Unspoken Security Ep 62: How Do We Know What's Real in the Age of AI?

In a few months, we'll have an AI that will be able to deploy the patch and everything will be okay. But the one thing that's never going to be able to patch is the human being. And that was always the lowest link in the chain and the biggest vulnerability.

Welcome to Unspoken Security, the raw and gritty podcast for security professionals who are looking to understand the most important issues related to making the world a safer place. Including intelligence-driven security, risks and threats in the digital and physical world, and discussions related to corporate culture, leadership, and how world events impact all of us on and off our keyboards. In each episode, host AJ Nash engages with a range of industry experts to dissect current trends, share practical insights, and address the blunt truths surrounding all aspects of the security industry.

Truth's a weapon holding sharp, to living by silicon or steel.

Hello and welcome to another episode of Unspoken Security. I'm your host, AJ Nash. Spent about 19 years in the intelligence community, mostly at NSA, and been building and maturing intelligence programs in the private sector for, I don't know, 10, 11 years now. I'm passionate about intelligence, security, public speaking, mentoring, and teaching, and I also have a master's degree in organizational leadership from Gonzaga University. Go Zags! This podcast brings all these elements together with some incredible guests to have authentic, unfiltered conversations on a wide range of challenging topics. It's not a typical polished podcast. My dogs make occasional appearances. They're both at daycare today, so we're safe. People will argue and debate here. They even swear sometimes. I certainly do. That's all okay. I want you to think of this podcast as a conversation you'd overhear at a bar after a long day at one of the larger cybersecurity conferences. These are the conversations we usually have when nobody's listening. Today I'm super excited. I'm joined by Shai Gabai, who's co-founder and CEO of TrustMe, where he applies over 15 years of experience and deep expertise in informational security, cyber defense, and product management to battle against fraudsters. Now, prior to TrustMe, Shai held various executive roles in cybersecurity. He's been general manager, chief innovation officer, VP of product, and the unfortunate role of having to be a CISO. He's been a chief information security officer. Terrible job, hard work. He also has an impressive academic background, including a bachelor's in software engineering from Shankar College and a master's from Tel Aviv University with a double major in marketing and strategy and entrepreneurship. Welcome to the show, Shai. Anything you want to add to that bio before we jump in?

Yeah, I think that one of the things that I'm passionate about is solving business problems using technology. And that's part of the reason why we started FastMe, basically.

That's something I really appreciate about you specifically, is that you're very customer-focused. I know that you actually want to do good, right? And I love working with people who just want to do good things. So let's go ahead and jump into today's discussion. We're going to talk about how the rapidly vanishing reality we all live in, in this age of AI, is reflected in financial fraud. But before we get into the tech and the scary AI stuff, let's level set a little bit. When we talk about financial fraud, how large of a problem are we talking about and what are the most common techniques that you see?

So first, let's start with the first question, like what's the volume or how big is the problem? So most of the people think that everyone knows the problem, but no one really understands how big it is. So only last year it was around $450 billion globally.

Okay?

So think about those numbers and then We wanted to understand why it's become so big, right? So obviously AI contributed to that. But if you think about what's the most common attack scenarios, you know, this is a business problem. In B2B world, everyone doing payment, right? That's how we operate, right? You need to pay your supplier, you need to work with different people, you need to send money. And in most of those cases, the attacker, the cybercriminal, are basically Now exploiting the human being and the process around it. So if you think about B2B payment process, it's a very complex process because, so first, it involves a lot of different people inside and outside of the organization. Almost most of the communications are based on email as a source of truth, although in cybersecurity, we all know that it's the source of all evil, right?

Right, right.

But then on top of that, you have so many different systems involved. Like for payment, right? So you have procurement, supplier portals, ERPs, the finance payment itself, and each one of them are kind of a silo. And on top of that, what usually organizations are doing are implement manual controls and education to try to mitigate those risks. So at the end of the day, it's a classic people process technology problem, meaning you have a very comprehensive process, each part doing their own thing, but no one connecting the dots. And making sure that the end-to-end transaction was legit and everything was okay. I think that's the biggest problem around that. And what the attacker usually will do, they'll compromise the process.

Sure.

And there are so many various ways to do it because it's so comprehensive. So they usually will start with impersonation. By the way, around 39% of attacks start with fake domain or similar domain, and no one's counting that. And then you have different impersonation and hijacking of the payment details or something like that, but always compromised and leveraging, basically exploiting the trust relationship. Because in most of those cases, it's not fake payment that never happened. Like it's a relationship with someone that you already have. They exploiting that trust. They know the context. There was a business transaction. The goods was delivered, and then they just asked something like, oh, can you change our payment details or something like that? So that's the most common example that we see.

