Unspoken Security Ep 11: How to Demonstrate the Value of Cyber Threat Intelligence

I've seen too many cases of people coming from the government sector with a lot of knowledge, but they try to apply the exact same way of working. This is not a government position. This is not the same way. Need to adapt, adapt or die. And I learned that the hard way the first couple of months. And I got some feedback from people who now are my friends and I trust. And whenever they give me feedback, I take that to note and to heart, I mean, and actually do something with it so I can improve myself. And I think that's one of the key things.

Welcome to Unspoken Security by ZeroFox, the raw and gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging the internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started.

This is how legends are made.

Hello and welcome to another episode of Unspoken Security, brought to you by ZeroFox. The only unified external cybersecurity platform. I'm your host, AJ Nash. For those who don't know me personally or are first-time listeners, I'm a traditional intelligence guy who spent nearly 20 years in the intelligence community, both within the US Air Force and then as a defense contractor. Most of that time was spent at NSA. I've been in the private sector for about 8 years now, going on almost 9, I guess, primarily building or helping other people build effective intelligence-driven security practices. I'm passionate about intelligence, security, security, public speaking, mentoring, and teaching. And obviously at this point, podcasting. I'm also deeply committed to servant leadership, which is why I completed my master's degree in organizational leadership at Gonzaga University. Go Zags! Tournament's coming up.

Let's see how we do.

The goal of this podcast is to bring all of these elements together with some incredible guests and have authentic, unfiltered conversations, even debates, about a wide range of challenging topics. This is not gonna be your typical polished podcast. You might hear or see my dog Riley. She's around someplace. People may swear here, although Freddie's, our guest today, isn't known for that, but it's possible. We may argue or debate, and that's all okay. Think of this as a podcast, you know, it's really more like a conversation you might overhear at a bar, you know, after a long day at one of the larger cybersecurity conferences we all go to. These are the conversations we usually have when nobody's listening. Now today, I already mentioned Freddy's name. Today I'm happy to be joined all the way from Norway by my good friend Freddy Murray. Freddy has about 25 years of experience, so he's in my age group now. Spans areas from sales to consulting, academia to government and military service. Currently he's a senior threat intelligence analyst at the Nordic Finance CERT, as well as a PhD student at the Norwegian University of Science and Technology. So clearly much smarter and more disciplined than myself. Freddy, is there anything I left out about your background that you wanna add here?

No, I don't think so. I, I think you hit the nail on the head and I want, just wanna, you know, extend my gratitude for inviting me to your podcast. I'm looking forward to this for a couple of weeks now. So yeah, I'm looking forward to having a good conversation. Just missing the beers actually.

But yeah. Yeah. Well, yeah, I gotta figure that one out. The beers is a good point. I don't know if I, maybe we'll start working on that. Maybe I can send vouchers or something. It'd be nice if, you know, people had a beverage in their hand. Now it's, it's early in the morning for me today for this one, so might be a little unusual, but then again, nobody's gonna know when, when it goes live, right? I'm gonna work on that actually. Beers or wine or something for folks. Maybe I'll see if I can get some budget. If I get a few more people to like and post and repost this and, and get a bigger audience, like maybe I can get a bigger budget for that. But yeah, it's a good idea. Anyway, you know, let's jump into where we are for this particular episode. Which is titled, you know, today's is How to Demonstrate the Value of Cyber Threat Intelligence. Because as you know, I mean, this is the great struggle most of us have when we're building intelligence-driven security practices. When, or, or if in a lot of cases, we're able to build a strong enough business case to get an intelligence program off the ground, you know, to get the funding, to get the buy-in from leadership, we immediately have to move to how do we prove that we're providing value if we wanna be able to keep going and, and keep growing. So, you know, with that in mind, Freddy, I mean, you've been doing this a long time and you've got some amazing stories and a lot of background. So what are you seeing today as the biggest challenges facing organizations that are trying to build intelligence-driven security practices?

Oh, there's so many avenues we can take on this, but to, you know, keep in line with the question at least, I think one of the big issues would be to convince leadership that they needed. And, and in that, I think if I compare it with education that military officers get, one huge part of this is in the training is intelligence. So when they do mission planning, they do planning in any type of way or form. Intelligence is a huge ingrained component and they're taught this. So in the military service, of course. Whenever they plan a mission, intelligence is part of it. They don't, they will make decisions without it, but it's part of their, their planning procedures, if you will.

Yeah.

If we now compare this to a civilian education of leaders, when you go to business school, I'm not sure many business schools today include intelligence as a field or a separate study, elective, you know, study, or, you know, as part of leadership. And that, I think, is one of the core issues we see in private sectors specifically, where most leaders today do not have the education which includes to use or utilize intelligence. Thus, for their decision process, it's not natural for them to reach out to us. Now, not necessarily cyber threat intelligence, but intelligence function in overall. I speak to CISOs, I speak to Chief Risk Officers, the CROs, and they're flabbergasted, but how about how we can support them. And when I show them, they're like, oh my, my, you know, my goodness, this is what we needed. Why didn't anyone tell us that we could use you for this? I would love to discuss this more. Can you come in and show us, discuss? So that shows and demonstrates to me over the last 5, 6 years that there is a gap in our decision makers. And I'm talking about the higher ups in the decision chain, in knowledge of how they can utilize us. And then, you know, people like me and you or us, we have a job to do in spreading the message, showing the love. But, you know, all of us are in the— I, at least, I am the— I'm a preacher in my own church, right? Everyone hears me all the time. Having people like you and others who are also professing the word, if you will, of intelligence, the benefits of it, the value, how they can utilize it, how they can gain value from it. That's sort of the, the one of the big aspects I see. But there's so much, many more aspects, but I'm not sure what your thoughts on this are.

Well, you know, first of all, thanks for the plug on Rise of the CINO. For anybody who doesn't know, CINO, The Rise of the CINO, is a paper I wrote a few years ago now. It's arguing for the Chief Intelligence Officer being a C-level position. Feel free to Google it and pull it up and share it with your friends and neighbors because I agree with you, right, that we've got to push this, you know, to a higher level and more in leadership. But it's an interesting observation you made about Decision-making, right? And in the military, and listen, I'm remiss in your intro and you didn't correct me on it. I didn't even bother to mention you've been in the military too. You're still in the military, right? You're a second lieutenant right now in the Norwegian Armed Forces, if I'm not mistaken. So when you talk about military training and decision-making within the military, you know, you're speaking from a great deal of experience on the subject. I think you make a really interesting point that that isn't really something that comes out of business school, right? You know, there's, there's, I'm sure there's a lot and listen, I haven't been to B-school. So for those who have. Feel free to correct my misunderstandings, but I'm sure there— I haven't heard anything, at least about a lot of discussions about decision-making tied to intelligence, right? There's a lot of different ways to make decisions. And, you know, people I know who come out of these schools are often very, very bright and very good at making strong decisions quickly, but not intelligence-driven decisions. It's a different way of doing things. And I think, you know, it's great to hear. I've had some of the same conversations you mentioned. When you meet people, when you start having this discussion, they go, we didn't know you were here. We didn't realize you could support us this way. Right. Yeah. I think you hit it on the head that there's this education component that's just missing is, is the ability to just explain to people what is intelligence? You know, what do we actually do? You know, and you mentioned a crusade, which is almost what it has been, right? For the last 7 years or 8 years at least of just telling people, this is data, this is information, this is intelligence. These are not the same things. And intelligence analysis isn't just a smart person with Google and an idea who gave you their opinion, but that takes time to explain to people. And I have the same conversations where I'll say, hey, listen, this is what intelligence really is. I go through the process. I start showing about structured analytic techniques. And, you know, then people go, oh, I didn't, I didn't know any of this. And, and then you have to explain the language, right? The difference between possible and probable and more likely and less likely. And, you know, explaining all these caveat languages and on all the, the ways we speak in intelligence. So I think you hit it on the head and, and I'm excited to hear that you're having the same observations on your side of the world than I am. Uh, also frustrating.

