The Evolution of Human Risk - Simplifying Cyber with Ashley Rose of Living Security!

Thanks for tuning in to Simplifying Cyber. I'm Aaron Pritz. I'm Cody Rivers. And today we're pleased to be here with Ashley Rose, the CEO and co-founder of Living Security. And I'm especially excited for this talk because I've been an advocate as well as a critic all things security awareness and human risk back from my corporate days when I walked into a reboot of a cyber program after an FBI arrest of individual insiders and trying to get the business outside of IT to understand and do things very, very differently. So, I'm excited for this, Ashley. It's been a long time in the making. Looking forward to this conversation. Before we dive in, let's hear a little bit of the Ashley story and how, how did you find your way into cyber?

Yeah, I think like many in cyber, I have a non-traditional background, but you may hear people that just kind of fall into it, whether it's like military or, you know, government work or marketing and comms. I think we see a lot of, especially in the human risk space. So, and that's, you know, really had been my path. I went to school for business marketing. Actually fell in love with business through a program called DECA. And I, it's top of mind because I hosted my daughter's, my senior daughter's DECA end of year party yesterday at the house. So that was very cool.

Nice.

And really like what I learned about myself through that program and then through my years in schooling is that I just love to solve problems. And so that like, that's as simple as I can state it. And during you know, first in high school and then sort of post, or I'm sorry, during college and post-college, I actually got my feet wet in entrepreneurship, but building an infant and children's swimwear line. So yeah, that's probably surprising to people. But what was, what was really great, and I look back on that experience fondly, is I had to go from customer research, problem identification, design a solution, bring it to market, deliver it to the customer, and then solve the customer problem over and over and over again. And so like that in essence is what entrepreneurship is. And so doing that once, I learned a lot and was able to apply it to future states. So, you know, I spent some years in private company marketing and then I ended up actually, you know, really kind of getting my feet dirty, right? My hands dirty, my feet wet in cyber, kind of more from the audit and compliance angle. So I was I ended up as a product manager on a product team. This is what product people do, right? They're solving problems. So I was like, this is great. I can go solve problems with tech. And I was actually building an internal identity and access management solution at my last organization. And that's, you know, that's when I started kind of learning about the technical side of cyber. My husband, his background is more traditional. He came from a military background. He went MI, military intelligence, spent a couple years over with the Marine Corps doing cyber network and operations. When he came back post-deployment, he was building the cyber program at the company that I was working on, the identity solution. And I was actually able to witness firsthand the problem that he was having in the space. And I remember just like a very vivid conversation. This was happening, he, you know, he'd be coming home and building games. And at the time he was building an escape room for security training. And I remember asking him like, you know, You're a cyber guy, you're a tech guy, why are you building cyber, like games for people? And he said, Ashley, like my number one challenge is getting the people to care, getting them to engage with cybersecurity so that when they have a question, when they have a problem, that they'll come to me. Right now everyone is like scared of the cyber team. They think they're, we're gonna tell them no, we're gonna shut off access, we're gonna block them from doing their jobs. I need to start working on the culture. And then that was kind of my aha moment as a problem solver entrepreneur. I said, okay, like this, this really makes sense. And then we asked ourselves, if you're having this problem, how many other security leaders are having the same challenge in their organization? And so just to kind of fast forward to not quite the end of the story, but maybe the beginning, I found myself on the Black Hat floor with a tablet interviewing CISOs about what was going wrong within their human risk cyber program, and I learned a lot. And, you know, maybe the rest has been history, but I'm sure we'll, we'll close the gap on that today.

Well, that's awesome. And it didn't click for me when we did the, the prep call a couple weeks ago, but when you think about it, marketing as well as entrepreneurship is really a lot of the problems and the basis for the workforce or the human risk factor. And like some of my, on the corporate side, Some of my best people that I brought into roles that ultimately went on to become BSOs and lead insider threat programs were from marketing, marketing and a little bit of finance. So I do think like the cross-functional, like bringing people in that aren't traditional really helps us from a diversity of thought standpoint. But as well as like, how do we get people's attention? Well, that, that's marketing, that's comms, that's PR, right?

