Unspoken Security Ep 16: Facts and Myths of Insider Programs

the right kind of toolset, which means you read the right kind of expertise, knowledge, and you really need to be your own evangelist and your own program's evangelist. At the end of the day, you should be the chief, uh, crafter of your message and what you do. After all that's said and done, you need the right kind of processes and procedures in place so that it reinforces the trust and gives everyone an equal footing.

Welcome to Unspoken Security by ZeroFox, the raw and gritty podcast for cybersecurity professionals who want to understand how threat actors are leveraging the internet. In each episode, your host AJ Nash engages with various industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding security. Ultimately, the lessons learned will enable security professionals to take an intel-driven, proactive approach to physical and cybersecurity that extends past the perimeter. Let's get started. This is how legends are made. Hello and welcome to another episode of Unspoken Security brought to you by ZeroFox, the only unified external cybersecurity platform. I'm your host, AJ Nash. For those who don't know me personally or first-time listeners, I'm a traditional intelligence guy, spent nearly 20 years in the intelligence community, uh, both within the Air Force and then as a defense contractor. Most of that time was spent at NSA. Been in the private sector now for— I went and checked my own resume because I can't remember now— closing on 8 and a half years. Uh, primarily I build intel programs, or I help people build intel programs, build effective intelligence-driven security practices. I'm passionate about intelligence and security, public speaking, mentoring, and teaching. I'm also deeply committed to servant leadership, which is why I completed my master's degree in organizational leadership at Gonzaga University. Go Zags! Uh, the goal of this podcast is to bring all of those elements together along with some incredible guests and, and have authentic, unfiltered conversations, maybe even debates about a wide range of topics challenging for most of us in this industry. This is not gonna be a typical polished podcast. You might hear or see my dog. She's usually around here someplace. Uh, people may swear. Uh, I certainly do on a regular basis and we might argue or debate and that's all okay. Think of this podcast as the conversation you might overhear at a bar after a long day at one of the large cybersecurity conferences we all go to. These are the conversations we usually have when nobody's listening. Now today I'm joined by an old friend of mine going all the way back to the time, uh, we were together in the Air Force. It's Virgil Capillari. Now, Verge has decades of experience in intelligence, risk, and insider threat, uh, within the DOD, DIA, uh, the financial sector, and also as the founder of a boutique consulting firm, Adaptive Risk Strategies. Uh, Verge, anything else you want to tell people that I left out?

Uh, no, that was a very warm welcome. I just want to highlight that, uh, I think I'm forever a student of life, risk, and security.

All right, well, it's a good strategy to have. I'm always learning something, usually from smart people like you. Virgil's also the prettiest Albanian I'll probably ever have on the show. Um, so if anybody wants to know more about that, feel free to reach out to him directly. He'll tell you all about his cute button nose and green eyes. Those are direct quotes, uh, for those who aren't actually seeing the video and are just listening to the audio.

We're off to such a fine start.

That's what you get for joking before we got on. Before we started recording, Virgil, I use everything, man. You gotta know better than that.

This ought to be fun.

Yes, this is gonna be a good time. We've been together a long time, Virgil and I. Like I said, grew up together in the Air Force. Um, I was, uh, not, uh, the model airman, uh, and neither was Virgil, if I'm gonna be honest. But, uh, we both grew up to be somewhat successful in life.

So, well, I was gonna say, uh, you've picked up the skill of, uh, bus driver because you threw me under a couple times.

Yeah, man, that license was hard to come by, as it turns out. But I need a backup job in case this doesn't all work out. I need something to do so I can drive the bus over just about anybody. Yeah, buddy. Uh, all right, listen, man. So today's episode, we should jump into this thing. Uh, today we're going to talk about the facts and myths of insider threat programs. Because frankly, I mean, there was a lot of misconceptions about insider threat, about what you do, uh, you know, and what you've done for a long time now. And I think there's an opportunity for people to better understand how most of us, you know, can see insider threat as a partner. Instead of an adversary, which I think is, is how a lot of people perceive insider threat programs, um, as, you know, the spies that are watching us or that kind of a thing, right? Which is, which is really not the point. Uh, I'm aware of that, of course. Um, but I, I'd like to have that discussion, you know, with an expert and that's you, right? And so you've been doing insider threat a long time now, uh, in the government space, long after we got done doing, uh, linguistics together in the Air Force. So, you know, let's jump into this one, man. What do you see, first of all, like set a baseline. What do you see as fundamentals for, you know, an effective insider threat program? What does that look like to you?

Uh, well, first and foremost, uh, anything you do has to have definition. People have to know what it means, has to be, uh, and how it's applied. Therefore, if the concept is poor in its construction, everything else around it is going to follow suit. So, has to be clearly, uh, clearly defined. Articulated, and most importantly, has to have buy-in from the top downward.

Mm-hmm. Mm-hmm.

It's very difficult to try to build it the other way around. So after you have all those elements, you have to have a training program to once again reinforce those concepts and keep training, training, training. Why? Because, uh, these are perishable skills and what becomes out of sight becomes out of mind. Then you need the right kind of toolset, which means you need the right kind of expertise, knowledge, and you really need to be your own evangelist and your own program's evangelist. At the end of the day, you should be the chief, uh, crafter of your message and what you do. Uh, so, and then, uh, after all that's said and done, you need the right kind of processes and procedures in place. So that it reinforces the trust and gives everyone an equal footing. Uh, what I do not recommend is keeping the program secretive and not communicating with anyone. Uh, you don't want to become the very threat to the program you're trying to enhance. So work to be a better friend. Uh, don't undermine what you're doing.

So that's a good point. So I, you You're talking about being secretive, right? So I've worked, I don't work insider threat for anybody who doesn't know that. I'm sure everybody does. I've worked with that insider threat though. I'm an intel guy, right? So I'm a big believer in partnerships, intel. Everybody's a customer of intel in my opinion, insider threat, physical security, you know, the SOC, you know, take your pick, right? Almost every HR, everybody can be. But you talked about, you know, transparency and trying to be open and trying to not be so secretive. But there's a balance there, right? I mean, obviously the nature of the work of insider threat, you know, you're, you're investigating folks, those are closed investigations. So how do you, how do you have that open kimono so people know what you do and understand your processes and understand the structure and your goals and objectives and still keep that separation to keep the integrity of the actual work itself?

Go back to definitions. A lot of times you hear a lot of, uh, uh, conflation of terms and terminologies. Uh, they conflate risk, security, and threat. All three are not the same thing.