You have, we, we've spoken about this many, many times before as well. Yeah. And you know, that's how we got to know each other a few years ago. But, well, I guess we'll get to that later. But I want to jump back to an earlier episode. You had Welisa Ackerman, and she had a quote, and I'm just going to read. So she said, taking intelligence to the C-suite, so the C-level, the chief financial officer, the chief risk officer, the chief information security officer, the CISO, and actually introducing them to the benefits of utilizing intelligence as part of the risk equation. So usually we have a threat and there's some vulnerabilities and there's, you know, there's a consequence. There's so many different ways of calculating and working risk. Now, I have to admit, I don't work with risk normally. So, you know, you have to forgive me if I mess this up. But when we talk about introducing intelligence to them, they need to understand the basics of what intelligence is, what the bias is, what critical thinking is, what goes into the intelligence part so they can understand when they get something from us and an assessment from us. They understand the underlying parts of it. I'm not saying that they should become intelligence analysts, but at a minimum, understand a little bit of what it is and then thus what the benefits and value could be. So once they can do that, you know, they can take it into their job and actually do their job better because they can trust the information we gave them perhaps better. And I'm not championing to bring structured analytical techniques into them. What I'm saying is they need to understand the basics of what intelligence is and how they can actually benefit from using it and that function, that role, and actually test, try and fail a little bit to figure out the exact sweet spot and how they can utilize it best for that particular role or for that particular, um, subject, if you will.

Well, yeah, and I agree with you. Yeah, it's not—

I, I—

there is that sweet spot, right? You don't want to go too deep with leadership or anybody really, because they don't have to know all the minutiae and the details. Structured analytic techniques, listen, we could have days and days of training on that and discussions, and they don't need that anymore than they need to know all the minutia of how to reverse engineer malware or all the minutia of every tuning that goes into every tool, right? Leadership doesn't have the time and energy for all of that. They need to understand enough to know this happens, that this isn't magic, that there's a process and some science to it, and then enough to, to believe it, right? And to trust it. Not all the details. So it's finding that spot. But like you said, I've had these discussions we're just explaining structured analytic techniques in a, you know, at a 30,000-foot view. What is a structured analytic technique? And going through a couple of those and saying, you know, there's a whole book on these. We're not going to go through all of them, but just so you understand, here's the names of some. Here's how these work. You know, just so they understand there's a lot more to this than just, hey, we Googled an answer and wrote it down for you. When leadership buys in, when they understand these things, and I've been lucky enough to have some success in this area in the past. A big change, right? I'm curious if you've had the same experience. When I first moved into the private sector, my first gig was at a bank. And, you know, my job was to help put together an intel program. And at the beginning, it was just questions from leadership were a lot of boil the ocean, tell me everything you know about this, that, and the other. And it was just jumping around and, and, you know, they wanted a million things. They wanted them very, very fast. And there was a real misunderstanding of what we do and how we do it and, and therefore how fast it can happen and what the results will be. And caveat language meant nothing. So if you told them something that was low confidence, with a ton of caveats or high confidence with almost no caveats. They only took the, the last end of it and you had to explain, no, no, no, don't run and do anything with that. That's a really low confidence assessment because you asked for something in 12 minutes that should take 12 days. But as we started to get that education going and they understood, I found that they asked less questions. If they asked them, they asked better ones a lot of times. But also we found that they spent less time spinning themselves up and distracting themselves with, say, the news cycle., and a lot of outside things, because we were able to gain the confidence, you know, and the understanding of what we did and try to become one of, if not the primary source that they were going to. So instead of going out to the world, getting ramped up by whatever was out there and coming back panicked and asking us a lot of things, it was, hey, let's wait for the daily briefing and see what these guys tell us. And then if it's not in there, we can follow up and say, well, we also heard about this or, or the other. And a lot of times we were able to catch. And get ahead. I will tell you a quick note, a tip for anybody who's building intel programs or leading people into that path, and they're running into a lot of questions from upper, upper levels. Ask them what sources they use today. So I found once I knew what sources my leadership found interesting or trusted, uh, we spent a lot of time on those sources. And sometimes we'd just get ahead of the curve. We'd get the source and we'd ask, we'd ask ourselves what questions are going to come out of this source. And we'd start answering those questions before they were asked. And so when the briefing would come, they obviously would be answering questions we thought were coming and they gained more confidence and they asked less questions. So anyway, I, that's a lot of words to say exactly what you're talking about, which is about building this, this trust and confidence and shared understanding without going so deep into the weeds. We're not trying to turn every C-level or every leader into an intel professional. We just need them to understand what we do to a level to realize it's not just Googling and writing things down and giving opinions. There's a lot more structure to it. So when they get it, they have more faith in what we're giving them and what the, you know, more understanding and confidence in what those assessments are so they can act appropriately. It takes time, man. I don't know about you, but I've seen this take, you know, days, weeks, months. Some organizations never quite get there because it does require leadership that's also willing to learn and to listen and to grow, which can be challenging. But I think, I think it's a worthy endeavor. I know you do a lot of this and so do I and so do several others in our industry. Of just trying to bring the best from the intel community out and help people understand how important this can be and how impactful it can be. You know, and you made that point. You said people just, just say, well, I don't, I didn't even realize you could do this, which is such a great thing to hear once they, because you see the light bulb then, right?

