Unspoken Security Ep 39: The Human Side of Cyber

Data and employee engagement are like two sides of the same coin when it comes to human risk management. We need to have the data to have the visibility to see who's at risk, right? Why, where, what are they doing? All that context. And then you need to be able to have effective tools to be able to apply to mitigate the risk and drive positive behavior. Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello, and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I've spent 19 years in the intelligence community, mostly at NSA, building and maturing intelligence programs in the private sector now for about 9 years. And I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! So I continue to be deeply committed to servant leadership. Now, this podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. This is not your typical polished podcast. My dog has made a fair share of appearances. I don't have any dogs around here today, so I think we're probably fine. People do argue and debate here, and we even swear. I certainly will. And that's all okay. I want you to think of this podcast as a conversation that you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now today I'm joined by Ashley Rose, CEO of Living Security. It's a company she founded based on a philosophy that empowering people is the best approach to lasting security awareness and breach prevention. Now Ashley is thoughtful. She's a thoughtful and transparent leader, and in her approach to running the company and working with clients towards a singular goal of reducing risk by making people a security asset instead of a liability. Ashley has a bachelor's degree in business administration from the University of Michigan.

Go Blue!

I'm a big Michigan fan on the side. And she's a serial entrepreneur with experience designing and managing product lines. Ashley, anything you want to add to that impressive resume?

Well, if we're at a bar after RSA or Black Hat, we probably hear a little bit about my kids and also my puppies. So I have two of them, two golden doodles, and three daughters who are amazing. So, I'll add that to the mix, but I'm sure you'll hear much more about me throughout, throughout this conversation today.

Well, that's very interesting. And if we're at the bar, what are you drinking?

Oh, well, right now I'm on like a 70-day streak of clean eating, clean drinking. So I'm probably having water or an iced tea. But next week I'd be having a tequila soda or an Old Fashioned. I could go either way. Old Fashioned or tequila soda.

Is next week— is it just the end of this streak you're on? Or are you going to have a treat?

I've got 5 more days, AJ. So I'm probably— Counting it down.

All right, well, so if you run into Ashley at any of the bars at any of these conferences, it sounds like maybe an Old Fashioned is the way to go. Or just see if she's on the streak first. If you see her with water, you know why. I don't drink much, so you'd probably catch me with water or tea or an Arnold Palmer or something. Anyway, so now that we know a little bit about you and your background and some of the stuff you do outside of the work environment, let's talk about the show today. So today's topic is titled The Human Side of Cyber. Now, we already mentioned in your open But this is a big thing, right? You founded a company based on the concept, you know, that's really wrapped around the human approach, right? You know, to, to try to understand how to make things better. It sounds like you're, you're very tied to people as a security asset, as you said, instead of a liability. So before we jump into the solution, let's talk a little bit about what's really the norm, cuz that's not very common. So why do we keep doing the things the way we've always done them in terms of really looking at all the technologies and not so much the people?

Yeah, there's, there's so many angles here. But if we actually like step back in time a little bit, you know, to think about where did a lot of the things that we have going in cybersecurity, where do they stem from? And specifically around the human side, we look back to audit and compliance, right? Mm-hmm. So companies continued to get breached and over and over again, it was a result of some sort of like human action, probably, probably a phishing, some sort of, you know, phishing attack or that. That compromise their environment. You know, now we're seeing a lot of SMS phishing and vishing and all the ishings, right? And, you know, I think the regulatory bodies, like, they had the best of intention in mind, but they said, "Okay, you now need to protect yourself. We're going to mandate that you have security awareness and training in place, that everybody's trained once a year, and then you have phishing simulation tests." And so, over the last, you know, call it 10 to 20 years, organizations as they've grown, as they become public companies, as they had to protect more sensitive data, they had to comply with things like PCI and HIPAA, they implemented programs because they had to, right? And again, came from the best of intention. But as we, you know, continued to progress over time, what we started to see was we were really looking at, I would say, somewhat kind of arbitrary or vanity metrics when it came to success of our programs. But we had gotten really comfortable with those vanity metrics. And so things like, you know, annual security training pass rates, things like phishing simulation click rates and report rates, those things became standard. And so then they were also very safe and they were very measurable. And so it sort of presented this illusion that our teams, or maybe our security program, were in control. But ultimately, you know, Verizon DBIR kept coming out every year and showing us that 80, 90, 75, whatever it is, you know, the flavor of the week, humans were still responsible for a majority of cybersecurity breaches. And so, you know, again, this kind of became more like ritual than actual like risk management and doing things for the sake of a compliance checkbox than actually managing risk. And that's just not going to fly anymore with it, you know, especially in the era of like AI agents and GenAI, like the threats, the threat and attack surface is changing so rapidly, like more rapidly than ever before. And so, we can't continue to be comfortable with what always has been. We have to, you know, move past familiarity and question the playbook. Yeah.

I mean, you make good points, right? So, our industry is dominated by metrics, right? Everybody loves metrics. And listen, as an intel guy, it's challenging because I have sort of the opposite problem usually of trying to explain to people the value of intelligence when they say, well, show me the ROI, show me the metrics. And a lot of times you can't until it's too late. You know, intel by definition is the only thing that can be proactive. And in order to be proactive means you prevent things. If you prevent things, how do you know if you really saved any money or stopped anything? Right? It's, it's, I tell people it's like doing physical security at a bank or buying, you know, health insurance perhaps. You know, the preventative medicine doesn't, I mean, for somebody has some sort of ROI on it, but it's hard to show. And, you know, physical security, physical security at a bank with cameras and people. It's hard to say for certain if you're getting ROI, but I promise if you take away the cameras and the people, you're gonna get robbed, right? So, you know, that's been a challenge in our industry of, of we're very metrics-driven and can be very good. And I think you're get— you're bringing up a really good point in that it also has this other effect that we, we convince ourselves that things are going well because we created metrics to measure success and we're meeting those metrics, even if they aren't actually the right metrics to show success. And I think You know, the key piece you said there was we've turned it into a ritual. You know, it's not a, it's not a response. It's, but we have something we're comfortable with is what, is what I'm hearing you say that, hey, we've got these metrics and as long as we're doing these, it must mean we're okay. And I'm with you. The, the intent was good, right? Somebody said, you know, the government, you know, got involved in a lot of this regulatory, you know, agencies said you gotta have something and, and we gotta figure out how to measure it and you gotta have some kind of standards. So, you know, it makes sense to have them, but it just became this check the box thing where it's like, all right, we've got, you got your annual training. And I don't know anybody— maybe you do because you do this more than I do— but I don't know anybody who pays attention to annual training. If I'm being honest about it, I've— I have 4 screens on my desk. Most people at least have a couple. Annual training sits on the side screen. I hit a button, it starts running, it's talking, I'm not paying attention, I'm doing what I do. And when it stops talking, I figure I gotta click to the next slide. And so it— I do that till I get to the end, and then I click through and I get the test. And I've done this so many times, I'll probably pass. And if I don't, it'll just let me retest until I do. And that doesn't make anybody safer. It doesn't. We're not internalizing this threat or this risk. We're just checking boxes. And leadership's not checking. You know, they, they check the stats. Did, did everybody take the training? Is everybody done on time? You know, we've all had those emails, right? But you know, does anybody even check what the score is? Pass/fail. You know, I don't care if you got 100% or 72%, as long as you passed, it's, you're on the box. We're good. And does anybody follow up to find out later if I'm the sucker who falls for the phishing email? No offense to people that do. It happens so often. How did I do on my training? I bet I passed. I might even 100%.