Well, let's, I mean, I know we'll get into SAT, but who built the original security awareness and training programs? IT professionals. And so like, if we just like, we take that for what it is, it's, you know, people that are working mostly with computers and tech, less on the business and people side, they're trying to solve a business and people problem. And for all intents and purposes, the stats, you know, make the claim That has not been successful in my opinion. And so I think like it was actually a competitive advantage for us that I came more from a business, you know, marketing perspective. And, and to your very point, marketing's job is to drive behavior change. The behavior that they're looking for is how can I get you to follow my path, click my link, you know, go make a purchase and become a brand advocate and ambassador. In a similar way, when we're building a security culture, trying to drive positive behavior and become a security advocate or a champion, we're taking a very similar approach. So, yeah, a lot of kind of the methodology, like things I learned on the marketing side, we've been able to apply to the human risk side as well.

Love that. And I was in a conversation yesterday on sales automation, and I made the comment like sales automation and automating people to click on buttons. Click things and emails. The converse of that is the cybercriminals and the phishers, right? It's all about social engineering. There's the white hat social engineering, which is probably some benevolent thing like, "Hey, come look at my product and click the link, and I want to get you into the funnel," you know, that will ultimately lead to sales. But on the flip side, criminals are selling your entrance into their ransomware. So, so many parallels. That's not a great parallel, and sorry to my sales friends. That maybe I didn't get the good side of that one.

Did you just equate marketers to cyber criminals? Because that's kind of what I was thinking.

No, salespeople. Marketers are cool. Yeah, Ashley, you, Bronwyn, you're in the cool club. Salespeople, I might have just—

Oh, those salespeople.

You know, yeah. Anyway, let's move along before I dig my hole any deeper.

Yeah, well, and I also say real fast too, Ashley, I think I love the fact that your background is not the traditional route because a lot of times I tell people with like our clients, like, when you're trying to sell to people, IT and cyber, we know they can understand or have the foundational understanding of why this is important. But we're trying to get those who don't care about cyber, who don't think about it, like my most furthest stakeholder from it. And I would say marketing kind of gets the picture there, but they're, to your point, helping to sell the intention and to sell the dream. So I love that. That's why I love what you're doing over there and excited to chat more here on the podcast.

All right, so we've gotten through the entrepreneurial marketing background, the, the babies and kids swimwear, the pivot to cyber through both your own intrigue and your husband. Now let's fast forward to early days of Living Security. And I remember you guys like coming out with the escape room stuff before anyone was doing it. How did all that come to fruition? And then ultimately, let's pivot from SAT or security awareness and training to HRM and really get into maybe our listeners that aren't as familiar with that. It's not just another tool, but the tools have to look very different from what we've seen over the last decade.

Yeah, absolutely. So I'll actually go back to that black hat floor because the two insights that I heard just from every conversation, they're actually, you know, quite similar. One, there was a lack of engagement with cyber. People were not paying attention. It was not presented in an understandable and, you know, an approachable way. And therefore they're zoning out, tuning out, and still doing the same things post the training, despite, you know, clicking through and getting all the answers correct. So there was no behavior, there was no engagement, no behavior change. The second thing that we learned was that outside of, you know, I would say kind of easily fraudulent metrics, Completion, click rate, report rate, right? We can make our click rate go down if we make our phishing scenarios easier. We did not have any way to effectively measure and quantify human risk. Those were the two things that really stood out in my conversations. And so I actually remember sitting at a park, I can tell you like the exact location, and Drew and I sat on a hill and we like debated hardcore, which one are we gonna go after first? Because like we couldn't do both, right? When you're like a new startup, you are two people and little, like a little bit of funding, you gotta choose. And ultimately to, you know, maybe my dismay, 'cause I probably would've built human risk management in Unify back in 2017 and it would've absolutely failed, fallen flat on its face and nobody would've bought it. We opted to go, it was ahead of its time. We had to go the engagement route. And so we said, fine, let's do it. And so what was the fastest way to get product to market? It was to— Drew and I were not technical coders, although now with AI, I actually do a little coding myself.

Vibe it, vibe it. There we go.

