Simply Solving Cyber - w Guest John Sileo

Thanks for tuning in to Simply Solving Cyber. I'm Aaron Pritz.

I'm Teddy Guzik.

And we are here today with John Cillio, and we'll let him introduce himself, but I am excited to be talking to John again. He came in and did a, I think it was, I believe it was a Cybersecurity Awareness Month presentation to several hundred employees at the company I was at and has a compelling story about how he got into cyber. So before we get into the questions and dialogue, John, do you want to introduce yourself?

Yeah, absolutely. You want one story, both stories?

Hear it all.

Yeah, I guess let's hear it all. Let's get into it.

All the carnage. I'm John Cillio. I'm a cybersecurity, mostly keynote speaker, do a little bit of the other stuff, training and consulting as well, writing and books and so forth. But I came to the topic in probably the worst possible way as a multi-time victim. First case was garden variety. Put out some— we were doing, buying a new home. I put out some of the mortgage documents, probably copies of it in the trash without shredding it. A woman whose name turns out to be Rosemary Serrano picked up my, the garbage. Actually, it was a cybercrime ring called the Cashmen who are like your trashmen. They go around and pick up the garbage and they take it back to a warehouse and filter through it. Anyway, Rosemary Serrano purchased my identity, used it to buy herself a home cross-country in Boca Raton, Florida, drained our bank accounts, defaulted on the loan, declared bankruptcy in my name. And I spent, you know, the next couple of years solving all of that. So that was my experience with personal identity theft and that's where I got my start. But while that was going on and I was super distracted, I'll cut to the punchline of this story, which is I had taken on my best friend as a business partner in a family business that I was taking over. His name was Doug, and Doug utilized my identity to steal, to embezzle digitally from all of our clients, all of our customers. So it looked like me, it was him, the money was going to him. The DA's office, Agent Waimura from the Economic Crimes Unit came after me. I spent 2 years in a criminal trial. Lost the business, which was at that point, a multimillion-dollar software business, lost my personal wealth, and more importantly, lost a ton of time with my wife and two daughters, which is the part that hit me really hard. And really the lesson from all that was, man, security is always personal first. It starts with the personal. If we don't buy into our own security to protecting our own phone and Facebook and online accounts and so forth, Nobody gives a darn about it inside of the organization. So that's, that led to a book deal and then on 60 Minutes and Anderson Cooper and Rachael Ray and all the fun stuff that I love to brag about. But the point here is I'm just somebody who made some poor choices along the way. I have now spent the last 15 years in front of audiences trying to pump up the energy that, God, you gotta care about the details of this stuff.

It's, it's an amazing turning lemons into lemonade story. It's been a while since I've heard a good dumpster diving story, but that's probably probably one of the best with this Rosemary Serrano backstory, but man, to, to be hit from multiple perspectives and then get the passion, cuz you weren't in cyber before that. If I remember right, you were in an IT services business.

Yeah, kind of software.

We ran, my parents started this TV repair shop and we turned it into a computer, small computer company. Then as the big box stores came in and that was waning, we took on Doug as a business partner and we started up an ASP, application service provider. We took somebody's accounting software, ported it to the internet, which was barely around when we started this process in early 2000. And that was a phenomenally successful business. Unfortunately, Doug had some habits he was trying to fund under the radar of his wife and family. So he needed to earn illegitimate money that she didn't see. And that's what got us into this whole thing, which if you took your best friend, if any of you out there took your best friend and had them steal from you. The betrayal of that, it was deep. It was dark. I spent a lot of time in therapy and trying to work out how not to kill this man and ultimately funneled all of that into the books and the speeches. And if there's passion there, it was born out of pure fear and having to survive through all of this and hopefully not go to jail.

Did you have a moment where you had this aha of, I want to do this professionally, or I want to tell others how to avoid what I got into? Or what was the light bulb moment where you went out of the valley of despair and into, hey, I think I want to do this, I am motivated by this?