Mm-hmm.

So I kind of like to discuss risk in and of itself. Life is risky. What we do on a day-to-day basis is generally risky. We don't think about driving on an interstate highway as something risky. It's just something we have to do to get from point A to B or C and D, depending on what we're doing. Uh, the other point of it is that a threat, and I kind of use the, uh, the government Department of Defense's general definition, uh, an entity with a, uh, the means and capacity to want to exercise harm.

Mm-hmm. And the intent, right?

Sure. Not everybody in, uh, not everybody in your organization is waking up with the, uh, with the precon— uh, premeditated concept of trying to hurt the company, hurt the organization, or hurt you. So let's kind of reserve certain words for when they really become applied. Uh, but once again, uh, it comes down to how you articulate that at its earliest stages. And if you're throwing the word threat around, uh, loosely, in my personal opinion, you're really undermining the very nature of your program, which is to protect people.

So do you think we shouldn't be calling it insider threat? I mean, do you have another term that you're using for this?

I think insider risk may be, uh, maybe a better, uh, uh, kind of initial point, or at least communicate risk as the primary function piece of it. Some things that are risky can lead to threats, but not everything is a threat.

Interesting. Yeah, that's a good point. I don't think I've heard it said that way before. In fact, I, I'm quite confident I haven't. And I think it's an interesting point. Like you said, I think insider threat as a term, and it's, listen, it's an industry term. I doubt that you and I having a conversation today is gonna change that. But I think you make a good point that it, it, it creates an adversarial start, right? Everybody's seen as a threat. That's a problem right from the start. And, and everybody's not a threat. As you said, it's, it seems like it's more about mitigating risks, whether those risks are are malicious intent, whether they are accidental, you know, anywhere in between, you know, somebody who's a victim. It's, it's more about, as you said, you know, adversaries who have intent and capability are threats, right? But what you're talking about is risk. It's, it's a combination of those factors along with weaknesses and vulnerabilities. So I think that's interesting. I'd be interested to see if that takes off. I think talking about it as insider risk instead of insider threat Um, so you also mentioned talking about, uh, you know, building that communication standards and processes and structure. Uh, you know, can you talk a little bit about, you know, we don't need to go too far into the weeds, but I, I am curious a bit about how that gets set up. You know, in Intel we talk a lot about, you know, building processes obviously, and there's a lot of standards to how you write and how you, uh, do analysis and how you assess and how you, you know, communicate and how you report things. But for you, what does that look like when you talk about processes and standards like tactics, techniques, and procedures for doing insider risk? I'm gonna call it insider risk now. And just upset anybody who's a professional besides you in this industry, I guess. And also like, how do you document and manage standards for, you know, ethics, objectivity? You know, we have structured analytic techniques in intel side. Is there something like that, you know, in the insider risk side of things?

I'd say so. Just very similar to intel and having come from a long career in intelligence and in counterintelligence. It begins with the earliest communication to the stakeholders, to those, uh, individuals that you're looking to partnership and work with. Why? Because no insider threat program can act alone. So you kind of need to understand what the norm is or what the normative flavor, or as I would always say in my, uh, intel life, if another security professional thinks something's a concern, it's probably worth listening to. To kind of see where that may go. So, uh, I don't have to understand every discipline's ins and outs, uh, but I think, uh, I think any security professional would be wise to listen and, uh, use that kind of as the, uh, base point for building out. The other part of it too is like, just like when you're building a house or building out any other program, I, I do a lot of volunteer work with veterans. Veterans organizations, and I'm always willing to listen to what the stakeholders and other people want and what they're able to do, because then we can kind of leverage and build around it. I think too many, uh, I, I think that once again, very similar to the messaging, if you build it with too much of a narrow focus or not enough, uh, you're not really serving the very needs of the program to begin with and the organization.

Hmm. So, I mean, that sounds familiar to me, obviously on the intel side of things when you talk about stakeholders and requirements. Every episode seems like I'm hammering about, you know, intelligence requirements, you know, stakeholders engagement, right? So this, this sounds familiar to me. How do you view for, for the insider risks pro, you know, risk program, how, who are you viewing as stakeholders and how do you, how do you work to collect requirements in, in, I don't know if they call them intel requirements for you, if you have another term for it, but how do you, how do you look to collect those requirements to codify those requirements to make sure that they're there's a shared understanding between the identified stakeholders and your program on what, you know, what you do and don't do, right? Where are the guardrails? I'm sure that ethics and objectivity piece comes back in there as well. How do you, how do you build that relationship? How do you structure those things?

When I'm talking to a client, when I'm interacting with other professionals, I try to get a better understanding of what they're doing, which begins with rapport, rapport, rapport. It was, it was true when we were working in our intelligence business, whether it was human intelligence or counterintel. If I come to you right from the start and start preaching a bunch of rules to you and what you have to do, I'm probably going to turn you off. How about I try to get a better understanding of who you are and what you do? And, and I find that, uh, since, since this tends to be more of a support to a large organization, subordinating our egos is probably the first thing we need to do and work on the relationship. Because one problem with building out procedures and rules is if you make it too narrow, you're gonna shoot yourself in the foot because, in my opinion, you're not gonna catch those other things, nuances, observations that people may see. And, uh, you know, uh, but if the, if you don't articulate the processes well enough, then you may not be capturing what needs to be. Take a look at what's existing in place. Once again, just like the messaging, build around it. That's my, that's my recommendation.

I think that's really good. Yeah. And you talked about, uh, you know, took a look at what's in place. Um, you know, making sure you're not too narrow scoped, you know, with the, with the tooling, you know, as we talked a little bit about the TCPs earlier with the tooling, I mean, again, we're not here to plug specific, you know, tools and, and,, you know, platforms or whatever. I mean, you're, you're welcome to if you want. I don't really care, but I'm curious about the tooling that goes into some of this stuff. When you talk about getting baselines and understanding, you know, is it behavioral analysis tooling? Uh, at first baseline, is it, is it really, I mean, I'm sure you have to figure out at first, does this organization have any sort of insider, you know, risk program? Um, but you know, how much, how important is it, the visibility into, you know, the, the baseline, right? That baseline behavior on normally it's endpoints, right? On, on, laptops and phones and that kind of thing. Um, but, you know, is there a, how challenging is it to get the right tooling in place, especially if you're starting from scratch, or to, to determine if you have the right tooling or need to make changes in some of those areas?