Well, and it's a good point. Yeah. All this technology, but as you said, the defense against this or the process really is still very human-based, which is where things tend to break down, frankly. So, you know, if I'm in an accounts payable organization, something like that, and I know that we have a longstanding relationship with this vendor, I'm not going to be surprised when I see an email from them, when I see an invoice from them. And it's not that hard for anybody who wonders, it's not that hard to do some research and find out what companies work with other companies. So that's not hard to do at all. And so to be able, like you said, to hijack that whole process and just make one minor tweak isn't going to be surprising anybody. It doesn't set anybody off to get to the end and say, hey, you know, we just had a bank account change. Here's a new routing number. Can you just update your records and route the next payment there? And so Even with all the technology and all the improvements we've had for speed and efficiency, I'm a little surprised, I guess, or disappointed maybe is a better word, to find out that we still have the biggest weaknesses come down to just people. And we haven't really accounted for that. Email, as you said, it's really the root of almost all evil in cyber. 90-some-odd intrusions, percentage of intrusions start with some sort of email. As you said, 39% use lookalike domains and fabricated email threads, right? So it's hard to believe that we haven't been able to do a better job. Than just saying, well, we're going to train people and they should be able to spot that. I mean, there's got to be something we should be doing that's better than that, I would think.

I also think that, think it from the other side for a second. So there are tools today that can improve dramatically your security, like Deakin, D-Mark, all those buzzwords, right? But in order to do that, the other side needs to implement. Now, most of the corporate, you're working with a lot of different companies. And big part of them was like your third parties. Not all of them are very big security teams or have the right resources to even understand what you ask them to do, right? So a lot of the time it can be manufacturer or different organizations that are not so big or very not educated on those type of things. So only the idea that you can expect them to do everything in order to protect yourself, I don't think that that's realistic. No, not at all.

And that's, I mean, frankly, that's a common security problem we have across the board, is that we have all of these technologies and all of these systems that vendors develop. They're highly sophisticated and often have a lot of great success. And then they're purchased by people who understand security a lot of times, or should at least, and how all this works. And then in most cases, we still have something that comes back to an end user and we're like, well, we're going to leave it up to them. And the end user ends up being the vulnerability, but often they're also the most important piece. And we're just like, well, we've got all these other things, but ultimately, you know what, we'll do some security training and then the end users will understand what to look for. And we do that once a year and people just check the box and don't pay any attention to training. If you're out there listening and you're somebody who's diligently doing your training every year, congratulations, you're one of nobody. Nobody does that, right? We'd always check the box and move through. And I don't think the world's getting a lot smarter. I mean, I think we understand some things in phishing, but just as we got to the point where people understood not to try to send their money to some Nigerian prince, then AI comes along and makes all the phishing so much better. So anything people have learned, a lot of the things we learn, it looks like it's not native to that language, that kind of a thing. That's all gone now, right? So we drop it all to them.

The education is still on deck. Yeah. So you join Pivoting, let's try to find language mistakes or where maybe they ask for a lack of context or urgency and stuff like that. And it can happen, but most of the attack today, it's gone. It's much better because it's generated based AI. It's not people that need to do that. So no proofing issue, no language barrier, no things that are not from the right context. They have everything they need to execute it very easily.

Yeah, exactly. You know, so even if you have the training, it's outdated training now too. So, you know, now actually might work against you. I have training that says I should look for these things, and I get an email and none of those things exist. You know, it's, it's a spoofed address. So it doesn't, it's not a typo. It's not one of those things. The language is perfect. You know, it talks in good context. It really aligns with what we're doing because it's not hard to, you know, get ahold of the information necessary to impersonate. And actually, it might, the training may work against somebody at that point. 'Cause it's like, well, I've done all the checks. I went through all the things I was taught and this passes all those. So of course I should trust it. So we're actually in the reverse effect, perhaps in some of the training. If somebody's out there listening or watching and they're an expert on cyber training and they've got it solved, please let me know. I'm all about getting better. I just haven't seen people take training very seriously or haven't seen a great deal of effect so far. So the challenge then, I guess, is, you know, again, we're bringing it down to the person instead of dealing with end-to-end solutions here. But what have you seen that's changed in the threat landscape that's allowing fraudulent payment requests to appear more legitimate, you know, so that they're enough to pass the normal business processes and workflows?

Yeah. So look, I think that AI really contributes to the threat landscape as we see it across the board, right? We see much more vulnerabilities. We see a lot of other things, but it's also made their life very easy, not only from writing much more appealing email. That's one of them. But, you know, part of those processes, they need to provide evidence to answer different controls, right? So one of the most common controls will be corporate procedure. So we have defraud calls and stuff like that. And a lot of the time they need to provide different evidence, like, please provide me a bank approval letter or a void check or new invoice with the new bank details. So it becomes so easy today using AI to create all Oh, you need a new image? Here I will take it.