Yeah. And this ties into, you know, the reason we should tell them a little bit about it. So let me take a step back. I'm not saying we should tell them or teach them intelligence. I'm not saying that we should do that to the board of directors or stuff like this, right? I'm saying my go-between, uh, would be, or my go-to, are the CISO and the CRO, because they deal with risk and they have to portray the actual threat level and the actual risks involved in operating the business. So I have to, I could communicate the business side and the threats to the business, but I think the better people to do it are those who have that job as responsibility. And that's the CRO and the CISO. So those are my people. Those are the ones I need to focus on. So as far as they understand it. They can turn around to their products. Now, because it's not part of the education, we have to do this so they're at least at the minimum level of understanding so they can utilize it the best. That's why I'm saying this. The second we get this into education and, you know, so more people know and understand, then that probably won't be as necessary after a while. So, but this ties into, you know, budgets and time as well, right? So, Now we're getting into another answer to your question. Budget is about money, of course, and time is also about money per se, because we have to prioritize the people and their time, which goes into how much money are we spending on these people and what are the value and results we can get out of them? How are they actually supporting the business or their role and responsibilities that they're, uh, you know, dedicated to deal with? So there needs to be someone. Then in some sort of manager role in terms of team leader or a manager for a cyber defense center, whatever the case might be, who also need to understand the value of intelligence, but also more into what actually goes into it. So they know that if you're going to reverse engineer a malware, it's going to take 2 people a week or 1 person maybe 3 or 4 weeks to actually get down into the weeds and expose everything. Of that malware, if not longer. So they know this, but when they turn around and talk to a CTI person, hey, what's up with this thing, or can you help us with this assessment, that's actually going to take a person a week or two as well, because it's so much more complex than just a yes or no question. If it is a yes or no question, we have the information, then it's not intelligence. We haven't done anything. We just have the answer. When we have to assess because we have the incomplete picture, which is the puzzle, We have a possible missing pieces. That's when intelligence starts to be relevant. If we have the answer per the fact, I would say and argue that then now it isn't intelligence. Now I know a lot of OSINT people and a lot of CTI people and incident responders will go, well, yes, it's intelligence. Well, I'm not sure because if you can read the answer from your logs, what happened when, you're not assessing. If you're saying, oh, it's highly likely this happened because the log says so and we have 3 different log sources that says the same. I mean, there's no puzzle here. You have all the pieces. It's when you're missing pieces, you actually have to do assessments. And understanding this, I usually see this understanding grow as in maturity of the CTI people. So when they're starting into CTI, there's still a lot of technical. When they mature more and work with 5, maybe 10 years even, that's at least what I see here in the Nordics. More mature CTI people are looking more into, well, how can we actually utilize intelligence into our work? That's really interesting. And that's actually just a plug for me. That's what I'm researching on my PhD. How can we use intelligence methodology in CTI and not incident response, but CTI work where the I is the intelligence side and actually implement intelligence methodology in a good way when we have a little shorter time span, but we still have to set up some resources to actually work on a longer term. So having money to set that up, having people who knows what you and I do, and then actually setting off time that, you know, if we're going to write a report on this, it's going to take time and we have to have people who knows what they're doing. So those two are, you know, relevant. And you mentioned, you know, boiling the water, you know, I call it, I think Brian Moore says, you know, just download the internet and then, you know, give the answer. And I find it so true because most people are, you know, living online. They have LinkedIn, they have Facebook, they have multiple, channels in social media, but also following, you know, Bleeping Computer and many other sources that they get their intel from, or information, I would say. And they're like turning around and talking to the CTA team. Hey, we see this thing on the news and it's in Asia. We have no business there, but what's the danger to us? Well, we don't have the technology. We don't have the location. We're not, according to, you know, the threat actor, they're not interested in us. So You know, it's a non-starter, but then we have to spend time on it and explain it to them. So I usually like, and going back to what you said, I like to monitor what's going on and have a short sentence on, hey, this thing is in the media now, these 3 things, they're irrelevant for us because of the technology stack or the vulnerability we don't have or whatever the case might be, or we're looking into it. I'll give you more details if you want in 2 days.

Yep. So, well, and you make some great points in there that, you know, that really circle back to what we'd said, right?

The—

we have— once our leadership understands, at least at a high level, again, what we do and how long it takes— like you said, you know, people understand how long reversing malware might take, right? You can say it takes a few days or whatever it is, but they don't understand when they ask us a question why we say it's going to take a day or 2 days or a week or whatever it is. And I think that's that disconnect, right? Because they're, they're thinking, well, you're just going to go to Google, you're going to Google it, and you're going to write me an answer, right? That's what they do. I think people misunderstand their version of research for an intel version of research. Which is a different process, right? And I've had that happen where you say, hey, you know, we're going to paper and the paper's due in 2 weeks. And they say, well, how long is the paper going to be? It's going to be about 4 pages. Like, how the hell does it take 2 weeks to write 4 pages? I'm like, well, it doesn't take 2 weeks to write 4 pages. It takes a few days to write 4 pages really well, but it takes that whole week, week and a half to do the research and to apply the analytic techniques and to, you know, probably get a second person to take a look at it. You know, next, have a peer review in there and some editing, all this other stuff you have to explain. But the reason for that is because when we present a piece of intel to you, an assessment, you're going to make decisions based off of that. If you just want somebody to give you a quick snap answer, and then you're going to make a major decision off that, that's really risky. That's not a great plan. And so, but as you said, you know, as we go through this and they understand that, then the, the, they understand how long it's going to take. There's a, there's a shared understanding, expectation management. I spend a lot of time talking about, right? And that's that shared understanding on expectations. If you give me a day, a week, a month, a year, I'm gonna give you an answer to the same question, but it's gonna be a very different answer based on that timeline. You're gonna have a ton of caveat language, and it's not gonna have a lot of research if you only give me a day. If you give me a year, it's probably too much for almost any question, frankly. You're gonna get a PhD, you know, dissertation at that point. But once they understand, and that's the, that's the key, I think that's the reason we have this education piece to let them know there's a difference between the answer you're going to get from an Intel team and the answer you're gonna get for yourself or from a friend when you just ask a question about, hey, what do you know about this? There's a fundamental difference because we do things differently. And as long as people see that, just enough to look behind the curtain and realize this is different, this is not just us, you know, like I said, Googling and looking around, there's a lot more to it, then it makes more sense. And then it helps us, you know, get into this discussion about metrics and about value. Cause like you said, it's all about money. You know, it's, it's either money you have to spend on the resources, you know, on the tools or the money you have to spend in time, which is still money, as you said, you know, any company that's for profit, certainly at least nobody has unlimited budgets. So, you know, the key piece is they understand what we're going to provide them is for decision-making purposes, which is why you want to put in the time and effort to get it right. We're an efficient group. I think generally, I don't know many teams that sandbag too much. I'm not going to lie. If you give me a deadline opportunity, I'm probably going to sandbag a little bit in there. I'd rather deliver ahead. I might tell you 2 weeks when I know it's gonna take 8 days. So if, if we have new information that shows up we didn't expect, we don't have to delay coming out. And if we don't, hey, we're a little bit early. What a good deal. You know, we're on time. We're providing value. Very few times.

What would you call sandbag?

I call buffer, right? So buffer's a better word.

Yeah.