If you're looking at it from purely an electronic, uh, viewpoint, which is where a majority of the programs, it's very difficult. There is a ton of, uh, alleged out of the box solutions that are going to resolve every one of your problems.

Sure.

And there's an endless amount of literature and salespeople promoting them. I'm not saying that they're not helpful. I'm not saying that they don't deliver on some of the points. Anything that seems to be too good to be true probably is. I kind of wind it back. As we were talking about the education piece, the training, the awareness, you know, if I tell you, AJ Nash, I don't ever want you to think about a purple horse. I've now put that in your head. But let's talk about something much more because it's on base level conditioning and it's about working and making your human element the first foundational layer. Because if I said to you, uh, whenever you go to your favorite store in Minnesota, I don't know, Target. And, uh, whenever you leave your neighborhood, I want you to count how many, uh, white houses are on the right side of the road as you're leaving. Those white houses have been there the whole time. You just haven't thought about it. Maybe you probably had it more subconscious. That's essentially what we're going to do with the training piece. We're going to get you to kind of think about it without changing what you're really doing. Because I don't need you to disrupt what you're supposed to be doing. All I need for you to do is if you see something that's kind of strange to you, let us know. As far as the tooling goes, no program can survive without some sort of case management system or YUBA, you know, uh, user behavioral activity. So what I would say is, uh, think about it like a house. When you're having a home built, uh, you need a bunch of different people with skill sets working together. So you need a plumber and you need an electrician. You don't need one to do the other's job, but you need them both working in tandem. So as you're building out the program, uh, your case management system should be built around the messaging and training piece because, uh, your focus, regardless of what you have, is going to shape whether it's successful or not.

So, so when you're talking about training so far, you're talking about training the workforce, you're talking about training. Are you talking about training managers and just, you know, general workers? This is the, the see something, say something model. Essentially, we've all heard about, you know, counterterrorism, everything, of course. Um, so I'm curi— I'm curious about that and, and the training and the, the awareness, I guess, is probably the, the type of training you're talking about. But then let's also, I wanna learn more about that, but then as a two-part question here so I can talk less and listen more. After you've talked a bit about that, I'm curious to know about the training of the team itself. I'm gonna make the assumption here that Insider Risk is, is not just one person in a closed room, although I know that happens. But the training for the insider team itself, you know, in terms of not just the tooling and some of the, you know, some of those things, but you said, you know, see something, say something. Okay, great. So I'm the employee who saw something and said something. How do you train the team? You know, how are they going to react to that? Is, you know, to make sure they don't jump to conclusions, to stay, you know, unbiased to, I know you and I've talked, you know, prior to being on this today about actually biasing towards the accused, for lack of a better word, you know, to stay really objective and not jump to the, ah, they must be guilty, let's put 'em away. Which I know some people in this industry and certainly counterintel, there's lots of folks that are looking to break the next spy. And so every opportunity is a chance to be a hero, right? So how do you, how do you train the workforce to, to be diligent and aware without becoming paranoid or, or over the top? And then how do you train the team? To be objective and run through a process?

That's an excellent question because naturally—

Thanks, I worked hard on that one, man. Took me a while to think that one up and everything.

I gotta tell you, you know, I gotta thank your dogs and every, uh, yeah, Riley had a lot to do with this one. I would say that it has to begin kind of with the earliest side of it. Uh, I think you kind of, uh, it's incumbent upon a really effective program to kind of have a natural dose of skepticism. If, if you hear something and you're constantly reacting, in my opinion, your program's not proactive. In that case, you're just being reactive. And there's not much difference between that and the 8 o'clock news every night that tells you it's the end of the world. Step back, assess all the facts, make a decision. I spent many years as a counterintelligence special agent. I spent many years as a human intelligence agent. I can tell you right now that throughout my career, the stuff that I thought was going to be really big wasn't. And the little things that I didn't think there was much to at first turned out to be far bigger than I thought. So, uh, it's, uh, it's important to kind of stop, pause, assess, re-engage, spar. If it's too good to be true, once again, we come back to it. It probably is. However, you're not lo— you're not charged with any position other than being a fellow team member in a large organization, which means base-level respect for your peers and the people that you're alleging in programs you want to protect should be the driving force behind what you do. Now, you may come across elements that are, uh, up to something maybe more nefarious or malicious. That's not for you to determine, in my opinion. What we do is we gather information, we bring in other stakeholders, we give them what we find. We, we may offer at times our assessment of the situation. After that, there are other professionals that handle it and may choose to. Uh, so that's where, uh, that's where I think, uh, the, the impetus really needs to, uh, come down to is understanding our inherent roles and our limitations. And I think, uh, kind of stepping back sometimes may do us far more good than not.

Well, and that reminds me a bit of intel. Uh, you know, in intel we always talk about, listen, as an intel professional, our jobs are to gather everything we can, all the data, all the, all the indicators, all the facts, all the, all the everything, right? And apply analytics that, you know, standards and tradecraft, apply, you know, techniques. And analytic techniques and then provide our assessment and our, you know, our best understanding of the situation and maybe some recommendations. But after that, we get outta the way, right? We're not operators. We don't, we're not trigger pullers, you know, to use the old military terms. You know, we may provide recommended courses of action, whole bunch of them, but then you hand it off to the people who actually are gonna go in and do the operation, whatever it might be, whether it's in the military side, whether it's now on the civilian side. It sounds like you're saying it's similar in Insider Threat in that You do all the research and you, you make the assessments and you make the recommendations to leadership. And then as you said, there's other professionals that make the determination. Is this, is this a legal issue? Is this a, you know, whatever the next steps are, you know, in, in insider, you know, risk programs. Um, which sounds really interesting to me. I hadn't really thought of it that way, I suppose. But, um, it makes you another, in a sense, another independent party that's, that's a, a counselor to leadership. I would, I would say in that you're, You're knowledgeable, but you're not making the call, right?

Um, that's right.

And I, I suppose that does create that humility you're talking about then. You know, it's not about trying to get the next person, it's just trying to get to the facts and get to the truth. Um, which is tough sometimes. I'm sure you guys are dealing with not just what happened, you know, what did somebody do? When did they do it? How did they do it? But why did they do it? Um, you know, is a big piece and, you know, was it malicious? You know, were they tricked into doing something versus whether they did it on their own? Was it an accident? Um, you know, I mean, some things I'm sure are stone cold cases. Somebody stole a whole bunch of IP and sold it on the dark web and you watch the whole path or whatever. But I'm sure a lot of them are, are much more complicated than that. Um, go ahead.