No problem.

Here it is. And, you know, if previously it was kind of people with the right training could catch those things, it becomes so good that if only human beings were looking on that in the eye, it's become impossible for them to detect those type of things. And, you know, it's not only that, like part of the evolution of cybercriminal, they can do it in large scale. But they also understand much better how the controls exist today. And each time that there was a new control, they just bypass it by creating a new thing. I will give you one example. When we started the company, most of the cases of fraudulent activity that we've seen was kind of like the fraudulent account that they created or used. It was bogus. It was easy to detect. It wasn't the same beneficiary. It was different location. There were a lot of things that— Any human being that will think about it or try to understand that will say, you know what? That doesn't work. But in today's world, 95% of the attacks that we've seen last year, when they compromise your supplier, they don't only understand your business. Usually they go after their financing, like treasurer and so on, people that maintain and open all their bank accounts for their activity. And then they send a different document that they use to open their bank account. And then they go to the bank, they pass the KYC, they open a legitimate bank account, same verification, same everything, even transfer some funds to create like a good activity and balance. And then they have a legitimate account that they can control. Sophistication really uplift and change the game. But if you think about what most of the organizations are doing, They're still relying on manual controls. Some of them are better, some of them less, but that's the common ground that they are playing. So from one hand, when cybercriminals, that unlike big enterprise, they don't need to test things, they don't care if production will fall or whatever, any new model that comes in, they can just implement it and use it in a very effective way. And on the other side, still most of all the organizations rely on human being and manual controls to try to find those type of things. So I think we come in a new space that it's like an unbalanced match. Cybercriminals have all the advantage and people are leveraging the same techniques and tools that they use for the last decade.

Well, and you made a good point. You know, it used to be that you could challenge back and ask for artifacts, right? Hey, you know, like I said, a canceled check, you know, some of these other pieces. This is the golden age for counterfeiting. Anybody Can make virtually anything that'll pass, you know, the eye test, right? I recently, this is just as an example, was putting together some training and I needed a snapshot of a dark web forum with some activity, et cetera. Listen, I didn't want to take the time and effort to go out there and do that manually. Plus I didn't want to be, you know, putting real content into this training. No problem. Went to AI, described what I needed, popped up a really good example of what a dark web forum looked like, what a dark web marketplace looked like with the content I needed, the selling I need, all, all the things that, that were there, right? Somebody who doesn't know the dark web, doesn't know that forum would definitely be fooled. If I had wanted to make it more realistic, if I really needed to map it to match a forum, you can do that. I've done the same thing with training webpages. It's not that hard to put a mockup there. And I've got a training mockup that it took, I don't know, maybe an hour to put together. That's almost an identical mockup to the Citibank website, different branding, et cetera. And it doesn't actually work, obviously. But it's not that hard to do, right? So coming up with a canceled check or a bank statement or an invoice, anybody can do that now. It's really easy. And you could do it with tools that are free in most cases, right?

When they compromise your suppliers, they have the previous documents. So just to wait for it to be updated.

Even easier. Drop that in PowerPoint and just change dates, change numbers. Like anybody can do that. If anybody out there has ever lost a receipt and they needed to do an expense report, if you haven't figured out how to use PowerPoint to make that happen, With an old receipt. Let's have a chat offline because anybody who used to employ me, I'm confessing right now, there are some receipts I gave you that weren't quite valid. The charges were, but, you know, I ate at that restaurant 4 months ago and I forgot to save the receipt. Well, I've got another receipt from that restaurant, a little PowerPoint, a couple changes. I got the rest, you know, the receipt I need now. So anybody can do that, right? And again, like you said, it's just about passing manual checks. So all the things we used to have in terms of artifacts or proof, that's all gone, right?

Yeah.

And as you pointed out, the sophistication of actually being able to set up official bank accounts and go through the know your customer process. So you have something that's legitimate and validated. Now, I will say this, when you're going down that path, I'm gonna make an assumption, but I'm gonna ask, we're talking about more sophisticated organized criminals, right? Or are we still talking about one-offs that take the effort to go do those kinds of things?

As I mentioned at the beginning of the conversation, this is a huge profit for cybercriminals who are always motivated by making the maximum profit, minimum effort. There was a period that ransomware was the one thing that everyone was concerned because they figured out a new business model around it. They did a foundation, right? But they recently realized that going after people that has access to funds, that's much easier.

Yeah.

You're just breaking the process. You're compromising a very comprehensive process. You're doing small tweaks and no one catches you. It's become so easy for them And that's why it's become much sophisticated. But I, I think that in most of those attacks, it's not script kiddies anymore. It's very well-funded cybercriminals organization that doing a lot of activities because they know that that's a real business for them. Yeah.