I'm a Viber, a vibe coder. So, and yeah, so we said, well, what can we do? We can, you know, take these escape rooms that were like, were really, really popular. They were just kind of hitting, you know, a big street, just kind of like with the general public as well. And we were gonna turn those into security training. And so we were literally like, you know, going to Goodwill in the beginning, picking up props and then retrofitting them to basically like mimic security situations, packing them up in boxes, like literally luggage and suitcases, jumping on planes, and then getting on site with early customers and running these escape room experiences for their employees. And I'm talking like turn and turn, like every 30 minutes we're getting like 8 people in a room. And I'm on site for days at this point, right? Because we're trying to get like mass audience through. So what I, what, what was really unique about that opportunity is I got to sit next to these program owners, the CISOs, the leadership team that they wanted to bring through. And I got to hear firsthand for hours at a time, days at a time, weeks at a time, what was going on within their human risk and cyber program. So like Unify, like the human risk management concept, was actually like birthed on the ground floor in Security Escape Rooms, like alongside of the customers. And so that's truly like how this concept really developed. Like we knew we needed to be able to quantify risk, but we didn't really know how or like what it would look like. But we actually really got to materialize that while we were on site with the customers doing the escape rooms. And so there was a really like natural progression there. I'll say, you know, to kind of click in that. So the escape rooms were very popular. Customers loved them. One of the things that it truly did that I think you do have a hard time doing sort of with like mass scale online training is like the security team was in the room and they got to see like the benefit and value of the program that they were providing firsthand because the aha moment would like, it would pop up and you'd almost see this person like the light bulb go off when they learned something like unique or they would ask a question or say, I saw this thing on my phone come through. Like it was so visible, the ROI, still hard to quantify, but very visible. And so that really motivated the customers to keep like wanting to do that more and more. It actually probably wouldn't have been for like, you know, outside of COVID that I don't know that it would've been really hard to shut it down because it was so beloved. Like we still have people today come back and say, do you have these escape rooms? But anyway, COVID obviously accelerated accelerated the need to be online and to achieve scale. And so it was through 2020 and then some capital raising that we went after problem 2, right? Which is how do we, how do we get visibility? How do we quantify risk? How do we deploy interventions at scale and how do we drive an ROI from our programs? And so that was really like the accelerant for us was through, you know, like many businesses, like the COVID pandemic, you have to pivot and go with where the market's going. And it's been a great journey from there.

Love it. So, Ashley, talk about, because I think when HRM was kind of relabeled, Forrester declared it. I know you mentioned to me in the prep that Gartner just asked if we could do another, if it needs to be renamed again. And I think both of our reactions were very similar, but talk to me about, I think there was a misperception early on that risk quantification was going to be on the human risk signals that were available today, like phishing, like we're, we're doing metrics better. But talk to me about like the broader signals that, you know, an evolving HRM program should be pulling in and really how it starts to look very different from what SAT was able to measure and metric over the past.

Yeah, absolutely. So we started very intentionally and the naming convention was also very intentional. We called it risk management because I believe that is our job. You know, we are human risk managers. We're not human risk eliminators, and risk management is a business security function. They have to work hand in hand, right? So, and I do believe, I said this on the prep, that I think risk is not inherently good or bad. I think there is acceptable risk, and sometimes, you know, you have to take risk to drive competitive advantage. So when you have CIOs and CEOs saying, Hey, everybody in your organization needs to be using AI tools and there's like not a lot of, you know, security governance and restriction. The question is at that point, how do we like, how do we manage, right, the risk around this? And ultimately you're weighing out the upside, right? The potential benefit of letting people do that with the downside risk that could come with a security incident, a breach, right? Privacy, all that. And so, And we know where that's landed. I think generally many, most companies that I've, you know, have talked to, like they want their teams interacting with AI and they're gonna go figure it out after the fact. Now we have, you know, maybe more compliance oriented or people that have, you know, maybe not quite that risk tolerance that are blocking, restricting. I would beg that, you know, I would say there's probably a lot of like shadow AI in those environments, but we'll, we'll talk about that later. But back to your question. So started out with, Okay, this is truly like a risk management function. How do we quantify risk today? Likelihood and impact, right? And so how then can we quantify human risk in the form of likelihood and impact? And so that was really like the basis of where we started. And so we said, well, what are we learning from our metrics today? Well, how, what's the propensity of somebody to click on a phishing email potentially? Because, you know, these are also simulations, they're not real, but like it's giving us some signal. And then, are they taking their training and are they compliant? And like, that's really not a lot of depth, right, when we're thinking about risk quantification. And so it had to be more. And so then the next question was like, well, where can we get some of these risk signals from? And so we realized that like a lot of this signal aggregation was already happening in the security teams, right? We had SIEMs and SOARs like gathering and collecting data across, you your entire infrastructure and security tech stack, but they were like feeding it back into, you know, a solution that was really optimized to manage, you know, your network, your assets, your devices. Like, it wasn't tailored for user risk. And so in a similar way that the SIEM was collecting the data, we realized we could actually start getting a lot of behavioral data about users, not through simulations, but just how they were interacting within their environment. Was their endpoint compliant? Are they clicking on real phishing email? How are they handling data? What websites are they browsing? Are they using MFA? Are they setting strong passwords? Like the list goes on, but a lot of behavioral signals. So that was great. That was a great signal start. I would say there's some companies out there that will stop there. We said, well, that's not really true likelihood and impact either. And so how do we, how do we move beyond? So we said, well, we need, we need a threat vector. We wanna know like, is this person getting targeted, right? Well, there are signals, contextual signals outside of the behavior that really matter here too. So maybe we can get some of those through threat intel platforms. Can we see people who have breached credentials, for instance, that were found in the dark web? Absolutely. And so then the next piece was, all right, now let's think about the impact. Where can we get that signal from? Well, we can tell who has admin privileges, right? Who has privilege escalation. If their account's compromised, what's the blast radius for this individual? And so we wanted to go after the sort of inherent risk signals, the identity signals. And we really, we believe that if we could marry these two, these three areas, the behavior, the threat, and the identity, we could give you a really, really solid risk quantification engine or an HRI score and really give you the opportunity to start prioritizing where you spend your time. How do you get to that 10% of individuals that are driving 73% of the risk. And that's a, a backable claim by a study we did last year. So I think that answered your question, but like, it really was that simple. It was just, what do we need to get? What do we need to accomplish? Where's the data? Can we connect it? Does this make logical sense? And then let's go after it.

