Unspoken Security Ep 48: Is Anyone Able to Accurately Calculate Risk?

And things change when people experience things. I think people need to develop a better relationship with uncertainty. Of course, you know, things are going to happen. I think when you're thinking about scenarios, some uncomfortable scenarios are good. There's also some of the other ones, again, organizations that all of a sudden were building scenarios that were always good, and I have to challenge them.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place, including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. I spent 19 years in the intelligence community, mostly at NSA. I've been building and maturing intelligence programs in the private sector for about 10 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! Where am I today? Go Zags! As basketball season's about to kick off around here. So I continue to be deeply committed to servant leadership. Now, this podcast brings all of these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. It's not your typical polished podcast. My dogs, they make occasional appearances around here. Hopefully we won't see them today, but you never know. People argue, we swear, we debate. I certainly swear, and that's all okay. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Now today I'm joined by Dr. José A. Lugo Santiago, retired Air Force Chief Master Sergeant, president and CEO of LSEG, co-founder of the Institute for Leadership and Strategic Foresight, and co-founder and chief operating officer of Kubrick, a new tech startup focused on generating and delivering quantitative business risk intelligence to empower corporate leaders to mitigate risk in measurable ways that align with business objectives. Chief, that's a whole lot of stuff you got going on at the same time. Anything else you want to add to that bio?

No, thank you. I appreciate it. Well, I think the only thing that I think that I'd add is that we're here in the nice sunny San Antonio. And I think that's it. You know, I think it's an honor to be with you today. So I've been listening to your podcast for quite a bit. And so I always enjoy the opportunity to talk about this particular subject. And this is Unspoken Security. In cybersecurity, but overall, this is an issue that is affecting all of us. So, you know, so thank you for having me.

Well, thanks for being here, and I appreciate you listening and watching the show. I'm pretty sure I can get all my listeners together in one small room and have that conversation with everybody at once. So listen, you mentioned the topic today, obviously, you know, important topic. So what we're going to talk about today is basically, is anyone able to accurately calculate risk? Now, I've been saying for a while, I've been, like I said, private sector for about 10 years.. And what I've learned in the private sector is that leadership really only cares about two things. You know, they, they care about either lowering my risk or improving my bottom line. And if we're gonna be really honest, most leadership really just cares about lowering my risk of not improving my bottom line. So risk is, is fundamental to all of this, right? And, and as an intel guy, you know, my whole background at some level was related to risk. The idea is to, to know as much as you can as early as you can, get the best content to the right people at the right times to make informed decisions. And a lot of that is based on risk, but it doesn't seem like we've solved for this, right? So, you know, I wanna open with the, you know, the simple, easy question, right? What's the most impactful value of understanding risk and how are people currently calculating risk? Yeah.

So talking about risk, I would say that risk is like trying to predict the future, right? That's really what you're doing, right? You're trying to predict the future. Can you predict the future? I, I would say people say no. I think A lot of us know a lot about the future. We just don't, if we put it all together, we can see a lot about the future. And so when you're talking about risk and being, and what is the, you know, really the value of, of, you know, risk and understanding what risk is, the real value of that is just that you already know what the predictors are for your success. Because when you trace back, right, you understand what your risk is. The other, the other thing that you can do is, you know, that you can go through, you know, Highway 90, but you can't go through Highway 1604 because there's going to be a traffic jam in there. It's going to delay your departure. So then because of that type of risk, you're— so what I'm talking about is being able to, to manage the risk by being able to— some of us understand that risk because we have driven through these roads and some of us because we use devices. Right? Like, uh, GPS, for example. We use a GPS and it tells you, and we looked at it and think about it. Sometimes you use your GPS and when you're looking at it, it tells you to go through, I don't know, you know, this little road and you're like, really? Nope. Yeah. You're like, and so, but some of us doubt our own experience. Right. And so then we go and use this and, uh, and then we find ourselves, oh man, I wish I would have gone the other way. I would have listened to my gut feeling. Right. And so I think the most impactful value of understanding risk is that you know where you're going and you know that there are several ways to get there, right? And you have at least several courses of action. And a lot of times, a lot of us don't understand those options. And that's the reason why things happen. Sometimes bad things and some other things that happen just by a complete, you know, it was just haphazardly I got here and that's not a good strategy.

That's a good point though. You talk about, you know, technology, right? So, and I, I love the analogy of talking about, you know, commuting or traveling, right? So I, like most people probably, I, my GPS is on everywhere I go and, and places I've been to hundreds of times, like the places I know I could get to in my sleep. It's an instinct for me. I always turn the GPS on and I'm doing it because I'm like, well, you know, traffic, you know, patterns change, construction. I, I, I live in Minnesota where we only have two seasons here and that's winter and construction. And so there's always something happening. And so I always have the GPS on. And 90% of the time I don't pay any attention to it 'cause I know where I'm going, but it's just there to remind me if there's a change or whatever. But as you said, sometimes I see it and I'm like, no, I'm not going that road. I, you know, and I've said, I'm like, I'm just gonna ignore GPS because I don't agree with it. Because, you know, either my own instincts tell me I'm, it's gonna be wrong, which may turn out to be wrong. I mean, frankly, GPS knows accurate traffic at the moment and I don't, but maybe it's telling me to go through a neighborhood because the GPS is only calculating the quantities it's been given, right? The data it's been handed, which is traffic basically. What if I know, ah, that neighborhood's really sketchy? I don't want to go through that neighborhood because if I have to stop at that stoplight, I may not enjoy how that experience goes. GPS doesn't know that. All it knows is the travel distance and the time, right? And it might be, this is your fastest route. Well, that's my fastest route if I don't get carjacked, I suppose. But you know, it's important to know variables that the GPS doesn't know, right? So you can only calculate your risk based on the data that you have available to you. And, and in this, in the sense of travel, you know, GPS isn't given all the other factors, right? Nobody's pushing in crime data statistics and, you know, things that maybe or not really affect your travel, but distance in terms of your time and everything, but it might affect your comfort level. You know, that's not one of the things I've seen. I've seen, I've seen GPS that'll tell me, you know, the fastest route. It'll tell me the most fuel-efficient route, the one to avoid tolls. I've yet to see one that says the safest route or the most comfortable route or the most scenic route. You know, there's other variables that can be there depending on what your, You know, what you're looking to accomplish, right? And all those things, you know, play into it. So it's interesting when you, when you talk about it that way, not only knowing your own background and your own gut instincts, but also there can be other variables on what risk is. If my only risk, and I'm thinking about in travel, is the risk of being late, then GPS is great. That's, that's GPS's job. It's live traffic. It'll keep me as close to not being late as possible. But there's other risks that GPS isn't designed to account for. You know, what if I know that road? Oh, you know, it's fast, sure, but it's got terrible potholes. I've gone through that road 6 times and I've had 4 flat tires. Well, that's a risk GPS doesn't know anything about. And now I've got to have my other pieces in there. So, you know, those other variables, how many— I mean, when you're calculating risk, when you're talking about, you know, I know you're a guy that, you know, projects the future, as you said, trying to predict the future is a big part of the, you know, the roles and the data that you work with. How do you figure in all the different variables and weigh some of these things out? You know, this is a simple example, but it's actually not a bad one. You know, what if I know the road has construction that's not mentioned there, or it's got potholes or it's got crime or whatever? How do you balance all those things out and try to weigh things out to get a better understanding of your risk?