And you pointed it out. This is big business, right? You know, criminals, I've always said criminals are like water. They're always going to go for the path of least resistance. And they're obviously, they're great business people. They understand return on investment. Like I said, not a lot of time for a big profit. Listen, a sophisticated criminal in the physical world is the person who wants to rob banks. The unsophisticated one robs a liquor store. It's just as much time, effort, and by the way, prison time, but there's a lot less payoff available to you. So if you're going to be a criminal, you go for the big money. And that's the same thing we see in cyber here, right? So you're talking about organized crime, people who really know what they're doing. This is their profession. This is their business. And I think something you had mentioned before we got on is the discussion that fraud isn't just about fooling people anymore. I've been spending a lot of time talking about that. But you had mentioned that this is really being engineered now to pass through security and payment workflows without being stopped. And I know part of that was, as you said, they've already set up these accounts. They've already got the know your customer in place. It sounds like a lot of these things are already, by the time they reach out to the person they're going to fool, the person they're going to trick into giving them money, most of the things that are supposed to prevent that, it seems like have already been bypassed.

And that's what we see in most cases. Again, I think that a big part of the problem is that you have so many different people doing their own thing. Let's go back to the controls that exist today, even the minimal ones, right? One of the biggest controls that we have is like, if someone asks you to change a bank account, we have a callback procedure that we're going to call a known number.

Great.

And I would say, if you do it effectively, it's probably going to work. Okay. But, but, you know, there are 2 problems there. It's a manual process, so we have to really enforce it. And the second part is how you can do it efficiently. Now, efficiently, it's not only how much time it takes. So there's an underlying assumption that you know who are you going to call. And, you know, in most of the organizations, let's assume that you are working with a vendor for a few years. When you set up the vendor, there was one person that you contacted, everything was fine. 5 years later, probably this guy is gone. He's gone.

Yeah.

So for them right now to really, who are you going to call? It becomes so easy to bypass them. And I'll give you a few examples. Okay. So first, so everyone has a very strict process when speaking about changing bank account. But now what will happen if I ask you just to update your contact details? Is that policy? I can assure you, in most of the organizations, no. They're going to just update it. So I'll give you a real scenario. So we had a case that basically the attacker learned the controls of this enterprise. They knew that they were going to have a callback procedure. So what they did, first they created impersonation. They registered a lookalike domain to be very similar to the real supplier.

Mm-hmm.

Now, because they knew that they were going to have a callback procedure and maybe that someone is going to search for this number, They, as part of the register a new domain, the lookalike domain, they replicate the supplier website. Okay. They update contact details there, promote it in Google Ads to be the first one to appear. Also in different promotion engine, 4-way, all those generative AI search tools.

Sure. The LLMs.

Basically everyone that's going to search this company going to get their website first. with the new contact detail. But note that after they opened the infrastructure, all of that, when they hijacked the conversation, they started with a new email saying, our main contact person left the company.

Sure.

Please update the new contact and here's the details and also a link for the new website for all of that, right? Only 3 weeks later, they asked to change the bank account. So The lady that started the change process, she assumed that, okay, I need to do the callback procedure. What she did, she went to the master data in the ERP and extracted the contact data. She even didn't know, she didn't have any visibility that this number was updated. So you have so many different people doing part of the process, but not connecting the dots.

Yeah, well, it's a good point. I mean, it's fragmented, right? In order to be efficient in organizations, we rarely have somebody who's end-to-end on everything, right? There's handoffs along the way, right? And, you know, I gotta be honest. I mean, what you just described is gonna fool everybody pretty much. I mean, even experts. If you get to the point where, you know, let's be realistic. I worked in security. I worked in Intel my whole career. But everything goes really fast. So if I wanna double-check on something, I'm gonna go check their website. I'm gonna go do a Google search. I'm gonna go check, you know, maybe I'll check AI searches. If they've taken the time and effort to create a fake website and promote it to be number one on the response, and all the other things come back, I'm gonna get that website and show contact info. I'm gonna get other searches and that show this is the contact info. Yeah, I'm probably done, to be honest. I mean, I've got multiple sources that are, I consider to be trusted, valid sources that are all telling me this contact info is valid. I'm probably done at that point. And I'm, I'm a professional; this is what I do. But there's not enough time and effort to go further than that, because then you start thinking, well, I'm just wasting time if I go further. What would be the point? Like, I've already done the validation. How much more validation could I do? And that's somebody who's an expert, right? That's not the person who's frontline just trying to move through. Of course they're going to do that if you've taken the time to build that. I mean, that's very sophisticated, but at the same time, it's also not very hard to do. You know, frankly, setting up a dummy website's easy. You got to pay a little bit for the advertising to get you promoted to the top, but it's not, you know, when we're talking about hundreds of billions of dollars in profits per year, a little bit to get promoted to the top's good use of advertising dollars. And so again, now you've created this system where How are you going to combat that? The person's not going to know. They're just not. And so now, and as you pointed out, they also don't try to do it all in one fell swoop. The professionals aren't foolish. They're patient. You know, hey, first let's talk about updating the contact info and, oh, this person's left the company. Okay. That's all normal behavior. Happens all the time. You don't rush in and say, hey, I got to change a bunch of contact info and I got to change all the banking info at the same time. Right. That would be suspicious.

