Unspoken Security Ep 59: Is All Social Engineering Malicious?

Security awareness training can go bite me. It's the worst name ever because raising awareness does nothing unless you talk to the right person and give them the action to take, right? That is social engineering.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place. Including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. Spent about 19 years in the intelligence community, mostly at NSA. Been building and maturing intelligence programs in private sector for 10 years or so now, and passionate about intelligence, security, public speaking, mentoring, and teaching. I also have a master's degree in organizational leadership from Gonzaga University, and I continue to be deeply committed to servant leadership. Now, this podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. It's not your typical polished podcast. My dogs make occasional appearances. People argue and debate here. We can swear. I certainly do plenty of that. And that's all okay. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the large cybersecurity conferences we all go to. These are the conversations we usually have when nobody's listening. Now today I'm super excited because I'm joined by a good friend of mine, Ashley Stryker, who just goes by Stryker. She's a director of threat analysis for Fable. And she spent over 10 years translating technical research and qualitative intelligence into the so what and what now materials that keep more people safe and secure. Now, she previously produced threat intelligence across financial services, cybersecurity vendors, and early-stage startups, including Avanti, BlackPoint Cyber, Geico. I usually find her playing tabletop exercises after her talks at Sektor or DEF CON. And she lives in Maryland, growing parsley for butterflies and algae for shrimp. So I don't know what more anybody could want to know about Stryker, but is there anything you want to add to that bio, my friend?

Well, hi, first of all. I'm so excited. So AJ's been doing this for many years now. He was just getting this off the ground when he and I first met back when I worked for Avanti.

I was a guest on your podcast at the time. Yeah.

And so it's, it's only taken 3 years for you to return the favor, sir.

Yeah, well, you know, I, uh, yeah, I don't have an answer for that. It's a fair point.

No, no, I'm teasing. And I think the only thing I would want to add is that, so I've spent over a decade doing in-depth research to produce things that people find valuable, uh, in a different career path. And it turns out it intersected very nicely with threat intel. Uh, and so, I've been doing threat intel now for a number of years. I've spoken at conferences about how I pivoted in, but what many people might not know is that AJ is actually one of the primary reasons I ended up in threat intel. There is a long since deleted Signal thread somewhere in which I tell AJ that I really got along much better with the cybersecurity folks than I did my direct team. And I'm thinking about pivoting in, but I'm not sure what I want to do. And AJ asked a terrible question for him, which was, well, what do you like in cyber? And I remember I sent you what, 8 multi-paragraph text messages over 45 minutes.

It was quite a read.

Yeah. Yeah. And he's like, well, you really need to niche down and pick one thing. I don't even think you read it, which is fair.

I probably did. I may not have read all of it, but I probably read enough. I rarely give a response without at least skimming through things. I do remember thinking, that's a lot she's got on her mind. Okay. But I probably read through a fair amount of it. Yeah, I do remember saying, yeah, you're going to have to slim this down a bit. There's a lot of everything.

And I ended up picking your brain a lot about what private threat intel was like because I have never worked in the military. I've been a contractor for the DOD in my previous life, but never directly doing that kind of clearance-level work. So I knew private sector was going to be it. And AJ has contacts and good buddies and advice on what it would take to do well, and that his advice has served me very well.

Yeah.

So, so just a fun little sucking up to my podcast host here.

Yeah, this was scripted.

No, I appreciate it. We have a whole document where I have put in multiple bullets of possible things to discuss and I made sure not to add it.

This was in none of it. Yeah, I appreciate it. Listen, it's, you're, you're very bright and talented and fun and like awesome to work with. And I'm glad things have gone as well as they have. You've earned every bit of it. You know, occasionally people ask me questions and I give whatever advice I have and I guess sometimes it's good. So I'm glad it was in this case. So, and I'm excited now to have you here. As a full-fledged intel professional in our industry.

I'm a big now, guys.

Listen, you got a director title, right? Didn't we call that out?

I did, yes.

Yeah, Director of Threat Analysis. That's a big deal. And so today what we want to talk about, so we're gonna talk about social engineering, right? So it's, I think we'll do a little basis on what it is for those who aren't familiar, but social engineering is a pretty common challenge, you know, in industry and in life in general, right? So I want to kind of dig into it with you as somebody who knows a lot about this. I kind of have a bit of a, almost a theological, theological, ethical, I guess, discussion.

Ethical, yes.

On social engineering. So before we do that though, in your words, and we'll kind of chat back and forth briefly, for the uninitiated, how would you describe social engineering? Like, what are we talking about?

Social engineering, and it depends on the audience you're speaking to, actually. So let's start with the cybersecurity context that most people know social engineering from, particularly because it is weaponized by threat actors frequently and is one of the top if not the top, cumulative vector for initial access in particular. Although it also plays a huge role in lateral movement, persistence, and especially reconnaissance. But social engineering as a rule is how do you hack people? It is the same way that hackers find the edge cases of things. They find the cracks. They use tools and software in ways that they weren't traditionally scripted and designed to be used in order to further their own goals, which makes hacking an ethically neutral activity. It is threat actors who abuse hacking for criminal pursuits, and it is very maverick and fun people to be around who use it for doing things like, you know, knitting chainmail purses. That's not really what chainmail is supposed to be used for, but boy, it makes a really interesting item, right? And so in the same way, Social engineering is pressing buttons in human psychology. It's not a matter of being smart. It's always a matter of context. It's a matter of, of where you are and who you are and what their goal is, et cetera. But it is just the act of consciously knowing how people work and explicitly doing something to get a human to act the way that you would want them to do. That is how I have approached social engineering, both in my previous career as a content marketer, where I created things and wrote copy to convince people to take actions that they otherwise would not have taken. What I do now as Threat Director at Fable and have throughout my career as a threat analyst, my big claim to fame, and you said it earlier in the bio, AJ, is that I can translate very technical things up the chain to leadership in such a way that they understand why this is important and why they personally or the company operationally would benefit from taking the security actions that are recommended, as opposed to slinging a 20-page PDF over the fence and calling it good because we worked really hard on this and you hired us to be the smart person. So no, just do what we tell you. How well has that worked for your patch program? So Like, there is social engineering to me, and cut me off here, but like, no, you're good. One of the things that I didn't know what this was until I started working for Avanti, and one of my mentors there, Chris Guttell, great guy, I was like, you realize what you're doing is social engineering? I'm like, what's that? And I read a book on a plane to a conference, and I'm like, that's not so— this isn't hacking, this is just being polite. And Cialdini's Influence is an absolutely cited foundational text that I literally do not have on my bookshelf behind me because I gave it to someone and they never gave it back. And I think I've bought it 3 times.

That's how good it is.