And you know, and that's a good point, right? You say, I like to use the analogy because a lot of us drive and we're able to kind of think through that analogy. But you see what you did was I had a, I used this system. Now, first of all, you used a human system. The human system is you. You have gone through that road several times. You know that school season is on or school season is off and you make adjustments to your departure based on some of those things. Right now it's just you. You're, you consider all these data points because you have gone through that before, because you understand the seasons, right? What was Sun Tzu, right? Master Sun, the, the Art of War, right? He said there are 5 things that you need to, you know, consider when you're talking about, you know, troops and who's going to win in battle, right? He talks about chain of command or logistics, right? He talks about the weather. The terrain. And so when you are, so we are putting, these are variables back then, you know, he thought about 5 variables. Now you going from one place to the other, you're thinking about multiple variables. You know, when people go out, how long is the traffic? Do I have gas? If I had to put gas, are they going to be open? So you're keeping all of these variables. That's just the human system in itself, trying to move through this risk Trying to anticipate, right, the future, what these scenarios are going to happen. And based on these scenarios, you make, you make an informed decision because actually what happens is once you create these variables, right, you're going through all of these variables, these variables are going to form different kinds of futures. In Strategic Foresight, we call that, you know, the, the futures cone, right? And, and what happens is in the futures cones, one, you, once you have all these variables, you create futures that are probable. You know, these things can happen. Preferable, this thing can happen and I want it to happen. And then of course there are wildcards and then there's also the Murphy's Law. Everything can happen. It doesn't matter. Right. But anyways, you're considering all of those things and then, and now based on that, you are going to make some decisions now in some things that are a little more complicated. Then now you take the human component and you are you marry it with this, right? For those that are listening, you know, I'm holding it up.

Technology, yeah.

Yeah, so now you take the GPS, and now when you look at the GPS, right, I do machine learning, and so one of the things that I am just so surprised, actually, it sounds ridiculous, right? In this day and age, we should know, but is the amount of data points that I can convert into a system and then being able to tell the machine that I want, for example, 3 clusters and takes all that data and, you know, and breaks it down into 3 clusters. And then based on these 3 clusters, I make all kinds of analysis. So now you have this system in here, this phone, this GPS that is considering all different kinds of patterns. And so now it's making some decisions and I marry it with my own experience and now I can, you know, then decide what I'm going to do for, for us, you know, and then you make your decision as to what, what is going to be the travel, is it going to be the route, when are you going to leave, when are you going to put gas in the car, who's going to be with you and so on. But in, when you're thinking about us in our personal environment, you know, and, and the kind of things that, that we do, you know, and for me, when I was, you know, doing futures, there are several models that we use. One of them is the International Futures Model, is the IFS model. And, and, and so you're trying to predict, right? We're here in trying to figure out what the risk is going to be for the future. We also understand that cybersecurity is constantly looking at risk. And I would like to, you know, later on, we're going to talk a little bit about how we do, how we get there. But cybersecurity looks at risk. And, but we, we're looking at risk based on what we know. And so what happens if I know that this particular risk, these are parameters that I can, you know, perhaps, you know, set at a high level and these other parameters, you know, let's say for example, the internal threat, you know, having a workforce that for example, not every, it's a new workforce, right? There is a new entrance age. So, My, then I set my security parameter at high, that, right? Because that's, it's a higher risk. And then I, I combine it with others. And as I go through high and lows, then I can understand really my, what my risk could be. And I can even quantify the risk that way. We used to do that back to the IFS model. And we used to go and look at population, right? Then we'll look at education. Then we look at resources. You know, we'll look at different minerals and stuff like that. And then based on that, we create a baseline scenario. And then we, based on what we have seen, what is happening in other countries, how national defense is moving different assets, you know, some things that is just open source, then I could just manipulate some of these variables and then establish different kinds of futures. And then we will build strategy, right? Because now we knew a little bit more of how that, futures could look like, and then we could take different kinds of, different kinds of risk mitigation techniques and courses of action. And that's one way, talking back to you about parameters and quantifying, this is just one way, you know, actually, and I know it sounds simple, right? But, but it could be, right? At least, at least at a point where, where we can make some decisions. Depends on your objective, you know, that's going to decide how deep you're gonna have to get into these parameter searching and, you know, and tools.

Well, and then I think if I understand correctly what we're talking about here, I've, I've been involved a little bit of this from the Intel side. So you're getting into sort of the most likely, most dangerous, you know, scenarios, right? So you're, when you're setting out the futures, right? What's the most likely scenario? What's the most dangerous scenario? It's bad if those overlap, by the way. You know, the least likely, the least dangerous, and all the little variables in between. And then figuring based on that and, and level of efforts, you know, how much do you want to try to mitigate? Do you really wanna put a ton of effort into trying to mitigate the least likely and least dangerous? Probably not. You probably want to put the most time into the top right corner, the most likely, most dangerous, and then, and work your way back, right? And it's sort of a heat map that goes with this. I've, I have experience feeding into this as an intel guy. You know, our job was to help give people the content that helped feed into this. And then I watched the other brilliant scientists actually come up with all the models a lot of times. So, so I have some familiarity, familiarity with this, and that helps us understand it. So, but to the question a little bit about where we're calculating it, and then there's some weights in there. We can get to some of the math.

I'm sure it's right.

Exactly. But how do you— when we talk about the value of this then, so is the value in understanding risk, you know, it's simple, like in the driving discussion we talked about, the value of my understanding risk is helping me figure out how to get where I need to do on time, right? If I'm try— I do a lot of travel, right? So now you gotta figure in your, your travel as far as you're driving to the airport, but also gotta figure in what time of day is the right time to be there based on when my flight is. You know, if I've got a late night flight on a Wednesday, do I really have to show up 3 hours early? If I have an early morning flight, you know, if you're flying out Mondays and Fridays, I think most people who fly regularly know those are really busy times cuz people business commuters are going out or coming back. So knowing those things, right? So you got those extra variables to figure in, right? So it's easy in travel to say, well, the, the value to me is how do I make the best use of my time? I don't need to get to the airport 3 hours early, right? And spend 2 and a half hours sitting in the club doing nothing. That's not necessarily the best use of my time. Maybe I have other things to do with my life, but I also can't be showing up 2 minutes before the flight's taking off because I'm not gonna make it. And then I gotta get another flight and then I got embarrassment and I got travel costs and all these things go with it, right? So the value for me is, is hitting that sweet spot. Early enough to be safe and cover a little bit of variables if TSA is slow or whatever, late enough that I'm not burning all my time at the airport that I could be doing other things with. But in general, when we talk about calculating risk, you know, what is the value of going through this process to be able to have an analysis and an understanding of whatever kind of risk we're talking about? What does that do for the individual or the organization to better understand their risk?