Exactly. And I mean, this was sort of like, like where Living Security entered into, this was like the state of things. And a couple other kind of points that you prompted me to think about. So not only do we have like vanity metrics, but we actually have metrics in a program that force us to act in a way that's against the best interest of the org. And let me clarify what I mean by that. So, When you think about like phishing simulation metrics, right? People who have clicked on phishing simulations. Well, everybody in the industry knows that if you put, present an easy phish, you're going to get a low click rate, right? And so if your program owner's success rate is being measured by the click rate over time, what are they incentivized to do? Are they incentivized to come out with, right, the most, you know, advanced phishing sim or like what's going on in that from a new attack perspective, like, oh look, AI doesn't misspell anymore and they're really good at localizing everything. And so we're now getting spearfished at scale with AI backing us. And so we can't rely on the same old tricks and tactics that we've seen before. But like the minute they change that, that metric is gonna immediately skew. And then not only are you gonna have your CISO asking like, what happened? But the board is gonna say, what happened? Because that's the only metric that the board has in front of them too. And so, This whole thing has been rigged against us. Like, which is like, you know, and maybe I don't say this on other podcasts, but like the system's rigged and we're sitting here in a bar at RSA and I would tell you that. So this is like truly the state of things. And then if I was gonna push past even some of the systems, like because of the solutions that we've had, had in place, and look, there's like really large, huge successful companies that have essentially like a established, you know, kind of their place in the cybersecurity arena backed on compliance training and phishing simulations. But they have actually somewhat done us a disservice because now we have CISOs that have said, hey, I've had security awareness and training for the last decade, 10, 15+ years, and guess what? All my breaches are still human. And so now people are disillusioned. With the idea that we can do something to affect the people, right? And so instead of saying, okay, is there like a better solution or is there something else out there, like trying and changing things, we're now like overinvesting in technology and we're saying like, well, you can't fix stupid anyway. So like, why, why? I mean, truly, like the amount of times I've heard that. So, so that is, that is the state of things. Like I think it's important to like really be aware of, of where living security sort of entered the arena.

Well, I mean, you make an excellent point, right? We're talking about the metrics. Again, if, if I know what I'm being judged on, my job is to make sure I, I win, right? My metrics need to be good. So if I'm the, if I'm the person running the program, and yeah, like you said, do I want to make these really, really challenging, difficult phishing, you know, scams that most people are going to fail, or more people are going to fail, and then it's just going to hurt me? I mean, there's no point in that. My, my goal is to have it look like the company is doing really well, 90, 95, 100%, whatever the number is supposed to be. Maybe not 100%. Maybe we don't want this to look like, you know, the, the elections in North Korea and Iraq, for instance. But, you know, you want something believable but strong, right? And so I'm going to, I'm disincentivized to challenge my workforce with what is the most advanced current state of, of a phishing, you know, campaigns. I'm, I'm incentivized to give them low-hanging fruit. Like I said, lots of misspellings, you know, really obvious, you know, errors to it. So they just don't click on things. And, and so as a result, We're not getting good training. So, and people aren't paying attention to training. The training they're getting isn't particularly good. The stats all look great, but then what you're talking about, you know, is the out, you know, the fallout of that, which is that things aren't improving. You know, as you said, every year we get the new report and it's, you know, 75, 85, 95% of all attacks start with phishing. You know, phishing's been the number one vector for as long as I've been around and probably prior to that because it works. And so the question is, why aren't we improving, right? So in fact, I want to dig a little deeper into this because I know there's more to the story. You know, you've been doing this a long time, you know, and, and you're deeply committed to this sector of security. So you've seen more of it than most people, I think. What do you see as the challenges with all the current training and culture? Now, we talked about a few of them. I'm sure there's a bunch more in here. I wanna kind of dig into what do you see as the holistic problem in terms of the challenges here?