For many years inside the, uh, defense industrial base, we had all sorts of counterintel investigations trying to, uh, figure out X, Y, and Z. One of the earliest, uh, uh, one of the earliest kind of learning opportunities or engagements I had was when people reference countries or activities, I think we as, I think it's logical to have this preconceived notion of, of the caricature of the individual from that country with that accent. You stick around the business long enough, just because it's that country doesn't mean it's a member of that society. And I think that's where where it kind of, uh, causes you to readjust. Uh, if I talk about a, uh, countries in, in Asia with over a billion people, just because those countries may be doing something doesn't mean that the individual working on their behalf comes from there. Same thing with terrorism. And I know that you and I were both around during, uh, 9/11, both in the service, but afterwards. How many people have they found were engaged with terrorist activities who have no absolute direct connection to the Middle East? Same thing applies here. Same thing applies here. And, and once again, we have to be constantly concerned about our own awareness bias, because if we're only seeing one thing and one thing all the time, that's what we're focused on. It's time to step back. Uh, just like being a member of any other organization committees, it's the integrity of the program that supersedes our own personal opinions and desires. That's at least how I've tried to approach it over the years.

Yeah, I love that point. You know, the, the bias, right? Um, and, and being able to step back from that. I mean, listen, if, if, if we said, you know, a terrorist act, uh, happened, right? I, I think a lot of people will immediately picture Well, these days a Middle Eastern person, right? I think that's the bias a lot of people have. Meanwhile, domestic terrorism is a massive problem. It's generally white guys. Not always. It can be anybody, frankly, but it is terrorism in Ireland. Been a problem going back a long time. I promise there weren't many Middle Easterners involved in that. I don't think there were any. Terrorism is around the world. It's not a geographic issue. There certainly is a lot of, you know, uh, uh, religiously generated terrorism that comes out of the Middle East right now. Um, you know, so it's not a non-issue. I'm not going to pretend it isn't, uh, a real thing, but I think you make a good point that, you know, people have a bias, right? And if you said, oh, this, this activity came from, from China or from India or whatever, uh, and there's that bias and then you realize, well, somebody could just be using their infrastructure or their architecture or they could be a contractor or they could be placed there by another nation. You know, we talk about nation states a lot of time and you see that crossover., you know, uh, people who are, who work for one government but are inside the borders of another. Uh, you know, we've, we've seen that, uh, you know, Russia, China, that kind of thing. And then, you know, Iran. And then you got the question of, are they partnering and that's why that's happening? Or are they there because they're co-opting somebody else's architecture so that they can then put blame on that country or, or have somebody chase that down? So, you know, obviously in Intel we've gone through a lot of this and this is why attribution is so difficult because you can't just say, well, it happened there, so that's the people responsible.

Mm-hmm.

Not necessarily. Let's slow, slow our roll a little bit and look and see.

Humans are far more complex. And, you know, both you and I have, uh, been in the intel business for many years, even prior to our venturing off in our private lives.

Just calling me old again. Every episode somebody calls me old. I got it. It's okay.

I couldn't help myself. It was kind of a knee-jerk reaction.

That's all right. That's all right.

But beyond that, but beyond that, humans are also more nuanced and complex. And I think that we live in a day and age, and this will be maybe a point of maybe want to bring up here in a little while, but I think it's really quick to want to slap a label on something or somebody. Humans just don't operate like that. It's, you know, uh, I kind of liken it to my upbringing and family from the Balkans. Many Balkan countries will blame Turkey for everything. Because of the Ottoman Empire. But if you try to rationally explain to somebody that, well, the Republic of Turkey is not the same thing as the Ottoman Empire, uh, it becomes a little more difficult. And then, oh yeah, what have you done in the 100 years since the Ottoman Empire's collapsed? How can it still be Turkey's fault?

Right. At some point you got to move on from that. And listen, I, I was a, for those who don't know, I was a linguist in the Air Force, uh, Serbian Croatian. So I'm familiar with the Balkans. Obviously Cap's got background there as well, both as a linguist and, and you know, his personal history, his family background. We're not here to refight the Balkan Wars, which I'm sure in another 50 or 100 years they'll take another swing at it themselves 'cause it's, oh yeah, every generation wants to. But, but you make the right point, you know, in my opinion at least. And this, it could be other regions. We don't, I don't wanna go too far down that path, but it's at some point you've gotta move forward from whatever. And I'm not saying the past didn't happen. I'm not saying horrible things didn't happen. Pick a geography, pick a nationality, pick a culture, pick a race, whatever it is, we, you can almost across the board, you can say that's, that's there. But at some point it's how do we move forward if we keep looking back at those things? And, and you talked about, you know, how people are complicated and those biases exist. So it actually, it brings up a question I wanted to ask. Um, you know, the world is a complicated place. There's a lot of terrible things. There's always a lot of terrible things, by the way, going on in the world. For those who don't know, we all think this is a really violent, horrible time in history because it feels that way and it is to an extent, but it's actually the least violent time in human history. We don't see it that way or perceive it that way because we see everything now, you know, but in antiquity we didn't. We only saw our, what was around us. So there was violence and terrible things going on around the world. We just didn't know. But that said, it's still a dangerous, violent, you know, scary place to live. How does that impact When you're talking about insider risk, right? How, how does the geopolitical events going on around the world, how does that affect a workforce? You know, is it something you're concerned about when it comes to insider threat, insider risk? Is it something you have to calculate and prepare for? And how do you, how do you, how do you work through that? And again, those are political minefields, right? If, if you say, hey, this, this thing happened, and as a result, you know, we know we've got some folks who might have interests here because they have family there or whatever. How do you take that approach without worrying about crossing a line and being seen as targeting somebody or picking a side or political? You know, the, listen, Gaza and Israel. I mean, we can use that one as an example. It's, we can talk around it all day, but people are going to think it anyway. Um, you know, bad things going on there. If you have, you know, employees that, you know, have, uh, historical ties, family ties, religious ties, uh, you know, to the area, you know, does this become an issue you might have a concern for? But at the same time, you don't want to cross over. You don't want to make assumptions and you certainly don't want to start targeting people. But you also can't ignore that world events impact people. So that was a long way for me to ask what should have been a short question, which is how do you work through all of that complicated morass when it talks about geopolitical events? And, and is this something you think about in terms of workforce and possibly raising the, the risk or the, or the threats of, of insider activities?

Short answer is absolutely. That's kind of—

okay, on to the next question. No, I'm just kidding.