You know, it's, it's, it's a better word. You know, the thing about it is really just that expectation management. You don't wanna be late for things. You know, people wanna make decisions and if somebody needs a really quick answer, hey, you know, this is an emergency, we need it now. We have to be able to explain to them, that's fine. Just understand we're going to have limited time. So we're going to have a limited opportunity to do the research. So it may not be complete research. We're not going to have time to apply all the analytic techniques we'd like to. You're going to get a lot of caveat language. If you run and make a decision based off this, you own a lot more risk because we haven't had the time to do everything, which happens sometimes. And we all know that, right? And so a lot of times I say, well, I'll give you a fractional now. And if you give us more time, we'll give you more context as we go forward. So I think those are all really important points you were, you were just making here. And I think it really ties it all together. This is why we have to educate leadership. It's so they know how, you know, the value of what they're getting, why it's different than just a, "Hey, what do you think?" And, you know, it's not a shooting from the hip and why it takes a little bit longer, but why you should have more confidence that you're gonna be able to make strong decisions off of this. There's still risk involved, and we should, as intel folks, if we're writing something, you know, be able to tell people, you know, what it is, why it matters, what you can do about it, and some sort of confidence assessment that goes with it. So at least you go in with an educated framework to make those decisions. So, but we talked about this and I guess, you know, we talked, we talked around a little bit. We talked about money and we talked about value. So let's just ask the question, like, how do you demonstrate value in a language that leadership trusts and understands?

Oh, I think this also ties into the previous question and that's sort of metrics to demonstrate value. I think metrics is key. And I think because, you know, okay, for decision makers, let's do the decision maker analogy first or definition. A decision maker to me is anyone I can support making a decision. That means, should someone block something in a firewall, or should someone buy a technology that will affect the company for the next 5 years and cost millions of dollars? That's a huge range of decision makers that I'm supporting. Some decision makers are more important. Usually those are the ones that are controlling money, controlling funding. If they don't get the value from us or understand what value they can get from us, they will cut the CTI department really fast. So our key job is to make sure that our key stakeholders, our key decision makers, are happy and getting the value that they expect. That ties into what you just was talking about, and that was the expectation management. If they have unrealistic expectations on what we can do for them, And we underdeliver because they have higher expectations than we can actually deliver, then they will never be happy. And thus they will cut funding off after a while. So our key job is to make sure that they are happy and delivering value to them consistently over time. So whenever there's a budget cut discussion, the chief risk officer, the chief financial officer, and the CISO are fighting your cause. I cannot, you know, overemphasize that enough. So demonstrating value that way is sort of a key point. So those who define, defend, sorry, those who are dictating the money and the funding, those are our key, you know, buddies. We need to, you know, buy a beer at the Christmas party and stuff like this, right? That they need to be on our side and, you know, being cunning people and using social engineering and, you know, anything you can to, to, to have those, those in your corner and fight your cause when there's tough times ahead.

Yeah, well, undoubtedly. I mean, the, you know, I've said for a while my opinion on the subject, you know, when it comes to leadership at the highest levels, you know, the board level really only speaks two languages. It's really just money and risk, right? And to be honest, sort of modifying this over the last year or two, they really speak one language and it's money. The risk part is really just what's the risk to my money? It's, you know, I used to say it was money and risk and that, you know, either, either raise my profits, lower my costs. Or lower my risk of something negative happening. But the truth is that risk of something negative happening is something negative that's going to affect their finances. If, if we're talking about for-profit businesses, I will say government has a different way of looking at things because our governments print money. Their risk scenarios are a bit different and nonprofits are a bit different and healthcare might be in some cases different. But in most cases, it really comes down to money and risk, which a lot of times is just money, right? So helping them understand. How we're going to positively impact those areas matters. You know, if we provide intel, you know, I said earlier, tell me what it is, tell me what it matters, why it matters, and it should be why it matters to us, and tell me what we can do about it. Because that can tie back. We also have to put it in those, in those terms a lot of times though. You know, there's a threat. We think it's a high confidence threat based on, you know, all this body of intelligence. It's a threat to a system that we have. We are a likely target because we fit within the, the realm of what this adversary has been known to target before, and what you can do about it as a result is here's what the, you know, their TTPs, et cetera. We can make these changes. The last piece that a lot of people miss, and sometimes we don't have the intel to do it, is how much is that gonna save us? You know, if we don't, if we do or don't do this thing, if, if we do it, what's the likely impact gonna be? Now that's a tough one as intel guys and gals. I know, you know, this is a learning experience for me when I moved to the private sector was, you know, early on we started writing intel reports and I was told, no, no, no. You gotta tell us, you know, what we're gonna do about it. And I was like, well, that's not what Intel does. You know, Intel's a J2 or, you know, S, you know, S2 function, whatever, you know, different branch of service you're in. We do Intel. We tell people the intel. We don't tell people what to do about it. That's operations. That's a 3 role. That's somebody else's job. And there's a lot of arguments about it. And I have to admit, I had a former boss who I didn't get along with all that well, but he was right on this one. I realized in the private sector, it took me a while to get over the hump and gather that just telling people the intel isn't good enough in private sector. It is a difference. Between the private and public sectors, we've gotta go to the next step of what can you do about it? And that means working with operators a lot of times, cuz I'm not a defender. I may not know what systems you have to change, so I gotta find out who does. But then the next piece, which is even harder, is what's that going to mean to us? It's likely we're gonna be attacked and this is what we have to do to stop it. How much time effort does that take? And what was that likely to prevent or save? If the attack's gonna happen in an area we don't care about anyway, and it would take us, a complete reconfiguring of an architecture to make it work, nobody's going to buy into that. So we have to also be able to say what the, like, impacts can be, what your risk is, you know, really go down those paths. You know, if this is a threat against a critical asset, crown jewel, as we like to say, and we think it's likely to happen and we have all the intel to support it, then you've got a stronger case to say, we've got to take the action, we got to make these changes, we got to spend this time and money. If it's, you know, a threat that's a low confidence threat against something we don't care about anyway, We just write it up that way and say, you know, this is something that could be resolved, but you know, here's the likely results of doing that. And people have to make a decision on whether they want to. My biggest concern with this though, to be honest with you, and we didn't talk about this before, so I'm kind of throwing a curveball, is, is I'm seeing more organizations that I fear, I can't say with certainty, but that I fear have enough intel to make good decisions that would prevent problems, but they've decided at the macroeconomic level the risk is just, you know, it's worth it to take. Apple's come to mind. I won't give specifics. I don't wanna call out and name and shame anybody, but there's been some really large ransomware attacks in the not too recent past. And you look at some of these organizations, you go, these are multi-billion dollar organizations. They certainly have the money to buy intel programs, to build intel programs, to buy this context. And you find out after they're attacked that they didn't really seem to know very much. They weren't prepared. And I, I just think to myself, well, is it just a business decision? They just decided we're gonna roll with the risk and if we get ransomed, we'll just pay the ransom because, you know, how often's that gonna happen? And paying to build an intel program and a intel-driven security program and run that year after year costs a lot of money. Mm-hmm. And so that's the downside I think we have unfortunately in, in giving people this assessments and these, these assessments of risk is that they may choose to accept risk in ways that I wouldn't want them to. I don't think it's necessarily in the best interest of consumers and, and the, the wider audience. But again, with for-profit businesses, it's all about, you know, make my bottom line better, lower my risk. In a lot of cases, that risk is really just the bottom line. And I do have a hard time, even if we tell them, hey, there's a ransomware, uh, group and this is what they're doing. And, you know, we could be a target because we fit within what they're used to doing. And, you know, it could be really bad. It's still tough to be able to say, you know, whoa. What's the likelihood we're gonna be targeted? Well, I don't know. I mean, we're in the group. It could happen now. It could happen next year. It could happen never. And it costs, you know, X number of dollars a year to try to defend against it. It's a tough sell to folks. I think, I think we see people take on a lot of risk because they don't seem to think the risk is real until it happens. You can do all the risk ratings and all the ever, you know, everything you want, say, well, there's a 14% chance or a 28% chance or whatever numbers people come up with for risk. But I see a lot of people that just don't internalize that risk until it's at their doorstep and then they're just shocked. Oh my goodness, I can't believe this happened. You know, and then they're panicking and they're, you know, frantic and it's, you know, buy every tool and technology in person you can, pay the ransom. All these things just, you know, come out because a lot of people just don't see risk until it's there. You know, no matter how many times you tell them that, they just can't seem to internalize it or they can't seem to see past the reward, the financial reward of owning that risk until the risk shows up, right?