It's really, and it explains it in a way that makes it understandable. It's, it's everyday stuff that's broken into these kinds of works. And then the other 2, Made to Stick and Contagious, are 2 other, but Made to Stick and Contagious, I literally have within reach. To remind me of those things. And that is, I spent over 10 years working on written persuasive writing to move people. And, and if you look at the rhetorical triangle, going way back to your English Lit days, you have persuasion by authority, ethos. You have persuasion by emotional appeal, pathos. And persuasion by logic, which is logos. Security way overindexes on authority. You You hired me to be the expert, so just listen because I said so. And logos, this is what the data says. Also a side case of trust me, bro, because nobody else knows what the acronyms in the data says. And yet people, even if they say they're data-driven, they frequently justify emotional decisions by cherry-picking the data and then saying, well, I don't trust you. Yeah.

So people are data-driven until they don't like the data. In a lot of cases.

Precisely.

I've often said the same thing about people who say, respect honesty, or I want honesty. Well, we're gonna even tell you something that they don't want to hear. And I've been there. I've made the mistake of believing somebody was very committed to honesty and giving them a brutal truth and then finding something else to do with my time when I was no longer gonna be asked to visit their establishment and get paid to do so. So, uh, people will tell you all sorts of things and they may even believe it. I don't think people who tell me they care about honesty are lying, or people who tell me they care about data. Are lying, it just becomes inconvenient. And then you realize, hmm, there's more to you. Now, one of the things you mentioned, I do want to, just for the audience who doesn't know, uh, you mentioned a book, right? Principles of Influence by Dr. Cialdini. So for those who don't know, and this really does lay out social engineering really well, he's got 7 principles. I'm going to go through it really fast. 7 principles of influence: reciprocity, people feel obliged to return favors or gifts. Commitment and consistency, people desire to be consistent with their past public statements. Social proof, individuals look to others to determine their own actions. Authority, they tend to follow The lead of perceived experts, liking— people like to be liked and want people to like them, right? Scarcity— items and opportunities that appear to be more valuable if there's less of them. And then unity, which is focused on shared identity, trying to create a one-of-us feel, right? And so every one of those, just quickly running through them, you've experienced them. We've all experienced them in every sales pitch ever. So there is a fine line between what's social engineering and what's just marketing, right? But I think, you know, a big piece we talk about social engineering is not just that it exists, right? And we've talked about some of the principles. But how is it used, you know, and does it matter? Is it ethical? Is it unethical? Those are questions that become a bigger concern for people, I think, than just that this exists, right? So I think just like with hacking, as you said, like hacking isn't always bad. I think there's a perception people think like, oh, he's a hacker, and it's this stereotype of somebody in a black hoodie in a dark room someplace doing nefarious things. And in most cases, it's nothing like any of that. But people have that opinion, right? And so they believe it. And it's the same thing with social engineering. It's like, ah, these people are manipulators and they're liars and they're nefarious. And so, I mean, is social engineering manipulation? And is it always bad?

Hi, Sean, from Cloud Security Office Hours. Congratulations. I am officially taking this opportunity to get on a soapbox and answer this question. Sean doesn't think that any social engineering is ethical. And he said this a couple weeks ago, and I had a moment of, "Huh, really?" Sean's wrong. Sean's wrong. I love him.

Sorry, I'm cutting you off. I'm gonna let you give the reasons for it, but I really think Sean is wrong, so go for it.

Yeah, no, Sean is wrong. I think, and it has to do with this public perception of social engineering. At the top, I kind of listed out how traditional cybersecurity professionals have aligned social engineering with various parts of the attack chain, right? And that's usually where people end up hearing the phrase social engineering. And I think the same way that we have attributed, to your point, AJ, we've attributed hacking exclusively to threat actor actions when it's really an ethically neutral kind of thing.

100%.

I think, for me, the question is, does it manipulate? And do you have an ethical background in Are you purposely using and deploying this persuasive technique, this bias, this— are you doing something on purpose? And do you know if the other person is going to be better off after, after they do the thing or not? I'll give you two examples.

I think a lot of it's motive, right? And now I will say, I know you're gonna give examples, but because I can hear the audience on this one saying, do you think the other person would be better off? And because I can hear people screaming, well, you don't get to decide.

You don't know.

You're better off for them might not be their better off, right? And by the way, for anybody yelling, yes, you're You're exactly right.

Yes.

That's, that's true. And there's, there's some subjectivity to all of this. Of course. I will say, I think a lot of it is about your motives, right? If your goal is to manipulate somebody to do something for your benefit alone, there's a chance your motives aren't very pure. If you're, if you think it's for the greater good, and we'll get into some examples that make it a little more obvious, you know, it gets into some gray area. I do understand the opinion that it's always wrong. I don't agree with it. But I, I, I also understand why somebody would say that. And you can argue manipulation's always wrong. It's sort of like saying lying is always wrong. Now, I'm a huge believer in truth and honesty, even if it's uncomfortable. I will also say lying is not always wrong. And anybody who disagrees with me, I can probably prove that you're a hypocrite because I'm sure somebody at some point said, do you like this haircut? Do you think I look good in this dress? You know, how did I do in my speech? And you didn't go, you look terrible. Uh, or you did allow, you didn't, you were nice to them and you said, no, it was great. It was interesting. You. At least once in your life you've done it because it was a happy, friendly lie. You didn't feel the need to crush somebody's hopes and dreams and love somebody you love. So don't tell me it's always wrong. That's probably not. And that's the same with social engineering. But back to what you had said, you were digging into some examples.

Yeah, no, there's— so let's take urgency, which I think is— at Fable, we do a lot of analysis of artifacts that threat actors leave behind in known social engineering campaigns or campaigns in which manipulation has occurred. And One of the things I do is I try and reconcile what are patterns beyond just this one lore that's in a headline or in a research blog. Where are some patterns of broader things that I could use this specific good example as, step back for a second, employee, you will see this pattern in other things. So instead of having the training be just this one thing, we step back. Urgency, any sort of time pressure. Where, because urgency biologically, if you think you don't have a lot of time, it cuts off your critical thinking. And the faster they can get you to take an action, the threat actor can get you to take an action and not stop and think about, this doesn't feel like the normal process, or I thought you said we had until next week to do this. The remediation here is not just click, it is just pause. So, if you can train your employee at a higher level to just, wait a sec before they click anything that has to do with process or finances and just think, you have cut off at the knees this urgency kind of ploy. But they will deploy this urgency as a threat actor tactic of, you know, we're going to— you need to get back to us within 20— I almost fell for this phish actually when I worked for Avanti because I was on my phone and I was learning about this, creating content about cybersecurity, uh, patch and risk and prioritized exploits. At Ivanti, I am on my phone and I get an email saying, we're gonna shut off Ivanti's Facebook ads account in 24 hours if you don't do something right now. And I didn't click, thank God. I just forwarded the email to my boss and the woman who was in charge of our ads platform and said, hey, I just got this, can you guys just go to the platform and double-check we're okay. I thought it was legit.

Mhm.