Let me kind of wind this back here as we're, as we're talking. Uh, I, uh, I do various, uh, uh, foreign travel security, uh, uh, presentations. I prepare people and they travel to other parts of the world where there are ongoing conflicts, ongoing issues, struggles, uh, political dilemmas. And, uh, when I look back to my, uh, counterintelligence life and I look back to my human intelligence life. This would've been one of the ripest times to kind of seek out individuals. Now I'm gonna put in a, uh, plug for Dr. Eric Shaw.

Mm.

Who talks about, uh, insider risk, but more importantly talks about the critical pathway, uh, to behavioral issues and, uh, uh, stressors and various things that could affect someone during the course of their life and day. Financial divorce. Death in the family, other things, other distractions. It's not that necessarily these people are bad people. It's just that sometimes life gets in the way and they may not be as alert to what they're doing. So just because we see an activity on the other side, we don't necessarily have the whole story. And this is where the, uh, former, you know, special agent me kind of comes out and says it's incumbent upon us to try to learn as much as we can about what led to that. So as to determine whether this was malicious or not. Now, the end result is still the end result, and that will probably be dealt with by, uh, other stakeholders, other people much higher on the food chain. However, if we're not asking the why, then what we're really doing is we're just checking a block and behaving like a compliance And, uh, this is kind of where I editorialize. If the insider threat or insider risk program is compliance-driven, in my opinion, it's gonna have a compliance reaction and it's probably not gonna be as effective and, uh, it's going to, uh, likely hinder progress.

Hmm.

I understand that, you know, there's varying degrees of it depending on what industry you're in. Uh, the other thing too is I think, uh, and this is just kind of me editorializing, I think that anytime the government pushes a certain type of requirement, it almost inherently will, uh, create this checklist mentality. Therefore, we've checked these blocks, we've done what you wanted. The idea is to think a little more openly about that and try to really deliver. If all you're doing is checking blocks, then what makes you special?

Sure. But you gotta be able to balance those things, right? I mean, the, I don't disagree with you, by the way. If, if all you focus on is compliance, whether it's security, whether it's intel, whether it's anything insider. Yeah. If all you focus on is compliance and checking the right boxes, you're gonna miss a whole lot of stuff. Right? I mean, compliance is really meant to be sort of a minimum standard, not the, not the perfect standard, but you have to be able to do both. Right? I mean, compliance is compliance. Yes. You can't just not do it. When you have all those challenges, you gotta be able to do the compliance stuff first, cuz that's the stuff that keeps you in business. But you're, wait, what I'm hearing you say is you, you gotta go beyond that into, there's more of a human approach, right? People are complicated, as you said, and it's messy and, and sure, checkboxes get you through, but they don't necessarily make you safe. And it's hard cuz you're talking about now getting into, into much more complicated issues of really understanding the depths of people, which I assume means communicating with HR, for instance. You know, you talk about stressors, you know, if somebody's going through a divorce or a child custody case or financial stress, I know those are a few indicators, you know, of possible challenges. Um, you're going to have to work with HR on that, which of course is close hold things, but it's a human approach. It's understanding the person and not to get them right, but to understand, you know, who might be a likely target. I'm going to look at it from a positive standpoint of others targeting our folks to try to turn them into insider Threats when they're not intending to be one, um, helps to know what their vulnerabilities might be and, you know, what they may be up to, which might include, you know, what are they posting on social media? Do they seem like they're distressed? Are they, are they stressed? Are they angry? Are they, are they challenged? Are they, you know, financially struggling? Uh, maybe they're having mental health challenges, whatever it might be, right? To try to prevent somebody from being lured into making a bad decision. Um, but that takes a lot, right? So you got the compliance stuff.

Okay.

Do you, Do you find programs have enough resources to do the must-haves and the really should-haves and need-to-haves to be successful?

The answer to that would be no, and I'm going to explain why kind of with it, because as I look at my career from a, from a, uh, intelligence collection side of the house with people and trying to recruit, uh, identify possible sources. This would have been a ripe environment as those stressors that you mentioned, because if you're distracted, if you're, if you're thinking about things outside of there, it's going to make my life a whole lot easier. So when talking about the staffing standpoint, the reason why I kind of go back to my original point of being the evangelist is because you need to recruit your organization to be one giant layer, that human layer, you're going to have, you're going to go from having a handful of people in your program to a lot more. Why? Because they're helping identify things you might not. So it's about winning them over. And if you're not winning over your organization, that may be more reflective too. Uh, in my life as a special agent, regardless of the presentations I gave, counterintelligence awareness, it was incumbent upon me to make sure that the message was delivering, which means it involves eating crow, stepping back and allowing, uh, and allowing people. The other side of the modern coin is there's a real lack of empathy in modern society. People need to, I think if we take a little more time to empathize, with the people around us, regardless of what we may think of them up front, chances are it's probably going to have more beneficial results.

I'm glad you said that. I apologize. I'm going to cut you off because I'll forget my thoughts otherwise because I'm ADD, but I'm glad you said that because that's what I was going to jump in with is when you do training, you know, the, the counter awareness, you know, counter intel, we talk about in the awareness, right? See something, say something, all the trainings. And you and I have had those, you know, I, guys like you gave them to guys like me in the intel community too. But is it just, and it sounds like it's not, so I'm setting up for an easy answer. It's not just the see something, say something and all those. You're saying, I think, and I don't want to put words in your mouth, we also have to train the workforce empathy, right? To, to better understand our fellow person, right? To, to, to take that time because that affects the see something, say something approach. If I see something and I have no context, I may report that. And if I have some context, because, you know, I've taken time to actually get to know people around me and actually care about the people I work with and for, or who might work, you know, for me, then maybe that context allows me to better understand it. And either, either now I'm reporting something that has a little more substance to it and, you know, some reason, or maybe I'm able to go, oh, you know what? No, they're just ranting because of this thing today. This is probably not an issue. But does that also open you up to that question of, you know, do we want people making those judgment calls? So do you include the human approach, the, the empathy you're talking about as part of your awareness trainings to people, whether it's as a consultant or for companies you've worked directly for? Absolutely. And how does that balance out?

Absolutely. Anytime you lead with empathy, it's not going to hurt because once again, you're building relationships. I can't stand the word connections. I got these connections at work. It's too impersonal. These are humans. These are relationships. There's people we like and don't like and vice versa. They probably don't like us, you know, and that's okay. However, what's not okay is, uh, to, to miss the signs. There's a lot of discussion these days about all these red flags, but if we're not seeing them and they're being flashed right in front of us, what good are they?