Yeah.

So just change the contact info. Okay. Now Alice is the new contact at that company instead of Bob. Okay, fine. And then a couple weeks later, it's, hey, you know, we've got a new bank account we've got to switch to. Well, that's fine. I just talked to Alice a couple weeks ago. I know she's the new rep. So that's accepted, right? That's normal. And so it's interesting to hear about this and how professionalized it is as a process. And again, that people are in a tough position to account for that. And even if we use technology on that, technology is likely going to validate through the same ways. So I think I want to dig a little bit deeper on how attackers are using AI to build these convincing Approval packages and some of the practical steps that finance and security teams can take to stay ahead of the evolution. We talked a little bit about it in terms of fake profiles and fake websites and fake artifacts, but can you talk a little bit more about what you've seen in terms of what attackers, adversaries, criminals are using for AI to really go better, and then how are we going to work against it?

So first, we're touching a few of those already, right? And then creating a new bank account, creating fake invoices or fake documents and all of that evidence. Fake bank website, all that. But once they realize and they understand what's the process of the organization and what control they have, now they can use AI to automate the full process. So they're doing it not only more sophisticated, but much more scale. So if in the past they needed a big team to do those type of attack and they needed different, let's say different position, like different skills, right? Now you can train the skills of the different agent. And just do it very easily. So that's a big part of that. Another interesting thing that we've seen a lot, and that's become like one of the top techniques that we are seeing today, they create fake conversations as part of the conversation.

Okay?

Sure. For example, a lot of the time, in order to create urgency or to give much more confidence for those transactions or for those requests, they generated So they have like tools today that are servicing the dark web that they can literally offer that. The data layer, for example, if you're targeting specific organization, who's the decision makers? Who are the CEOs, leadership, all of that? What type of business they're doing? A lot of different things. And then now that when there was an invoice, they inject like a fake conversation that never happened. Okay. And they just put it as part of the body of the email. So for example, now I'm an AP and I see that, oh, it started from the CFO or it started from the CEO and there was urgency for something because something really happened right now. And all those different leadership was already discussed that and I just need to see the invoice.

And nobody's going to go back and ask, hey, you know, boss, the CEO, you know, the person in accounts payable isn't going to pay and be like, ah, this looks suspicious. I better email the CEO to confirm that they were actually in this conversation. Right. I don't know how many organizations are set up that way. You know, like I said, the CEO and maybe a VP and a general manager, whatever it is, all these people that are 3, 4, 5, 10 layers up, that person who finally gets that and has to act isn't going to reach back out and be like, you know, I should double-check and see. Because in most organizations, they don't even have that culture. They don't have that latitude or authority. And again, even if you had that, they might not even be suspicious about it because, I mean, that's a brilliant concept to send an email that actually shows a fake chain behind it and makes it seem like, well, this isn't an email coming from this person. It's an email that's coming from all these other people down. And, you know, many organizations work that way.

Brilliant. Like, yeah, look very good. And, you know, we started with everyone uses email as source of proof. So here's all the evidence, right? You have all that for what you need. Just execute.

Yeah, it's all written evidence. You've got all this stuff here, right? Like you said, and again, people are in a hurry. Everything's so fast. There's so much pressure to get things done quickly. Efficiency is everything. If you're not efficient, you're probably going to lose your job at some point. So, you know, we expect people to make highly impactful decisions on very short timelines and have all the evidence necessary to support the decision. And here's somebody who's going to get fooled. And at least they'll be able to say, hey, listen, here's all the evidence I had. I mean, it's pretty solid. It certainly goes beyond the annual security training we got to prepare for this. So at least they weren't negligent. Doesn't do the company any good when the money's gone. But it's fascinating.

Yeah.

To hear that, you know, the adversaries continue to get more and more professionalized, right? And, you know, way beyond where we've been training people to do this. And I know you've talked before about, you know, the barrier to entry just having collapsed, right? The technologies are everywhere. And again, most of them, many of them are free. You know, if you've got a Google account, you've got Gemini, right? If you've got a Microsoft account, you've got Copilot, for whatever that's worth. The other technologies are available. And I believe you mentioned you can go to the dark web and there's people with services for this kind of thing too. So if you don't wanna do it yourself, you can pay somebody.