Yeah. This is sort of the, the, this is really touching upon the core value here, right? So, What I talked about before was I usually speak to this chief risk officer for this specific reason. I paint the threat picture to them and the consequences of what they can do. And they have to internalize that into the business language and the cost, and they have to do the calculations. Then it's out of my hands. I don't, I usually don't provide these other things you need to do because they need to figure that out together with the CISO and perhaps even the, you know, the cyber defense people or, you know, the infrastructure, people, right? To figure out exactly what to do, why, and how much it's going to cost. So that goes back to something you also said, the money part. And I mentioned that before earlier. We need to speak and communicate in a way that they understand. And that is the language of the business. The business isn't in cyber unless there are, you know, they are selling cyber tools or cyber defense. So for instance, your company is in cyber. That's what you're living off, you know, that, that's just sort of your, your main focus. But a bank is running a bank, and it's all about the dollars and the cents, and, and, you know, the red numbers and the black numbers, and they always want everything, you know, going positive. And so if they can see that, you know, if we ask— and you just again hit the nail on the head— there is a yearly cost to having CTI people. There's a running cost of defending this and year over year, if ransomware never happens, that's money they can save. And then once it happens, they can fix it, organize it. It'll cost, it'll, it'll, you know, it'll hurt, but over 5 years or 10 years, it happened once. They can save a lot of money, right? So then it goes back to communication and that's, that's where I started, right? We need to educate them to understand how they can use us to, to use value and perhaps not, you know, having a full-time employee, maybe a 50%, working on CTI, not, you know, recommended, but at least having a good CTI function through a vendor, through a SOC, you know, whatever the case might be that actually can provide value more than, oh, you had 17, you know, malicious emails that passed through your email gateway last month. Okay. So what?

Right. What does that mean?

So what of the so what and now what, right? That those are the words I'm used to in terms of, you know, what can we do with it? What does that mean to us? Which is, you know, another thing. And I think that, again, going back to we as CTI people, we need to be able to communicate in a language they understand. And that's sort of my core job. I work at the strategic operational level, not so much at the technical, technical. My colleague, he was an incident responder and also with a background with intelligence and understand that. So, so he and I work closely together, but he sort of deals with the tactical, technical and speaks CTI with the incident responders. I speak CTI with the CISOs and chief risk officers, the chief defense, sorry, the cyber defense center managers, et cetera. So we have different conversations about the same topic and how to support them in the best way. So I think the value, at least the way I've done it and successfully done so in the Nordics and through the finance sector is year over year, I have shown value through the reporting I do. The quality of the reporting, and it has been noticed so much that the different organizations are asking, hey, can you come in and teach our team? Can you do workshops with us? Can you teach us how to do structured analytical techniques? That to me is a way to demonstrate value when they, or at least a confirmation of value that I can show, I can give you these products because of tradecraft. Intelligence tradecraft has given me the option or the opportunity to give you these products. That would take your CTI technical people 2 months. I can do it in 2 weeks because I'm so, you know, because I know the techniques and know how to work them. And me and my colleague, we have the same background and education. So we can spin off each other and work together and dish out really good. I'm not, I'm not going to toot my own horn, but good enough intelligence for the, for the, the, the targeted audience. And they are really happy. So we're not going at just, you know, good enough. We're going at good enough plus. By everything we do. So we always say, oh, this is really great. This is exactly what I needed. I can actually turn around and give this to the board. They will understand this product. That then we're really, you know, nailing, I mean, hitting the home run and showing value and getting noticed. And I think the value perspective is understated. And most people, not most people, too many people, I think, who work in the CTI field are technically focused. And they're not engaged with those who are in leadership, those who are actually paying the dollars. Yep. Right.

Yeah. They don't speak that language of business. Yeah. They don't speak that business language. And I said a few episodes ago, I was talking to Brian Moore about Intel requirements and I'd said, listen, nothing costs too much if it delivers more value than it costs. Right. Yeah. We run into that a lot in sales where people say, well, we, you know, we lost the deal because, you know, they said we cost too much. And most sales leaders will say, you never lose a deal for price. You know, you lose a deal because you didn't show you had a value that was superior to the value you lost to. Now there's, there are minor exceptions. Listen, there are groups that just have no money. You know, if you need, if you have $8,000 and, and the minimum for the tool you're trying to buy is $50,000, yeah, you're gonna, it's cost. But in most cases, it's nothing as, you know, costs as much as, it's not considered a cost if it delivers more value than it costs.

Right?

Right. And so as you said, it's about putting it in, in terms that make sense. Right? And turning things into a dollars and cents discussion. It says you, you wanna do this cuz it's gonna save you this, which is why we have challenges with risk. You know, We talk about things like ransomware and people go, well, how, how often are we gonna hit? Well, we don't know. Well, if we say every 10 years, how big is it gonna be? What's gonna be this? And you start math, you know, doing the math backwards and people convince themselves they don't need to be proactive. It used to be the thinking was you had to be proactive, not just for money, but the thought was if you were compromised, you'd lose business. You know, I remember when I got out of the private or got the government space from the private sector at a bank, that was one of the big motivations was we have to do this cuz if we don't, people won't trust us. They won't if they're money with us, they will leave. That's turning out not to be true. I think there's a lot of research suggesting that people don't actually leave. And if that's the case, it's really demotivating companies because now again, you've taken less— you've taken risk away from their bottom line, that risk to money we talked about. And if that's the case, I think they start carrying more risk of, eh, let's just go, you know, and see what happens. Because if we go another quarter or another year without spending all this money on security, you know, it's, you know, the stock stays up, we have lower costs, etc. And eventually somebody's going to be sitting on the box when it pops off, and we'll deal with it then, which I don't think is a great plan. But a lot of people are doing that, and it's very frustrating. But, you know, we've talked about this value. We talked about this language. So, you know, for people who are saying, hey, I want to, I want to do a better job of explaining this to leadership. I want to build, you know, the proper argument. Are there any tools? Like, is there anything out there that says, hey, here's, you know, here's how you can properly categorize this, how you can put this all together and present this to leadership and say, this is why we should do these things. These are the value propositions that come out of this. You know, I know you've been working on something in this area. You know, a lot of people are saying, give me a tool, help me develop this. So what do you know, what do you want to share in this one?