Mm-hmm.

What good are, what good is the program of any value if it's not connecting with the very people it's claiming to want to protect? If you protect people, you protect, uh, IP, you protect product, you protect organization. That's what it comes, it, it all begins with the human.

See, and I love that. I think two programs that I've often been talked or told You know, remember, they may seem like they're here to help you, but they really just work for the company. Our HR, uh, you know, any place you go, you know, people will remind you, as nice as the HR people are, don't forget ultimately they're, they work for the executives and their job is to protect the company from, from risk and harm. Right. And I love, by the way, most HR people I've ever worked with, really good people, hard job, but ultimately it's a true story, right? They eventually are there to protect the company from risk. They may really care about us and try hard, but. Push comes to shove, they're going to do what's best for the company. And I've always heard the same thing about Insider that, you know, ultimately their job is to protect the company and not, you know, we are part of the equation, but not necessarily the important part as the workforce. But it sounds like you're really saying, I mean, of course you still have to protect the company, but it sounds like you're saying it really starts with the people. And I hear a lot more from you about protecting the people from becoming the problem. And of course you'll find the malicious ones there. I mean, listen, they're going to show up. Either way, they're gonna be there. But it sounds like you are really much more focused on understanding people and protecting the people because that also does protect the company. It can reduce the risk of somebody being put in a position to make a bad decision they may not otherwise make on their own. You can't do anything about the ones that are just straight up malicious. You're gonna find them, the cops are gonna get a chance to talk to them and prosecute them or whatever happens, right? But it's interesting and refreshing for me to hear you talk so much more about the people approach. Get to know people, get to understand people, empathy, care about people, you You know, we got a lot, I'm with you, we got a lot less empathy in society and business now than at any time in my life. It just seems like, you know, it's more people are out for themselves, out for number one. And as a result, don't pay enough attention to how to help other people, which is super, you know, depressing and frustrating to me.

Year after year.

Yeah.

Year after year in January, there's a slew of different reports from industry talking about how insider threat has exponentially increased. Mm-hmm. And, uh, every, every incident has now cost X number of more dollars.

Sure.

So I'm sitting there thinking to myself, okay, after all these years with all this programs out there, it keeps going up. Are we just missing what's in front of us? I know I probably am. And sometimes you need to pinch yourself and kind of step back. Uh, and I, and I, and I think that not enough people in the program space do that. Second, if we're just chasing down a bunch of red flashing lights, like the little buzzer, like the mouse going after the cheese, uh, what about when there's something bigger going on? Is this just another, uh, example of how alert fatigue has worn us down to where we're missing it? And are we really, are we really identifying the real threats and risks? Or are we concentrated on the low-hanging fruit? Essentially the goal of the program should be to not be a better victim.

Right. Well, and how do you convince people to care? You know, we just talked about companies with, you know, people have lack of empathy and people are more focused on themselves. But at the same time, you're saying to be successful, you're never going to have enough tools and people. You need that layer of the workforce who is, you know, aware, the see something, say something, but also, you know, provides that empathetic layer to understand people in context. But that also takes people caring about the company, which I think also is diminished quite a bit, rightfully so in my opinion, or at least justifiably so because companies have proven they don't care as much about people as they used to. So, you know, how do you account for that? Or can you account for the idea of, hey, there's a person who probably could be useful for us, but listen, they, they're just here to make money and they're looking for their next job and the next opportunity because the company just had another series of layoffs. And most folks here realize the company doesn't love us. So what do I care if Bob in accounting is stealing money? It's not my problem, right? I got my own things to do. So, you know, I don't know if there's any way to attack that or approach that, or it's an impossible question, but I'm curious about how that plays out.

I think, I think you kind of have to approach it from more of a, from, from more very simplistic, uh, adult approach, which is I don't expect everyone to walk away with the same enthusiasm of a message. I gave counterintelligence briefings to a room full of people with very sensitive accesses to very sensitive programs. I never once left there thinking, wow, everybody in there understood exactly what I said and they're going to embrace it. And it's not that. If you're able to connect with a few people along the way, that, that becomes a force multiplier in and of itself. If you're, if, if, if the day consists of just sitting behind your computer and not talking to anyone, and then the only time you're talking to them is when something bad's happening.

Mm-hmm.

You kind of, you, you've created that awareness yourself. So I think it's incumbent to just get out. Uh, I do, like I said earlier, you know, I do a lot of veteran support. The very first question I ask a lot of veterans is, how can, how can we better help serve? Instead of telling them what they need, why don't you ask them what they need? How can, how can our program better help what you're trying to do?

It's, it's, I love that. I think everybody probably realizes why, you know, I love you so much and, and why you're great to have on, like humanist approach. How can I help servant? Uh, you know, servant leadership, obviously I talked about at the beginning. So, you know, you're, you're saying all these things, which I obviously believe in very deeply, but it's nice to hear that, you know, this is something you're, you're working on out in the world, out in the field and, and having a lot of success with clearly. So with all of this discussion, I mean, at some point, listen, if you're going to continue to have a program or build a program, keep funding, gain funding, you know, et cetera, somebody's got to decide what, what does it look like? What does success look like? So who's accountable for success or failure if there's such a thing? I guess there is. And, and how do you, how do you measure that? Is it just a matter of, well, we haven't had an insider threat attack. So we must be good because if that's the case, then people would just have terrible tooling and never, you know, if you don't find something, nothing bad happened, right? So it can't be that no, no bad things have happened, but also I'm sure you don't want to be a bean counting of the most, you know, insiders addressed and stopped because that is an overaggressive strategy and then forces people to go down the path of that's the metric to succeed. So now I'm going to attack every little detail and fight everybody. So how do you, how do you determine the proper metrics for measuring a successful insider threat program and who's ultimately responsible? For success and failure of that program?

It's a shared responsibility. It's not just one factor. Metrics are part of it. And let's face it, metrics are a part of organizations. I think it becomes with how, how the message is crafted. If one is only looking in terms of this is how many we've identified, that's only a partial picture. I think there also has to be other elements to it. One of the things I've tried to do, and I recommend, I strongly recommend with clients, is how much of the program involves training. Because in my, in my opinion, even from my counterintelligence life, a majority of what I did was really training and awareness because that's what led to these other things. And I kind of go back to the basic messaging of it. And then it's building the team around you, supporting their inherent, you know, investigations, programs, maybe their travel security, what they're doing, being able to deliver on those points. So I think that when, when, when just talking about metrics, I think you gotta kind of break it down a little further. What is it we're, what is it that we've really helped address? The message shouldn't be the same for every organization. Because if we're gonna say our company's unique, then we should have our own unique challenges. So I, I, I think it just involves kind of more baseline, and then really it's understanding what each stakeholder views as success. And you need to, my, my recommendation is you should tailor your message around that.