Yeah. Yeah. So yeah, we talked about the state of sort of programs, but like, let's dig in a little bit deeper. So the first thing that we'll talk about is training programs operate in a silo. And so, like, even when we first, like, started pitching what human risk management was and is and could be, we actually had this, we had this, like, image, and it was like all of these, you know, popular kids playing together. They're in a sandbox, and you had, like, the security awareness program, like, over to the side playing alone. Or, you know, if you maybe, like, use another image, it's like, you know, you're at the little kids' table at Thanksgiving, right? Instead of, like, with all of the adults. I mean, this is like truly what we eat, sleep, breathe every day. And, you know, it, it's, I think it's great security teams and programs have had, um, they were really intentional. They're like, hey, we're gonna bring people in with some different backgrounds and expertise, things like marketing and comms and communication, behavioral science. Like, mm-hmm, those things are really, really valid. But then what's happening is this like highly technical group of individuals, they tend to overlook or think, oh, these people are like in charge of the softer skills. And so the software part of security. And so like, you know, they're not hearing from incident response. They're not talking to the SOC. They're not integrated into your data loss protection program. And so like truly they're operating in a silo. And so phishing sim, awareness modules, data protection, you know, SEGs, your web application firewall, like they're rarely talking to each other. And so this creates a really fragmented approach and it's like impossible to or nearly impossible to connect the dots between behavior and real risk. So I would say that's one. And you can't, you know, the SIEM, right, brings all of these different data points together, and we're able to look at our networks and our applications and our devices. If you don't have that around the user, do you really have the right amount of context, right? The right amount of visibility to take action? That's a huge issue, like lack of visibility, you know, kind of lack of systems coming together in a way that's understandable when it comes to our human risk. And so I'll give you kind of an example to bring it home. So, you know, we see somebody who's repeatedly clicking on phishing emails, whether that's simulated or real, potentially. But if they also have access to really sensitive financial systems, if you don't have your tools coming together, you're like missing a part of the picture. And so we often talk about like no two clicks are the same, right? If you have like, you know, Susie in accounting with elevated access and she's getting like highly targeted by a phishing scam and we've seen malware on her device in the past, is her clicking on a phishing email the same as, you know, Johnny who doesn't have any system access and he's really not targeted that much? And so if he was to become compromised, his blast radius is like much smaller. And I would say no. And so again, this is like lack of visibility means we can't manage our risk effectively. So that would be one. The second one you mentioned, which was, you know, compliance training or awareness training, like, that's what it does. It can raise awareness, but it's like really not resulting in meaningful and lasting change. Before we hit record, you and I were talking about, you know, Halloween, October in Michigan and Minnesota, and we both had these like really like visceral experiences around Hey, like some Octobers we're in snow, you know, our snowsuit and some were in our bathing suit. But it's like, it's because we had that experience, right? That we like remembered it and it's gonna, you know, stick with us and it's gonna change the way that we're, you know, potentially that we're gonna act like maybe we're checking the weather before we go trick-or-treating next year, whatever. I think that one thing that a lot of organizations like miss the mark on early on is, you know, we look to try to train people like for the sake of training. And so we really did not incorporate experiences, behavioral science in a way that like really stuck with the people that were watching it. Or even maybe we were talking with too many acronyms or, but in a way that like didn't make security approachable for the, the average employee. And so, you know, I think that's something also that we're really passionate about. And we actually like, before we even moved into the data side of, of human risk management, We spent a lot of time working with our customers and their team members to figure out how do we get people to engage with security? How do we help them to listen? How do we help them to open up their ears? How do we make this like fun and inter— and interactive? Anything from like cybersecurity escape rooms up to like Netflix-style training content to now like TikTok-style videos, like storytelling, people seeing people's faces versus like animated cartoons, like There's so many opportunities for us to like, you know, just to like make things that don't suck. Like, it's just like—

I think that should be the new company motto, by the way. If that's not your tagline, it really should be, "Living Security: We make things that don't suck." Listen, I'm only half joking. I mean, somebody in marketing probably is going to hope I cut that later, but it's a good point. You know, it's that there are a lot of things that just— we make a lot of things that we think are good ideas. You know, the intent is all there. And most of it sucks. I mean, let's be honest. Like you said, we leave out the human component to it. That visceral reaction, as you said, you know, you and I, as, you know, as, as you mentioned before we, you know, we jumped on here and started recording, we talked about, you know, growing up in, I'm in Minnesota, you're in Michigan, or were at least, and, and those weathers, right? And, and immediately it evokes something, right? It isn't just a discussion, it's also a memory and it's something that's been internalized.

Right.

We don't have that in most of our security training. People don't internalize. And I talk about this from Intel too, getting leadership to internalize the risk. And the threat is different than just explaining it to them. If I tell them what's going on in the world, you know, you get some, OK, oh, that's interesting. And maybe it's even exciting, whatever. But you got to internalize it. You got to be able to tell them, this is why it matters to you. You know, I spent a lot of time dealing with this—people in intel do—of explaining not just what's going on, you know, but why it matters. You know, what happened? What does it mean? What can you do about it? And I spent a lot of time with that. Because if you don't have the "What can you do about it?" or the "What does it mean to you?" part, It's just gee whiz, it's interesting, right? And security training feels a lot the same as like, oh, there's, you know, there's phishing and there's vishing and there's smishing and there's, you know, there's man-in-the-middle and there's social engineering and people kind of just go, ah, you know, and shrug it off because it doesn't feel real.

And it's not on the calendar, right? So, a lot of time, and look, like, we created the calendar. We're like, here's your calendar because people, like, want predictability. But, like, that's why, from my perspective, and the company believes, like, data and employee engagement are like two sides of the same coin when it comes to human risk management. We need to have the data to have the visibility to see who's at risk, right? Why, where, what are they doing? All that context. And then you need to be able to have effective tools to be able to apply to mitigate the risk and drive positive behavior. And that can be in the form of like training that doesn't suck. But it could also be in the form of policies or controls or reporting, right? There's, there's a lot of different ways or sort of action plans that you can enact once you can see what you need to do. But without the context, you're essentially like, you know, throwing darts blindfolded and hoping something sticks, right? And that's not gonna work either. And so you have to have both. You need data and visibility, and you need, you know, successful employee engagement mechanisms to essentially like close the loop.

Yeah, and that's really interesting. And that gets us to, to where you fit in, right? And, and so, you know, you talk about human risk management, HRM, which is a term that I've heard a little bit here and there, but it doesn't come up often. It probably should. You know, we hear all the time that people are the problem. I mean, I've, I've written papers on it. Others have. I've seen presentations on it. I've also written papers on people are the solution. It's a whole different thing. But people are the problem comes up a lot. So if, if that's the case, then it's a human risk management challenge. So can you talk a bit about human risk management? Like, what is it? You know, some of the basics, how do we define it? And then what goes into it and how you guys approach this, you know, at Living Security.

Yeah, absolutely. So, yeah, Living Security was the pioneer of human risk management. I think I bought the domain back in like 2020 before marketing was like, are you sure you want to do this? Because like nobody's searching. And I was like, you just wait, you just wait. Like, we will have search terms. But human risk management, HRM, which is actually now is the new defined category name by Forrester as of last year. Boomkit's a data-driven cybersecurity strategy that identifies, prioritizes, and mitigates human-driven risks before they lead to an incident. So it's all about moving our program left of boom. You talked about threat intel, right? Being extremely proactive. We see HRM in the same way because we're looking for trends, deviations from baseline, indicators that someone could potentially lead to or be susceptible to risk that would be posed to a human, and how do we get in front of that? How do we make a choice on how do we move from compliance-based or traditional training to risk-based training? How do we apply policies and controls in a very effective and proactive way and adapt policies around our users so they can work but also work securely? So that's, you know, it's very simplistic form. It's giving you visibility to make decisions. So you can apply mitigations ahead of an incident. And so, you know, HRM would surface things like password reuse, falling for deepfakes, ignoring security alerts, right? We want to enable those faster and smarter responses.

Okay. So, how does this, how does this relate to, because it sounds similar to me at least, how does this relate to Insider Threat, for instance? The Insider Threat has a lot of programs. I know they have a lot of platforms that have algorithms. I mean, it sounds like there's some similarities in the concept. It sounds like some of the application is different, but I don't want to speak for you. So, how do these two, do they work together? How similar are they? More different than I realize?