Mm-hmm. So it depends on where you are, right? You consider value. It's just like in quality management, right? We say the customer defines what value looks like and then it defines it. And so that means that depending where you are, but if you are a CEO of a company, for example, one of the things that you are concerned with, of course you gotta make money. I mean, that's the reason why you're in business. But that profit equation had this thing called expenses. It is., right? And so, and so you want to maximize profit, right? By minimizing expenses. And so if you're talking about value, then I want to understand, you know, if, if, how can I spend less, right? So I'm talking about the utilization of resources, for example. And this happens here, right? When I was in the military, one of the things that we, we did is we did not protect every asset in the same exact same way, right? It's just, it's just, it's just very expensive and so on. There's just a limited amount of people that can do certain things. So we use what we call concentric circles. We know this area has a, if something happens to this particular area, it's going to, it's going to be, we're going to have a major impact, right? So, and because of that, We do, you know, the typical failure mode and effects analysis, you know, the FMEA, right? We figure out why, you know, what's, you know, what's the, what's the, the, the thing that could go wrong, just like you were just talking about, right? And then we do a brainstorming of all the things that could go wrong with this particular thing. And then we do category management, right? This belongs to this category. This belongs to this category. And then once we do this, this categorization, then we're trying to figure out what's the failure mode. If, you know, this thing can go wrong, this particular thing can break. And so now I understand, okay, if that happened, so then, you know, I'm going to miss an opportunity for this. Maybe I have a security compromise because— and that is going to result in a fine of however many millions. Do I want to pay that? You know, so you have to do the calculation as to, you know, how much is the return on investment in terms of all the countermeasures that I'm going to take to prevent this particular one risk, right? And so when you're thinking about what's the value of this situation is the value of, you know, resources, manpower, money spent, reputation that sometimes we forget about this, you know, reputation management. Yeah. Yep. And so nobody wants to hear, oh yeah, this was the CEO who was in the, you know, when this happened, right? You know, the major breach they had, major, you know, data breach was here. You know, that was the person, right? And then not only that, but what is the cost to society? And so a lot of times people don't think about that.

Also a piece that gets ignored a lot.

Yes, exactly. And that's true. And so to your point, being ignored, what happens is some people say, you know what, we'll just take that risk if something happens. No, I mean, we'll pay the fine and then we'll go. And, and what we failed to understand really, if that's the, the, the great solution, because they, we did not understand what was the impact to society. And so what you want to do is to minimize your loss, right? And so you, you got to figure out what is, what is our, our loss function in all this. And we're trying to minimize it so we can not the greatest value. And who benefits? Well, you know, people in the organization benefits, you know, our employees benefit. They have a job, you know, they, and who knows bonuses. And then of course, stakeholders, society, stakeholders. Absolutely. So that is, I think in my opinion, the greatest value that we have or that is just being able to, to move away from reactive ways of dealing with situation to a proactive future shaping. Paradigm so we can be better, so organizations can be better, so people can be better, so, and so on. And then in the end, in terms of risk, you know, our nation really is the one that suffers.

Well, you make a good point. You know, it's, we talk about obviously from a business standpoint, you know, the risk, you know, people want to lower their costs, right? That's all about bottom line. That's about, so, and I've seen that, I've seen organizations talk about, you know, what's the risk of this happening? What's the likelihood this is going to happen? What would it cost if it happens? All the things you were talking about, right? As you go through that process and then determining, well, am I really going to spend $10 million $2 million to prevent a, a risk, you know, prevent a threat that if it becomes a reality is only gonna cost me $2 million? Well, probably not. Yeah. You know, it's just bad math in business. But I think where we, we've run into some problems is that the pieces that don't get calculated that aren't necessarily all about the money, like you said, reputational damage, which, you know, is a subtle thing until it happens.

Yeah.

Or, or societal damage. And I think, I, I fear we've reached a point, at least in the private sector, where those are almost not considered by some organizations, you know? And, and so we're seeing some of that. It's, it's, it's very much focused on the bottom line of, well, what happens if we have this breach and all these people lose this data and they're, you know, all their personal data goes to a foreign nation and they're all in risk and it's all in danger. And, and I'm not seeing too many, I'm not saying anybody, so for anybody out there, feel free to jump in. I'm not saying everybody, but I'm seeing more organizations who really look at that and go, well, that's not my problem. Like, I'm worried about the money. You know, are these people getting mad? Are they gonna leave us as a customer? Well, they're not. Well, then I don't really care about their personal data. Let it go wherever it's gonna go. And that changes their calculations and, and therefore it changes their decision-making on whether they want to protect things. You know, when I moved to the private sector about a decade decade ago. I started in the banking industry and I was, it was very clear why we did what we did. We were told, you know, flat out, hey, listen, we do this to protect our customers. 'Cause if we don't protect our customers, they're going to leave. And if they leave, that's our business. So it's a, it's in our best interest to protect other people. It wasn't, you know, altruistic and that's fine, but it was in our best interest as a company. Doesn't seem that way anymore. Turns out people don't leave when the company gets breached because everybody's been breached. Every bank, every, every airline, every hotel, every retailer, you know, anybody who's ever shopped for on Amazon, you know, is well aware that Amazon's been breached multiple times. But I haven't seen Amazon's retail, you know, sales drop or anything like that. So once companies have figured out that they're probably not gonna lose business, it seems like they're less interested in the, in that bigger impact, the brand impact or the, or the social impact, the, the societal impact, as you said. And then it becomes a very cold and hard numbers game of how much should I spend? I'm, I'm seeing more companies where I'm recognizing they're, they're cutting out intelligence. For instance, you talked about being proactive, right? Trying to get ahead, trying to really predict the future, which really takes intelligence. But I'm seeing more organizations say, well, All right, so ransomware, what's the likelihood we'll be hit? What's the average cost of a ransomware attack, et cetera? And how often do you think we'll have it? Well, maybe every 10 years we might catch one and maybe it's going to cost us a few million dollars. Well, then I'm not going to spend $5 million a year on a great intel program and a security program to be proactive so I can spend $50 million in a decade to worry about a $3 million risk, which is great if you're only thinking about the money. It's that societal piece that gets lost, which is kind of frustrating for me personally. But yeah, you know, we talk about risk in the bigger sense, but yeah, I've kind of sort of leaned into Slim as I go there. I'm just talking about from cybersecurity. So how are most people, most organizations calculating cybersecurity risk today? And is it working? Like, do we have good models? Whether people are actually acting on them or not, it's a different discussion. I kind of went down that path. But what are the models now, you know, most common models for calculating cybersecurity risk today? What are people using and do they work? Do they give us something that's meaningful, that's actionable, that's accurate?