No, I did not have the light bulb. I was too dense and I was too, I was too in my own head. Like, I was a flipping wreck from all of this. Like, I couldn't sleep at night. And, but my wife did. And about 3 o'clock one morning of me not sleeping anymore. She was like, "Enough. Like, we get that this was hard. Are you going to do something about it? Or are you just going to sit around?" So many of us do when there's breach, like we just, we don't go forward with it. And so that turned into a conversation that we had on a little one-day vacation we took of maybe I should write a book. And that was Stolen Lives. And the book started to do pretty well. And I got invited to do Barnes Noble type things that like 3 people would show up to, cuz nobody even knew what identity theft was. And, and it became readily apparent that I should be speaking, not writing. I still write, but, and that I was better getting people energized about this, not going into the technical details so much. Most of your listeners will have way more knowledge than me about what to do. I'm why to do it and how culturally to get it done. So, that moment really came, honestly, where it truly came was my wife and I had a huge fight and I was in the basement and feeling sorry for myself and I started writing the first book. And when I did that, it was cathartic and it was like, hey, I can turn this into something better for everybody else. And then that personal aspect over time morphed into But corporations are just a bunch of people. And if you don't pay attention to them first and to their security, you can't pay attention to the firewalls and the zero trust architecture and all the stuff that has come since then. And that's where I spend most of my time now.

That's awesome.

Yeah, definitely. I think the thing that you said hit the nail on the head about ensuring or making sure that people understand that the security lies on them too. You have organizations that have a security program and that But when it comes down to it, the best and most effective security awareness programs are the ones that empower the employees to really care about the security and understand how it will affect them and not just the company as a whole.

You're right. One of the things that bothers me most when I go into an organization, whether I'm doing a little consulting or speaking to them, like I did with the pharma that we worked with, is that the attitude of humans are our weakest link. If they're your weakest link, it's because A, of that attitude, and B, because you have done such a poor job doing your security awareness training, keeping them engaged, making it personally relevant to them, making it memorable and funny and engaging so that they actually walk away with something and it sticks. The humans, like, that is the only real competitive advantage we have when we've topped out the technology is how do we get those individuals involved? I think it's a great point.

And not only that also, but understanding that the practices that they use at work for security are also relevant at home too. So many people are so concerned about, oh, my identity is going to be taken, and they don't think about— they think in terms of the macro level of ransomware from a security perspective, but at the same time you have these problems at home where I have people that ask me consistently, just all the time, what can I do? And it's the same thing, same practices, same steps you're taking at work. It's just to apply those at home. And if they understand how they can do that, I think you're going to do— there's going to be a better job of these, like the cross between work and home and, and what it is that— how people handle that at home.

So, and how much more relevant has that become now that we're all working from home or hybrid or going back and forth? That they're the same thing at this point.

Yep. One, one related story. It was Q4 last year. It was the lull between the lockdown and when things locked down again. And I didn't do many workshops from a consulting standpoint, but did one. It was locally here in Indianapolis with a small tax prep business that had an incident where people's taxes that they supported or their W-9 submission packets, all that were intercepted. Long story short, We weren't, we were at lunch and we, we weren't talking about that. We were talking about our families and there were about 8 people around the table and actually 8 out of 8 people had a personal story about their, their direct parent or their grandparent that they had to coach out of some sort of identity theft, a call scam, one of the wire me, wire me some money type of urgent scam. So it was actually one of the most powerful conversations because everyone realized that they had something. Painful that they had all dealt with that no one at, even at the company that we were supporting, had ever talked about that. And we rode that energy into the afternoon session where we were mapping crown jewels within that business and the processes. And it was a whole different, it was a game-changing, like after they talked about the personal, they were like 10x more engaged in how to figure it out for the company that they were working at for 10 years plus. It's pretty cool.

