EP178 Meet Brandon Wood: The Human Side of Threat Intelligence: From Bad IP to Trafficking Busts

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here are myself, Timothy Peacock, the Senior PM for Risk Analytics and Cloud Threat in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners on our community page. Anton, this is our June Voices episode. I am delighted to once again be celebrating Pride Month with all of our listeners. Listeners, if you watch our live streams where I'm home, you can see my bi flag in the background. It's always fun to be, uh, Like, almost obnoxiously visibly bisexual man in the industry. There's a lot of us out there, and it's great. We've got a fun episode today. This is really more of an episode about getting into product management in the security world. And I don't know, what did you think about it? As a former PM, what did you think about this guy who just told us about how excited for PM he was?

I think that I was such a bad PM that even calling me a former PM is an offense to all PMs. I think I was bad enough for this comment to be offensive to all PMs, probably past, present, and definitely future as well. But it's a very fun Threat Intel episode, though.

It is also a fun Threat Intel episode. And so maybe happy Pride Month, listeners. And without further ado, let's hear from my friend, PM colleague, all-around good guy, Brandon Wood. Truly delighted to introduce today's guest. We are recording from the same place at the same time, which is always fun. Today we're joined by Brandon Wood. Product Manager for Google Threat Intelligence. And Anton, you get to ask today's first question.

Sure. And I think threat intelligence is a very fun topic, and it has multiple kind of interesting challenges. It means different things. I still occasionally see people who think that a list of bad IP addresses is threat intel. So Brandon, given that you're a Product Manager for Google Threat Intelligence, how do you define threat intel? And How did you define it at various stages of your career? And maybe final question to this batch, what do you tell people who show up at your door and say, ah, bad IP addresses?

Welcome to the show, Brandon. You get 3 questions at a time. Good luck.

I tell them, I'm like, why are you at my house? Get out of my house. No, no, thank you so much, Anton. And I think it's interesting. So I had a pretty interesting start in the career. So I think that was question 2. I'll try to jump to question 1. And then roll into question 2. So, you know, for me, you know, getting into this cybersecurity game, one of the things I continually appreciate is how hard it is to actually find out if a bad guy's in the network or your stuff is out on the internet or somebody is attempting to gain access to your network. It's actually a huge data problem, right? And it's a very hard question to get after if you're trying to start it from scratch. It's very hard to get after, right? And there's pretty much 2 philosophical approaches you could take to try to solve that problem, right? One is what's going on in the environment and can I try to color the events that are happening in this environment in order to find things that are interesting, right? And it's kind of the reactive approach, a bit of the passive approach, right? And then secondly, there's the more behavioral approach to finding potential activity, right? What types of behaviors look sketchy? What types of behaviors would a person with bad intent try to attempt, right? And so it's through those 2 frames that we try to figure out and, you know, prioritize and, you know, help responders look into potentially malicious activity, right? And bad IP lists was a way to do it. It still exists, still lives with us, right? Essentially, you know, often a crowdsourced list of activity that A responder looked into some activity, saw it was bad, saw the IP addresses associated to, and then put a list together, and then passed that list to somebody on some other security team, and then this list continually gets passed around, right? And this is how we would address sketchy things in the normal world, right? I'm like, yeah, I went to a restaurant. It was a bad restaurant. Friends, don't go to that restaurant, and folks pass around a list of bad restaurants not to go to, right? Threat intelligence attempts to do that, attempts to curate a list of bad signals, potentially bad facts, IP addresses, domains, potentially malicious files, and then also tries to inform potentially scary activity. And so you have threat intelligence in this passive sense, trying to look at activity in your environment, beyond your environment, but threat intelligence is also useful to help inspire creativity for responders as well and defenders as well. Right. So when you're reading one of these threat intelligence reports, I think the best way to use one of those reports is not to read verbatim. Right. Like, I think it's, you know, in the first pass, you should, you know, read it verbatim, look into all the IOCs the report mentions, look into all the different behaviors and let that inform threat hunting. But when you're looking at a threat intel report, it's a useful way to try to imagine, okay, I'm a threat actor. This threat actor group just attempted this new feat. I never thought that was possible before. I didn't know you could do that. And so I'm going to try to use that behavior to imagine what other things related to that might be happening in the environment as well. And so—

So it's not just this restaurant was bad. Now I've seen that mussels can give me food poisoning. Maybe those oyster bars aren't to be trusted either. That's the through line on the analogy?