So this is what I have noticed, right, in working with a few organizations and basically in in my case, more on the data side and the machine learning side of things and trying to understand. And also watching some organizations putting, you know, cybersecurity practices to secure the networks. And I was involved with a particular organization in trying to under— and I was watching how they were really using their practices and try to understand how they were going to secure the network and what I see. Right, is that most of the way that the method is this. We looked at what has happened in the past, and then I'm going to, based on what happened in the past, then I'm going to extrapolate into the future. These are the kind of things that I need to prevent. You know, that I need to make sure that your network is patched, you know, on these particular areas because there was a ransom attack on this particular area. You know, I mean, Think about how flawed is that, right? Because if I know, if I, you know, if somebody, if a thief is out there looking at my house, you know, I see, you know, and I know that the person is going in because the doors are left open. So what am I going to do? I'm going to lock my door, right? Of course we do that, but this person is going to be looking for other ways to get into my house. And so I need to start thinking what other ways. Can this person get in? And so what I'm talking about is using historical data to predict what is going to happen in the future. So then, of course, there's something new that is going to happen. I just mentioned to you the power of artificial intelligence and machine learning and learning so fast, being able to use billions of parameters to do something. Just a little sidebar, and then I'm going to get back to the question.

Yeah, no problem.

Yeah. Now I've been doing a lot of, and obviously Six Sigma and, and process reengineering for many years. And, one of the things that, that we used to do when we are looking at, for example, doing, one of the, everybody, everything, every time we do a survey, the customer wants to know, you know, what is the, the, the, the sampling size, right? That's what they want to know, right? And so they want to know, and then I had to say, okay, you know, it's the sampling size is going to be this, you know, with the margin of error, we're looking at that with 95% confidence interval. You know, and we'll go through all the statistical things, but that's what we used to do, right? We used to sample from a population because we believe that when we sample from the population, the, the, when we average in all of these sampling, so the, we believe, right? The central theorem, you know, theory says central tendencies. It says that if I average all of those things is going to approximate the actual mean of the population, right? And so we do that. Now with AI, you don't have to sample all this stuff because I can take the entire dataset, right? The entire thing and then do it. So now if this thing has this kind of power to be able to do that, imagine what it can do when you're talking about networks. You know, I can take the entire data, the entire set of ransomware and how things have been done in the past and then predict a different kind of, you know, from where I am, trace a line into the future into what are different kinds of possibilities in regards to threats, and then use that to create something that I can use to hack into your network, right? But this particular situation I'm talking about, I'm not using the past to predict the future, but I'm using the past to inform the future, right? Because I know what I'm doing is I'm taking all, all of these things that happened in the, in the, in the past, taking all these data points and then understanding, well, based on these parameters, you know, in these trends and these things that are never going to change and those things that are going to change, we call it, you know, we call it fixtures of the future. And those things are not going to change. And then uncertainties, then I can develop these futures and then I can go and do all of these things. But in this case, what I see is to try the, you know, to try to patch a network or trying to solve issues based on historical data that has been, is not going to help you. It's going to help some, right? But it's not going to be the entire solution. And I think that's what I see right now that we're using to help us in cybersecurity. And that is not working. Back to your second question. Is it working? No, it's not working.

No, it's not working. I mean, it's a good point. Like, and I, I don't want to put your words in your mouth, but I'm pretty sure I know the answer to this one. So we're not saying ignore the past, obviously. Like, you know, people who are ignorant to the past will repeat it, right? And past does give us some indications. So for instance, if you're dealing with an adversary, historically they've always attacked banks. That's all they've ever attacked. Well, I certainly wouldn't ignore that. If I'm not a bank, I would suspect that my risk of them attacking me is lower than if I am a bank. But I also wouldn't decide if I'm not a bank, that means they will never attack me because that isn't going to allow me to anticipate the potential maturation of that organization or their— or, you know, what might happen. I would want to do more investigation into, okay, who are these folks and why do they always attack banks? What's their motivation? Well, money, I'm sure, but who is supporting them? Who is supplying them? Who is directing them? If it turns out it's a government agency, you know, they can switch their directives. That happens. You could be a nation-state actor, you know, who's directed to target a certain group of organizations because that's where, you know, the nation state has you going. But they can come back with new leadership that says, no, we're gonna reorganize and now this group's gonna attack another place. And we've seen that happen before where, you know, nation state actors have targeting that changes and then, and you're not prepared for it because you went, no, no, all they've ever done is attack banks. We're only gonna worry about banks. And then one day they, you wake up and you find out they're attacking the health, you know, healthcare industry and you're like, well, we weren't prepared for this at all. Well, it's 'cause you never anticipated it. You didn't even give it a thought that it was a possibility. So, you know, it's, it's not that we ignore the past, but I do think you're right that it seems like most people, the past is all they look at. Well, what have they done before? We're gonna map that out. That's clearly what they're always going to do forever. There's no, no allowance for maturation. There's no allowance for evolution. And then, you know, that's how you get caught by surprise. You know, I'm, I'm not saying we can predict the future, but it helps to at least leave your eyes open to the possibilities. Absolutely. That things will change, that organizations will advance or change. It requires more effort to, to dig deeper into threat actors and groups, for instance, to understand, you know, their motivations, their leadership structures, you know, sometimes getting into the internal politics to find out, you know, who's in charge and what, you know, what might be changing. And, and you might be able to see that. I know we see that on nation-state levels when you think about, you know, forgetting cyber for a minute, but just like, you know, international, international relations or, or, you know, war or things like that. We've looked and said, well, who's the new, who's elected? Who's gonna be the new leader? Oh, okay. Well, this is a nation that's never started a war before, but the person they just elected, or at least it looks likely to win an election, is a far-right warmonger. Well, we're going to have to consider that. We can't just say they've never attacked anybody before, but they've also never hired anybody like this to be in charge, you know. They've never elected this person, or, you know, you have a coup or something like that. So, you know, it's important to have the past as, as an informative piece, but it can't be the only thing you look at, you know. But I think, and I think you make an extra point, excellent point with that. And I think then the challenge— and I'm going to ask you this one, not tell you this one, because I'm curious about your thoughts— but it feels to me The challenge on that is most people don't know how to do the other part. Like, it's easy to look at the past and use that to project and say, okay, this is what the future's gonna look like. But if you say, hey, that's not good enough, that's gonna leave giant gaps, that's gonna, that, that might feel good and allow you to patch things that have already happened. It's, you know, it's great that you're, you know, you're worried about, you know, making sure the barn doesn't get struck by lightning, but it was struck by lightning last week. It's pretty unlikely to happen twice, but go ahead and feel, feel free to make it safe so it won't be struck again. But most people don't know how to do the other piece. So that, that seems to leave this giant gap where, where we have people that are creating risk models and they're getting results, they're getting stock charts and they're getting stats and they're getting all these things that they're able to use and saying, oh, this is where our risk is. But it's, it seems very incomplete, right? It's, it's based on what they know and understand, but not everything available or needed. It's just they don't know how to do the other pieces. So, you know, where does that leave us? What kind of gaps are we dealing with and how do we, how do we address that? How do we help people understand? That the past is part of the way to look at the future, but to actually be able to project out futures and to talk about, you know, like I said, brainstorming and sitting down and putting in the thought necessary to say, well, what else could happen? What's, you know, possible, probable, you know, more likely, less likely, you know, how do we get people there, you know, and so we can have better risk management, better risk models?