It is cool. And, and what a great way to bridge to business email compromise or CEO fraud, or— right, same tactics, same social engineering beneath it. You got to build those reflexes in personally and then apply them to that type of situation. That's a great story. I love the positive side of this stuff.

So John, you obviously came from an abnormal background into the field, and some of the people we've talked to also come from different fields, some from business backgrounds, some from psychology, some from biology. Just all, and maybe that's just like their major in college or their field that they were working in. But what do you think is important for someone that wants to get involved in the field specifically to cyber? Is there specific traits that you feel are important for someone to really have to, to get to immerse himself in the field?

Well, that's a really good question. And I'm not sure I've been asked that. Everybody's so interested to know, how do I get the people? Because there's 500,000 shortage. It's not what, what's the profile? I would say, here are some of the thoughts. Number 1, attention to detail is like paramount. Long-term, slow-burn ability to look at detail and not be mind-numbing. And I'm talking about the actual on-the-line type workers. Different maybe for a CISO or somebody at a higher level who's more business-oriented. And I think we should talk about that because I have a strong opinion on the lack of business orientation among security people, and I think it's important in the average organization. Another thing I see is diversity has actually added a huge competitive advantage to companies who are willing to do it because they have people who are willing to think, go figure, in diverse ways. So that means racially, gender-wise, seeing women inside of companies that are attracting that. Number one, uh, females have a really strong position now to get into the business because Diversity is becoming something that we're all thinking about. They add a completely different type of thinking to the security posture than males do. And without being stereotypical, it's a softer, more collaborative, less fortress, build the walls, put out the perimeters type of thinking. And the companies that have done really well in this morphing process, going to a more distributed inside, outside of the company type the perimeter is dead type world. That, that to me is just vital. So looking for diversity, looking, looking for attention to detail. And then I think we should talk about the business aspect. Yeah.

Let's talk about that business aspect, because that is something passionate to me. And through, through several of the companies I've worked with, they went through an incident where prior to that incident, security was nested in the, I call it the proverbial basement of IT. And really didn't have business engagement. And companies that have been fortunate enough to have something bad enough happen, similar to how you had something happen to you personally, they go through a transformation and they bring in some of those skills, but there's still a lot of organizations where it's, oh, IT will handle that. Like, I got to focus on the core business. Times are changing. And I'm curious your thoughts on where you see the gaps, where you see the opportunities and what business leaders should be thinking about as they should be getting more engaged in this.

I have to say my training of boards, executive teams, sitting on boards has skyrocketed because of COVID because all of these business leaders figured out that cyber actually is a core component of their business strategy, their profitability, their reputation, their brand management. And that when you get in this defeat reaction cycle, which is, okay, we've had ransomware, now we're going to do something. And, but we only solve ransomware. And then we have social engineering or business email compromise, then we solve that. That defeat-repeat cycle is, it often gets handed directly to IT. Guess what? There's all kinds of operational concerns. There's legal concerns. Your marketing department is involved. And that's, those are business decisions. Cybersecurity is a part of the business as usual aspect of the business, like sales would be, like HR would be. Cyber is now part of that. And when you integrate the business people and you speak even about technical topics in business terms, it becomes a whole different culture within the organization. And I still see more organizations that are shoving it still to the IT people and they solve one little thing because that's the role of IT. They're solving technology. They're not solving the people part of it. They're not solving the procedures and processes in terms of the business outcomes that organization is trying to fulfill.

Yeah.

So when you go in to talk to boards or executive committees and you hear narrative like, I'm never going to learn the technical, or this is a, you know, cyber attacks are technical and IT, I can't get up to speed. So I have to defer to people. I see that as typically a cop-out, but how do you twist that narrative into something that's more productive and embracing of the role that they need to have to play, but they may not know that yet?