Yeah, yeah. Really great question. We get it all the time. So I'll kind of take a few different approaches. So at its start, we are integrating a lot of the same signaling from, or at least from the same tooling, right, into the platforms. What Insider Threat and sort of where these things break off, what Insider Threat does is they're looking to catch something and detect risk. Sort of at the point of risk so that they can shut it down as quickly as possible. So there's really a, a focus on detection and response. You also layer in, you know, a little bit of like kind of the investigations and the HR, the HR theme. Insider threat doesn't want the employee to know that insider threat exists, right? Like most organizations don't want their employees thinking that they're being monitored because they believe they're a malicious insider that's, you know, being a bad actor. And so they sort of like exist below the surface in the background. They're not really talked about, you know, maybe this is something incident response or HR manages. And again, we're really trying to like monitor to see when somebody's gonna do something wrong and like shut it down and then we can go take corrective action. So that's one aspect, right? Still focus on the human behavior, but I would say somewhat like point in time or maybe more kind of reactive. And it does not engage the employee in a way where they can be an active part of security, right? They're sort of like the bad guy in that instance. Human risk management is taking it, looking at it from a different approach. And so we're being proactive. And so we're looking at risk signaling. And again, we're sort of like correlating and aggregating all of these signals where somebody's getting a risk score. And so it could be over a period of time that people are taking risky action, or maybe they're being highly targeted there's more threats coming inbound, or they have a level of access that's put them into a risky position. And we would identify that user as being high risk or more susceptible to an attack. And then that gives you the time and the advantage to get in front of it. And so then you can apply training or nudges in a way where people's behavior would correct. And so they would actually never make it onto an insider threat list, or they wouldn't sit in front of HR, for instance. Or they wouldn't be part of the reason that incident response is being called because they need to go shut something down, right? We want to get ahead of that. Or we're able to then apply, like, for instance, a stricter policy or control so that we're protecting that user. So that could mean a high-risk individual is having a stricter MFA policy, for instance, and they're having to multifactor authenticate in or get approval to access a specific application by, you know, a senior level of authority. So, Or maybe we're saying, hey, this group of users, we're seeing them at high risk for account takeover. We're seeing a lot of passwords that have been leaked onto the dark web. We're going to either reset their password or we're going to require password management usage. But as you can see, like, this is a very proactive stance and it gives the employee the opportunity to be trained, to be corrected, and to be an active part of the security strategy versus insider threat thinking, you know, hey, how are we going to find this malicious insider, shut them down? And then we're going to shoot this over to HR. So those, those are really two of the biggest differences. We work together in a lot of instances. So for instance, a lot, some of our customers, they have the risk profiling going on on the users, but they've opted to even pull in some type of HR data. And so we could actually see, let's say somebody's a high-risk individual and they're on leave or notice, or they're on a performance improvement plan, or they're a contractor, right? So we have all these sort of identity characteristics that we think about as impact modifiers. And then by applying those, we can then segment the, the data and show here's high-risk users with this impact modifier. And we're actually able to create lenses or lists that we send over to Insider Threat, and they may run a deeper investigation on them, or maybe they're tracking somebody because a lot of Insider Threat, a lot of Insider Threat investigations are actually opened up because somebody went and, and said something. They're opening up a case and it's not driven by data. And so then they need to go backwards and say, okay, like, what's going on with this individual? And so they may have somebody that came in and gave them a name, and they're going back into our system and saying, okay, is this a high-risk individual? Are they a vigilant? Like, what's actually going on with this human? So we work hand in hand. There's certainly some overlap specifically in the tools that we're integrated into, but how we operationalize the program, who's involved, and what the mitigation steps are, are extremely different.

Okay. So that brings up two questions for me, at least. So the first one is, do you see a future where these should be closer together, united? You know, if, if the goal was prevention, and I think there is across the board for security, I think everybody wants to prevent things. It seems in my mind, listening to this, that it would make sense that the human risk management concept should be applied to insider threat. You know, insider threat, not always about malicious, obviously. There's also the, you know, the unintended. Insiders, right, which is something we really try to prevent because there are people that are getting, you know, lured in, they're getting hooked, and they're getting tricked, and in some cases have no idea, right? So, do you see a future where these mesh, where HRM is, you know, part of insider threat or is a leading component to it, is a foundational component to it? So I've got, I have a second question, but I'll start with that one and then I'll come back to the other one.

Yeah, so it's actually interesting. So you and I had our conversation at RSA, and I think right before we met, I had met with one of the lead analysts from Forrester on insider threat, and I was like, hey, let's unpack this. Because like, I have this theory that like these things are becoming, they're converging, they're getting closer together. Like, how are you talking to customers about this? And how are you talking to other vendors in the space? And so, the feedback that I had gotten was a lot of times when organizations are like, hey, I have an insider threat problem, I have insider risk problem, they're looking at vendors that would traditionally, you know, play in the UEBA, DLP, or like insider threat area. And they have like, you know, a, a big kind of hotspot need. And so they're, they're setting up, they're tailoring, tailoring it, they're putting in, you know, whatever combinations of kind of indicators of compromise, like they're building all of these different, you know, scripts within the, the system. And what they're finding is that 5 to 10% of them, right, of the signals that they're getting are actually meaningful when it comes to like looking at that malicious insider. And so they get really good at putting those systems, putting those detections in place, and figuring out like what their process is. And then once that program matures, that's when they start saying, okay, all right, we've gotten sort of like the hotspot risk areas covered. We have those 5 to 10% of the signals. Now we need to start focusing on the 80 to 95% of the signal. That is like not malicious insider. How do we get more proactive and preventative? And that's when they come and they're like, we need human risk management, we need to engage our people, we need to apply policies, controls, and training. And then they're coming and talking to Living Security. And so, so again, so this is another example of how the two programs work hand in hand. And so I, I believe they're complimentary. They're covering kind of different aspects of the human risk attack surface. Do those things converge over time? I believe the answer is yes. I think over time our, right, our buyers, and we're seeing this across the security market, so this is not like, oh my gosh, I can't believe she said that. Insider threat and like human risk management are gonna converge. Like we're seeing all, all kinds of consolidation because CISOs have way too many systems and, and tools and technologies in place. And a lot of times there's overlap. And so I think there's gonna be sort of a natural movement in that direction. What the time is, how that happens. Like, I don't have a crystal ball. I wish I did, but I think it makes, you know, it definitely makes a lot of sense. The challenges that we're going to have to get through would be things like, how do these things get purchased and by whom within the organization? Because, you know, I would say some of the things that we run into when we're actually in a buying process is actually aversion to insider threat tooling, right? And that could be coming from workers' councils, like it could be coming from HR. And so there's actually like a lot of internal tape of, or in different people that are saying like, we don't want this. Like, we don't think that this is like culturally aligned with how we think about our people. Our people are our number one asset, right? They're not our, they're not like an attacker or somebody who's out there and malicious. So, so there's a little bit of that that still needs to be worked through, I would say, just from a market standpoint. And so people do tend to I would say those types of individuals tend to take like a kind of a friendlier stance to HRM because we're like, "Hey, we're here to actually like empower your people." You know, this is actually like somewhat of an employee benefit, if you will, right? Where they're like, you know, being strengthened and they're an active part of security. Like they're not being thought of and approached as an adversary. Yeah.