Well, I think the first thing that you got to do is to understand your bias, right? I think that's number one, you understand your bias. And number 2, you gotta understand that most people, when change begins to happen, because you hear this, the phrase, right? Oh, change, you know, this exponential change. It is really not exponential. If you think through it, it has actually been happening over time, right? And then you just woke up one day because you're not looking at, you know, what's driving change and stuff. You know, I mean, for, for years, you know, I started doing, working with with AI in 2017 and machine learning, right? Mostly because, you know, we were creating different kinds of scenarios for different organizations and then we were strategy and then we were stress testing these scenarios through their strategy to see if they would, what would happen if they would survive or not. And, and I had a ton of conversations with a lot of these people, but so this is what happens, change, right? We, at the beginning of change, we under Actually, we over-expect, right? So people over-expect change, so we tend to hype it, right? And then as change happens, right, then because this, you know, as things happen, right, then once it starts maturing, we underestimate. And so, and that's when you kind of begin to see that curve. And then what people talk, the exponential change, right? And that's really in tech. You know, when you think about tech, that's really what happens. Some of these things, we hype it, right? At the beginning, we over-expect. And then, but there's not quite a linear expectation. And the same thing happens when you're talking about, you know, cybersecurity. You see some things in what we call in the fringes. And that's the reason why, you know, you as a leader, especially when you're talking about cybersecurity, you gotta understand, and you mentioned intelligence, that is everyday work. You know, you gotta be able to do that. Hopefully, one of the things that I do at least once a week, I take about 2 hours and I'm scanning, scanning the horizons and I look at what's happening in the fringes so I can understand what's changing. And normally what happens, I begin to see change and it happens in the tech sector and cybersecurity. And you start seeing it and then you gotta ask yourself several things, right? Because I know that I have my own bias. And number 2, me as a human, I will tend to over-expect at the beginning and under-expect into the future. So I need to figure out, I know it, this is not gonna be linear, but I'm gonna have to figure that out. And so by looking then drivers of change, right? I used to, like I started saying, I started looking at 36 drivers of change and, uh, in 5 macro changes. And one of the things that I found is every time these macro trends got together, you, we would see disruption in the world. Like, for example, you would technological progress when you combine it with economics. Every time those two collide, you see there's disruption. The same thing with, with, for example, improving human health. And increasing mobility every time those two macro trends. So the idea here is to understand, you know, those two things, you know, how is changing happening? What is my bias? And then adjust, you know, for, for those things. And of course, you're not going to have the answer for all of those things. There's mathematical models and there's all kinds of other tools out there that are actually free out there that you can use. You know, for example, Kubrick, you know, we, we have tools that we're looking at and we're developing that helps us understand, you know, what, how some of these trends and how some of these risks are morphing into the future. So that way we can understand, you know, how much is going to be our investment and what are going to be the aspects of impact in terms of, you know, many different variables that are important to our customers. I can adjust for all those things once I'm able to, you know, scan the environment, understand my bias, and of course understand that, that I will as a human under-expect or over-expect and then under-expect for change.

Yeah. And that's— I think that's an excellent point. You know, right now, yeah, my, my opinion at least on what I see from risk is again, there's this big bias towards whatever happened in the past. There's, there's no real understanding or very little understanding of how to be forward-looking and how to think outside the box, for lack of a better term. You know, the creative, creative minds aren't really put on this, right? A lot of things are— again, it's, this is business, so it's all about quick. I want to, I wanted something that I can put together quickly, I can understand, I can explain quickly, and then I can, you know, move forward with and give me some sort of a number, some sort of data I can work with. It doesn't seem like there's that much effort on is it right, is it good. Sometimes it's just I need to check a box and say I've done this, I, you know, and I've got enough data and enough due diligence that when bad things happen, I'll be able to throw up my hands and say, well, we tried. You know, if regulators come in or the customers get mad, it's, hey, we didn't— it's not like we didn't make the effort. Look, we put all these risk assessments together. We tried. We applied the FARE model, which is considered one of the better models out there right now. It's an academic model, but we tried, right? And I think I find a lot of times— I'm sorry, this is pretty, you know, jaded for those who might be listening. I am at this point on some of these things. I feel like there's a lot more of let's check the box and prove that we tried So the lawyers can keep us out of trouble than to actually make the effort to try to do it properly and best because that's just time-consuming, which means it's expensive and maybe there isn't enough juice for the squeeze on that. And so I think we're seeing a lot more organizations that just say, well, let me do enough to look like I did enough, not necessarily do enough to do it properly because that takes more effort, right? And so, you know, I find that to be a little bit frustrating, whereas there are other opportunities to put things in different perspective. First of all, I don't like stoplight charts for risks, and if you give me a risk score, 72 is my risk score. I'm gonna ask you a whole lot of questions. What the hell does 72 mean? 72.

Exactly.

What, and what are the variables used to get there, et cetera?

Yes.

What? Yeah. What I'd rather know is, and, and as a business leader, what does it mean to be in money? 'Cause that's all they care about. We talked about that at the front, you know, bottom line, you know, risk and really risk on the bottom line not being good enough. So I need to understand my risk in terms of numbers that mean dollars and cents, not in terms of stoplight charts and, and risk scores and ethereal things. Talk to me about it in dollars and cents so that I can figure out where I'm going to spend my money, you know, where I need to spend it or where I'm overspending it or underspending it. So I need to understand it in that way. And then, and that's, that's one big component I'm curious to hear your thoughts on. But then the other one, and this is the big piece you talked about that I don't know anybody doing this, is how do we apply the methodologies you're talking about for future state in a way that is understandable for people who have no background in this area to be able to say, listen, not only am I telling you what your threat is right now and what your risk is right now in terms of dollars and cents and where you need to make moves to improve the use of your current funds and maybe make moves for the future, but we have a better way of showing you what the future's gonna look like because we're not doing it just off of the past without going so far down the path of, you know, here's, here's a huge data set and here's a bunch of scientific equations that have, you know, letters and symbols you've never heard of before because, you know, you're an MBA, you know, at the CFO level, you don't know any of these things necessarily. And how do we do it in a way that's going to resonate? So people look at it and go, okay, it matters. It does make it better. And in a way that resonates monetarily and still convinces them you want to spend this money now. It is still worth doing. It is not about just, well, we'll manage the bad things that happen later. Like, how do we bridge that gap? How do we pull all that together?