I look at it rather than trying to convince that person that they need to pay attention, and that's part of it. If that person is on a board, oftentimes them leaving the board or having mandatory training is important. But what I see is training the technical people on presenting these issues in business-related ways in terms of competitive advantage, return on investment, metric-driven, business processes, those type of things will get board members or executives on board. And it doesn't have to be super technical. They don't need to know, hey, zero trust is— has these 5 aspects and it's weak in its— in that it doesn't have number 6, 7, and 8. They need to know, listen, the concept here is that instead of having all of this stuff centralized in one place where nobody can get to it. It's now in the cloud. It's with our vendors. It's with our people. It's at home. And we need to defend the kingdom in a way different than we defended the fortress, metaphorically. And to tell a story from the technical perspective that is in business or everyday terms, that to me gets more ownership from the leaders. They start to respect it than convincing them in some way, you gotta be technical now. And I will say the people who are not technical or refuse to be technical are being weeded out of the organization because it would be like somebody now saying, I don't really think we need sales in this organization. I don't understand it and we can't have it. Nobody would put up with that.

Yeah. Yeah, for sure. So do you also help cyber teams to your mention of storytelling in business terms? Do you help teams communicate upwards, or are you more doing board trainings and helping those individuals learn how they should be embracing things differently, or both?

No, I do, I do both. In fact, my favorite, probably favorite thing to do, and I do it sometimes on retreats like at this retreat center I've got here in Breckenridge, Colorado, but I do it a lot in meetings, is simple story structure. All story follows the same basic framework, and once you have that down as a technical person of, okay, listen, we've got a hero with something at stake in a risky setting that faces an adversary who launches an attack and there's a defeat. And then we look for a guide who has a plan and that leads to victory, right? That is how almost every story throughout time works. When you start teaching that through Rocky III and how Rocky III relates to how you relate the story of the Colonial Pipeline and what it has to do, and we don't have to suffer the defeat. We're moving the defeat to the start of the story and the victory is at the end. And we have, we create this arc or this narrative of where the company, the hero goes. Like it's such a simple type of concept that you can literally fill out a sheet and then the technical people can utilize that to tell a business-based story. It's incredibly powerful because the executives already know how that framework works. They know how story works. They remember it. They get it. They see the arc. Oh, we're going from colonial defeat to our victory by taking this action plan and you're my guide. Super, super simple way to get that across. So that actually leads right into something that I do with the security and IT people all the time. Let me see if I can switch over to a slide here.

Oh, what just happened there? That is pretty cool.

The magic of technology. It turns out that story is a framework that pretty much everybody understands. And if you're telling a better story, whether you're an executive selling down or security selling up to get the budget, to get the buy-in or whatever, when you can create what I call a victory narrative, it makes a huge difference. Take a look at how story works here. And this is clearly, this is a segment that I do when I'm training one direction or the other. So in, in every story, you basically typically have a hero with something very valuable at stake that exists in a risky setting of some sort, right? There's, there's problems here. Then they face some sort of an adversary who attacks them and leads to defeat, right? That is story structure. There is a defeat in the second act of the story, which leads to the third act. At that point, the hero finds a guide of some sort who has a plan of action, and that leads them by the end of the story to victory. Now, there's variations of that, but that basic framework works over and over again. So if we take a look at this in terms of a story that you all know and we think of, of something that we already grasp, you've got Rocky Balboa in Rocky III, and he has got the heavy heavyweight belt title at stake. But he's gotten soft, right? The setting is such that he's no longer doing what he needs to do to be competitive, and that allows Clubber Lang, Mr. T, to put him up on the ropes, to attack right away aggressively, put Rocky on his heels, and that leads to defeat. That's the point of the story, that who comes along? Apollo Creed, right? His former enemy is now his coach. They come up with a plan. Eye of the Tiger. They're going to train just as hard for this fight as Rocky did for Apollo Creed's fight in 2. And that leads in the end to victory. Here's the issue is the average organization starts thinking about the problem that they have when they are in defeat, when they have failed at what they are doing. When you move these items around, when you shift how the story is told, and how the story is created. So this would be the, the CISO, the IT person who is creating a story. You start with the defeat and you end with the victory. It's called a victory narrative, and that's a term of my own. You are reorganizing from, hey, Colonial Pipeline had this defeat. I'm going to guide you through a plan so it doesn't happen to us, and you build That narrative format, it's a cyber threat narrative, but you're doing it in terms of victory. You're doing it in terms of business terms. It makes all the difference in the world. Instead of this defeat-action-plan loop, that's actually not defeat-action-plan, it's defeat, I'm going to give this to the IT team and not look at all of the different aspects of it. You're replacing that with kind of a better plan, a better story. The story that we're hearing a lot now is zero trust, and we can talk about that a separate time, but you have to build it in such a way that the executives understand the people above, and this works for the people below as well, that you're going from somebody else's defeat to your victory and using the negative aspect in a very positive way.