Well, that, and that's perfect. That actually leads directly into the other question that was in my mind. Which is about the ick factor, like, frankly, right? So, you know, you had mentioned insider threat. Generally, people don't know about them. They're quiet. They're in the background, you know, and, and to be clear, I have some friends who work insider who would disagree with that. It depends on who runs the program, right? There are definitely programs that run that way. I think there are ones that are trying harder to actually lean towards your approach of being more engaging and more involved and, and working more with people because again, partnering with the people is, is the way to get the solution, right? The people are the problem, but people are also the solution. And so if, if If it's— if insider threat is thought of as the Gestapo, you know, the corporate, you know, secret police in the background, nobody wants anything to do with them. You know, it's a real negative. And what you want really is to partner, which is what you're talking about. So, but then that becomes the question is, you know, how do we, how do we better balance out this sort of ick factor? Because you're talking about getting a lot of data on people, some of which is obvious. I don't think would, you know, creep anybody out. Hey, I work in accounting. My risk level is going to be higher. Than, you know, the person who doesn't touch numbers and money, for instance, right? You know, if I work in accounts payable, there are a whole different group of people that are gonna target me because I can actually send money on behalf of the company. So that's a challenge. You know, if I work in HR and I have access to everybody's W-2s, you know, or, or I-9s or whatever. So I think some of those things are understood and probably wouldn't creep people out. But at the same time, I think some of them aren't, right? So helping people understand what, you know, what's, what's creepy and what's not. How do we avoid that, that ick factor, right? So do you have any thoughts about, how that's going to work, how you're going to team better and how people feel good about this, as opposed to just thinking, well, the company's just spying on me and they're getting all this information. Yeah, it's creepy.

So, yeah, I mean, there's a couple ways that I'll approach this. So I would say that from a, like, first and foremost, like, Living Security, I don't want to speak to all of their vendors, right? Because, you know, even the depth that I know about them, I'm sure there's probably things I would miss, but Living Security does not create any net new data or net new monitoring than what you already have in place. And so, because we are API integrated into your existing technology stack, like your web application firewall, your, you know, your, your SEG, right? Your DLP system, like they're already collecting all this data. And so there is nothing net new there. We're, all we're doing is we're aggregating it and we're correlating it back to the human. But again, like the monitoring is already in place. And so if you think like you're not being monitored, guess what? Like you're wrong. These tools are already out there because we, we don't, we're not like installing anything on the endpoint. We, you know, we don't have, you know, anything going into the browser. Again, there are other companies out there that do. And so, but for us, that is one of the reasons that organizations that, you know, would sort of butt up against this or that maybe it'd be a little bit more abrasive. Like they're like, okay, yeah, that makes sense. The data's already being collected. We're just like, Putting it into a usable form, essentially, that we can make decisions on. So, so I would think, say that that's number one. The other thing that, again, may be unique to us versus to other systems would be that we're looking at metadata. So for instance, like, we're not, we don't want to know, like, what website you're on and exactly what you're doing on it. Like, we just need to know, is that, like, a riskier website or not? So, so that's, like, the way that we approach the world. And again, different maybe than other systems. It's like, okay, if your Netscope or your Zscaler is telling us like this is a potentially malicious website, then that's gonna like ding your risk score. But it's like, we don't know if you were on, you know, porn or gambling. Like, I like, we don't really know. And nor do I—

probably on a company computer you weren't on either, but you know, I don't know.

But yeah, so, so that's sort of like our approach to the world. And again, it's because we're not saying you're on this site, we're gonna stop. We're not going to block detect and respond, right? But we're saying like, are you constantly visiting potentially malicious websites and you've clicked on phishing emails in the past and you've had a malware incident and you have access to a lot of sensitive data? Okay, your risk score is much higher. We need to prioritize like figuring out what to do about this for, you know, you individually or for your department. If we're seeing that this is a trend, right? Hey, we're seeing like a lot of people in customer support are visiting a lot of malicious websites. They have risky web browsing behavior. And then, hey, head of customer support, did you know that your team is visiting a lot of malicious websites? And there, that customer support leader is like, what? Why are they online? They need to be handling support tickets. You know, this is an actual customer example, like, they were given. And then that customer support leader is like, Let's just remove browser access. Like, I don't need them on the web. Like, I need them managing tickets, right? And so these are the types of conversations that can actually take place in a human risk management concept if we're trying to enable the business and partner with them to make a decision that not only secures the organization, but actually allows for productivity and employee engagement and employee retention, right? Like, it's a, it's a risk management conversation at the end of the day. And so real quick, because I know I'm, I'm going off kind of like— no, you're fine, go, go. We sometimes— we've gotten some slack about like human risk management, the name, and they're like, well, what are we saying to our people if we're calling them a risk, right? And, and I'll come back to that, but like potentially insider threat, right? If we say, okay, you are threat, that I think could have some negative, you know, reactions. So maybe that's why they went from like insider threat to insider risk. Like they will soften it a little bit. But I would say, I think people don't always think about like risk in the right way. And so, you know, I like if we, if we just take this from a personal standpoint, like everyone has a risk tolerance, right? Like from a financial standpoint, people have a risk tolerance and like we know that, hey, if you take more risk, you have more gain. And I think we need to think about like innovation and organizations, like in a, like organizations should have a risk tolerance. They do, right? They're like, hey, we're a startup organization. Mm-hmm. We need to be innovating. We need to be testing and trialing. Maybe our risk tolerance is a little bit higher. Oh, we are a financial services organization. We have a lot of regulatory demands. Maybe our risk tolerance is a little like, so as you see, like when I think about risk, like I don't think risk is negative. Like risk is somewhat neutral in a sense. Like it's about balancing risk and managing risk in a way that aligns to your business priorities. And so I think if more people thought about it that way, like that's why having the terminology human risk management is so much more fitting than compliance or, you know, insider threat or whoever you want to term this. Like there are some organizations that are going to say, Hey, guess what? Those are my top-selling salespeople. Like, if like I need them to be on any website that they possibly need to be on, because if they're trying to get information about a prospect so they can make a sale, like do that all day long. And then there's other ones that are like, no, that's not acceptable. But it's not gonna be the same for every single company. And so we need to recognize that. Yeah.