You know, you got to make people feel uncomfortable. That's how you get them.

I do that every day. Oh, you meant professionally. Sorry, go ahead. Yeah.

Exactly. Professionally without getting in that kind of trouble. Exactly. And so one way to do that, you know, I emphasize organizations. Think about it. How many organizations are there really exploring different kinds of futures? And a lot of people use the word scenario and they don't really understand that. I mean, you I'm talking about creating all these, I mean, after looking at all these parameters and, you know, how change is going to happen, how issues are being advancing politically, you know, legally, you know, socially, social change. Sometimes we forget, we always talk about tech, but, you know, social change, you know, for example, the rates of adoption, it really tells you a lot about what your risk is going to be in cybersecurity and just a regular security alone. And really in advancing technology, rates of adoption, that's what we're looking at. I mean, if you're smart, that's the one thing that, that's the great metric, right? That you will have. But what happens is because people use this word scenario, they, what they do is they have a philosophical discussion about the scenario. Well, if this happens and then this happens, you know, what I did with a particular organization. We created these scenarios and I mean, like, they really happened. And probably you remember from your days, obviously you guys used to do that in the military. We used to execute these scenarios that you guys would do. But you created all of these things with public affairs news, you know, and you had a broadcaster and everything, you know, and But it was all like a play, right? But it took a lot of time to build. You're building a story and what happened. And so you got to create those scenarios and then make organizations, the key people in that organization, play on these scenarios. And what I mean is they go there, act it. You know how somebody knocks on the door? Hi, sir. How you doing? Oh, good. Ma'am, I understand that 'You have this particular area of responsibility. We learned that this happens. So can you explain this for our audience? What does this mean for them?' You know, and so then they get caught off guard. And, you know, in some of the cases, you want to play it as real as possible and then learn from that. And we had different kinds of scenarios. In one case, I remember we had just a desk for a person and two chairs. And so the CEO, I mean, we took everything out of the room. The person came in and then the person was like, what the heck is going on in here? And said, oh no, we just need to talk with you about this. And have a seat. Yeah. Have a seat. And he was, and then we talked with this person, you know, we played the scenario, you know, we just understand that the organization is at this level. We had to let some people go. Understand that you're liable for this and that. Can you explain to me? We had a person, also a lawyer. You know, going over there playing. So when you get legalistic, you know, all kinds of stuff happen. So this person was so uncomfortable with what happened because now he's experiencing the risk, the actually the impact of risk in actual, you know, flesh. And so now when the person got out of there, it was a complete culture change because that's the problem that we have when we talk about, you know, cybersecurity. You know, we understand all these risks, but nobody wants to make any change, right? Don't make me uncomfortable. You know, why all this security? You know, I can't access this site, you know, and stuff like that. You don't understand. You can't have that application in your machine because of this. But when you go through a scenario like that, that now people actually experience themselves the impact of all of these things, all things change. Culture change. Accountability is better. People start thinking innovatively. So, you know, to your question, I mean, I can go on and on on this, but I have seen it. It works. It works.

Yeah, no, I think it's fantastic. I mean, I've, I, you know, I've done a lot of exercises, right? Tabletop exercises and then actual, you know, live exercises. Like, obviously we did a lot of that in the military and did a little bit in the private sector. And I remember, you know, at the bank, you know, we were doing exercises and they'd never done it before. We were building exercises and they had some really smart people doing it, but they also had some gaps. They'd never done this before. So they didn't know like what a white cell was. And we had to have that discussion. They have to have some controls. Also, I've seen organizations do it where they build these exercises, these, these events like you're talking about. Experiential learning is huge, right? I, I tell people all the time, until you internalize the risk, it's not real. Like, it's all on paper and there's too many executives go, oh, risk, okay, it's a number, it's on paper, et cetera. But they don't really internalize it. You know, when, when you feel it, things might change. But I've also seen people set these, these risk, you know, scenarios up and they've set out these exercises. But they rigged the game in their favor cuz they just want metrics to come out and show the boss, oh, we're ready, we're good. Look, look, we passed, we had a 95%. The goal shouldn't be to pass. The goal is to get the right answer on where we are. And if the answer is we're terrible at this, then that's fine. That's what you work on. But you know, you get toxic leadership that circles down and the answer is no, no, we can't afford to tell the boss we're not good at this. So we're gonna rig the game, we're gonna set up a great scenario, but we're gonna tell everybody the answers in advance and everybody's gonna come in and play out the game, but everybody knows how it works out. We all get high scores, the boss is happy, everything's good, nothing's actually improved. And, and the risk hasn't changed and the, the feelings haven't changed. You know, I, I, I will tell, I think I probably told this story before. I certainly have it in life. I don't know if I have it in the show, but you know, I, I worked at a company at one point. I used to get called in to talk to, to clients or prospective clients, you know, 'cause I was working with the Intel team. And so I'm in, it's a sales discussion. I'm not in sales, but I'm in this discussion and I'm talking to the CISO and, and I won't name names, but he's just kind of an arrogant jerk and he's sort of dismissive. You know, I've been brought in and, and he's just not really listening to me. And, and I finally got to the point where I said, okay, well I'm, I think I'm gonna get up and go. And which kind of got his attention. I said, well, here's the thing. I was brought in here cuz I was told you have a problem and that we might be able to help and, and you need intel so you can get more proactive and get ahead. You don't seem to think you have a problem. You seem to think you have all the answers. And I have a lot of people who do know they have problems that I need to go help. So I'm gonna recommend that you update your resume. And buy a lot of crypto so you can handle this threat when it comes in. Because it was ransomware at the time. I said, maybe you'll be okay, and if not, I guess I'll just work with your, you know, your successor when you're gone. And I got ready to get up, and, and to be clear, the sales team all turned white as a sheet. They were not happy. They were not happy with the, the way I've taken the discussion. And the CISO wasn't happy either. Yeah, I, I— this was not how I opened the discussion, to be clear, but it was clear we were just out of answers. This guy wasn't listening. So I said, you know, basically, you don't see yourself having a problem. You don't see the risk. I can't make you see the risk. I'm gonna go help people who can. And when you're gone, I'll talk to your successor. Well, at that point he's like, whoa, whoa, wait a minute. And now he's listening. Like, now he's paying attention because the thought of him being fired for a compromise or a threat had not apparently occurred to him.

Yeah.

And all of a sudden it all hit like, oh, this could be real and this could affect me personally. And now we're having a different discussion. I'm like, yeah, I don't mean to be rude, but you know, and he's like, no, no, sit down, let's talk. And so then we had a more productive conversation. And on, again, I wouldn't recommend that to people. It's a great way to lose your job.. And, and I'm not saying it's the first way you should talk to anybody about much of anything, but there weren't any options left. And I realized in that moment, and I've discussed it with people since, if you don't think you have a problem, I can't, I can't help, you know, I, as an intel person, if you don't think you have a risk or you don't think there's a problem here until you've internalized that risk as a, as a leader or as an organization, it's all just words on paper. And right. You know, you try really hard to help, but some people don't wanna listen. And I've said, well, you know, experiential learning is the answer. And if you're not willing to do it, it yourself in a controlled environment with hard exercises that hold people accountable, then you're going to experience it the hard way. And like I said, I'll be there to talk to the next person who's there who I'm sure will pay a lot more attention and also will have a lot more budget, thankfully, because of your failures. They will get a lot more money to fix the problem.

