like massive volume, massive scale. Um, and that's also in this economic environment where you've seen a lot of contraction, a lot of merger acquisition, a lot of business. There's going to be a desperate play there. And I think that's why we want to help change that. So we'll take a break here. We have aired our grievances, but we're not here to admire the problem. We have a gauntlet to throw down to the industry, and we will reveal that when we come back. Okay, and we are back. All right, gents, uh, we talked offline about what could we do to change this behavior that we've talked about, and we've come up with two challenges because I think it's twofold. So For the marketers, I'll take that. So for the vendors, I want to come to you and say the challenge for October is to not do what everyone does, right? Stand out. Don't send 101 marketing shit to people who do cyber year-long, day in, day out, right? So to that end, I would like to see you take on this challenge of what we are calling Cyber Community Month, right? And I want to see vendors using this time to contribute to the cyber community at large. And the challenge is to come up with a program that does that and to share it with the hashtag #CyberCommunityMonth. And we'll be watching. And, uh, we have some prizes that we're putting together. We're pooling our resources among our networks and friends. But as an example, Maybe you sponsor something for your customers to bring their parents on, and you could teach them about vishing. You could teach them about voice cloning, which is really on the rise against senior citizens. Extend it outside of your immediate customers, and what could you bring to their families, to their friends, to the community? How can you give back? Um, so that is the challenge to vendors. Aaron Pritzker, I want to turn it over to you. What is a challenge that we can issue to the client side, to the, to the people who are also tired of doing something heavy in October and not year-round?

All right. So practitioners, I think we've talked about cybersecurity awareness and month, and I think we've kind of gotten in lockstep a little bit about where we want to head with that. I think ultimately what we need to do is the same thing we're asking the vendors to do. I want to involve community. I want to see you guys going back to your vendors and pushing for— and I know some vendors will do this— hey, that EDR I'm paying for, how about you give me my clients to my home users for free? Let my employees use their EDR client on their systems at home for free. Let's work that into the next deal we ink, right? Let's, let's do the same thing the vendors are doing. Let's, let's reach out to mom and dad and buddy and sis, right? Let's not just go to our employees and hang the posters on the wall and do the usual BS in the break room. Let's actually engage people. Let's make cybersecurity matter to the human beings who work for us, remembering first and foremost that they are in fact human beings and they have relatives and they have elderly parents perhaps, or they have little kids perhaps, or they have middle kids perhaps.

Mm-hmm.

Any and all of us can be doing something to outreach to those folks. We do this all day long. We breathe it, we live it, we don't even think twice about it. The whole point of Cybersecurity Awareness Month when it started was there's a massive populace who doesn't breathe it like we do. So let's give them that fresh breath this month.

Yeah, and I want to turn it over to you, George, because I also think it's been my experience that a lot of InfoSec professionals want to do that, but as we all know, time is at a premium. Teams are getting downsized, do more with less, and I think that they just don't feel like they have the freedom to get out of the chair to take, you know, the hour lunch break to go read at their kids' school or whatever. So, George, you know, I know you have some thoughts here about how that helps professional development. I want to give you a moment there and some space to talk about that.

Yeah, thanks, George. So I think again, when we talk about, um, like getting involved with the community and, and how you frame this, how you sell everything, unfortunately, unless you're working at a pure public sector shop it always boils down to the ROI for the business or how's it going to benefit the business. And then the framing that I would look at is our community reputation as an organization improves when we go out and we actually talk about what we do and we actually give it context and we educate people, right? I think going to schools, going to— even if you go to community centers, if you go to places where, you know, there's kids who Um, you know, there are places where there's kids with learning disabilities or kids who really aren't doing too well on the normal educational track, and they're often technical or vocational schools, right? A, a job like cybersecurity is perfect for them because they're probably neuroatypical, they're misunderstood, right? They get shown this new thing, it's cool, it's, it's, it's teachable, it's learnable. A real person is actually showing it to them. And it's not some crazy thing they see in a movie. It's not some NCIS nonsense. It's actually something that you can fucking do and you can actually have a good life with it, right? If we talk about this as a bridge to build our communities, as this is something that we can actually educate people, we can improve the cyber hygiene of the people around us and also improve our corporate reputations by being out there and being like, hey, we care about the community. We can do this, right? I think you get a lot more support. And again, George, you kind of hit the nail on the head. We're so busy because if we're not actually monitoring and managing the operation ourselves, there are umpteen different projects from a development roadmap standpoint, cleaning up tech debt. If you're part of a CI/CD pipeline, you're basically providing security advice for every single new product that's coming out within that sprint cycle or within that PI. So, you know, you have to kind of decide, like, are you going to choose to make the time to do the thing, right? And, and I think of it, you know, outside of, um, let's say in a completely different context, non-cyber related, um, I like to, you know, like once a month or whatever, I like to go and serve the homeless, right? It's on Sunday, first Sunday of the month. Um, they're, they're the only reason why realistically that I do it. Um, I do it as like a bit of a humbling exercise, uh, my part of my ethnic community, we, we do it as a group. But I think it's important that no matter how good you're doing in life, you have to connect with people and you have to kind of see people at their most raw. And it's the same thing when you're dealing with a group of kids. You know, George, I know you did the thing at your kids' school. Your kids are absolute superstars. We're all going to work for them someday. Believe me, George's kids are geniuses. That's a really good example of like a super positive, like, fun experience. The real work is actually going into a school, dealing with kids who might be a little bit troubled, and giving them an opportunity to see a new chance at having a life for themselves. And I see that as like what cyber and cyber awareness can do, even if they don't want to do it for work, at least understanding how to operate safely on their phone and on the internet to not be preyed after, right? To have their data be secure. These are the simple things. It's empowering people to defend themselves and be more capable online because at the end of the day, on a personal security level, on a safety level from sexual predators or people who want to elicit violence or drug dealers, on the level of just knowing how to operate in a growingly more digital or digitized economy, I should say. People need to know how to get the most out of their tools, out of their devices, and not just spend money getting the newest thing or whatever, bothering their parents about it or whatever they have to do. That's where I see, you know, and sorry if it sounds like a bit of a ramble, guys, but it's how you actually frame the business case for support. For going out into the community and just bringing the cyber hygiene and cyber narrative to people who have nothing to do with your business and nothing to do with generating revenue for you, that's actually going to be the thing that gives your business community longevity years after you're gone.