I think so. Yeah, I think so. Okay. I think so. Firsthand experience on that metaphor too.

Yeah.

Yeah.

I've gotten destroyed by some mussels before.

Definitely.

So one of the things we heard when we were prepping for this episode is that your career, you've been doing this for a while now. One of the things you worked on was breaking up a very serious issue, a human trafficking ring. What was that story and how did that shape your career? What's the story there?

Well, it's pretty interesting. So for me, I was in my early 20s living in Washington, D.C., and a byproduct of what many folks experience in D.C., which is unpaid internships and trying to work on Capitol Hill and trying to work at think tanks and trying to do the feat of making a difference in the world, right? And I did some unpaid internships. I ran out of money and then I fell into startups. I worked in energy for a while. I attempted to start my own company, went massively into debt because I didn't have money because I was a kid. And so I was at— classic startup story. I was at a coffee bar in Arlington, Virginia. Hashtag Northside Social. Miss that place. That was like my mafia hangout during that time. And I was there and I was just like kind of staring down at the table trying to figure out what to do with life, how I get out of this horrible credit card debt that I put myself in because I didn't know what I was doing. And a founder literally bumps into me and, you know, we get to talking and he's the founder of a cybersecurity startup and he's like, hey, you don't know this, but I've seen you around, you've chatted with a lot of folks, you'd be really good at cybersecurity sales. And I'm like, That on both counts sounds absolutely terrible, right?

Really?

Cybersecurity sounds absolutely boring. I know nothing about it. I want nothing to do with it. And I don't want to be a sales guy, right? Like, I just— it didn't sound appealing. I'm like, I'm in here, I'm in D.C., I'm trying to make a difference. And he's like, yeah, well, you know, I know we've talked a little bit. We know your financial situation. This is how commission checks work. And I'm like, yeah, okay, you have my attention. I'm horribly in debt. And then his second statement was, By the way, we also shut down human trafficking rings and we protect elections. And I was like, I don't know what or how or whatever. I'm with you and we're going to— I'm in. Right. And within a couple of months of working with him, I was his first employee and he was Curtis Mender of GroupSense. He's a tremendously grateful for him. Got to catch up with him this week out at RSA.

Love that.

Trained me up on how to do sales, trained me up on what a cyber was, and he trained me up on what the dark web was all about. And we were in that like 2015 to 2017 era where like hash Dark web was like absolutely the thing. And we were doing dark web collections and we, you know, we were working with a major US state and, you know, closed a deal there in the first couple of months. And we uncovered a human trafficking ring. And unfortunately, human trafficking is very rampant in dark web forums. It's unfortunately a very vibrant economy. And we were able, through one of our analysts, were able to uncover that gang's poor OPSEC and were able to get a physical address of their location. And, you know, we worked with our customer and they sent the police there that night and they freed a couple dozen people.

No way.

And so, you know, it's funny, that happened on a Friday. I remember waking up on Saturday and I'm in my kitchen making coffee and I'm reading my Slack about what happened last night and just crying on my floor.

Right.

And—

Yeah, I bet.

It's funny, you know, you know, getting into cybersecurity sales and all of that, you know, I was trying to avoid it. I'm like, you know, I don't want to go that direction, but it's amazing, you know, what you can do and the type of impact you could have on the world. And so since then, I've been ride or die with cybersecurity and threat intelligence.

I don't even know what question to follow that up with.

You guys started with 3. I think we got through 2. So.

Yeah, no, I would, I would try to sort of, yeah, this is like, I mean, this is kind of inspiring, motivating, uplifting, but also scary. But it also reminds you that OPSEC, bad OPSEC gets you every time, which is kind of— not that we want to teach criminals to do better OPSEC, because I don't think they will in many cases, but this is a useful reminder that it's the attacker's mistake. Defenders benefit from attackers' mistakes. It happens in cyber, it happens in the physical realm, right? It's what makes it.