Yeah.

To run all this as well. There's gotta be a whole ecosystem for that too.

Definitely. And, and I also think that we're living today in a world that it's very hard to understand what's real and what's not. And now take it to the business level. So even if I'm reading the news, it's hard for me to say, is that a legitimate video or it's generated by AI, right? So now go back to the business and say, if I cannot know that, How can I know that this invoice, or even me and you that's speaking right now, maybe it's a piece of paper or whatever? Yeah.

Are you real? I'm not even sure you're real right now.

$25 million off, right?

I mean, it's a good point. You and I have never met in person. I believe you're real. I did some background research. You were introduced to me by somebody who I know is a real person. I gotta think for a second. I think she's a real person. I guess I've never met her in person either. But yeah, now I'm sitting here going, oh, maybe this is all fake too. I'm real. I'm pretty sure still. I've met a lot of people who would vouch for me, I think. But you make a good point. Like, it's just harder and harder to know what's real, right? I mean, there's been fraud cases, you know, there's a kind of famous one now, somebody on Zoom who got popped. I want to say it was $80 million. They were brought into a Zoom meeting with a whole bunch of—

A whole company, software engineering company from the US. Basically, they had a case that one of the shared services from Hong Kong was contacted by someone, the team person and the CFO. joined a Zoom meeting with few people that allegedly in HQ. It was all fake. During this conversation, they asked few wire transactions and they offered $5 million. So yeah, that's the biggest one that everyone speaks about, but we've seen a lot of others. So it's already there.

Exactly. And who's going to defend against that? There's no training that says, hey, if you could get invited to a Zoom meeting and there's several people there, you should assume they're all fake. You should really interrogate, especially one of them is a C-level executive. Feel free to interrogate them before you take their input, their direction, really.

If you think about the defense for a second, they rely on the fact that I'm working in an organization, usually an enterprise. This enterprise invests heavily on security. So basically, if I get an email, it's probably because it passed the security email.

Right, right.

If I'm going to a Zoom meeting, probably it's legitimate because they rely on those tools that are provided by the enterprise. And now, but how are they legit? How are they really solving the problem? I don't know.

Well, and that's the thing. So what do we do? You can't trust what you read. You can't trust email. You can't really trust what you hear or see anymore, necessarily. So what is the average person supposed to do? You know, you've talked before about it. You got to get away from assuming things like that. You got to assume everything's not authentic, basically, and then strengthen like workflows and independent verification and things like that. I'm curious if you can talk a little bit more about how that's going to be the future and how people are gonna be able to do that.

I think that needs to change, especially in those areas. Usually, how those controls came to life, okay? Usually, something happened. Okay, we had that case, let's add a callback procedure. Let's add another control because something else happened. And then you have so many different controls that form so many things, you don't really see what you do. But more to that, Most of the controls are not doing security. They're mostly compliance. Okay. So they add more money on the wall and give you a fake confidence because at the end of the day, you're like, okay, I did everything right, but it doesn't really do anything.

But I checked all the boxes. Doesn't that count, Shai? I checked all the boxes.

Exactly. So I think that the core is going back to how we started the conversation. If we speak about B2B payment, what they are compromising? The process itself. It's a people process technology problem. Okay. So in order to really be able to address those types of situations, we need to have different technologies. We need to have different processes and education is part of that. But at the end of the day, the one thing that we need to do is connecting the dots. You cannot rely only on spotted check, test and controls. that no one looked in on because of that. So yeah, maybe the invoice was okay, but is the email was okay? Is the payment verification was okay? Did they do that? Before you're really sending the money, you need to look over the entire process and say, yes, everything was okay, or, you know what, that wasn't okay, and that's why it's not important.

For what it's worth, and it's easy for me to say, it's not universal, but I've often talked to people about the urgency component to whatever it is. And urgency is a big thing adversaries have used for years for everything, right? For every sort of trick they want to play on somebody, there's got to be an urgency component. Usually it's related to money at some level. And very rarely, if you think about it, like, how urgent is this? All right, we have an invoice that needs to be paid. Okay, invoices need to be paid. There's timelines on that. People have been late paying things before. The world doesn't collapse. Most invoices aren't the kind of thing where if it's not paid today, something terrible will happen. If that's happened, you're way late. You've gone through several rounds normally, especially if it's an extended relationship. I've never seen a vendor yet that shut you off on day 1 of being overdue on something. So A lot of times it seems like we just have to go, hey, slow down a little bit, you know? And that, I think, in many cases reveals things. Adversaries don't have a lot of patience, right? They're in a hurry for a reason. They like to put pressure on you. And if you slow roll that stuff, I've seen adversaries that have spiraled out of control and they reveal themselves. They start acting very unprofessionally. Some just give up and go away because, again, they're looking for path of least resistance. So, you know, something to consider is just the possibility of just slowing down for a minute, take a beat. It's tough when it's impersonating somebody in your own organization, right? When it's your own C-level leaning on you, especially if they're notorious for being impatient, it's hard to slow roll them. But when it's something coming from externally, it's a little bit easier. So I'm curious, I want to look ahead a little bit. I've talked about how terrible everything is, obviously, but in your opinion, are things actually getting better or worse? And are we going to win? Like, we have AI too, you know, so what's the future looking like?