So one of the key things here, and I got to mention different things that I know of. So there's a workshop that I'm part of, the first CTI conference in Berlin. This is the third year. We're running what's called an intelligence requirement management workshop. Basically teaching CTI people how to identify your stakeholders, prioritize them, and finding your key stakeholders. Then discussing with them what are the requirements and having that expectation management conversation, figuring out what they actually want us to do so we can tag the, what's the value we can deliver, then identify their questions, tying those questions into requirements that then can be tied into sources. And once you know your sourcing, you know your questions, you know how, then you can start structuring your product and then going back and demonstrating value and having follow-up conversations with your key stakeholders. You asked for these things in January. Now it's June. After 6 months, we have delivered these products answering these questions, which were the ones we highlighted in our conversation in January. Does this, you know, are you happy? If no, how can we do better? That goes into the whole, I jokingly say, I kick in the doors of CISOs because I'm, and I'm in Norwegian also say, I'm sitting on their laps and won't let them go. Comfortably so, you know, sitting there staring into their eyes and going, yeah, so how can we help you better? Right? So that's one thing, learning how to do a basic of intelligence requirement will help you and guide you, uh, with small tools. Another one, you had Brian Moore on the last one and he has some sort of, you know, a software that can help and structure this, but it's in a more complex way. So if, if that first one, the IRM workshop sort of is to give a start starting point and you outgrow this. I would look into what he's doing because I love what he's doing there as well. Now, the last one is to understand intelligence and understand what it is. And, you know, when you look at different blogs, you hear on podcasts, you read all these articles about intelligence or books, they usually mention 4 or 5, maybe 6 steps of the intel cycle. And, you know, they dig about this deep and then they quickly move on to what they're more comfortable with. If it's malware analysis or, you know, technical CTI. You know, it varies, but a lot of people, and even in the intelligence community that I see, they might have been working there for 25 years, but they worked on this specific part of a military unit or that country or this person or their capabilities and XYZ, and they're really good at it, but they haven't, you know, lifted their gaze to understand how does what I do fit into the intelligence process. So enter how you and I got to know each other. It was summer of 2019. I just read your CNO article. I think it's from 2019. And I was like, oh, this man is speaking my language because I started in the cyber world in 2018. So I only been there since October 2019. So not even a year when I, you know, I reached out to you on LinkedIn, basically kicking in the door. Hey, I need to speak to you and we need to have a conversation. My biggest issue was people in cyber threat intelligence, they were talking the talk. They were using the words, they were using the acronyms, they were talking about the requirements, this, and, you know, collection plan, that. But when I discussed with them, they had no clue. Absolutely no clue. And you and I spoke about it. And I spoke with Sergio, the guy who invented the Diamond Model. And one of you or both of you mentioned that, you know, someone should create a mind map to sort of explain better that there's so much more to intelligence.

So over Christmas— Yeah, we were both too lazy to do it, I think. Sergio, Sergio, I don't know Sergio. Andy Pendergast, the other guy with Diamond Model, and Andy and I know each other in passing. Sergio, I, I won't claim to know, but I'm sure we were both just too lazy to do it. Yeah. It's, it's a great idea. We need this mind map. This would be a fantastic thing. And then I go on to do something else, right? Because there's a million things to do, but you went ahead and did it.

Yeah. That's the thing, right? So over Christmas, I, you know, I usually dive into some sort of project every Christmas, you know, between the holidays of a Christmas Eve and New Year's Eve. So there's a week where, you know, I can indulge a little. So I started playing with it. And I remember calling you and also Sergio and other people up afterwards, you know, in January, February of that year, 2020. It's just, oh, you know, this is a starting point, you know, what do you think? And we walked through it and you added ideas and everyone I spoke to added ideas. Then COVID hit. Then I had a lot of free time on my hands. So I reached out to former CIA, former FBI, former GCHQ. I had no shame. I just reached out on LinkedIn and say, hey, I have this project. You know, I would love to interview you. Can we have some time together? And also I'm looking into doing a PhD. So sort of that was a plug to this will be my research, but I need to do some pre-research to it and, you know, understand what's going on. So I interviewed, you know, almost 50 people and I spent hours with all of them walking through every step. So it grew from being an Intel process to be Intel intelligence architecture mind map. Where I can't remember now, but someone argued that, you know, I shouldn't call it the process, maybe call this architecture because it's actually exactly explaining in real, you know, detail in what goes into intelligence. What are the requirements or prerequisites if you're going to do stakeholder engagement? What are all the things you need to cover if you're going to build an intelligence program? So when you look at the intelligence mind map up on the top right corner, that's basically what we call the intelligence management, where you have to have the funding, the structure, how to build it, how to structure it over time, and also how to mature it over time. How are you going to get buying budgets? How are you going to defend the budgets over here over the next couple of years to actually build this function? The next 4 points of this mind map is the intel process. 4 steps. That's what NATO uses, which is direction, collection, analysis, and dissemination. Those are usually the 4 steps. With some variations of the names, but that's the standard that NATO has used since 1980-something. And, you know, and that hasn't changed much. I know a lot of people are building out, you know, 4 steps, 6 steps. I've seen as many as 16 steps in an intel cycle. And I'm like, I'm not sure if they're covering or understanding what it is. So the 4 steps are there. And then the last one on the top left corner is the blue one, which says that's sort of the metrics. How can we demonstrate value back to management so we can actually run intelligence with the right people, with the right funding, send them on the right courses, also deliver the value through what they're actually asking for? That goes back to the core element of the intelligence dialogue where you do expectation management. So all of this is so much more complex than the 4 steps of the intel cycle. So to actually run an intel function, you actually need more.

Now, have you shared the mind map publicly at this point? Is it available to people?

Yeah, it's been available since the get-go. I put it up on GitHub and we can hopefully share the link with the talk as well, but it's on GitHub and my name backwards, Edum. So my name is Murray, M-U-R-R-Y, but Edum is backwards. So then you can find it there, but you know, we'll probably share it, I hope. Yeah. Yeah.