They came back to me and said, no, I don't think this is real, considering the domain was something really obvious. If I had not been on my phone, I would have seen the facebook.help.eu or some shit like that.

Sure.

But it was because it was my phone. So again, it's all about context. People aren't stupid, but it's that moment of urgency that really had me act immediately on that phish. Instead of something else, given what I knew was going on, because I knew we were about to have a multimillion-dollar campaign go live. So they happened to hit me in exactly the right context on my phone. And with that, to trigger the urgency. Contrast that with a reminder email from, you've signed up for a webinar, or I'd like you to sign up for a webinar that I think would be useful because you looked at this other stuff. And I know that the webinar is going to be useful. I might sign like, hey, you've got 24 hours left before this event. Go ahead and sign up, and I'll even send you the recording later if you can't make it. That's using that same tactic of urgency in a context in which I personally feel you would be better off taking advantage of that, right? It is a rhetorical tool that has been abused by threat actors for manipulation, because the threat actor knows you're going to be worse off once you click that thing because they know they're taking your credential. I, in fact, want to make something that is worthy of the hour or half hour or 15 minutes you can spare to give me your sign up so that you can see this thing that I've done. And now people will argue that in marketing, well, you ultimately want me to buy your stuff. Only if you need it. Right. And that's—

well, let's be honest. I've never met a company that says, I would love to take your money, but you don't need this. So I'm going to have to tell you no. And you're going to put your checkbook away. That in and of itself isn't nefarious. I would just make the argument that, yes, I've never walked into a discussion with somebody and said, you know, in a business sense, and not had them know. I work for a for-profit company. I've walked into rooms and said, obviously, this is a for-profit company. So at some point, there will be a number attached to this discussion. You know, I don't think that's wrong. I think that's being upfront. That's business, right? There's nothing inherently wrong with that. It's okay to have something that's a win-win. You know, you're trying to help somebody get there because you do think it'll be beneficial to them, or you want to find out if it will and give them a chance to find out if this benefits them. And if it does, yes, you'd like them to pay. Nothing wrong with that. You're not stealing their money.

Hashtag, we live in a society. We need to eat.

That's right. And you're not stealing from them. The idea is if they like it, great. We can have a discussion about how this could help them. If they don't, you don't then turn around and take money out of their bank account anyway. Like, that's, you know, threat actors are going to commit a crime. They don't care about what you want. There is no quid pro quo. There is, I'm going to take your things. You're going to get nothing in return. Business, at least the idea is there's free will. Yeah, sure, marketing is full of manipulation. Let's call it what it is. It's influence. You can take your pick. It's manipulation. Marketing and sales, the goal is to get you to want something that I have to offer that you will then pay for. And the more you want it, the better chance I have of getting you to pay for it.

The more you trust me that I know what I'm talking about.

Yeah, that's right. The more I hope you'll pay for it, right? So those things are all true. But at the same time, it's, it's, there's nothing nefarious about that. Everybody knows I'm a salesperson coming in to sell something if that's the case right now. I, I'm an exception because I actually have literally told somebody I wouldn't sell them something they wanted in my career. But it's, there's a difference, right? And I think social engineering has been just aligned with bad, like with, with threat actors. It is, you know, everybody I think knows that, you know, email is the number one threat vector, you know, and that's phishing and that's, you know, social engineering makes phishing better, right? If I send you something that I know is very likely to align with your wants and needs and desires and the timeframe you mentioned, context. You know, it's funny you talked about your story on the phone. The one time in my entire career that I've ever failed a phishing training, and I was on my phone too. And it was just, it was the absolute perfect timing. I would argue that our team maybe even cheated about it because they hit me with something and it was specific to the annual review cycle. It had an attachment, all these things, right? And we had just had a meeting on the topic. Like the timing couldn't have been more perfect. I didn't see the URL because I was on my phone. Of course, I clicked on the thing and thankfully it was just training and I got to be a little embarrassed, proving that it happens to everybody. Like you said, you don't have to be, it's not about being dumb. It's not about being fooled.

Nope.

It's a, it's a high-volume game threat actors do in terms of phishing and, and the better their social engineering is, the more tech-tailored their phishing is. And we talk about it being like, you know, spear phishing is, is the term that's often used. The more they know about you, the better they can build their lures to, to get you. Right. And that is nefarious. There, the, the goal is crime. There is no other goal there. For others, then you do get into more of an ethical discussion of how much manipulation is wrong. Anybody who's ever managed up in an organization has done this. They may not even realize it, but if you've ever been in a position where you've had to manage up, and if you haven't, God bless you. You've been working at some of the most healthy places ever, or you haven't been in business long enough to run into this. Anybody who's been doing it for a while has been in a position where they've had to learn how to manage up. It's one thing to be able to, first you gotta manage yourself. Ideally, you're in a position, hopefully, where you can lead others, help others, maybe manage if necessary, others. But almost every time in somebody's career, there's a position where you're going to have to manage up. You're going to have a leader and they either don't listen to you enough or they are toxic or they are angry or they are poisoned. There's all sorts of negatives that go with it, arrogant and whatever it might be. But at some point, you need to find a way to influence this person. Maybe you have to influence them just to like you or to listen to you, or you have to influence them to make decisions that are better than the ones they've been making. And so to do that, you can't just tell your boss, "Hey, you're dumb. You're wrong. You should listen to me." That's not going to go well. I can tell you from experience, by the way, that is not going to end well. So don't do that. So it means then, OK, how do I get my boss to listen more? How do I get my boss to see things differently? As soon as you ask yourself that question, you're starting on the path of social engineering. You're trying to figure out what does this person respect and what do they appreciate? How do they consume information? What's it going to take? How do I get them to think that this idea is actually their idea and not mine? Brilliant social engineers have done that, gotten people to do things and they're convinced it was their own idea and it never was. So anybody who's ever managed up knows how to do this, even if they don't realize it. And so to me, the gap between what's ethical and not is it's about motive. And admittedly, there's some gray area in there. The whole, is it better for the other person? Well, if you're being dishonest, you're making a decision on what you think is better for them. Yeah, you could argue that's unethical.

If you're, I think if you're lying. If you are effectively lying to promote whatever you're trying to do, I think that's probably a sign you're at least on the frickin' edge. Because there are, of course, reasons that you would lie, right? Let's talk about— and I think the classic example is spies, right? We have national— I mean, go there for a second.

You're good.

No, you're good. But it's true, right? Our spies have to lie to survive. And they have to lie in order to protect the greater good of the country. And so at that point, that's not a great— so that's not a great moment. And I just want to acknowledge the fact that not all lying is bad. Just, that's my, that's my hat tip there.

Lying is bad, true.