So first, I'm very optimistic in my nature. So obviously we're going to win.

We should hang out more often because I am not nearly as optimistic most days. So we should spend more time together. Yeah.

I think that it really depends how you want to look about the AI future, but I do think that yes, attacker has a lot of advantage. Okay. But organization, especially in those types of scenarios, if they will start to implement more AI to fight the bad AI and to start looking on the bigger picture and not just fragmented siloed places. And start also collaborate with security teams as well. And I see a very bright future when connecting all of that. But in order to do it, first, it's starting from everything, you know, starting from education. By the way, in cybersecurity, everything that happens, you monitor it, you measure it, you try to understand what's going on.

Mm-hmm.

I don't know a lot of organizations that really track what's going on, incident. You know, part of the problem, to my perspective, in most of the organizations that I see, when something like that been happening, it's not been reported well. Most of the organizations keep it hush-hush in very small groups. It's basically maybe going to be reported in audit committee and stuff like that. Okay.

Mm-hmm.

A lot of the time, security teams are even not part of that process. Okay. And that's a very good opportunity for security leaders to start to interact with their finance leaders and to really start to impact the bottom line of the business. Because I always believe that cybersecurity needs to serve the business and needs to work with the business together. Now, this is a very big attack surface, okay? And very, very important for the business. So how many security organizations really know exactly what's the process? What they could do and what tools and processes they have in place in order to make sure that it won't happen. Yeah.

I mean, you make an excellent point. So some things at least stay true, right? Some advice has been around for a long time. Having documented processes and workflows that everybody is trained on and follows can be helpful because with every new attack type, you know, we get a chance to learn. Even if we learn retroactively, if we end up learning responsively instead of proactively, we still have a chance to learn, hey, this happened. We hadn't seen it before. We need to update. I don't love that we get this more fragmented set of opportunities for adversaries, but at least there's something there, right? But then you got to be able to build those workflows. Something I'll add to that, that I'm a big believer in, because we put so much on people still, is you've got to empower people. Ultimately, a lot of this has to come down to somebody who has the ability to pull the trigger and actually send money. And often that's somebody who's not a super high-ranking person. It's a series of high-ranking people leaning down until it ends up with the person who pulls that trigger. That person has to be, in my opinion, empowered to ask the questions, to push back, even if it turns out they're wrong. The extra 30 seconds or 2 minutes or whatever it is for a mid-manager to ask, how does that play out, right? So I'm a big believer in organizational health being part of this as well, that we have to be able to take that pause and take that moment because all the processes and all the systems are great, but ultimately it still lands on a person right now. So I wonder if we'll see more of that.

I think that's the area that we need to improve. Meaning, we're going to have a lot of AI, a lot of tools, a lot of things, right? But those tools need to work with people. And everyone right now are very scared for the new vulnerabilities that the AI can discover and we won't be able to patch it. So, in a few months' time, we'll have an AI that will be able to deploy the patch and everything will be okay. Okay?

Okay.

But the one thing that it's never going to be able to patch, Is the human being. Okay. And that was always the lowest link in the chain and the biggest vulnerability. And I think that right now it's even become much, much, much bigger.

No, and you're exactly right. AI is, in one sense, it's changing everything. In another sense, it's not changing anything. It's making things faster and better and more difficult to detect. But of course we have AI and we'll get faster and better and respond to. So again, adversaries do something and we respond to it. So in that regard, things aren't changing too much. The people are still there, right? We can't get people out of this. And so then it's about trying to be in a position to say, how do we improve those processes? How do we execute those processes still? So I'm excited to hear that you are optimistic about this. I waver back and forth on my optimism some days. So it's, it's good to be people with whom are optimistic. I like to hang out with. Before I get to the closer question though, I want to make sure we had a chance to cover everything. I move quickly and sometimes I miss things. So I wanna make sure, are there any points you wanted to talk about today that I didn't get us through and then we didn't have a chance to go through? I don't wanna cut you short before I jump into the final question here.