Well, and one follow-up on the, can we connect it? For those of us that went through like UEBA, you know, probably 5, 10 years ago, UEBA implementations and lots of Actually, one of the managing directors on our team, when he was first getting introduced to HRM, he was like, oh man, I went down this with UEBA and all the connectors and trying to get everything. And it always sounds great from the vendor perspective, but then nothing connects right. But that was 10 years ago. APIs are different. The world is more interconnected. What does that look for you guys? And the kind of promise of the great things you can do if you connect everything to actually connecting it. What does that take?

Yeah, that's a great question. So certainly we have stumbled quite a bit. I have all the bumps, the bruises, and the scars to prove it is what I tell people when I'm, especially when I'm speaking to the enterprise, I'm like, we've seen it all. Like we work with the biggest companies in the world. There's a lot of messy identity, you know, out there, like a lot of messy identity systems. And so one of the first things that we did was realize like we needed to create our own entity resolution and identity graph in this solution because we're gonna like see Ashley and her, you know, on the endpoint and in the web application firewall and like in the email security tool and like Ashley's gonna look different in all of these systems. And we needed a way to bring it all together and see like who Ashley was, what she was doing, right? All of those things. And so, so that was the first thing we did. And so then it didn't like, we like a source of truth, right? Typically that's coming through like an HR system, a Workday, maybe it's coming from your Okta or your SailPoint, like an identity, solution, but we could then orient everything else around it. And we're really kind of like cleaning up the identity mess in a lot of these organizations. So that was the first piece. The second thing was when you go out to these APIs and you're bringing in signal, we knew we did not want to be like an alerting and noise platform. And actually something I think is worth noting that you said, right, when you did UEBA, like oftentimes the complaint was like, this was very noisy. There was a lot of alerts, like you couldn't really find the needle in the haystack that you were looking for. And it was also like very reactive in its approach. It was meant to be more of a detection response system. HRM, our focus was on how do we shift left and how do we go to predict and prevent so that we're finding the signals and the sequencing that could lead to an incident and getting in front of it before the incident and the breach occurs. And so it was a very different like mindset and approach. And so the data model had to support that as well. And so we said, we don't want all the data. We want the meaningful data. And so we got really specific about like what parts, what feeds, what signals and streams we're gonna be pulling in. It had to add context and value to our model, and the output needed to, to not be noise or junk either. We wanted the output to be actionable. And so when we started building like the signal library and all of that, like it, it was with the mindset of how do we make this actionable? I'll say like maybe this last third thing to answer your question, There are a lot of systems out there. I would say pre-AI, it was very like time-consuming and costly to build out a lot of APIs direct to these systems. And we found like enterprises would have, I have this homegrown system or something you've never heard of. And so our team spent a lot of time like building out custom connectors and we had, you know, sort of an internal like, you know, sales engineering position where we would have to go out, we'd build this custom connector, we'd work kind of directly hand in hand with the customer. And making sure that there was trust in the data that was coming in. That was absolutely critical. It's actually why one of the first reasons we started outreaching to partners like Reveal Risk, right, and others, is because we said, hey, there's, there's really a need for services in the upfront, like, implementation of this for these enterprise customers that have complex environments. And so, yeah, I'm not going to, like, say that it was really easy. We learned a lot. I think we've gotten very good at this. It's, like, one of the things that is standout-ish about our company. And then certainly with AI, we're, we're doing some really cool things where, you know, now deploying like AI against an API, you can actually do things like best-guess matching and then surfacing up, you know, signals that you haven't seen before. Like the AI can kind of like map that to the data models. And so there's some really cool advancements which we can get into, but yeah, complex environments takes a lot of work and we spent the years to figure it out.