Yeah, that's actually the coolest presentation of 2021 that I've seen. I don't know about you, Teddy.

We're gonna have to get it on that.

Now, can you do Pulp Fiction? Oh my God. I can't explain Pulp Fiction. It's so out of sequence. I don't even understand the story. So not a good example of the storytelling methodology.

I don't think so.

I was making a joke about Pulp Fiction, but I think a lot of cyber programs are running out-of-sequence stories. I tell leaders like, you shouldn't be planning like in, in marketing departments, you can do a 5 to 10 year long range plan. In cyber, we operate in 18 to 24 month cycles and you can, swag some budgets. 3 years from now, your adversarial tactics are going to change. I feel like the last couple of years have been all about ransomware. Before that, it was about the last topic and we're continuously changing. So it's almost like you cannot write an entire novel or write an entire movie script about your cyber program, what you want to do, and just tell one story. It has to be, it has to be iterative. It has to be evolving.

I'm going to, I'm going to go back to another slide that I just happen to have up because of what we were talking about. Which is if you don't reprioritize your crown jewels constantly, like you said, 18 months, I'm down to a year. Like I'm recommending that you have that meeting where you're reprioritizing. You have a COVID type event and your crown jewels now live in a thousand offsite places rather than in the one network database, or you're allowing people now to compute on home devices or whatever. Your crown jewels are in a totally different situation. I love that you've used that term and that You're putting a time limit on, listen, this has a lifespan of 18 months or whatever.

I like that you have reprioritized because in some cases I would say, gosh, maybe 70% of the companies that we walk into to help don't know their crown jewels. So in some, they need to reprioritize if you don't even know them. And when we co-founded Reveal Risk, Tim Sool and I, we called it Reveal Risk because that was not happening in a lot of companies that we had seen. You need to understand the risk, the business risk, not the tech stack risk and figure out what battle we're fighting and what's the priority. And to your point, reprioritize that to dial in what the focus of the year or the day or whatnot is.

Yeah. And it goes back to who you hire and their vision for this, that this is not set and forget, to use the old saw, that this is very much about, listen, I'm going to come back and reevaluate tomorrow what I did yesterday. And things are going to change. And that type of dynamic mindset, it's a growth mindset. We could get into the whole growth mindset psychology of it. That's what you have to have in this field. And if I were going to test people on the technical side, growth mindset, diversity, those would be the top things I'd look at. Yeah.

It's sometimes we're grilling for how many certifications somebody has, and that's the wrong answer. Motivational fit. Acumen, business acumen. Those are the things that are hard to teach without experience. And it is always a balance, like people, process, technology. So I do want to, I do want to pivot to the last question we always ask is, and actually I think Teddy's got some more on getting into the field, but want to talk about one of your biggest challenges in this field that you've solved, not with technology, but with good people, with process, with And not that technology is bad, but how can we really shed some more light on the importance of the people process aspects?

So I'm going to one-up you there.

Awesome.