Okay. I mean, that makes sense. I, I think, you know, most organizations, I, I've said this many times, Ultimately, you know, the C-level, they only care about two things, which is, you know, lower my risk or improve my profit margins. And to be honest, I've been modifying and saying at this point, they actually care about one thing, which is profit. The lower my risk is just lower my risk towards my profit margin or towards my bottom line, right? So how do you, how do you make that happen here? How do you have metrics that are going to tie to these things? Now, risk reduction, I'm sure you work with a chief risk officer. I'm sure there's some risk ratings you can talk about and risk reduction is squishy. I mean, there's math to it. I'm not an expert on it. I find it to be somewhat squishy because risk is a challenging thing. Uh, but I'd be interested in your thoughts on how this fits there. And then that cost savings approach, you know, hey, we stopped this, uh, event from happening. Uh, and it would have been, or could have been, could have resulted in these kinds of damages. Now, preventative is always really hard. We have the same problem at Intel. If we prevent bad things from happening, how do we prove they would have happened with a reasonable amount of certainty? And therefore, how do we extrapolate the costs and what we've saved you because prevention doesn't provide great metrics, but without it, then you don't have the metrics you need to, you know, justify funding the program. So how do you tie insider risk, insider threat, depending on who wants to call it what, how do you tie these programs metrics to risk reduction in a justifiable, documented, mathematical type of a way? And how do you tie them to cost savings to show that, hey, we're, we're not a cost center. We save you more than we cost you. And therefore you should continue to fund us and let us keep doing what we do. How do you make those things happen? Or can you?

That's a, that's a very good question. This is very difficult. I say it has to start off slow and has to start off with getting a better understanding of exactly the stakeholders you're working with and how they're measuring success. Because at the end of the day, you're leveraging existing tools and functions within, within any organization. To help kind of deliver that. Therefore, you're not requesting, uh, another 5 add-ons every year. You're making do with what you have. And let's face it, uh, even in the best of programs, you kind of have to do that. If you're not, sooner or later someone's gonna take a look at, okay, what are you doing exactly? And, uh, I think that, uh, I think that in the general messaging around it, you kind of help kind of condition that by not focusing specifically on that. But yes, you do still have to produce something. And you can also tie in metrics to the amount of presentations, interactions, other organizations, how you've helped them streamline, because your insider threat program should really be organizationally focused.

Hmm. Now, does that mean you have connections to corporate training programs, for instance? Um, I mean, you're talking about doing a lot of training and personnel training. Do you, do you find that inside organizations tied to training, do they tie budgets together sometimes? Uh, does training offer any, any insights on how they value and create a metric that shows value for training, uh, which I also see our budgets that have a tough time sometimes, uh, beyond whatever's mandated, that is.

So rather than kind of going to that kind of large organizational standpoint, see it as you connecting with a manager and then suggesting to the manager, if you and your team have 15 or 20 minutes available on this day at this time, I'd be more than happy to provide something.

Hmm.

Manager's involved, manager reaches out. So you kind of have the buy-in at that level. Now, at the same time, you're also working with the upper echelons to make sure that the message is coming across. From top down, but you're also working across. Once again, by working with them, you're showing that you're trying to be a team player with them. And I say that that's how you kind of help conquer that. And let's face it, word of mouth is far better than any other thing because when someone says something to someone else, you know, uh, my parents passed away in the last year and a half. Yeah, I know. But I always, uh, you know, it's been tough, but I always, I would always laugh when my father would always know how much the house in the neighborhood up the road sold for. And I know that he was too grumpy to talk to any of the neighbors. So how did he know that? Somehow there was an intelligence network there that was alive and well because the neighbors all knew it. It's the same thing with the program. Hmm. Uh, good news and bad news travels fast. Average news doesn't.

Yeah. I mean, it's a good point. You keep your, your ear to the ground, so to speak. And, and, uh, that awareness component, uh, you know, combined with the empathy we talked about and things will, will come to you. Um, but I think it's interesting. You're also talking about, you know, those, those building those, uh, relationships. I like that you said, you know, relationships. I don't really like the word connections. I like relationships, you know, building those relationships, uh, you know, really matters because that's where a lot of these things are going to come together and you're going to see them. It's also when you're talking about building these relationships, There's some perceived value, right? We have the same things with Intel. Intel, ideally, if you do it really well, a lot of it is preventative, but then you run into the, why are we spending so much money on this? You know, bad things aren't happening. I use the example all the time that if you run a bank and you don't get robbed for 3 or 4 years, nobody ever comes in and says, fire all the security guards, get rid of these cameras. You clearly don't need these. We all accepted that there's a risk if you do that, but there isn't a metric that really tells you, well, what if I get rid of one camera or one security person? Or what if I got two of you? Where's the sweet spot? Where's the number, right? And some of that becomes a bit of a gut feel, I suppose. Um, and I think it's the same thing you're talking about, about here is building those relationships so that people say, I really like working with Verge. I like, I like, I like this program. I felt like the training we got was really valuable. I feel like our folks, you know, know what to look for now. I feel like I know what to look for and how to talk to people differently about some of these things. And, and I believe that's going to pay off and that's going to prevent harm, you know, and I'm sure tied with an intel program as well. We didn't really talk about that and we're out of time. So we'll do it another time, but how this connects back to intel and how the intel team is able to feed in and say, these are adversaries you should look for. These are people that are targeting our company or our organization or people like them. And having that as part of the awareness training, as you mentioned, right? So listen, I'm running outta time, so I gotta kind of wrap us up today. You know, as you know, the name of the show is Unspoken Security, and I get to ask every guest the same question and put 'em on the spot. So you're on the seat today.

Uh oh.

Yeah. With that in mind, uh, tell me something so far for you that has gone unspoken.

Wow. A deep, dark secret.

I, I mean, don't confess to a murder. Like I, this is, you know, I don't have responsibilities, but yeah. You know, something that, that you haven't talked about with people, something unspoken, something unspoken.