Love it. Ashley, do you have a dog in the office?

I do. Did she—

no, no, it was, it was perfectly, it was perfectly timed because when you were talking about signals, all I saw was a little tail wagging right below your name and I'm like, perfectly timed. It was on cue. Love it.

Yeah. So she was supposed to be with, uh, I have a, a child from school in the back room who's supposed to be keeping the dogs quiet.

So, hey, we, we applaud when, when office Office canine workers make an appearance. So that's welcome on the show.

All right. Good. Good. Well, she may jump up in my lap if we let her, if we keep saying what a great opportunity that is for her.

Ashley, you've done a lot of cool things. I want to talk about kind of like the action out of what you're gathering the data. And I think it's on a prep call or was on an interview. I think I read that you did recently, but you said something that stuck with me and it was like, make the secure path the easiest one to follow. So kind of give us what that looks like in practice.

Absolutely. So first and foremost, CISOs, security leaders, like they need to know where to spend their time actually learning about which pathways are broken. 'Cause I think a lot of times we actually don't know 'cause we're trying to like combat the thing that's like on fire in front of us. And we're maybe missing out on some like really big opportunities to, enable faster work streams, drive business efficiency, and enable the business to drive operational results in a secure way. And so the first pass of that, the first requirement of that is, can we go figure out, is there an unknown unknown in our environment, like an area of risk that's just like we haven't quite figured out? And we've seen that in a couple of our customer environments where it's like, okay, this group of people continues to do this same thing over and over and over again. And in the past, I think we would have said, oh, those stupid users, like they don't care about security, why are they doing that? Reality is that, guess what? We're putting a lot of friction in their job. They need to go get something done. They have a goal and an outcome, right? These people were hired, they're smart people, right? They went through an interview process, they were given a mission, and so they're trying to get their job done most of the time and something's in their way. So, you know, an example I gave, maybe it was in the prep call, was, You know, we were working with a healthcare system and they were like, hey, these, you know, nurse practitioners and doctors, they keep like sharing their password and, you know, they're not, you know, they're bypassing MFA and all these things. And it took actually like going and having a conversation with that business and even like maybe getting on the ground floor, like going to the hospital system and saying like, what is happening? Why are we behaving like this? To realize these healthcare workers, like their number one job is to save patients' lives. So they're on the floor, they're trying to get their job done, and like this system's logging out pretty consistently, and like they're moving carts around, and it's just taking so long to get, you know, to the patient record and, and whatever else. And so, you know, that's a risk, a risk decision for the business. Like, do we, do we wanna keep this type of, you know, logout time on the, on the system? Maybe we wanna, we wanna extend it. Is there like a different type of tool that can make it easier for these, you know, doctors and nurses to log in? You know, there's, there's something here. That it's not what we're doing now because the behavior that we want is not happening, right? The behavior we don't want is happening. So that's not secure. And on the flip side, we have frustrated clinical staff. And so that's just an example, but like it required the data to be surfaced to start and like ask the question, like, why is this happening? Go investigate, go spend time with feet on the ground, or go have a conversation with, if you have a BSO, right, your business owner over there, And then really co-author and work together to strategize what's gonna work for our business, what's our risk tolerance, and let the business make the decision, right? Is this acceptable risk or not? Do we wanna pay to mitigate it, to transfer it, to reduce it, whatever that is? And so that would be like one, you know, kind of on-the-ground example. There's plenty of others, but like sometimes it's a systems issue. It may not be the bad users that keep doing something wrong. I mean, maybe it's a problem, but we're not gonna train that away. Right? Like, and we, if we could have, we would have by now.