I mean, I don't think risk inherently is negative at all. I think, like you said, we're all measuring risk all the time. You know, what's the risk of jumping out of a plane without a parachute? It's a lot greater than the risk of jumping out of a plane with a parachute, which is still greater than the risk of not jumping out of a plane at all, which is greater than the risk of not flying at all. Like, we, we do this all the time. I don't know anybody who's jumping out of planes without parachutes. Nobody agrees to that risk. I know a lot of people who fly, and there's something in between, probably. So, you know, I don't think risk in and of itself is negative. I think, I think it's great to talk about it in the, in the way you're talking about it. It, and a lot of what you're aligning to isn't dissimilar to risks that we do already with, with architecture. With, you know, with hardware and software, right? So, you know, you're talking about risks, you know, risk components related to a person. We do the same thing now. There's plenty of, you know, companies that do risk scoring based on specific endpoints, based on specific networks, you know, based on, you know, your corporate profile. You know, the, the risk of China attacking you is greater in some industries than others, for instance, or, you know, hacktivists or take your pick. So I don't think there's anything negative about risk. Now granted, I work in the industry. I, I understand that the average person Yeah, there might be some massaging to it. I agree with you. Risk still sounds worse than threat, you know, but ultimately—

You know what? Well, I know, I think threat sounds worse than risk.

No, I'm sorry. Risk sounds better than threat. Yes. No, risk sounds better than threat. You know, ultimately, I think everybody probably understands they present some risk to the company. Maybe not a threat to the company, but a risk. You know, just, just being a part of a company, you're part of the risk. You have an email address. That means you can be targeted. There's a risk related to that, right? If you weren't part of the company, you would present no risk. Doesn't mean you present a threat. You know, that's just, that's just how it works, right? So I, I think it's a good thing that you're talking about in terms of risk and, you know, risk management is, is a constant problem. You know, I tell people all the time, you know, ultimately the board only cares about two things. They want to, you know, improve my bottom line and lower my risk. And the truth is they want to improve— well, they want to lower my risk of not improving the bottom line. That's really the only thing any company cares about if they're a profitable company. So, you know, this all ties into it, right? If you have people, as you said, that are taking risky behavior, going to risky websites, you know, and they're also— then it's about, well, what's the rest of that? You know, again, the, the person who's the head of custodial arts going to a risky website isn't nearly as dangerous as the person who, you know, is the head of accounts payable. Their impact's just not gonna be as great. You know, there's still some risk, and they can be going to a site and they could be getting compromised, and therefore you get malware in your system or whatever, but it's, it's not as risky. Now, so one other piece I want to add to this a tough question, I suppose. So if we're gonna really do this whole human risk management and, and profiling, really, where do we go in terms of, does this crossover into things that aren't part of work? Does this crossover into social media? Does this crossover into people's personal lives? You know, with or without their permission? You know, I've certainly done some profiling, you know, with permission on contract on people's, you know, full security, full risk profile. You know, you do that with, with high-value targets, high-value people. Sometimes you'll do a full profile of, of the risk of themselves and their family and everything. But that's with their permission and knowledge and understanding, and they pay for it. But does this go there at some point, do you think? This whole concept leads to, you know, hey, it's social media, it's public, I'm allowed to monitor it. Should companies, are companies, and should companies be monitoring, you know, their employees' behaviors outside of work?

I think OSINT data is like fair game. So I, you know, like when we think about breached credentials, right, on the dark web, it's open source intelligence. Like, we should be able to pull that in. But yeah, I, I mean, I think, look, LLMs, like, let's talk GenAI for a minute. Like, it is scraping all kinds of things. So if you have things that are out there, it's, you know, open source, it's visible. Like, I, I think it is fair game. Look, like, we'll, we'll leave that up to the customers to make a decision of what's right for them. But, but yeah, certainly we're exploring, we have customers that are asking for those types of integrations. Now, you know, looking into like also an opportunity to like train and educate on ways that you can drop, that you can actually like limit your exposure for things like social media, right? Is if, okay, you don't want your social media monitored, well, how do you make that private? And so then the company's not out there monitoring it. So I think there's, there's ways that you can do it, but if something is public, it's being absorbed and it's taken into account for a lot of areas. The attackers are certainly using it against you. I talked, I mentioned earlier, you know, sort of spear phishing at scale is kind of like where I think like the future of phishing is going. And I think largely that we're already probably starting to see some of that, but getting all of this context on an individual and then applying that in a very malicious way, like we need to use that same data and context to actually like train and educate and get in front of it. And so, you know, fighting AI with AI, one of the things that we launched at RSA was our AI phishing module. And so now we're not necessarily like, we don't today have, you know, OSINT, social media type information and data getting pulled into there or anything that's like personal, you know, exposed on the web. But we are taking the data of your risk profile and we're seeing like what attacks you've fallen victim to before. We know what tools that you're using, right? Because we have those integrated as well. And then we're able to create like more personalized and specific phishing campaigns. And so again, like we're working with companies that are okay their click rate going from 2% to 7% or whatever, you know, maybe higher because they want to train and educate and then move people in a way where they're becoming more resilient, right? But yeah, I mean, I would say if the data's out there, then we're kidding ourselves if we don't think that that same data is going to be used against us. And so how do we do it in a way that's empowering and it's helping to create more organizational and kind of individual resilience against cyberattacks.

I have to agree. Listen, I'll tell you, I'm sure you know this. It's probably an unpopular opinion. I happen to agree that if it's available publicly, it's open game, right? We cannot allow our personal sensitivities to override the realities of security. I mean, that's just how it works. If the adversaries can get to it reasonably easily, then we have to include it, in my opinion, in risk profiles and assessments and all these things. And Yeah, that's just how it works. We have to try to emulate the adversaries. Now, an interesting point you brought up that I wish I'd thought of before, frankly, is maybe this is what finally motivates people to care though. I, I can't count the number of times I've explained to friends, family, acquaintances, coworkers, whatever, you know, you should really lock down your social media. And they just, you know, they chuckle, they laugh, you know, they don't do it or they don't understand the risk. Again, internalizing the risk. I bet if I told them their companies are gonna start reading everything they put on social media. And that's fair game, suddenly I imagine they're going to take another look at this and say, well, maybe I don't want that stuff out to the public because now they start worrying about companies saying, well, you know, we don't want to hire this person because of their political opinions or things that are discriminatory, but they would still do it.