That's right.

And so I've had that discussion with people occasionally. I say, like I said, I wouldn't open with it and risk your career as you will, but I think your point is the point. You've got to make people uncomfortable. People have got to accept what risk really is in true terms, and they've got to think it matters to them. And I think we have too many people that just don't have that, whether it's leadership, whether it's day-to-day working. You know, a lot of people also overworked and they're burnt out, and you know, there's a lot that goes into it. But I don't think many people see the risk. They, they, they, they do the thing they have to do every day. They, you know, they turn the wheel, they keep it moving. They don't feel the risk themselves. And so the change doesn't necessarily happen. So I, I love your idea of doing these really hard exercises, you know, these, these planned out scenarios where everybody but the players necessarily knows the outcome and then really push people through it. But I think it only works if you have leadership, healthy leadership that isn't saying, hey, if you fail, you're in trouble. You're supposed to fail exercises. That's the whole point.

Yes.

Like if you're, if you're passing all of them, I, I'm going to challenge that somebody's already cheating.

All right.

There's a, nobody's that good at security. You're supposed to fail these things. It's so you get better. 'Cause the adversaries continue to find new ways, right? And that's what red teaming is about. You see it on red team results. People get red teamed out and then suddenly it's just blasting the blue team. It's like, no, that's not the point of red team. Like, it's so you get better. That's what you want. You want your red team to succeed so the bad guys actually don't succeed. But it seems like there's a cultural issue with a lot of that and that toxicity. And then people are afraid to be honest.

The culture issue is true. I believe that that's a point right there, right? And things change when people experience things. I think people need to develop a better relationship with uncertainty. Of course, you know, things are going to happen. I think when you're thinking about scenarios, some uncomfortable scenarios are good. There's also some of the other ones. I've been in organizations that all of a sudden we were building scenarios that were always good, and I have to challenge them, you know, and sometimes, you know, I say, hey, here's an organization that thought the exact same thing as you. Look,, you know, and, you know, recent, right? And they can see, you know, and it's easy to find those examples now because you can, you know, profile the organization and then go out and then start doing scannings and reviews and find an organization that has almost the exact same profile and say, hey, look, this organization had these, they had these organizations, this is where they got hit. They thought they could pay a fine and then, you know, forget about their security, you know, but then this happens and these people were liable. Even personally, right? And so that's, and the whole thing about this is not to scare people, although you should be scared if you're not doing your job. You know, I do believe that, you know, Robert Greenleaf, Servant Leader.

Sure, obviously, right? That's the basis of my master's program is Bob Greenleaf stuff. It's all, it's amazing. Yeah.

Yeah. So he said that the, and he wrote that book a long time ago, right? 1971 or something like that. And he said that he could see all the failures in leadership to one thing, and that was foresight. Because if the leader could be able to see that this and that could have happened if this person would've taken this decision or this decision, and they would see the effects of how those decisions, you know, had ripple effects in multiple scenarios. And we do this. I mean, it's a natural innate.

Yeah.

Human characteristic that we can do that animals can't do, and that's our ability to foresee the future and then create it, right? And then create it. That's the most amazing thing. So when you, when you see these things that you're talking about, you can attribute most of it to a failure of leadership and doing foresight, you know, and a lot of times what happens in some organizations, they, you know, using the past to predict the future and stuff like that. Sometimes you can do that, right? It depends. You know, we have some, in some organizations, you know, if you're, if you live in an environment that is not, there's not a lot of certainty and you have a lot of control over, you know, then, then you, over your actions. So then the past is a reasonable guide to the future and that's what we call forecasting, right? But then if you are in a place where you have, you, you probably, there's a lot of uncertainty and probably you have some kind of control things and you had to move to what we call reflexive strategy, right? You gotta use transformative scenarios. You have to be able to understand, you know, who is innovating in that space that you're in. And, and then you can, then you have to start calculating, okay, what the risk of me getting out of business is going to be because this technology is moving. Or because, you know, you know, cybersecurity risk has increased and this one's and how these things are going to move. And so I think, so I think all of those things again leads to one place and that is your ability to take obviously the leadership role and in the leadership role means taking all of these behaviors that come with leadership and that is, you know, foresighting what could happen and not doing it alone because you can't do all of this stuff alone. You gotta do it with a bunch of other people. That's how you get a really good picture. Of how the future is gonna look like.

Yeah. And it's gotta be people who have diverse, you know, opinions, diverse backgrounds. Like groupthink doesn't do you any good. If you have 5 people that are the same, the exact same person, you have one person, right? And 100%. And for anybody wondering, you know, AI has a place in all this, but you can't replace it all with AI either. If it's you and AI alone, you're still pretty much alone. Yeah. So, you know, it is, 'cause AI's gonna tell you you're brilliant every time. You're, you're a genius. Everything you say is amazing. Like AI is gonna love you because that's what it's designed to do. So, so yeah, it is important to note that, you know, you need, you need diverse thought to get a better, you know, better outcome, right? And yeah, I have a fair amount of history of this. I obviously, I know Robert Greenleaf's work really well, and I agree, you know, failure, failure to foresight is a huge problem, you know, with leadership. It's— and unfortunately, our system, our economic system, our business, you know, structures, they're not set for a lot of that. We don't do a lot of— it's quarter by quarter. Like most companies, for-profit companies, how do I How do I make the most money this quarter? And then how do I make the most money the next quarter? And sure, companies project out what they're gonna do 3, 5, 10 years out, but ultimately they keep driving back to this quarter and this quarter and this quarter, and they make all sorts of short-term decisions that have long-term consequences that are— and then they, then they're constantly trying to unravel some of those things. And we see a lot of that with manpower too. But it's, it's frustrating to watch. It's very frustrating to watch from the, from the risk standpoint and from the, you know, from the cybersecurity standpoint. But, I think this is all very fascinating. We could obviously talk about this a lot longer, but I don't think I'm going to listen to us a lot longer. But I do think it's fascinating.

Well, we're having fun with it, you know, obviously, because it's right.

Yeah.

But yeah, it's a great conversation.

I enjoy it. It's a great topic, you know. Absolutely.

Absolutely.

Absolutely. Yeah.