Yeah. I actually, I'd like to double down on like the business process issue piece. Cause so when I was on the corporate side and had the FBI arrest and the insider threat, you know, the, you know, no lack of executive support to fix it, which not a lot of cyber leaders get. You don't want to get that level of support, but when you've got, you get it, you can do a lot of things that you maybe couldn't if they're still kind of doubtful that it'll happen to them. But on broken business processes, right after this, obviously we really amped up the data loss prevention capabilities because data loss, data going out the door, exfiltration, that is insider threat. And when we were first turning it on in the high-risk countries, as well as the high-risk business areas, all sorts of alerts. And some of it was white noise, but a lot of it was, in that case, like insider threat, HR is doing interviews and you're doing investigations. And if it's you know, not a false positive, then like, you know, potentially someone is doing something bad. But what we realized early on is there's so many broken business processes and people have done things a certain way, you know, emailing to vendors in clear text, so very, very sensitive files, or pick whatever bad behavior it was. And it wasn't anything any security awareness training once a year, quarterly, bite-sized, it wasn't going to fix it. Like somebody needed to go re-engineer that business process. And then the second thing on Cody's question, like making it easier, hey, if you're going to, you know, if you have the signals from a quality tool, HRM, DLP, wherever you're identifying the gap and you're going to go in and fix the business process to make it secure while in there, why would a cyber person not want to take some credit for like getting rid of unnecessary steps and making it go very much quicker? We had a bunch of success when we use Six Sigma black belts to kind of parachute in. And again, it's hard to ask a business process owner to be like, hey, here's a, here's an HRM report and your business process is broken on top of everything else you're doing. Go fix this on your own without direction. That won't work. So I'm a big advocate for our industry and CISOs have understaffed SAT. Usually a lot of companies we see is like half of a person. If we want to get HRM right, we can't expect, even with the greatest tools, if you don't have the human capital around them to enact the positive change, there'll be a lot of good signals and tools that, and we can block stuff, but like, let's, let's put some effort and resources behind this and, and do all the things that CISOs wish, wish, wish the human side of cyber could help. So I get a little passionate about that, but what are your thoughts on the, let's, how do we go fix it?