And it really speaks to the difference that our work can make. And listeners, I know we sometimes talk really abstract about migrations and Kubernetes, but At the end of the day, the impact of our work is real. And when criminals steal money from enterprises, they don't donate it to the local homeless shelter. They engage in very bad activity with very real impact. And so, whether we're stopping the crime or breaking up the rings where the proceeds of the crime are used, it really is meaningful work we're doing in cybersecurity. And I don't know, one of the things I love about working at Google, and Brandon, I imagine you feel this way, is we get to contribute to that. here still at Google. So Anton, I think the next question may be for you then.

Next one's mine, yes. And I think I want to move us back to the cyber domain, especially given that RSA conference and all that was happening. But I dealt with threat intel, of course, the cyber kind, not the physical kind, during my Gartner days. And I've met a lot of organizations, and I'm still seeing them now, that are kind of stuck in this bit of a paradox of like, 1, get more threat intel, 3, profit, but 2, they're really unsure of. So they're actually understanding the mechanics, but they don't get the value. So how do you move past that? Like, what would your response be if somebody is gathering threat intel, but they're not seeing the path to benefit becoming more secure?

Yeah.

Yeah, Anton, I really agree with that. Right. And I think one of the issues with threat intelligence is that more intelligence, more data isn't always better. Right. One of the issues—

Wait, what? More is not better.

More is not always better, for sure. More and maybe worse, actually.

Yes, that's right.

Say more or don't if it's going to be worse.

That's nice. That's nice. No, it's one of the issues, right? So when you look at vendors or organizations that are creating intelligence, right, it's everyone has their own collection biases, right? So it's either a byproduct of the technology that they're deployed on and just what information you could get off of it, right? You know, often amazing privacy laws that protect all of us, right, put a lot of restrictions in place too, usefully. And then also languages are also a collection bias, and regional understandings are a collection bias, right? So we do a lot of underground and dark web collection, right? And if you don't speak a language in a particular form, and if you're not using the right slang, and you don't know somebody, and you know, you get booted from that forum pretty quickly. Right. And what you see from different vendors, typically their intelligence is driven by, you know, how they can do their collection and create interesting data from that. And what you see is that there are organizations that can do very strong first-party collection and have that richness and insight of first-party collection. They could actually deliver a lot of interesting metadata because they saw it themselves. Right. And then you have a second pocket of organizations that are primarily kind of data aggregators, right? They're OEMing or buying intelligence from other firms, cobbling it together. And often they have amazing user experiences. They have very powerful looking platforms, amazing dashboards that kind of help figure out the other side of the problem of how you use this intelligence. But when you drill in and you, and you look under the hood, and if you're a user and you're trying to figure out, okay, I see a risk rating, why is the risk rating this? How did you arrive at that conclusion? Right. Help inform what I need to do from here. And if you're an aggregator and not collecting first-party intelligence, you just— that data didn't show up in the API, right? And if you just kind of add these siloed-off streams together without that explainability, you're not going to get that insight and be able to answer that question, right? And so that's one of the challenges and why I say, you know, more isn't always better, right? It really comes into how and, and also what problems you care to solve too. Right.

Okay. I want to ask another thing that's always bothered me about threat intelligence. Anton got his I'm bothered. I want to ask my I'm bothered.

I didn't know I was going to be a threat intel piñata today.

You're the threat intel piñata. It's great.

Congratulations.

AKA podcast guest.

Yeah.

But at least we are not coming. But imagine it could be worse. You could join and it'd be like, threat intel is kind of useless, right?

And Tim is like, yeah.

Like, that's not what happens because we jump on threat.

Yeah. So that's question 7. So the question I want to ask is, is I've always been struck by how goofy it seems, this like dark web monitoring. Like, are people really out there being like, guys, tomorrow we're going to get this company and then we're going to get that company and we're going to get them this way, that way, and the other way? Like, what are you actually finding on the dark web that is at all relevant to how somebody is going to change their security outcomes? Because like, are you a target? Sure. Does that change what you do? If it doesn't change what you do, I struggle to understand what the utility is. So help, help me with this one.

Well, let's challenge some of those assumptions, right? So I think some of this relates to what Anton said earlier, right? Of bad guys make mistakes, right? And the reason anybody makes mistakes, usually, definitely me, I make a lot of mistakes.

Me too.