And I think, you know, so people understand the takeaways like the past helps, but it isn't the only way to predict the future. There's a lot more that goes into this. We have to get away from these stoplight charts and squishy numbers in the fair model and talk more about how it aligns with money. Because that's what people are going to care about and listen to. But we also have to help people internalize this risk. They have to understand why it matters and how it matters to them directly. I think, I think we have a lot of work to do to help people understand how, you know, how this affects societally and, you know, brand and not just the numbers so that people can see that sometimes it's worth spending the money to protect everyone as opposed to just worrying about your quarterly and your bottom line. We're not going to solve all that today. Obviously we'll probably have more discussions about it in the future, but you know, as we're getting ready to close out here, I got to, I gotta ask you the same question everybody gets, you know, at least, at least at this point, people watch the show for a while, have some preparation, so they're not caught completely off guard. But, you know, with this topic, this has been a great topic, but as we close out, you know, the name of the show is Unspoken Security. So, you know, with that in mind, tell me something you never told anybody, something unspoken.

You know, I knew you were gonna ask me this question, and I was thinking about it. As I was driving, I was thinking, you know what, I, I I don't know what I, I mean, I think, I think I'm pretty open, you know, you get what you get, right? And, and so, but then, as I was trying to get to your studio, I go and, you send me the link and then I go in there and, and I click and I'm thinking, what is happening? And I send you a text, hey, something is wrong with your link. Uh, you know, what's going, what's the problem? So, and then I see there, it says in my screen. You know, click and, you know, on your bar. And I was thinking through it and I tried again. And so, okay, long story longer, what I find is that in my security settings in the computer, right, it was, you know, it's just a, wait a minute, you have not been in this site before. So it blocked it. And then in the, you know, in the URL bar, there was, there was it right there. It was a little icon and it was, you know, for me to click. So I clicked it and here we are. So anyways, it is nothing cosmic, but it's just embarrassing. I should have known that.

Well, well, and it's, it's, I mean, it makes a couple of good points. I, I obviously I was on the other side of this. I know I sent you a couple links and I'm not gonna lie, at a moment I rolled my eyes and went, all right, I've been doing this a while. Not many people don't find their way in, so I'm pretty sure the link's fine. But at the same time, it makes a couple points that are valuable in that first of all, it happens to everybody. You know, for anybody who's listening or watching, I, you know, it happens to everybody, right? I've got friends and family who are like, oh, I don't know anything about tech, can you help me with this thing? Or they, you know, I'm such a dummy. I'm like, you're not a dummy. Like, it's happened to everybody. There's things that— right, tech is complicated and confusing. Users' experiences are different across different platforms, et cetera. It's just, you know, something that's different. But it also points to, you know, we talk about challenges with security, and there's that balance between doing things that keep you secure without creating so much friction that users just want to get around those things and shut them off. And this is a good example of that. This is probably design flaw needs to change because it added security friction unnecessarily and made you have to go search around and dig for it and slowed you down. I mean, I get it. You know, it's your system set up to say, hey, this is a new website. You haven't been here before. You know, we need you to enable it. That's great. They need to probably have a different popup or some sort of graphic that makes it easier for you to see it because the way you were reading it made it seem like it was a problem with my platform. I knew it wasn't only because you said it's grayed out. It's saying I need to approve and it's grayed out. And I'm like, well, you don't approve to get into my platform. I have to approve you. So I know that's not on this side, but, but it's, it's a good example of, hey, it happens to everybody. Like, listen, for those who don't know, Lugo's a genius. I mean, this guy, this guy, this guy's a retired chief. There are less chiefs in the Air Force than there are generals. That's how few there are. He's also a PhD. The guy is a genius and he still struggled with this simple thing. It happens to everybody.

Yeah.

So it is a valuable lesson.

Too kind. Too kind.

No, it's true. It happens to absolutely everybody. If I had a nickel for every piece of technology I fought with and then realized at the end, oh my God, it should have been super simple. I'd have a lot more nickels than I have right now. So, no, I appreciate it and I appreciate you sharing it. Like, I, you know, it's one of those moments we all get a little embarrassed by, but we don't have to. And it tells us that, you know, security created more friction for you than was necessary in this case. I'm glad you made it in though. I appreciate it.

Me too.

It's been a great conversation. I'm glad you're able to come out and spend some time, you know, and so we're gonna close up with, before I do though, just last thoughts here. Is there anything you want to share? Anything you want to plug? Anything you want to talk about? Anything you wanna share before we close out the show and let people go on with their lives?

I think the only thing I would say is, you know, it dates back to where we started, right? You know, using the past to, you know, in cybersecurity to figure out what's going to happen in the future. And I will say, you know, do not be, do not be that person that says, tell me exactly what threats we face and exactly how to stop them, right? Because then you have not developed a future awareness sense, and you are going to always be in this, you know, churn where your people are going to constantly be battling and never having rest or never moving forward.

Yeah. No, that's a good point. Like, we don't have crystal balls. I've talked about it at Intel a lot. Like, our job is to try to give you the best content at the, you know, at the right time to make the right decisions, you know, at least the most informed decisions. But we don't have a crystal ball. It's not a perfect scenario. And don't let perfect be the enemy of good enough is what I always tell Intel people. You know, at some point you throw your caveat language on it. You know, possible, probable, et cetera, more likely, less likely, and pass it off to leadership or, or to the, you know, to the J3 or whoever it might be and let them do what they gotta do next with it.

Right.

You can't hold it forever. But yeah, it's, it's not gonna be perfect. Right. And so that's why we have to have all these calculations. That's why we have big data and that's why we have AI that's helping us get better at this. That's why we have big brains like yours helping us understand all these things so we can continue to get better at these things. But you know, it only helps if we get people to internalize the risk. And I think that's a big takeaway from this is let's make people a little more uncomfortable. I like that one. Make 'em uncomfortable. Make them feel it for themselves and then see if that doesn't change some of these cultures and help people get better because, you know, we all need to get better or pretty soon we're not going to have anything to worry about protecting anymore. So listen, with that in mind though, I want to wrap up today. Again, Doc, I appreciate you coming on. Dr. Chief, I never forgot. I just call him Lugo in our private lives, but you know, I want to thank you for coming on the show and taking the time. This has been very informative. If anybody wants any more information, you can reach out to Lugo. I think it's lugo@kubrick.ai. One of several email addresses I'm sure you can find him at. Yeah.

Loured.ai.

There you go. And if you can't find him there, find me and I'll find you.

Yeah.

We're LinkedIn, right?

That's right.

I'm gonna look up there. So, so no, thank you very much though.

Yeah. Thanks AJ. I appreciate it. You know, it's, it's been a great conversation.

Yeah, absolutely. Yeah. Thanks for coming on and, and thank you everybody who's listening and watching. Please, you know, like and follow and share and all the good things that help us grow the audience. And I wanna get from 12 people to at least like 14 or 15. That'd be awesome. And so just please do that and, and we'll keep growing up the show and try to make it better. And if you have feedback, let me hear about it. If it's really negative, at least be nice. But I'm always looking to try to make this show better. So with that in mind, we're going to close up today. Again, for everybody, thank you for listening and watching. This has been another episode of Unspoken Security.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.