Yeah, there was like so much goodness there in the story that you just told. So a couple things really stand out to me. First and foremost, it's not just about adding capacity, but it's also empowering, enabling, and like actually elevating that particular individual. So I remember like one of the first or individuals, because one of the first decks that we built around human risk management, and again, in partnership with the customer, it was like, there was like a table and, you know, SecOps was there and like insider threat and GRC and like the network security team and like, you know, the list goes on. And it, you know, they had like the table and they're like enjoying a conversation. And then there was like the kid table over to the side. And the security awareness person was like sitting at the kid table. And like this analogy came from our customers. They were like, we aren't invited to the conversations. Like we don't have a seat at the table. And so how do you expect them to go help solve? Like your number one risk is your people. Like stats are clear. And like you put a person on that, that is great. Like they are, they are motivated, but they do not have the tooling, right? They do not have the access. They oftentimes do not have the executive support and they don't have the budget. And so that is like a really hard position to be in. And so when we talk to this type of individual, they are like, they're always telling me, they're like, I want to do more for my company. I wanna be able to prove out that the work that I'm doing, like, I know it's doing good. Like I can feel it. Like, right? I can see it, like I can see the light bulb moments, but like I have no proof of my effort. And so it's hard for me to communicate to that around that, and I can't get budget, right? So that is like still very much, I, I'd say, the state of the industry, which we need to do more work there. Um, so yes, we need to give them a seat at the table, and we need the cyber teams, and we need CISOs to recognize that this is like a critical attack surface. And you need to manage that well and you need to staff it well, and you need to be breaking down the silos in your security team. And so then moving to the tool, right? How do we do that? We always say like human risk management tools when implemented and operationalized effectively are breaking down the silos. So first and foremost, we can't do anything without the security data. So we need SecOps at the table. We need the tool owners. We need to be pulling in and ingesting the data. But that should not stop there. When we are able to categorize and derive really important insights and prioritization of risk, there's so much value for these tool owners, and context that we can provide them can actually enhance the value of the tools they've already invested in and that they're spending their time. So let me give an example. The DLP issues that you were talking about, you probably like weren't gonna go block every type of, you know, DLP alert that came through. Actually, many times, like, the DLP, UEBA solutions, when they're first put into practice, are in, like, read-only. There's, like, not a lot of write happening. And we've seen that, and, like, people have, you know, negative connotations about, like, the first pass of this. But, like, the real reason was because it is noisy, and, like, there was a lot of risk if you blocked somebody from getting their job done. And especially when it was, like, maybe not a malicious insider, right? There's a lot of false positives in there. But what if we could start prioritizing those alerts for you? What if we could marry high-risk individuals across numerous systems, across their identity system, across their email system? Like, you know, what are they doing within phishing and all of that? So on their endpoint, is their endpoint out of compliance? What if we could see very clearly that this person holistically is very high risk, and now we're also seeing a lot of DLP alerts, maybe we would turn on a block for that individual, right? You know, and then people that are more vigilant in nature, right? They're reporting phishing emails, they're taking their training, and they're doing their— they're setting strong passwords or using MFA. You start seeing that, like maybe you're gonna not block it right off the bat. Maybe you're gonna send them a training, you're gonna send them a nudge and like redirect them to the appropriate business process. So you can start providing contextualized and adaptive controls and policies when you have the context of that individual from a risk perspective. So I think there's a lot of value for security teams in doing that. And then I think there's two other points I wanted to make from what you said. Efficiency is key. We have small teams across all of security. We are understaffed, not just in the human risk side of things, And so it was really important for the platform to be able to enable a lot of efficiency and workflows. And so there's a lot of like broken security business practices. Like if you wanna just like clean up your own house first, you know? And so for instance, like I had a customer tell me, okay, well, when there's like an exception policy that's requested, you know, the plan is, the path is that they need to go and they need to take their training. Once they take their training, we can give them the exception. And that, you know, if they don't have it after so many days, we need to go like revoke that access or exception. And that this was all happening manually, like it's tickets going into like ITSM and ServiceNow, and then somebody's like getting a list and they're like sending a training, and then they have to go track and see if that person took their training. And then maybe like if they go check on it, you know, they're gonna go check on it later, maybe they didn't take it, so we have to go send like another ticket back, we're gonna revoke their access, and then that user's like pissed. They're like, I can't get my job done. Like, what if that whole thing could be automated, right? Through a platform like an HRM platform. And so this is where like workflows and automation can be really helpful in achieving scale. If you can clean up some of like the operational burden and friction of just like the management of these programs, you can actually like take those resources and like reposition them and pivot their focus to something that is more strategic and they can get more, you know, get more done you get more, you know, bang for your buck with your security budget, if you will. And then the last thing I think you said was around ROI and measurement. That's critical because if you can't, you know, especially today, like if you can't provide business justification and some sort of ROI story, it could be as simple as, hey, instead of requiring everybody in my organization to take 30 minutes of training a month, I'm only gonna target risk-based training to the people that need it. And that's probably about 10% of my staff. And so the 90%, That equates to 10,000 people. We're saving 30 minutes a month. Average, you know, cost per hour of wages for our people are this. This is like the potential cost savings for the business by going into more of a risk-based approach versus requiring training for everybody all year long. Like that was just one example, but it's very, it's more concrete, right? It's black and white than trying to say like, okay, what is like the risk avoidance? Like how do we quantify that? Certainly we're working on those things as well, but I think we need to get more creative and like that financial-oriented mind that you said earlier, that sometimes it's really great to be a part of the security team. Like, they can be helpful in those, you know, business calculations.

Love it.

Yeah. And thinking too, like, we've been, you know, years in the game now in security awareness training. I think HRM now is kind of catching some of the fire, and I think we're getting some of the groundswell. Do we get to critical mass? Does the name change again? I mean, what are your thoughts there? How do we start to get this in the limelight, or does the narrative shift again on the name of what we're trying to accomplish?

Accomplish? Yeah, great question. So if you look at like analyst coverage today, they'd probably say that we're still at about 15%, and I would say that's growing and it's accelerating adoption of true human risk management. Again, I do believe like the last, I would say the last maybe 3, 4 quarters, so almost a year, like we've actually seen a huge uptick and we track things like number of RFPs that are coming in and we can see like customers and all that stuff. So, so that's really good news for all of us because as you know, like Third-party risk and supply chain is a big thing. So if we're all safer, if we're all more secure, like everybody benefits, right? So we should all be advocating for this. Look, I think naming convention, I feel pretty strongly like this is a risk management function. So I think that's great. Human risk management, who knows, right? Because the workforce is changing and that's really where we're spending some time is really understanding that the workforce is now hybrid human and AI agent. And so then therefore, like, the workforce attack surface is changing before our eyes. We know that humans and agents are interconnected because we're delegating access and we're creating them. We have agents working on behalf of humans. And so we need to get our arms wrapped around the broader workforce challenge and equation right now. And so does that turn into something like unified workforce risk management? I think there is probably over the next decade some sort of change that's going to occur, but for right now, as we're maturing this category, you know, we talk about this as like, hey, it's, you know, we're a human response vendor. We operate in this category and we're not thinking about the hybrid workforce, which is inclusive of our AI agents.