Yeah.

And George, Katie, your first question, you know, how do you find the time? We're all busy. Yeah, I'm a CISO. In fact, I'm a multiple CISO now with kind of a combination of CISOing and consulting and all the things I'm doing. I'm busy. Doesn't matter. It doesn't take a lot of time. It doesn't. I spent a couple of hours over the course of a month putting together a cyber education program for a Girl Scout troop. Just took me a couple hours to do it. I spent about an hour putting together for a presentation to— I kid you not— a group of kindergartners called How to Be a Hacker. Took me about an hour to write it and 30 minutes to present it to a room full of kindergartners, and they loved it. They ate it up. Um, Time is not really the problem. Prioritization is the problem. And to George's point, there's things you can do to give back that are far bigger than any dollar and cent bottom line thing. We're only talking about a little bit of time here. I know so many good companies in this community that do so many things that have programs where it's like, hey, one day a year we're all going to go volunteer somewhere, or you get a free X days a year of volunteer time to go volunteer to wherever you want to volunteer. There's Companies have tons of these kinds of programs. We just haven't rolled cyber into that same mindset. That's all that's missing.

Bingo.

Totally. Cody, do you want to talk about the board you're on and how we've connected that into George and George's call for action here?

Yeah, yeah, absolutely. And I think it's going to line up well. So I'm on the board for a nonprofit called Kids' Voice. And what they do is they're an Indiana company and they represent kids in the court of law in custody battles. Demographic spans from income across the board, low income, privileged, you know, all different kinds of income. But the lawyers and these, these representatives are the kids' lawyers. And so it's a nonprofit. They handle a lot of data. They do a lot of, they do like a couple thousand kids a year just in Marion County, which is the central county in Indianapolis, Indiana. And so what we're doing this year is since, you know, I'm on the board for them and I work with Reveal, Reveal Risk is We're going to do kind of a team day where our company is going to go on site with them and do kind of like a workshop with their employees, teaching them some cyber hygiene, helping them with some crown jewel assessment, and helping them with kind of a fundamental roadmap of like where their program is today, what are some key things to do, but all pro bono. So it doesn't help us from any standpoint of a revenue standpoint. It's something we give back. One of our employees, myself, I'm involved with it. Aaron's wife as well is a volunteer for the organization. But to your point, kind of going out in the community, improving it, they're doing phenomenal things. They don't have the CISO or the budget to go do security stuff there. So just a time we can use, Alan, to your point, we can use our talent to go and enrich and invest our talent and time into some individuals doing some amazing things for the community, keep them safe, and then in turn protect thousands of kids in rough situations across central Indiana. So to your point, time, talent, and that investment is going to, you know, Metcalfe's Law, right? 2 goes to 4, goes to 8, goes to 16. So it's going to multiply out quicker than if I write, you know, a couple thousand dollar check to, to a fundraiser.

Yeah. And I would argue that our team will be better even if you didn't care about the philanthropical part of it, which we, we do. Our team will be better for going into an org like that and figuring out how to stretch $0 to something or something where they're not going to get a huge budget to buy all the greatest tools. Like, how do we use our brains to innovate in that space, you know?

Yeah, that's, that's perfect. Um, all right, well, I, I think we should probably wrap there. So thank you everyone for joining, and to the listeners, we will have more details on social, but the gauntlet has been thrown.

Vendors are going to be fat.

Yeah, they're going to be amazing.

We got—

we're really well connected, I think, enough to get you some good swag and incentivize some really creative ideas. So as Aaron said, what can you do to get creative? Well, let's take that out. So vendors, what can you do to give back to the community of cybersecurity professionals, clients and customers? What can you do to empower your cybersecurity employees to get out there in the community. Yeah, it's gonna be really exciting. But this is the first, I hope, of many of these challenges. Maybe we can get it done every year, prizes will get bigger. But yeah, thank you everyone for joining us. What's the hashtag, George?

Let's end on the hashtag. What's the hashtag?

Oh, there you go, yeah. Good marketing, Aaron. You gotta end with a call to action. So we wanna see this. We wanna see it on social, #CyberCommunityMonth. We want to see great stories, share them widely, and, and we'll share them as well. So, uh, yeah, thanks for listening, thanks for joining, and let's make October way better than it has been historically.

Relevant.

Hey, that's the whole theme of our show. Let's make it less shitty.

It's awesome.

Making October suck a little less since 2023.

It's great working with you guys, by the way. This is an awesome show. I hope we get to do, uh, work with you guys again.

Let's do it.

Likewise, appreciate it. Thanks for the invite.