I'm going to up the ante in that I don't know that I've ever seen a company actually make huge progress on technology alone. So you say, give me an example of— well, every example of successful companies— and I'm not saying every company I work with is successful because some some won't do it. They are human solutions integrating with the technology. A good example would be, let's play off of the whole business email compromise or the call coming into your personal phone saying, "It's Microsoft. You need to give me your access to your computer." Worked with a large national bank who was having all kinds of trouble with their call centers and business email compromise or wire transfer fraud in this case. People would call in, they would convince these tellers that are paid— phone tellers that are paid, what, $15 an hour. Hey, you need to wire transfer these funds. They call me, you got to solve this. You got to train them better. They're not doing their training, so forth, blaming it on the end users. So I go down to Florida where they're based. They're affiliated with a large theme park there, go down and present to them in a different way, which is a collaborative way called appreciative inquiry. So it's, hey, what's going right in this call center? What's working? What are you doing? And pretty soon you start to hear what's actually happening because you're not talking to them about how they're missing something. You're not doing gap analysis. You're hearing what you're doing. And what we came up with as a group was they had all of the answers they needed inside of their people. They were trained. They knew what to do. But the problem there was process. The problem was we get these— we get paid on how quickly we get these people off of the phone and get it onto our next call, solving the next problem. We are incented to not take the time to authenticate that they're actually who they say they are. That was the problem. And of course, behind the glass window, or in this case the video camera, the executive team is sitting in the boardroom watching these people who are finally being honest because we're connecting personally. My God, this is not a problem that we don't know. It's potentially not the user that they, their accent is wrong or whatever. We don't have time to properly authenticate them or we get penalized and we're not going to do that. And that people and process solution to the fact that no technology was going to stop stop that without the people being involved. That was so incredibly satisfying. And I got a quote, and it's probably someplace on my website, that the week after this simple training where we found out they had the answers— it wasn't about me, it wasn't about the executives or the tech team, it was about the call center people coming up with it— and so they owned it. They said that they had a $300,000 in one week, a $300,000 save of we had this call and in the past it would've led to wire transfer fraud. And in this case it didn't. And I'm sure that replicated itself over and over through all of their branches.

Yeah.

And the Six Sigma black belt in me is super excited about that methodology and process. And I almost feel like you got to be a little bit of an Undercover Boss show host to be able to create that experience.

Totally. You, I'll tell you, you get the people away from the power structure and just get them talking about what's going on. You learn so much. They'll never do it with those people in the room. And that's the power of bringing in somebody like the two of you or myself to do some of this work is you hear what's actually happening, not what the conception of the leadership is thinking.

Right.

Totally. Yeah.

So John, you're probably the epitome of a perfect guest for us as our entire theme behind our show is how do you use people and process over technology? And most people point to a technology that fixes the problem. And you, I don't think you use any technology in terms of to come up with your final result for who you're training. I think that's fantastic. And you've done, you've really shown that cyber is not just tools and technology and hands on keyboard. And so with that, I want to pivot to my last thing is how do you help show people how they can be their own cyber warrior and with their own strengths and skill sets that doesn't have to do with computers? Because we've got a lot of people that are, that ask, how do we get into cyber? But I'm not good at typing, right?

Coding.

I'm not good at coding or something like that. So with that, yeah, what advice would you give to those people and like finding their strength and how they can be effective in cyber?

So you're not talking about just the average employee who wants to do a better job. You're talking about somebody who wants to be in the field of cyber.

Yeah, they want to make a difference in cyber. Yeah.

I think that I have such a strong business bias to this that I see little— so little business thinking and holistic thinking in terms of this. I would say that by example, the best heads of security and risk that I know of have a business background and are open to technology, meaning that they've sat in on the tech meetings and they're willing to learn some of the languaging. More importantly, they're willing to learn a framework of how to think about it, whether it's a story framework or zero trust framework. In 5 minutes, I could give a business-type review of what zero trust is that exactly 0% of the average corporate board or executives think about. So I think it's willingness to be open to the technology side and to ask questions, the curiosity aspect. What we taught a year ago has almost nothing to do with what we're teaching today.