In a personal or professional context, for the vast majority of us, if you find yourself lying in order to convince somebody to do something, the greater good you're serving needs to be much higher, in my opinion. Not just I want a raise, or I'm annoyed with this tool that they're making me use and I'd rather use a different one just because I don't want to learn. Like, if it impacts more people, if it impacts your customers, if it's going to be like— that's where you do your risk analysis. But I think that's a good sign of whether or not you have crossed the line in terms of ethical social engineering. I think when I first started learning about social engineering, as somebody who gets very excited about new things, I was very excited to realize that there was a vocabulary for things I had been doing for years. And I told my boss and she freaked out. I'm like, I think I'm a social engineer. And we're like, look at all these things that I'm doing and like what I'm being asked to do. And she's like, don't share that with anyone. Don't talk about that.

Like, don't.

And she's not, she wasn't wrong because the perception is that I'm manipulating people all the time. I manipulated AJ to have me on the show or I manipulated people.

It just took 3 short years to make it happen.

God, I am a terrible agent if that was like— but I also am bad at sales. The— I, I can't close worth a damn. In LinkedIn though, like, I have talks and stuff and I have had comments that, well, why did— like, I've had people who were close to me find out that I got accepted for speaking my first year in the industry and I had been actively discouraged from doing that by certain individuals close to me because, well, you don't have anything to say yet.

Fucking awful.

There's a whole story behind that one. But when I told that person I got in, they basically said, well, of course you got in because you know how to phrase it and you manipulated them, basically. Or you got in over somebody who deserves it more because just because you're better at words. Or people who sit in the audience and go No, yeah, no, you don't know who didn't get in.

So I don't know how anyone can say you got in over somebody who deserved it more. You don't know who was rejected unless you're saying you were rejected and you're mad about it. And secondly, because you're good with words— well, that's kind of a big part of presenting things, is it not? Yeah, yes, being good with words matters. If you're brilliant and can't, can't put 3 sentences together, just submit your paper and let people read it. Don't try to get on stage. Like, that's just how that shit works. So what terrible, terrible criticisms, which I'm gonna go ahead and say the thing These were all guys, right? Every one of them.

Yeah, every one of them was a guy, with the exception of my boss who warned me not to say anything.

Well, yeah, but for different reasons. But the people who are telling you either you have nothing to say or you didn't deserve to be there, they're all men. And, you know, mostly, if that upsets anybody, feel free not to listen anymore to my shows because you probably don't already. But, uh, I mean, it's just, it, it just goes with the territory, right? Some guy was upset he didn't get in, and so he's mad, and he always points the finger at a woman because I don't know why. There's some other guy on stage probably didn't belong there. Uh, no, let's pick on her. So that's really just terrible shitty behavior.

But to be fair, there is a bias, and, and you and I have spoken about this, AJ. My transition into cyber was twice as difficult than it is for other industries. Not every industry, but other industries, because I did— not only did I not come up through the traditional IT help desk pipeline, or the military complex pipeline. I came into cyber from marketing, which everybody knows are a bunch of lying, manipulative bastards.

Well, that's not untrue.

We're just discussing how the difference is. And I will insist that manipulation, for me, the way I define manipulation is somebody I know, or I suspect that somebody will not be better off for the interaction. But I've convinced them to do something regardless. That makes sense.

Doing something that's not in their best interest.

Right.

If anyone wonders about my opinions on marketing, by the way, I did do a show a long time ago. Now you have to go look back on it called, "Is All Security Marketing Bullshit?" That was the title. And so, I had a security marketer on. It was a fantastic show.

We poisoned the well. Marketers has poisoned that well because it's so easy to move. We're back to talk about urgency, right? We're back to one of the key messaging things is fear, uncertainty, and doubt. Fear, uncertainty, and doubt. FUD. Yep. It is a very common acronym to use, especially within cybersecurity marketing, because everybody knows you only get budget when there's breaches, which is not true, but whatever. It's a lazy tactic that ruins your credibility if you over-index on it to the point where I refuse to report on breaches at Fable unless we know something actionable happened. I wrote a whole article on, do you need awareness training for the Striker Handala breach the day after we found out? The answer, TL;DR, is no, because you have no reason. This would just be reassuring yourself that you feel like you did something in a pure security theater play. It would be pandering to your executives, but to the average end user, At the time, we had no idea how they got in. We had no idea what action an end user could even take. And turns out, by the way, I have moderate confidence, it's likely that they got in with years-old team credentials that hadn't been rotated off of an info stealer from 3 years before. Which, by the way, anyone saying MFA should have been deployed, yeah, you deploy MFA on a team-based service account, bitch, and we'll see how well that goes. And talk about bias again, we had bystander effect, right? Everybody went, oh yeah, the other guy will do it. And so, no, nobody is explicitly assigned, they'll all do the pointy thing. So, really the training should have been at that point, you know, whenever you get an alert, for anybody who owns a team-based service account that has more than one person assigned to an inbox or has a login of some sort, you send out a briefing to those people going, hey, these people accidentally got popped because everybody thought, Somebody else should do it. Perfectly understandable. But if this ever happens to you, we have alerts with this. You guys need to assign a person as a team and then reply to the inbox to let everybody know that the password has been changed and do it within your designated email password manager, etc. I had people wanting to send out alerts about these script kitty hacktivists who are just making noise because the headline said they should. And they would just drum up so much fear, uncertainty, and doubt in their own employees that there's this cognitive loop behavior. And my, one of my founders talks about it. She's got a doctorate in behavioral psychology. I cannot remember the term right off the top of my head, but it's this cognitive loop in which you want to complete an action. You want a great example of someone who does this well? John Oliver. Watch his net neutrality video where he spends 25 minutes doing a comedic sketch about one of the driest topics on earth, net neutrality. And I remember distinctly, I watched that video on YouTube and like that night or something, they released it pretty fast because they were trying to drum up publicity for this relatively new show. And at the end he goes, fly my minions, fly! And tells, because he tells them the FCC had the comments open. Mm-hmm. So what he did was he raised awareness for the problem. He said, what bad thing will happen if we can't change it? And then he gave people an action to take. And you know what happened? They crashed the fucking website. What happens when you give people an action to take? They do it. And if they don't, if you just raise awareness, security awareness training can go bite me. It's the worst name ever. Because raising awareness does nothing unless you talk to the right person and give them the action to take, right? That is social engineering. Going back to social engineering, that there is an action that they can take, in my opinion. It's, you are driving them to take an action and you have to know what action you want them to take in order to social engineer. And so, because otherwise you have this, they get uncomfortable. People get uncomfortable if you don't give them something that they can do. How often have you read stats about poverty, about world hunger, and you feel uncomfortable with it because it feels like there's nothing you can do? Because they just are like, boy, this is really bad, and you're like, yep, this is really bad, and now I just feel depressed and I can't actually feel better about this problem. Always give someone an action to take and a tiered reciprocal action to what you have given them. Giving them information is often not enough to engender that reciprocity. Is how do you make them feel and how can you make them taking the action feel better than not? That is at its core what security training should do. It should make it easier and feel better to take the secure action than it is to take the insecure action. And it doesn't make them feel stupid. It makes them feel empowered. If you can make your users feel like they're fighting bad guys, holy cow, they would feel like invincible. I have threat idols here behind me from CrowdStrike. CrowdStrike idolizes threat actors because it's a powerful persuasive technique to create a character. You tell a story. People are hardwired to tell stories. Mm-hmm. They have chosen the threat actor to turn into supervillains so that the average cybersecurity person can feel like a superhero. That's why they— it's wonderful marketing. Yeah, it's great marketing.