So I think this is where I need to caveat a couple of things for my own sake. So first is, again, like we don't integrate anything that the company that you work for, like, has not given us permission to integrate.

So, yeah, I'm not trying to put words in your mouth. You're not doing this. No, no, no.

And yeah, I just wanna make sure like we're very clear if a customer, you know, anybody's listening to this, like we are not like proactively doing this and like monitoring and then pulling it in for your company. So this is all kind of company driven or customer driven. Mm-hmm. But secondarily, to your point, this is why the distinction between human risk management and insider threat is actually like so important. Because at the end of the day, it's like, what's the consequence? What is, what are you gonna do with this information? And so, Right? Like, what is the goal of an insider threat or a team? It's to find malicious insiders, to take corrective action, and probably someone's gonna lose their job, right? The goal of human risk management is to provide proactive training, education, policies, and controls to help move a potentially risky employee to a proactive defense. Like, we wanna make like defenders, we're like, yeah, like vigil— we wanna make like cyber vigilantes essentially of like all our employees. Where they understand their role, they understand like what risk that brings to the organization, and they make smarter decisions, right? In a, in a way that encourages them to get their job done, accomplish their goals, you know, go, go forth to the mission, but in a way that's like secure for the organizations, for the data, for their customers' data, for the reputation. And so it's all about like, again, empowerment and transfer performing risk to proactive defense. And I think under that context, then you ask yourself, right, if that's the mission for the company, then like what information will help us do that job? And that's why we kind of come back to the point of like, like, does it matter to me if you're on this website or this website? What really matters is if that website's risky, because then I wanna talk to you about like proper, you know, web browsing hygiene. And so it's like we keep this kind of mantra in our minds of like, We want to do this to like better impact the employee population. That's sort of the filter of like what data matters for us. And this kind of gets back to like mission, vision, values for the business and all that stuff. But like, that should be the filter. Is this going to help us to create a stronger workforce? Right.

So now here's a, here's a tough question. I'm sure you're thrilled. Maybe you won't even answer it. I don't know. But so you mentioned, listen, we only do things that the companies ask us to do. Obviously, you're not doing much things proactively. So I guess the question becomes, where does that line get drawn? Do you think, in your opinion at least, where the line should be drawn in terms of what should a company tell an employee about these programs? If a customer came to you and said, "Hey, we want to do this. We want you to be super proactive. We want you to monitor everybody's social media," or maybe just a select group. Maybe you did your first run-through and you said, "Here's your high-value or your high-risk people based on, you know, their access, etc." And they said, "OK, great. I want you to monitor all these people's social media and all the different pieces to it. A, is that something that's inbounds? And B, is that something you think companies should be telling employees they're doing? It certainly would create a different risk management capability and different scores. Is that still fair game? And do you think companies should be telling employees they're doing that kind of thing?

Let me, let me answer, I guess, like question 1. So the way that, the way that our system, again, is set up is like we're integrating into data sources or tools that the company already has in place. And so there are like plenty of companies that do social media monitoring. And so like if a company had contracted with that, that, you know, that type of organization, we would API connect into that. We'd pull that data into our system and then we'd marry it with, you know, the other, you know, feeds essentially that we're bringing in, whether it's behavioral threat or sort of identity and access. And so I think a system or tool like that would, would need to be in place. Now we are exploring partnerships with, you know, think sort of like, like open-source intelligence systems, you know, the SpyClouds, the Recorded Futures of the world that are doing this monitoring of open-source intelligence and data and being able to like feed that in and then marry that with, you know, with data that the company already has. But again, the way that we're constructed, like, we wouldn't be able to like bring that in and surface that up to an employee or a customer unless they contracted with us to do so. And so, you know, that kind of like lets the customer make the choice. You know, I, I don't have— I don't think I'm gonna speak to two. I don't think I'm gonna speak to two. So I am pretty sure, again, like, maybe this is like not everywhere, but when you sign on as an employee, like, as part of your employment agreement and like onboarding documents, like, you're giving companies the ability to like monitor you, right? Like, that is being disclosed up front. Now, like, are you reading all that documentation? Maybe, maybe not. But like, there is monitoring that, that is allowed for. So I think employees are signing off on more than maybe they, they think they are. So again, you know, I'm not sort of like an HR attorney in that, right? So I can't speak, you know, too broadly. But, you know, I know there was a lot of consternation, especially like during COVID when people were, you know, working from home, and, you know, they had those like little mouse things that they had, and then they got really mad because the, the, they're like, well, they're gonna like pretend that they're working and they're gonna put all these like little mouse movers in place. And then the flip side, the company's like monitoring to see whether or not they like have a mouse thing in place, and then like, right, he's mad. And we're like, well, you signed off on monitoring, and also you were like making a bad decision. So, you know, I think there's going to be sensitivity across the board. But, but yeah, I, you I don't know that I have a firm opinion to share on this at this point.

Yeah, that's fair. I mean, listen, it's a tough question. I don't know where it lands. I think you make a really excellent point in that people should be reading their employment contracts. I think a lot of times people are agreeing to things that they may or may not know, right? And if that's happening, it's happening. I don't know of companies that are out there, you know, wildly spying on employees. I think there's a lot more paranoia than reality there. I think, you know, an excellent point you make is that you're not bringing in new data. You're taking whatever data the company has. You have a platform that helps bring all this stuff together. Together and score it. And that's important. You know, that's— the data's already there. So making the most of that data and, and as you said, marrying things together, you know, and getting, getting a human risk score, you know, the human risk management component to this is really important. Whether people end up bringing in other data is, you know, a lot of companies I'm sure are. And, and as you said, you know, a lot of them probably have that in their contracts. And if they don't, you know, then employees probably need to be aware of these things. I personally think, for what it's worth, there's a benefit to knowing this exists. Like I said, my, one of my biggest frustrations is convincing people to do a better job of securing their social media, you know, of locking things down. I'm an, I'm an OSINT guy. I'm an intel guy in general, but I do OSINT a lot. And you'd be amazed, well maybe you wouldn't cuz you're in the industry, but a lot of people would be amazed at how easy it is to build a dossier on somebody based on what they have out in the world. And whether you think it's your company that's gonna look at you, whether you think it's adversaries are gonna look at you, whether you think it's an ex, you know, romantic encounter, whatever it might be. I think people are, are wildly underestimating how easy it is to get a whole lot of information on you. And that ties back to where we just started this with the human risk component here, the human risk management piece. That's what adversaries do. That's how they figure out who to go after is to understand, you know, where you fit in the corporate environment, you know, where you fit personally and professionally, you know, what's, what are the risk factors you bring into, into the, you know, into this? Are you disgruntled? Are you financially challenged? Are you, you know, emotionally challenged? Do you have healthcare issues? Yeah. And then where do you fit within the company? What value could you be? All those things tie together, you know, whether it's your own company or adversary, somebody's looking at it.