I rarely tell people that during one of my very first investigations, I not only got the person's name wrong, but I got some other basic identifying information because I was too busy cutting and pasting. And fortunately enough, somebody in the DOJ was kind enough to call me and save me an enormous amount of embarrassment. That told me no more cutting and pasting and trying to take the easy way out. And it set me on a, uh, an overly meticulous pathway. I can't believe I've admitted this. I, it was beyond embarrassing.

But it's a, it's, I think it's a great, first of all, thanks for sharing it. And you'd be surprised how many people will share things and they go, I can't believe I said that. But, but thanks for that. But I think you make a really good point with this. First of all, it happened a long time ago. It didn't end up in harm, thankfully, because again, team game, in this case, a colleague was able to reach out and go, hey, you might want to check this. I think there's great humility in saying, hey, I'm not perfect. You know, things happen. But it sounds like the lesson is the big piece, right? You said it. I stopped taking shortcuts. I don't cut and paste anymore. Now listen, all of us cut and paste stuff. Still sometimes, but the importance of the work, you know, whether it's intel work, whether it's insider work, you know, some jobs and not to, not to put us ahead of anybody else. Everybody's job is important. Some jobs just affect more people differently. And, and when you work in a job with such great impact, uh, you know, we did this in the military, right? You, you make a mistake and throw the wrong coordinates on a target and a bomb shows up. That's a rather significant problem. That is a more significant problem than accidentally overcharging somebody., because you typed the wrong code into a system, right? And that's not, again, it's just how it works. And in your case, you're talking about, you know, bad information could have led to the wrong person. Uh, you know, it could have created all sorts of impactful things. And I was so, you know, it's great to learn that. Go ahead, man.

Well, I was so proud of that report because I got it done. I was on top of the world. I was on cloud nine. I was borderline cocky. And it was such a nice, uh, uh, personal character readjustment.

Yeah. Humility is always nice to pick up. Um, and, and we all struggle with it. I do as well. Um, but yeah, I think that's another key point you mentioned, right? Is it also could have, and I'm sure you've thought of this, I'm putting words in your mouth on this, but Intel, we talk about how difficult it is to do the work we do. And same thing with you. You write these, you do this research, you write all this stuff, you make these assessments. And I think to me, our, one of our biggest challenges and our, one of our top jobs is to create trust, to get people to understand the processes and the, and the challenges and the difficulties and the time and effort that went into this and to trust that what we've done has resulted in the best possible answer we could give. And it's amazing how quickly that can be eroded, right? Uh, this biological error being off. I remember reports where there were minor typos and then people would spend all their time questioning the typo and you're like, This is a rather significant report with 600 sources behind it. Perhaps we should look at the conclusions, the assessments, and the recommendations, and maybe not the typo on page 3 that distracted you. But I think this is a key piece, right? That could have been a credibility issue that thankfully somebody was nice enough to correct. But, you know, I think that's— I think it's great that you, you know, you brought that one forward. We've all done it, by the way. I can't count the number.

Can I give one alibi?

Yeah.

One alibi too, kind of, uh, on a previous topic, uh, we discussed, we are heading into what is otherwise going to be a, a spirited presidential campaign season.

To say the least.

I am asking all security professionals, regardless of what your personal preference, political parties, whatever, to pay attention to see how this affects the the workforce, because unfortunately people, a lot more people carry their political opinions on their sleeves regardless of whether what they hold is true or not. And, uh, stay tuned. Uh, you may have a bumpy ride along the way.

Yeah, I think that's a, that's an excellent point, you know, and, and, uh, and like I said, it doesn't matter what side you're on. Right. That isn't the point of this. We're not picking positions, but you're right. We're at a very contentious time. Uh, and, and people are very passionate about their positions and some cases influenced by things that aren't true. You know, I spent a lot of time talking about misdis and malinformation and that can affect either side or both sides as well. And if there's a third side of this at this point, whatever that might be. So I think you're right. You know, I think it's, it's, we got to be aware of those things because people are getting amped up. About all sorts of topics. Some may be, you know, valid and, and true and some less so. Um, but designed to, to create great deep passion that, that is gonna put people in positions of conflict. Um, that it's gonna bleed over into some workspaces. It just does, you know, humans are humans. Um, and may lead to, to physical security issues, may lead to cybersecurity issues, may lead to insider issues, all the, all these things we've talked about. So I think that's a great point to bring home. And again, for those listening, you'll hear it all the time from guys like Verge and myself and other intel folks. It's not about politics. All right. This is, we're intel people. We're insider people. And the point here is the risks are real and you can't just not talk about them because you're afraid somebody's going to be offended or you became too political. This isn't political. It's all sides. There are risks. There are threats. We have to be aware of them. But as Verge pointed out, we've got to be able to do it, you know, with, with humanity, with, with empathy. And try to, try to see the whole picture and, and the whole person. But I'm with you, man. The next several months at least are gonna be a, a bumpy ride for, for a whole lot of us, I think.

So go ahead, man.

You get the last word and then I'm gonna close this out.

No, I just wanted to say, AJ, it's been great. It's been a lifetime. We grew up together in this business. Yep. I'm happy to have taken part today. I love talking about this stuff. Sometimes at nauseam to the people around me. But I'd be remiss if I just didn't say to my, uh, fellow professionals out there, government, non-government, uh, please always feel free to reach out. If we're not talking amongst each other and we're not being critical of ourselves, uh, we're probably not learning.

Yeah, great, great point. And, and contact information readily available for Verge. Uh, I definitely recommend reaching out. We've been friends so long that he had more hair and I had less. Um, so that gives you an idea of how long it's been. Um, so anyway, with, with that, this has been a great conversation. I really appreciate you taking the time, you know, to hang out with me today, man. Um, and for those who've been listening or watching, you know, if this is something you like, uh, please do take the time to leave feedback, like, subscribe, download, all of those things, because that's what keeps us able to do this. Uh, if you really dislike the show, please don't tell anybody, uh, ever. Um, but do tell me, like, I'd like to know. I'm, I'm good with the feedback. Positive or negative, want to make it better. It's not about me. As I say every week, it's, you know, every time we do this, it's about the guests, it's about the audience. You know, we're trying to provide value to folks. And if you're not getting value, I do want to hear about it. But, you know, give me a chance, give us a chance to try to make it better before you go out and rant to the world. So far we've been lucky enough not to have that. So please continue to listen and focus and let us know how we can do more. So for that, this is the last I'm going to say today. This is the last of this episode of Unspoken Security. So until next time, Be safe out there. That's a wrap for this episode of Unspoken Security, brought to you by ZeroFox, the only unified external cybersecurity platform. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.

This is how legends are made.