They've done a great job. I think what you're talking about with that need to close the loop is the Zeigarnik effect. I'll trust you on this one. I had the advantage of Google while you were talking. So it's a 1920s psychologist, Bluma Zeigarnik, has this theory and includes like open loop tension is kind of what you're thinking. Yeah. When somebody starts something there's this constant need to feel like you have to finish it. So anybody's ever started anything, and sometimes ADD, this happens to me all the time, and that's how you build up a lot of stress when you're ADD. You start a lot of things, then wander off. You don't actually forget those things exist. You just never get back to them and then just build up all the stress about the 68 things you have to do. Have to do, I say. And then your anxiety starts. 6 months later, you realize that you don't have to do any of them. Actually, you started them unnecessarily to begin with, and you can just abandon them, and suddenly you'll feel better. Don't worry, you've already got 30 new things that you started that you aren't going to finish. Welcome to being ADHD. But yeah, the Zeigarnik effect is what you're talking about.

I think that cybersecurity marketing has leaned way too heavily into the fear, uncertainty, and doubt immediate. They've salted the earth. And because they manipulate at times, not all— hashtag not all marketers, hashtag not all campaigns. There are times that you definitely want to iterate the urgency and issues that are at hand. But there's a whole toolbox. If you know what social engineering is, if you know what persuasion is, that you can draw from to build your credibility, to build up and use different techniques for different audiences in different contexts. My learning social engineering made me more ethical because I was able to do it on purpose instead of doing it accidentally. I knew that if I did these things, I could trigger this reaction. It was just a writing thing. It was experimentation over time. It was years and years and years of practice. It wasn't until I read the social engineering book and several of them and was able to map my experiences directly to these techniques that I realized, oh, I'm doing this. And now I'm much more aware of when I'm doing it in person, when I'm doing it in writing. It makes me more aware. I was more dangerous being a random person, being that persuasive accidentally than I am now when I choose when I'm using this technique. And I will stand by that.

Which is an interesting learning experience, right? And often the opposite, obviously, depending on how people come in. Again, back to motive, right? Somebody who's got pure motives, somebody who's got ethics and morals realizes, oh my goodness, I've actually been getting people to do things that they didn't really want to do. I didn't realize I was that kind of persuasive. And it turns out I'm applying these tactics I didn't realize existed. 'cause it's just naturally who I am versus somebody who's the opposite and then wants to learn all these things so they can get people to do things that are not— Pick up artistry. That's a good example. Yeah. So actually it gets us to the next piece I wanted to talk about, which is both good and bad. When have you used social engineering either personally or professionally? Let's give you some examples of how this happens all the time and how it might be happening to them and how you might be able to do it yourself. And people might realize, oh, maybe I do some social engineering and don't realize it. So I'm sure you got some cool stories on the topic, right? I have, I'll start.

I have a couple. I have one that is particularly useful for people in a professional context and is what I would argue is ethical social engineering that leaves everybody just feeling happier and nicer and wonderful. But if we're going to go off of the pickup artistry, I'm going to blush. There's, oh, there's, I was accused. By someone I cared about very much that I led people on and flirted and was flirting when I didn't think I was flirting. And this is not unheard of at tech conferences where there is a disproportionate ratio of genders and sexualities and all of that fun jazz. And I felt bad. For leading people on, because I realized way too late that I had been sending out some sort of signal that was letting people think that I was interested in—

Well, in this industry and in the places you're talking about, that could have been as simple as you smiled at somebody, made eye contact. So, and I had—

May well not have been you. Oh, don't, don't skip ahead just yet. So I'm in the middle of figuring out how do I continue being a friendly— how do I continue being myself without making people feel awkward because they misread something? Because I can only control me. I can't control anyone else. And I refuse to stop talking with people and all of that jazz. And for the record, I have had wonderful experiences at every conference. I can count on one hand over the last 3 years and dozens of conferences I've attended, where I felt someone made me feel uncomfortable, I, I stand on the shoulders of giants, of allies, and of others who have made sure that I feel safe enough to drink at these conferences, which— that's a big deal. Yeah. Yeah. So I just, I want to make sure that nobody— this is not a thing. This is just me wanting to make people feel comfortable with me. And it was— I doing something. And so I went to Charisma on Command. A YouTube channel where they have quite a few YouTube videos on how to be more confident getting dates, body language, that kind of stuff. Like, how do you become more charismatic and all of that sort of stuff. And I explicitly looked for 'she wants you to ask her out' signs. So I found a video that was something like the 7 green flags that the girl wants you to ask her out. I'm like, great, I will just not do those. 5 out of the first one's like saying hello. Active listening. Apparently active listening where you make eye contact, you actually listen to what the other person is saying and then ask questions related to what that is. You don't just wait to ask your own questions or have an agenda. Like 5 out of the 7 flags were active listening. And I just went, oh, I'm screwed. Okay. Because I refuse to not participate in conversation. So congratulations, society. We have devolved to the point where active listening means that she wants you to ask her out. She does not. And, um, and if, if you still mistake it, be gracious when she says no. Again, most guys have been wonderful this way. I have felt bad because I thought it was me. The one thing that I don't do now is body contact. I'm a very physical person. If you ever meet me in person, AJ will tell you I will knock you over with hugs because it is like a golden retriever greeting me, especially if I know you. Like, I'll shake your hand the first time, but next time, nah, dude. Unless you're uncomfortable with it, in which case I get it. But like, I, I talk with people, I lean in, I laugh, I touch their arms. That's how you connect with somebody, right? That is, in a social context, occasionally misjudged as she would like you to ask her out romantically. So I no longer— I am very— I'm within my bubble. I gesture, I move around, I— but I'm very deliberate when I touch someone in public now because of that. And so that's when I was accidentally using social engineering, because active listening is apparently a pickup artistry signal. And, and So that's, that's my funny story about that.