I'll, I'll make sure we get a link shared in the description for this episode. When it comes out. We'll make sure to get people access to it. So, I mean, the question being about tools, right? So you mentioned a couple here. So there's the one that you've been developing, you know, co-authoring at first. Is that available? And if so, we can add that link as well. And obviously the mind map, which I highly recommend, by the way, anybody take a look at. It's amazing. You know, I remember when you first started it and like you said, you got a lot of input. I was happy to contribute to it. The hard part is starting, right? You know, Sergio, I'm sure said similar things. We talked about, yeah, there should be a thing, right? But neither of us did anything with it. And listen, Sergio already did the Diamond Model with Andy. I've not done anything in my life of meaning, it seems like, comparatively. So, you know, they already built a thing. It's hard to start a thing. You started a thing. It was, I was, you know, honored to be asked to contribute. It's grown into this amazing thing, built off of fantastic talent. So I highly recommend people see this. We'll get you, we'll get the link through, you know, the GitHub link, because it's incredible. So you got the first tool, you got that tool. I will say for what it's worth, I've also developed something that I've been using, and then I'll freely share with anybody who asks, and a process. You know, I, I learned a long time ago, frankly, that we had to help people. We had to teach people how to do this. And a lot of it started with teaching intelligence requirements. And so I've done a lot of free consulting. I'm sure most companies I've worked with would rather we charge, but I think it helps seed the field so you can actually have customers who can be successful. And I've been developing an intel requirements process and some tools to go with it, you know, spreadsheets. And we have some training. I've, I've recorded a video with our company that I'm happy to share as well because this is the thing that's needed, right? We talked about this. People have to understand, they have to have this education. And if they don't have it, they don't have the ability to move forward successfully. They don't have that structure in place. And we got to do it in a way that's simple and easy. You know, it's not the Intel requirements we use in the government space or giant books, frameworks, and other like this thick. They're massive and nobody remembers what's in them anymore. But so there's those tools. So the first tool, is that available publicly?

Yes, it is. But we have to share. I think it's on GitHub where we're— okay, if you're talking about the workshop.

Yeah, yeah, yeah, the workshop. All right. So we'll find that one so we can share it. We've got the mind map. We'll get that link so we can share it. I've also got stuff I can't throw it out publicly, but anybody can reach out to me for it. I'll make sure it shows up in the description for this episode so you can read that up. All right. So listen, we're running out of time. I want to get to the end of this episode. And because the show is called Unspoken Security, you know, I always ask people the same question, right? Tell me something that's to this point, you know, been unspoken when it comes to you. You know, what's, you know, whatever it might be. People have told all sorts of interesting secrets. Or tips or career moves, whatever it might be. But what do you have in your head right now that so far has been unspoken, Freddy?

Well, I think when we, well, I can only speak for myself. When I started, I went out of the military and went into the private sector. That was in 2018. I felt naked. I was walking around naked, right? So the imposter syndrome, I was waiting to get, you know, stripped naked and, you know, just, you have, you have no idea what you're doing. And I really didn't. I have to admit in the beginning. Some people were critical because I was only talking about intelligence and military and, you know, that, that was sort of my, my comfort zone. And, and though they challenged me in the sense of, well, you need to focus on the value, right? And that, that clicked for me really, really quickly. How can I demonstrate value or what I know? And I need to step out of the, the government role, how we did stuff in the government. It doesn't work in the private sector. And I've seen too many cases of people coming. From the government sector with a lot of knowledge, but they try to apply the exact same way of working. This is not a government position. This is not the same way. Need to adapt, adapt or die. And I learned that the hard way the first couple of months. And I got some feedback from, from people who now are my friends and I trust. And whenever they give me feedback, I take that to note and to heart, I mean, and actually do something with it. So I can improve myself. And I think that's one of the key things. I felt like an imposter in the beginning and I knew it. I felt that they told me so. I'm like, okay, I need to fix this, right? Because I had no idea. I was, I was, my boss, you know, God bless him. He hired me as an intel analyst. He didn't know what to do with me, but he said, there's something there. I'm not sure yet how, but you need to figure it out. So he gave me. Sort of an open slate so I can sort of fill in the blanks the way I thought it was. I messed up quite a few times in the beginning, but then I sort of found my groove and started showing value. And then I got confident and I was, okay, no, you know what? I can do this when it takes time. So I felt alone because I didn't have anyone I can talk to about this. So that's, I guess, why I started reaching out to people like you and others, people I thought, hey, These guys have done the same thing. They came from, you know, the same type of background. They ventured into private sector. And I remember all of us, at least you and some of the others, we were like, oh, we know, we all agree that, you know, there's a big gap in knowledge. How can we do this? And that sort of gave me the boost to move forward to figure out, you know, how can I adapt to this? And Lisa, in one of the episodes you had with her, Lisa Ackerman, she said, you know, there's a decision advantage. I usually call this decision support, but it's actually decision advantage. And I really, really love that term. I'm going to steal it and use it going forward because it's a better description of what we're doing. So yeah, I think the feeling naked, feeling alone, feeling like a fraud in the beginning, it's normal, but you really, I had to, and I've seen that in other people as well. And I, oh, I remember a story ahead of one of the organizations, CDC, he told me that, you know, he had hired cyber, no, sorry, intel people before, but they came in with geopolitics and a completely different view and understanding of what, and what he needed. So whenever he turned to those people, he never got what he wanted. So he was like, ah, I don't know what to do with people like you. He told me, and I was like, oh, challenge accepted. Now he knows. And, you know, he buys me a beer every time we meet and it's like, I am, I got you wrong. I got you wrong. And I'm impressed. And I give him a big hug every time because he was one of the people who sort of nudged me into the right space. So. Adapting.

Well, you make a good point that— yeah, you make a good point. You know, not all Intel people are the same, right? We're not all focused in the same way to do the same things. There's a big difference between the tactical, technical versus operational versus strategic. And if he was looking for tactical, technical Intel or operational Intel and he hired a bunch of people that are strat Intel, you know, 30-year pictures, you know, geopolitics— yeah, there's gonna be a disconnect there, right? There are people who do all these things across the board. I'm not entirely technical, tactical. I can do a little there. I definitely do the operational, a lot of strat. But you gotta make sure the people you're hiring are aligned to the kind of work you're trying to get, trying to output you're trying to get. You know, I think it's interesting you, you talked about, well, imposter syndrome basically, right? Coming out and just feeling like you're, you're, you're a fraud and people are about to say it.

Yeah.

And there's nobody I know in this industry who doesn't have that. Yeah. It's an interesting thing. And I've, I've read a fair amount on this that just says it's, it's sort of ironic. It's only a problem that affects people who are actually pretty good at their jobs. You have to be good enough to realize how much you don't know.

Mm-hmm.

Which means you have to know a fair amount first. The people that don't have imposter syndrome of any kind— and again, if somebody out there is super healthy and really talented and they just have none of this, congratulations— but generally speaking, they're narcissists, or they're people that are so clueless they don't realize how much they don't know. So they think they're an expert because they haven't even learned enough to know what they don't know, right?

Yeah.