I think that we spoke on the biggest things that we wanted to. You know, for me, it's always a great opportunity to just connect with people and let them understand that this is much bigger problem than they really know, especially on the security side. Not all of the organization really understand that. And I also think that there's nothing like solving a business problem and really connect to the business. When I was in the bank, I did a lot of work in fraud prevention, and that was the way to connect to the business. You know, you want to impact the bottom line, you want to contribute to the business. And in a lot of the organizations, cybersecurity looks more like an expense center and not always be able to show real ROI.

Mm-hmm.

And that's part of my reason to founding PlusMe. I want to do something that we can really show ROI that is measurable, but not like only how many alerts we had. No, how much money we can save to the organization, how we can really impact the bottom line of the business.

And that's why I really appreciate talking to you and having a chance to learn more because you're very committed to the people portion, which really matters. So if anybody's looking for more information on how to do this better, I highly recommend reaching out to Shai. over at TrustMe and learning more about what they do and how they can help. Because I think these are good people to work with and they have cool technologies and they like to solve problems and make the world a better place, which I'm a big fan of that, right? All right. So listen, we're going to start moving towards the close. Everybody knows the name of the show is Unspoken Security. So I always close with the same question. You don't get to duck it either. So I'm interested to hear your answer. As the show being Unspoken Security, tell me something you've never told anyone before, something that has been unspoken.

One of the things that I really enjoy doing, even today that I'm CEO and all that, is the denial of process. Even when I was a CISO, that was one of the things that I really enjoyed doing. And still today, sometimes that I see a very interesting fraud attempt or something like that, I'd love to go in and really understand the bits and bytes and really understand exactly what happened. It's always very curious for me to really understand how those things really happen. And especially fraud is one thing that is really—

Exciting.

Because they do have a lot of very sophisticated things, but a lot of the time it's not so sophisticated, but it's like how they thinking about it to make it happen. So I love to really understand those type of things.

So you still get your hands dirty is what you're saying. You still get in and actually want to dig around and understand the processes and the adversaries and what they're doing, which, I mean, obviously as a practitioner, I think is awesome. I'm a little surprised though. I don't know how you find the time to do it. You must be very, very efficient.

It's not that every incident, it's not everything, but yeah, I love to do those things as well.

Well, I mean, I think that's, that's great. You know, that's, I think if you do something, you know, it's, I don't know, the old cliché, if you do something you love, you never work a day in your life. I don't know if that's entirely true, but I think it's great when you get a chance to work with people who are really passionate about what they do. And if you genuinely enjoy it and care about it, I can relate to that, right? I still really enjoy intelligence work. I enjoy OSINT. Like I, notorious for going down rabbit holes. I spend hours and hours on something and I look and go, why did I even do this? None of this matters. Like, in my case, it's normally stuff that doesn't matter. At least in your case, you're studying things that actually directly relate to making, you know, the world better and making your customers safer. But I do understand, I can relate to the passion of just caring about what you're doing, right? And so I think that's interesting. And then do you sometimes find things the team hasn't found before? Are you investigating things that nobody has yet? I think that's awesome. I imagine people enjoy that too. It's fun to work with somebody Who's, you know, as you said, made it, you know, C-level and all those things, but still understands the work, still gets it, right? And still cares about it. So I think that's awesome. I really appreciate you sharing that with me. So, all right, listen, we're going to wrap up. I appreciate you, Shai Gabai from TrustMe. I appreciate you coming on and taking the time to talk with us today. For anybody, again, if you're interested in learning more about TrustMe, or you just want to talk to Shai because he's a pretty cool guy, I highly recommend reaching out. If you can't find him, let me know and I'll find a way to connect the two of you. And for everybody who's been listening and watching, thank you so much for supporting the show. Please like and give good reviews and tell your friends and neighbors and whatever so we can keep growing the audience and have more great guests like Shayan. And if you don't like the show, don't tell anybody. But tell me, you know, I'll see if I can make it better. You come rant at me and I listen. I read emails and I check messages and whatnot, and we'll see if we can make it better.

Just make sure that they are not fake.

Exactly. Well, yeah, that's a good point. Now I have to assume if somebody gives me critiques, it's probably just fake, right? I can just write it off. It's all AI. But if it's anything good, then I guess it must be real. That's— that makes my life better. So no, I gotta check and see if they're all fake. Thanks, Shai. Now I gotta think about that. Anyway, with that, I'm gonna go ahead and close out the show. So again, thank you, Shai. Thank you, everybody, for listening and watching. This has been another episode of Unspoken Security. That's a wrap for this episode of Unspoken Security. If you enjoyed this episode, follow us wherever you listen to your favorite podcasts. See you next time.