Funny tag along with that. It's actually the opposite in this case. I didn't expect to have this conversation, but I'm notorious. Jess, my partner, will back this up, or anybody who's ever known me, I guess, as it turns out, for just the opposite. I never pick up any signs, apparently. More often than I can count, I've had somebody say, she was into you, or she— I was like, no, she— what are you talking about? And I always assumed like my friends were just being nice or kind or whatever. Ah, you're flattering. And I've had it pointed out to me by my own partners who've said, I'm like, I didn't catch that at all, which apparently means I'm just not very good at active listening, so I'm not paying attention. But it's sort of the opposite. Like, you get the guys, and there's plenty of them, oh, she smiled at me, she must want me. I don't think anybody does want me to begin with, so you'd have to really hit me over the head basically to make it work. So I always look at some of those guys and I think to myself, you think she wants you? Like, even forgetting whatever gesture— did you look in a mirror today? Like, anyway, so that gives us two—

like, so pickup artistry though is a Social engine. That is a pure social engine.

Oh, yeah. Yeah, the idea is to get somebody, again, to make a decision that's not in their best interest, that is in your best interest. It's to convince them that you are a worthy, I don't know, prize, even, even when you may not be. And yeah, I mean, a lot of those things also involve other even more nefarious actions. You know, there's ways to convince people to feel less confident about themselves, right? So, oh, you think she's out of— yeah, right. She thinks she's out of your league. Well, make her not think that. Which is just horrible garbage.

That is an effective social engineering. It's a, a very effective social engineering tactic. Or scarcity. I want to be that thing that other people can't have. And so you end up just— pickup artistry takes courtship, takes dating, and those things that make you a desirable partner. And the reason it's pickup artistry and not just general social graces is because there's that act of manipulation where somebody is being presented a false image where they will be worse off because you did that thing. And I've had to worry— dating apps are interesting, and I've had honestly a conversation with friends of mine about, am I being unethical being on a dating app instead of trying to meet someone in person? Because I have spent years copywriting in very small things to get people to take the action I want them to take. Am I selling a bill of goods of myself knowing the best way to present myself. Are you lying about yourself? No, but there's always strategic presentation. That's, that's seriously marketing.

Marketing is acceptable, right? Social engineering is a different thing. You're not lying about yourself. There are people who have, you know, it's like phishing all over again, false personas, you know, a sock puppet. That is not what you're doing, though. You're saying, I'm this person, these are the things I like, these are things I care about, this is my experience, whatever you're sharing, right? You're not lying, you know, whereas there's And many, many profiles on dating sites are fictitious, either entirely, the person themselves doesn't even exist. That's for other purposes. Or yeah, that person exists, but everything about them is a lie. Their whole story is designed to convince you, or it is a significant manipulation. I work in the Defense Department. I can't really talk much about my job. Turns out that they work on the cleaning crew that cleans the Pentagon. They didn't lie. They work in the Defense Department. Who the hell would want to talk about their job? But they've given you an impression that it's a totally different thing that they do. That's manipulative. So no, I think marketing yourself is expected. I mean, I would assume somebody's going to put their best foot forward as you're trying to attract opportunities, right? I mean, you know, the dating apps are all about getting opportunities. It's, you put a line in the water, you're going to catch a fish occasionally. You put a whole net in the water, you're going to get a lot more fish to choose from, I suppose. But you aren't throwing dynamite in the water and catching all the fish out of midair.

Like, you're not cheating. Like, no filters, whatever. Like, and it Regardless, it comes pretty quick in conversation whether or not somebody has actually read the profile or just enjoyed swiping because they have a hobby and they can't tell you about it. I think this brings us to actually leaving someone better off versus lying. One of the things I love to do at organizations, and I would highly encourage anyone who thinks that social engineering is irredeemable, I want you to think about, go and read something on reciprocity. Reciprocity. It's where you give something to someone and they feel a social debt to give something else to you. The very first time I thought this was bullshit. Very first time I ever read it, I was on a plane. I'm like, this is just manners. And I remember reading the line, you know, even a smile can trigger reciprocity. You said it yourself earlier. And I'm like, this is bullshit. I don't believe it. And so I was on a plane to this conference and the flight attendant comes by and I remember she was wearing a deep purple sweater. Like, it was a nice cardigan. Purple's my favorite color. It was genuinely a nice sweater. I'm like, that is such a nice sweater. And I made a point of smiling nicely. Just—

what did you get for free on that flight?

I thought nothing. We just had— we exchanged a smile. I'm like, look, politeness, it's fine. And then she came around with the drinks, and I got the full can of ginger ale instead of like that third that they give you. And I went, oh boy, I just found a cheat code. Shit. So it really does work. So try, one, try smiling and smile nicely. Smiling, you will get so many more. But more to the point though, at work, one of the things I like to do is meet stakeholders. So people that I have to report to or I work with or are important and connected to me in some way. I will learn what their goals are, what their team is supposed to do, what maybe their roadblocks have been. And I will ask, and a lot of the time when I make things, I can't make things and then ship them over the fence. I need people who are smarter than I am to help me with it. But one of the things when you're in marketing, we're back to reputation, nobody wants to work with you because they feel like they've lost their time or you're going to misinterpret it or they're going to take it out of context, whatever. So I would pick a small thing and ask for a small, like, Can you point me in the right direction? Would you mind looking this over super quick? And so something very small, basically the equivalent of a work smile, right? And then the key here is that you fill in that loop, right? That behavior loop of you look at how it performs, of what they did and what they accomplished, whether that's just you made the thing or it did something. You go back and you thank them for their effort. The second follow-up of the social smile of the tiny help connecting it to what they want and making it a tiny, tiny ask, that real social smile moment is when you go back to them and smile at them and say, "Because you helped me with XYZ, we were, you made a difference in ABC as measured by number of whatever." They will do whatever you want. Because, and it is such a simple, small thing to do, is to listen to someone. We're back to active listening. You listen to them, you contextualize the ask. So learn your audience, contextualize the ask, and apply it to what matters to them, not just why it would help you. And then you always, always make a point of going back and saying, thank you, because you did this with me. We were able to achieve this. And people feel seen, they feel recognized, especially if you work with technical or cyber people. They, they love to feel like their expertise is listened to because they feel like they're trapped in a closet a lot of the time. Not fair, but like, it is— is it manipulative that I do that? Maybe, because I do it on purpose knowing that this is how you make friends, right?

How to win friends and influence People is a very famous book. It's been around forever. You could make the same argument. Is that manipulative? Understanding what people like and appealing to that, as long as you're genuinely that person, is not necessarily manipulative. It's, again, it's that fine line of what's your true self? You know, if you're playing a role to get people to like you and you know for a fact they absolutely would not like you if they understood your actual morals and ethics, then you're, you're a jerk. If you're just trying to amplify the things that you really are anyway, then yeah, you're just accelerating the process and helping people see who you are and moving forward. I'll give one more. Example in my head on managing up. And we talked about that earlier, right?

So this is a great moment to manage up. It's a great technique to manage up and manage sideways. You will get so many allies up, down, and sideways. 100%.