Yeah, no, that's a great point. What I do know is I don't want it to follow the path of GRC, you know, similar. Gartner, Forrester renamed GRC Integrated Risk Management or IRM, and now it's back to GRC, or there's confusion. Are we back? Are we not? And what didn't happen was the tech— the technology didn't shift materially. And if analysts are calling for name change because the technology category is not showing value, that's not a naming problem. That's an adoption, people, process, technology, making it all work together, and a technology capability.

Problem.

So I've already seen, you know, a more substantive change in HRM from SAT than there— I think the GRC to IRM was more hype and surface label or lipstick on a pig than it really was materially changing what we're focused on from a practitioner standpoint.

That's right, Aaron. So I will say there's still, you know, and this always happens, but you always have like those vendors that are saying, oh, well, like I need to jump on the hype wagon. I'm gonna call myself human risk management. But if you like peel back the covers, it's really like phishing and training with a, you know, stoplight, you know, like numerical system on top of it. Red, yellow, green, 0 to 100, whatever you wanna say. And they're saying, oh, we're doing human risk management too. We can give you risk scores. But like, it's really like the same old metrics, like in a different way. So look, I think that's up to the market, right? When they're going through RFPs and they're putting out criteria, it's why like We win our POVs 90%, 90+ percent of the time because truly like the, the, the value and the proof is in, you know, in the delivery. But we cannot be remiss. We have to recognize that human resource management is a strategy and you can't like deploy a tool and expect, you know, results overnight. It does require business conversations. It requires breaking down silos. It requires strategic alignment. It requires executive sponsor, like, The companies that are doing the best are the ones that their CISO are on the QBRs. Their CISO is at, they're at, they're trying to figure out what's going on in my, in this, you know, in this human attack surface, like what, what's this platform showing me? And they're helping to drive business change and they're, you know, bringing teams together around that and they're saying, oh, I can use this data over here as well. And so I think executive, executive alignment is absolutely key. And then, you know, partners like Reveal Risk as well, they're not, you guys are not paying me to say this, but like, it's, I'm a true believer that if you can find like a really strategic partner to come in and that understands like the ins and outs of security organizations, like friction and all that, like that can help you navigate, you know, deriving, getting all the right stakeholders there, and then like implementing, executing, and managing a program, like that can be an unlock for a lot of companies, especially if they don't have the resources internally. So I think, you know, we're, we got a match made in heaven in front of us. Agreed.

Well, thank you, Ashley, again. We always have one question for our guests, and this is because it's a VIP experience. But for those who wouldn't know Ashley Rose or personally, give our crowd like a fun fact. What's something that maybe no one knows yet? It could be brand new or it could be something that you've been keeping to yourself.

Well, you know, I founded a swimwear line. I think that's a pretty fun fact. So one of my goals in life is to get my pilot's license. And so I've taken a couple, I've taken a couple flights, but I still have a ways to go. I think that's a pretty fun fact about myself and I will get there. I don't know if my husband will ever let me fly my children around, but I'll be up there. I'll be up there in the, in the sky. So yeah, I would say that's like an, you know, an unmet dream that I'm pretty excited about. So I'm sure there's more, but hopefully that one's good enough.

That's great.

I'm sure at some point we see the future, Aaron could share a story he had when he was doing his pilot's license, but I don't want to scare Ashley away from the pilot experience that I had in high school as I was, I was prepping, but that's, that's a story for part 2 of this podcast. Ashley, thanks so much for joining us and looking forward to seeing you in Boston where I think we're both going to be at HealthSuck and hosting a dinner. So, uh, would love to meet, uh, uh, mutual fans of both companies as well as Great cyber practitioners doing great things. When— if anybody's out in Boston.

Amazing. Yeah. See you there.

Thanks so much. Have a good day.