Right.

So to be curious about it and learn it from the ground up right now and ask the questions, that's really where all the change comes from. It does not come from— we have moved from, how do I say this, from an expert model of knowledge to a curiosity, to a I want to know about this model. And the person who goes in and says, hey, I want to know about where is our data, What's most important? Let's organize this around our business outcomes. Let's organize this around our activities, not around the data. Doesn't matter. It's everything connected to the data that matters. But I want to get curious about that. That to me leads people high up the ladder through the technical ranks or over the technical ranks into the management type positions. And I don't think you have to be super technical.

That's great. So you're sitting there in beautiful Breckenridge, Colorado, which I've skied at several times now. I think when we were prepping, you mentioned that you, you needed to pivot your business to more good news stories or a different flavor of that. So tell me, tell me what you're doing beyond cyber and specifically in Breckenridge.

Yeah, I do retreats and traditionally they have been with executives who need this type of training, whether it's presentation or Hey, let's give them a framework of how cyber works. And you're right. Cyber can oftentimes be, uh, you're always fighting the enemy. They're always renewed. They're maybe steps ahead and it can get a little bit depressing. So I started doing these retreats, having seen all the burnout that the cyber teams are going through. They are, they're whacked from spending a year going to in-person, work at home, back in hybrid. And that kind of has morphed into, I don't know, the shortcut for saying it is intentional living for overachievers, people who work really hard, but they want to maybe slow down, work a little differently, work smarter, not harder, maybe work in a very different framework of how you used to, especially when you're creating and then take time out to recover. This is really— the retreats are about recovery and about thinking, what's important to me? I'm rethinking post-COVID. I'm rethinking because I've achieved what I want to in, in this job or this stage of my life. We come up to Breckenridge. We have a lot of quiet time. We do a lot in nature. We give skills like niksen, for example, is a Dutch skill of literally sitting and doing nothing. How is it different than meditation? Vastly different because there is no intended outcome to it. But what you see, the brainwaves in people as they slow down, they start to get more creative. They start to recharge, re-energize, have better ideas for the corporation. So it's ultimately, does it benefit the company? No question. Is that the point? No, it's to get people to live and work more intentionally, maybe work a little bit less, live a little bit more. And doing it in a setting like this is just whether we're mountain biking, hiking, going to a spa, sitting and reading a book in front of the fireplace, talking around the fire pit, fly fishing, whatever. It changes the mental mindset and it gives those people a chance to recover and rethink.

Yeah, that's really cool. I know a lot of folks in cyber that have told me that they're not their best self after, whether it's burnout or just 17-hour days back to back or a long incident that everyone's been, had to be more than the 8 hours by far. For such a sustained period. So I think doing that as individuals or groups and teams, that's a really important and often overlooked necessity that's going to help in this field.

And it's more than a one-time vacation as a fix, right? It's changing mindsets of, hey, we need to work in a different way for the long game here, and that's going to mean X, Y, and Z. So a lot of times it's individuals coming up When it's cyber, it's usually a team coming up and we're mapping out a strategy of how to create this longer burn, take a deep breath, this stuff doesn't go away type of strategy.

Yeah, John, this has been great discussion, great dialogue. I think we collectively unpacked a few things that we didn't even plan or think that we were going to unpack. So that's been awesome. Really appreciate having you on the show. Anything else you want to leave us as parting advice or thoughts for the listeners?

No, let's all get together, come up here and we'll ski or fish or whatever and, and get to enjoy each other just as friends. To me, the human part, like we've already talked about, that's the most important thing. I will learn more from your wisdom than I will from any course that I sit through. So I appreciate you sharing your side.

Awesome. Thanks so much. I'll take you up on that and we'll talk soon.

Yeah.

Good. Thanks so much.

All right.

Bye.