If you're managing up, you have an idea, you need it to get through. You think it's really important. You don't know if your boss is gonna like it or whatever. I've often, it took me a long time to learn this one, frankly, and a lot of reading, and then I have to actually believe the reading and actually follow through on it. Don't, I don't present ideas necessarily. Depends on the people. And now I've been doing this a long time and people actually listen to me. So now I can actually present my own ideas if I want to, and people might actually take 'em seriously. But still, in some cases, I recognize that's not the answer. So instead of presenting the idea, I present the question. I already know what I think the answer's supposed to be, but you know, a discussion about, you know, a challenge that somebody has and saying, hey, you know, I wish I could do more to help with that. I was thinking through it. I'd like to get your thoughts and ideas cuz I really value your opinion or I respect you or whatever, whatever shit you wanna say. And then it's, you know, start asking questions that lead to the place, right? What if, what if it was this? Or has anybody ever done this before? Or, you know, I heard something about it, whatever it is. Don't make it about you. You know, but what-ifs, and what are your thoughts on? Have you, have you, you know, I know you did this before that was really successful. What about this? You know, not things like, have you thought of doing it this way? Or I think we should do it this way. It's a fine line, right? But it's the same communication. And that person now hears that you care about their opinion, that you respect them, that you know their previous work. Like, you're appealing to their ego, you're appealing to their sense of authority and leadership and whatever it might be. And maybe none of that's true. Now, again, I'm making the assumption here this is somebody you actually don't get along with and have had troubles getting to listen to you. There's just different ways to present those things. And oftentimes those discussions lead to more discussions, and that person ends up coming to a conclusion and has an idea, which was the idea you had all along, but now it's their idea. And so all of a sudden, the idea that, you know, if you'd walked in and said, you know, I think we're doing this all wrong and we should really do it this way, that's gonna fall flat and you're never gonna get anywhere. You might have been right, but it won't matter. You've now gone a little longer path, but this person now thinks that it's their idea, which means it's got a much better chance of succeeding. And you've made a good reputation and good relationship in the process because they won't necessarily forget that you were involved at all, even if they don't give you any credit for it. But they won't necessarily forget about it, and you've created some warmth and some relationship there that might lead to more, right? And so Is that manipulative? I mean, by definition, yeah, I suppose it is. Is it nefarious? No, I don't think so. You actually ain't gaining anything out of it. In a sense, you're losing because you're giving away your idea just to get something done that you think needs to get done.

Assuming you actually believe this needs to get done and the other person will benefit from it. That would be the only case in which I would say it was ethically twitchy to me.

100%. And it's frustrating. Some people don't do it well. It took me a long time. Some people call it office politics. There's a lot of ways to describe it. Describe these things. Took me a long time to recognize that just getting the right solution makes more sense than trying to get credit for things. Sometimes it'll work itself out. There's some I probably regret and some I don't. But I think if you're going to manage up, these are the kind of tactics, and it's one of many. And again, you could read the book we were talking about and kind of go through what motivates people and assess what motivates the person you're dealing with, your boss. You know, what do you see that they care about? Are they somebody who comes in and talks about their impeccable taste? They talk about, you know, all their fancy things in their cars and they have a lot of vanity to them, for instance? Or are they somebody that just loves cats? Don't tell me anybody listening or watching this, all 12 of you, haven't ever been in a position with a conversation where somebody said something they cared deeply about and you couldn't have cared less, but you leaned into it anyway and went, oh my God, I love cats too. And you hate cats, you're allergic to them and you think they should all disappear. Everybody's done that sometime. Social engineering. You want to create a bond. You want to create an I'm one of you kind of a feeling because you want to get to the next thing that you want to talk about, and it helps if they feel like there's common ground. And people do that all the time, and it's semi-harmless. It gets bad if it turns into one of those things where they invite you to go to their cat festival or some crap, and then you really got to go down the path.

But it's from a communication perspective, from a rhetorical persuasion and context, right? I can do this example for both cyber and for the cat example. So like, from a cybersecurity perspective, the phish that get most click based on the analysis I've done at multiple environments over my career now, are typically the ones that look like they belong and are like a file that's sent to somebody who often opens up files that look like these things. They don't have to exactly mimic the environment. Like, and if I get a Windows phish because it's been sprayed and prayed and I don't have Outlook or use Windows, then, you know, that context misses for me but then reaches someone else. So it's always context-dependent for a fish. And for rhetorical, as a professional persuader and rhetorician, in certain cases I would choose— if your early example about good taste, I was thinking, okay, so if that's an executive, let's say it's a male executive, he would be what I would, you know, colloquially term as metro— metrosexual, very cognizant of how they dress, they, they talk, they wear, you know, certain things, whatever. I would not use sport metaphors with them, and they would probably respond much better than the person who uses the comparison of, of like, you know, who would assume that because they're a man, they would then use all of those. It would be using the context to create an emotional connection. And that is— is that manipulative? No, it's just being persuasive because you know what would trigger somebody to move by that or not. So exactly, I wouldn't use— you know, if somebody really liked cats, I wouldn't talk about my fish. I might talk about my dog. And that's one of my rules for social engineering too. I don't lie. I present strategic truths. So I wouldn't lead necessarily with, you know, I had, you know, my, my, you have a cat. Well, I have fish and these are not cuddly and I, they're basically aquatic freshwater insects. Like, you know, let me talk about my shrimp because you've talked about your fish. I might say something like, oh man, do cats cuddle? I loved it when my dog cuddled me. Like, and so, so you find the context and the truths that connect with you. In that way. Don't lie to the point where you get taken to the cat festival because you found that person. But yeah, it's a danger for sure.

And then you can find a way out of it. There's always ways to social engineer back out of those things. But I'm— that fine line of where we're social engineering, where we're lying again, right? So yeah, now listen, I could keep doing this all day and I would, but nobody's gonna listen and nobody has time. So we do need to wrap up, unfortunately. We'll probably have more conversations. We left a lot of content on the table, but I do want to get through to the end of the show, right? Last question that everybody gets asked, including you, nobody gets an exception, is, you know, the name of the show's Unspoken Security. So with that in mind, tell me something you've never told anyone, something unspoken. You have a fair amount to choose from, I'm gonna guess.

I, I've had a couple ideas. One of them involved my hair, but I think the one I wanted to kind of talk about that kind of went back to riffing a little bit off of strategic truthing. I've been social engineering my identity for various different reasons since I came into cyber. I had both in writing and what I present and how I contextualize my previous career. I don't lie about it, I contextualize it. But specifically my name, I go by Striker, S-T-R-Y-K-E-R, just like the people who got hacked, which was part of the reason I had to write that article. Oh God, how many RIP Striker memes I got. That, that was how I found out. I have a threat intel feed. I found out because of the 10 RIP striker memes in my inbox.

Oh yeah, I imagine if Nash Coffee ever got hacked, I'd probably hear about it. So, oh, exactly. Like, coffee is—

I don't know if they exist anymore, but so lots of people have— lots of people actually assume that it's a handle. It is truly my last name. I, I have at least once per conference somebody's like, I'm too old for that handle shit. And I'm like, ah, so you are the individual I get to show my license to today.