And so a lot of intel people I know, even the ones that come across as very confident, even ones come across as arrogant sometimes, uh, a lot of them are, are struggling with You know, what's the day somebody's going to figure out I don't know anything? You know, and so you've mentioned it, a couple other guests have mentioned this previously, that either they jumped in and felt like they were, you know, lost or they were naked, as you used the expression, or had, you know, these other feelings of insecurities over it. And then as you get in and you start doing it, you realize, no, I'm all right. You know, I'm meeting other people that feel the same way. We're validating each other's thoughts in supportable ways, not just a bunch of people who have the bad idea and can agree on a bad idea. I mean, I met you and knew almost instantly. It didn't take long. I was like, this guy's brilliant. This guy is amazing. This guy's got a great brain. He knows, he knows what he's doing and executes. By the way, being really smart and not executing isn't of great value. I've got a history of that sometimes.

Oh, I appreciate it.

You also were able to execute. No, it was amazing. And you made a huge difference already. I'm looking forward to people seeing the mind map because you took the time and energy. You had a good thought to begin with. You started building a structure that nobody had. And then you also said, hey, I'm gonna reach out to anybody and everybody. Like you said, you'll kick in the doors. And that's really gutsy and works out well cuz most people want to contribute. It's hard to get started.

Mm-hmm.

And I think what you've created is something I haven't seen before that, that should change a lot of people in the industry and improve a lot of people who have a chance to read it. And that's because you created something really important and it's because you had the vision. So I mean, you're, you're better than you think, as, as I'm sure as most people I think are frankly. But it's good to hear. I think for others out there, if you're, you know, new to the industry or you've been in for a while for that matter and you feel this way, just remember all of us feel this way. Like the truth is very few of us think we know what we're doing. I'm surprised anybody listens to anything I have to say. And I've been doing it long enough to have a whole lot of gray over here and not as much gray matter up here anymore. So, you know, it's, we're all doing that. But when you sit down and think about it, and I know you can do this, I had somebody point it out to me, you know, start talking about any of these things, you know, intel requirements. Intel cycle, you know, all, and, and all, all of a sudden we're an hour and a half in and you realize, geez, I, I must know a fair amount about this cuz I just keep talking and it's all new material, right? We know a lot and we don't realize it. And what I've learned is when I have these conversations with people who are less experienced or aren't in our industry at all, then you realize how much you really know. Because I talk to people a lot of times who are, you know, family, friends who aren't in our business, who are awestruck at, at how much we all know. And then you realize, you know, oh, it's 'cause I spend so much time with so many other people that are brilliant. I work with smarter people every day. The world doesn't know everything we know. So, you know, but I think it's a good thing that you've said it. I think it reassures folks. It should at least. I mean, Freddie, if you guys don't know him, you should get to know him and reach out and talk to him. The guy's brilliant and he's got an amazing career, you know, military, you know, intelligence work. Like I say, working on his PhD now. I mean, this guy, this guy's really sharp and knows a lot of things. Uh, I'm blushing now, please.

So yeah, thank you so much.

I don't think so.

Well, yeah, you're also very humble. Same to you. Maybe it's a Norwegian thing that, that, you know, reaching out to people who are smarter than me, that's what I do all the time. So when I kick in someone's door is because I think they're smarter than me and can actually contribute to, to and helping me. I have a messy mind. I'm not sure how you work, but my mind is like everywhere. So creating mind maps is a way for me to get it out, structure it. And so this is what I'm trying to say. Right. So my mind is, as I said, is everywhere, but thank you so much for the kind words. And I write back at you, AJ. I mean, you're amazing and everything you're doing and sharing your thoughts and sharing the knowledge that you have over all these years you worked inside of government and now outside as well.

So yeah. Yeah. Well, thanks, man. I appreciate it. I hope, I hope I help a few people along the way. All right.

Listen, this has been fantastic. One thing on a positive note is that one thing I've learned is that although I didn't know what I was doing and sort of trying to figure it out. I'm doing a PhD for Pete's sake, right? So I must love either hurting myself or actually, you know, maybe I have something to contribute with. And that's given me sort of a self-confidence boost in the sense of, you know, yes, I didn't know what I was doing, but I actually grew on it. I learned by it and I loved it. Looking back, I was nervous and like, oh, you know, it scared me. But that was a good feeling. I can't explain it. So now I'm hurting myself again doing the PhD, right? So it's, there must be something there. So yeah.

Well, it sounds a little bit like people who work out their bodies, right? And when you first start, you hurt, like you're stretching your muscles, right? And it hurts and you get up next day and you're sore. And people who continue with it, they get past that soreness and they build muscle and they build stamina if they're doing whatever kind of workouts they're doing. Anybody who looks at me realizes I don't spent a lot of time in the gym, so I don't know how I'm talking about. But I think what you're describing is the same thing, right? You put yourself through that pain because there's the growth that comes with it, and you realize the results, and then you go, I like the results, let me do it again. You know, PhD programs are very intimidating. I've looked at, you know, higher education, and I haven't pulled the trigger on that, much like I wasn't able to build a mind map. So I'll probably follow you at some point and see how you do with it.

Yes, please do.

It's very impressive, and I'm with you. You know, it's again stepping back into the breach and saying, I want another uncomfortable thing because look at the results, right? So I'm always impressed, you know, by what you're working on. I'm really excited about the PhD program, you know, that you're in and I think you're, the contributions you're gonna make and are making already are really changing the industry. And that's, I mean, it's fun to watch. I'm excited about it. I'm, you know, I'm thankful we're friends. Eventually I will run out of friends for this show, so I better find people that want to come on who don't already know me and maybe owe me a favor. But dude, I'm so thankful you came on the show. I'm glad people are getting a chance to meet you. Hopefully more people will. And reach out and, and work with the tools that you talked about and, and keep making the world, you know, a little smarter and a little bit safer. So thanks for taking all this time. I, I'm gonna wrap us up and, and get us out. I know people have other things they're gonna wanna do, but thanks again for coming on, for coming on on Smoking Security and, and speaking with, with me for a while and hanging out. I really appreciate you taking the time. You know, let's, we'll follow back up. I wanna see how the PhD program goes as you're moving forward. Maybe we'll have a chance to, to bring you back and catch on and see how it finishes. But, you know, Again, thank you very much for joining today. And for those of you who've stuck with us and listened and watched this whole episode, thank you as well. Please take the time to like and review and share with your friends and neighbors. If you love the show, tell everybody. If you don't like the show, tell very few people or nobody at all. But tell me, right? You know, give me the feedback. If you know somebody you think should be on the show, if you want to be on the show yourself, you know, please reach out. This is, this show isn't about me. It's about people like Freddie. It's about the audience. And I want to make sure we keep building this and bringing things of value to folks. So thanks everybody for taking the time to listen. Thank you again, Freddy, for being here. And that's going to be it for this episode of Unspoken Security. Until next time, you know, be well and be safe.

Thank you for having me. Have a good day.

You too. That's a wrap for this episode of Unspoken Security, brought to you by ZeroFox, the only unified external internal cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

This is how legends are made.