And I think maybe like a kind of a public service announcement is like warranted here. But like to your point, you know, there are like such so many easy ways to like figure out so much information. So like anybody that's listening to this, just go to ChatGPT or Claude or Perplexity or Grok, whatever, like your LLM, you know, of the day is. And go like ask it about yourself. Right? Go like ask questions. I mean, truly the amount of like of data that they, that these models already have on you and know about you, it's phenomenal. And you're like, I cannot believe that that's there. So, you know, that, that would be one. I'll tell a funny story really quick. So my, my daughter was in this like Nerf war because, you know, upperclassmen at the, at the end of the year, they do these like Nerf war challenges and there's like hundreds of kids to get together. And they're like, well, you know, we can go to their house and like wait outside their house and then shoot them with a Nerf gun. But she's like, but I know— I like don't know where they live. And I was like, oh, you just have to go to like, you know, the county tax records, like put in their last name, and guess what, like their address will pop up. And she's like, what? That's like available online? But it's like, I don't think that people really know, like, know a lot of these things, that like all of this is already out there and it's being used against them. And so Yeah, to your point, like, locking down social media. One of the things, like, I do sort of in my, you know, lots of spare time is I talk to 5th grade girls, and I do— I have like a cyber training course, and we spend a lot of time in social media, like social engineering, like, you know, how do you know that somebody is who they say they are, and like what data is okay to post on whatever their, you know, Snapchat and whatever else. So it needs to start young. Like, it really needs to be ingrained. If you're using technology, like, you need to be hearing, learning, teaching, talking about what the risks are of oversharing and, and all of those things. Yeah, 100%.

I mean, that does need to start young. I think if you're old enough to be on the technology, then you're old enough to know the harsh realities that go with it. And if not, then, then maybe that child shouldn't be on the tech yet. And there's a whole debate on that, and that's a whole other topic. And I think, you know, But I agree with you, if you're going to let somebody get there, then you've got to be honest with them about what the risks are and the threats are and how to protect themselves. Otherwise, it seems a little irresponsible to just send them out there and pretend that bad things aren't out there. And that's how we end up with some, some problems. And not to— I'm not trying to point fingers, obviously. There's, you know, bad people do bad things and they are responsible. But yes, we need to give people better opportunities to protect themselves. And it starts very young because we have— now we're working out, I guess, on a second generation really that's just growing up completely in the internet, you know, and on the internet and on mobile. And it's just, it's everything. It's all, it's all, you know, ingrained in life. So, now listen, this has been a really, really interesting discussion and I really appreciate you taking the time, especially a couple extra questions I threw in that were a little challenging. We're getting to the end of the show and I do want to close it up. And so like every guest, you get stuck with the same question. You don't get to duck. The name of the show is Unspoken Security. So with that in mind, tell me something you've never told anyone, something unspoken.

AJ, this sent me into like a spiral of self-reflection and I was like, oh, because I, I am like, it's in my profile, like I'm a very transparent leader. Like, I feel like, you know, my team knows, knows a lot about me. I was like, who doesn't know things? So, all right, so what I came up with was like what really lit a fire for me in the beginning of starting my company and like just kind of in life. So a little background, we'll put a little bit more like data out there about me. I grew up in someone of like kind of a lower to mid-income household, and I feel like I've carried this sort of lifelong sense of being underestimated. And so I had this like desire to prove people wrong. And so that was actually the drive that fueled so much of my journey as a founder. And if you layer in like a woman being a woman—

I was like, a woman in tech is where you thought you would go, feeling underestimated?

Like, woman, okay, sure, background, looking to raise venture capital in cybersecurity. Security, like not a typical path. And I think for me, like, I actually like thrived on defying all those expectations. Like, that was like a huge driver. But then as I've grown and like matured, you know, a little bit at least, like, to me, like, my whys also shifted a little bit. So it's not just about like proving people wrong anymore, but it's also proving to myself what I'm capable of. And also expanding upon that, like modeling grit and ambition for my kids. 'cause I want them to know, I have 3 daughters, like that they can then accomplish and do anything that they set out to do. And so, so that I thought was an interesting reflection. And then I think a little bit about like, I still actually gravitate towards people who, who have like something to prove or carry a little unfinished business. 'Cause I think, you know, the edge or that fire, it ignites that human passion that really can't be taught. And I think that's fuel that keeps us working really hard when like stakes are really high, the work is hard. And so, yeah, and like, especially in this space where human, the human element is everything, that's the kind of passion that's really our greatest asset. So that's the thing about me.

I love that. I'm glad this, this puts you into that, like you said, spiral of reflection. I get that occasionally from people. But I love that. I think that's fantastic, right? It's good to understand what motivates people. You know, and I happen to be a, I agree with a lot of this. It's nice to have, to work with people that have passion and desire and to understand what their motivation is and there is a lot to be said for feeling underappreciated or under-respected or, you know, underestimated as a driving factor to say, well, I'm gonna, I'm gonna prove that's not true. And there's no better industry if you want to have a constant fight against feeling like you're underappreciated or unrespected than being a woman in tech. I mean, you've picked the place to be. You'll have no short— no shortness of people that'll make bad choices and say terrible things. It'll give you plenty of new fire, new fuel for the fire going forward, because our industry is full of that, unfortunately. And clearly it's working. Like you're, you're building, not the industry, I mean, you are, it's working for you in that you're building something great, you know, Living Security and, and what you've, you know, pushed forward in this human risk management model and this whole concept. So I guess I wish people treat you well, but I kind of hope a few of 'em still underestimate you cuz it keeps you moving forward, I guess, if that makes sense. If that's what drives you, you know, I think that's fantastic. So listen, I appreciate it. Last words, anything you wanna say that we missed? Do you wanna, you know, quick plug for Living Security, anything like that before we wrap the show?

Yeah, I guess in the spirit of a social media conversation, come follow me on social media. You'll learn all kinds of things. Ashley M. Rose on LinkedIn. And then of course our website, www.livingsecurity.com.

Very cool. And for everybody listening and watching, appreciate you taking the time. You know, again, you can find us, you know, www.unspokensecurity.com, all the, all the platforms, LinkedIn. You can find me on LinkedIn. If you like the show, please, you know, comment and, and subscribe and share it with everybody, all those good things. If you don't like the show, as I've always said, don't tell anybody at all. But at least tell me, please, and I'll see what I can do to make it better. So with that, I'm gonna go ahead and wrap up. This has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.