Jesus, don't show people your license. Stop doing that. You know, we just had this whole discussion about—

Risk context! Risk context! But, so, point is, I have to prove that that is in fact my name at least once per conference. And it is my name. And usually people then ask, well, why do you do that? And there's a couple of different answers, and I've never given all of them all at once. So, the first is, it's just cool. I love my name. My last— I lucked out with my last name. And when you have a cool last name like that, you know, you just kind of embrace it. I went by it in high school. So for 4 years, I went by Stryker. My youth pastor was the one who gave it to me. My one teacher thought it was enormously disrespectful that my best friend was calling me by my last name. She's very old-fashioned. I had to explain to her that my pastor says this is fine. And also, you hear me in French class. So it's okay. Stryker's fine. There are too many Ashleys in the world. And so it becomes like you're living a Recess episode. Uh, if you've ever seen the '90s cartoon Recess, there's the Ashleys Club and they have Ashley P and Ashley S and Ashley T. That was my life for like all of elementary school. I was Ashley S and it sucked. So operational security has been very interesting. When I go to places like DEF CON or BSides, they'll often think it's a handle. And then not look deeper because they assume they know the truth. And one of the best operational security protocols I have ever embraced is tell enough of the truth that somebody doesn't bother looking deeper. And because they assume they already know the answer, so they don't bother. And then transitioning into tech, we talked a little bit about this before. I have had people enter a room, even though my headshot was attached to like a workshop or a talk, and they were surprised that I was, I was, a woman was giving the talk. You know, there's still a bias. Ashleys, there's a lot of Ashleys in cyber marketing. I don't know why. It is odd. This is just my perception, but it is truly, every time I think that I'm exaggerating, I meet at least 2 more.

There's a lot of Ashleys in general.

There's a lot of Ashleys in general in my age bracket. So going by my last name allowed me to kind of sidestep some of that bias in the industry. And then the last, but certainly not least, is usually reserved for when people are being a dick, and I want to make them feel bad. And so I explicitly say this to make them feel very awkward, and then I'm gracious enough to let them off the hook. But usually, you really got to make me mad to make me pull this one out. But to be honest, I'm divorced. I used to be married. My ex-husband is an Identity and Access management developer, uh, with a French tech company. And his first name is Ashley. I kid you not. Spelled exactly the same way. And I was transitioning into cybersecurity around the same time as my divorce. And so every time someone called me Ashley or Ash, I literally physically reacted to my own name. And so I just went, you know what? Call me Striker. Can you just call me Striker, please? I used to go by this in high school. And so I'm like, yeah, no, it's my ex-husband's last name and it gives me anxiety. So your ex-husband's name is Ashley?

It is. Your, your name, although you don't go by it, is Ashley? Yes. When you got married, did you change your last name to match his?

No, his last name— okay, good. Oh, well, we did— can't name him or anything, but we actually had thing. I have gotten his medical records, he's gotten my medical— like, it's been a nightmare. And then our, our son had— and it got my ex-husband's last name. That was kind of the deal, was that I would keep my maiden name and any kids we had would have my ex's name. My ex's last name is not nearly as cool as mine. Just straight up, he's not as cool. I'm sorry, kiddo, I've cursed him with the not as cool last name, but he can change it when he's older. But it also starts with S. And so I couldn't even hyphenate because then I would be an ass even beyond what I am now. And so, like, there was all of the reasons. And I remember we were sitting, driving in a car during the engagement, and I'm trying to puzzle out, like, how can we possibly do it? Like, I've got, like, the Silvio Pepe, like, the, the, the, maybe we could do this or this configuration, and nothing was working. And I finally go, well, what would happen if we both picked a new last name? And we both picked— except then we would still have the same problem of Ashley last name.

Still be the same thing. Yeah. Just with different last names. Last name. You'd still have the same name.

And then one of our best friends at the time suggested that we just name our child Ashley and then give him a different last name so that we could do a whole Asian thing.

Oh my God, I would have loved to have seen like the wedding invitations on this one.

I've got— we got formal wedding invitations addressed to the Ashley. The Ashley. It sounds like— and for many years I went by Lee because my ex-husband went by Ash. Names are powerful, guys. That's all I'm saying. That's also something I've not actually said. Oh my God.

That is ridiculous. The funny thing about it is, I'm gonna wrap up here in a second because I don't know where we are on time. But, uh, so for those who don't know, as you've heard, like Ashley, well, Stryker and I have known each other for years now. I, as we're prepping for this, you know, I said, hey, listen, I feel silly asking, but I don't remember your first name. I had to ask. Because I was like, when I introduce, I'm not going to introduce you just as Stryker. I'll introduce your full name and then I'll, you know, you go by Stryker. But I was like, I had forgotten. And when we met, I knew your first name.

Yeah, I introduced myself as Ashley when we first met.

I had forgotten. So, I mean, you talk about you social engineered your name, like you've successfully rebranded, no doubt about it. Like I know you and I never call you by your first name. And I, to the point where I had in fact forgotten, I was like, I know it's an A. I can start running down names, but that'll take a while. So yeah, it's, it's an interesting thing that it has just become, you know, who you are, which is cool. And now I know why, because I also didn't know why, although I knew that you and your ex had the same first name, which is ridiculous.

It was one of the first ways we bonded. His first name was on the dating app, and I'm like, I at least have to say hi to a fellow Ashley, my doppelganger. Yeah, see how that worked out.

Don't do that twice. No more Ashleys for you.

We had a very lovely relationship until we outgrew each other and all of the rest. And he has a wonderful dad to my child, and I really cannot ask for more. And I will end with, if anyone has kids and is considering separating, the thing I have told my son repeatedly is that if we do this right, divorce means— so as I tell my son frequently, if we do divorce right, it just means that there's more grown-ups who love you. Oh, well, that's so, so like So you're social engineering your kid to like divorce.

I got it. Okay, well done. Oh, it took a whole episode, but I got one. Every time we're together, I try to get at least one. Oh, I got two!

Look at me. Yes, I am social engineering my child to not hate me for the divorce that we had when he was 4 and cannot remember anything.

I am totally making sure that's the clip that gets marketed out, is me saying social engineer your child and you snorting. That That's totally going to be the clip that goes out for this show. All right, listen, I'm going to wrap it up. This is the best show ever just on that alone. So I'm going to wrap it up. Listen, thank you for being here, Stryker. I really appreciate it. We'll probably do more of this. For everybody watching and listening, thank you. Please, you know, take the time to like and share and all that and provide comments and feedback. If you don't like the show, shut up. But if you do, please let me know. Let me know either way. And again, thanks everybody for being here. I appreciate it. I know there's other things to do with your day. I hope this was helpful and informative. That's the goal. So with that, I'm going to go and wrap it up. This has been another episode of Unspoken Security.

Thanks, AJ.

That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.