Is usually I'm in a rush, right? And with cybercriminals, they're in a vibrant economy. And a fast-moving economy, and a pretty scary economy to participate in because you've got law enforcement. You also have other bad guys who are scary trying to also take your stuff. In order to monetize and make your time valuable, you have to move very quickly, and you have to— in order to de-risk participating in that and not show up in jail or dead, and I'm sorry that I use that lightly.

It's true though.

It is true.

In this economy, it's true, yeah.

It's one of those things where we find threat actors having to break like almost Henry Ford-style conveyor belt assembly line style of monetizing, you know, stolen information. Right. And so when we're in dark web forums, you have what are called initial access brokers, for example. And these folks, all they specialize in is getting access to networks by any means necessary. And they keep a session open and they advertise the session that they have access to, and they're often listing the organization that they have access to, right? And that's a very vibrant economy, and you pay to get access to it if you're a bad guy, right? So when bad guys inside of an organization coming out of that organization, they need to sell and monetize that information or use it themselves for the next part of the mission, right? And what you see in these marketplaces, and it's fascinating, I mean, they have ads, they have, you know, 2 for 1, they got all of these different marketing schemes. And they also hire— I'm going to keep going down this rabbit hole, right? But the more we study these different threat actor groups and you look at, you know, the nations that they're operating in, they have office places, they have job postings, they have—

They have job postings?

They have training programs, right? It feels like often you're going to a normal everyday job, and often they separate the jobs so well that you really don't know you're doing anything sketchy. You got a salary, you got Benefits, healthcare. It's fascinating, right? And so when you're operating in this economy, right, and you're having to move fast and you're trying to monetize, right, you have to kind of divulge what information you have and you have to legitimize it as well, right? You have to be credible and believable. And that's also why it's an interesting economy, because none of the threat actors trust each other, right? Why am I going to send you money to buy access to the thing? I don't trust you, and you have to show a bit of what you have in order to get the deal done, because these guys, they have bills to pay too, right? They have families to support, groceries to buy, right? So, it comes down to monetization.

By groceries, you mean Lamborghinis, I'm sure, right?

Yeah. I mean the good ones.

The good ones.

Yeah.

Yeah.

Really good groceries.

Yeah. And it's funny how— yeah, that's a whole other conversation, how they flaunt that. But yeah, so that's the economy, right? And so, any economy, there are places, there's vulnerabilities, because people are exchanging information with each other. Okay.

They actually do talk about this stuff. They actually do talk about it.

I mean, we had a case. So, you know, one of our teams monitors, you know, dark web activity on behalf of customers, right? And we saw a post when there was a big vulnerability that was happening, and we saw a threat actor that we knew when that threat actor said they were going to do something, they were going to do it. And he listed off 5 targets that he was going to— he or she or other was going to use in this campaign for this particular vulnerability. Several of them were organizations that we worked with, right? And we were able to, based on what we knew about this person from having watched him for over a decade, able to help prepare like, hey, this is what this person's likely to do, roughly, here's what they're going for, and you have to patch that vulnerability right now, right? Which helps prioritize that.

So you prioritize relatively within your stack, and that makes sense. Okay. Okay.

Well, and it's one of those things, I mean, to be frank—

So it does change what they do?

Yeah, and to be frank and honest, like, that's the flashy use case, you know, 2015 through 2017, like, was really driving it, right? There's these threat actors on the dark web and you could get access through it through the Google search bar for the dark web and, you know, save your organization. Today, it's one of those things where it's not very common, but when it does happen, it pays for whatever you're paying for your threat intel program many times over, right?

Yeah.

And it's just one of those things, it's if you have the resources and if you have the team and skillset to manage it, It's a good thing to have.

So I buy that, and I want to shift gears a little bit.

Wait, you said you would buy that?

Oh, that's actually funny.

You have sold me.

We launched this thing called Google Threat Intel this week.

What's that? What's Google Threat Intel?

Didn't mean to—

That's a big launch.

Yeah. Yeah. So—

You were part of that launch. That's a huge launch. Let's spend 30 seconds on that because that's really cool.

Yeah.

Yeah.

Yeah. So, yeah, Google Threat Intelligence, right? So Google in its history has bought some really cool companies, right? And one of them was Mandiant. Of course, I'll talk more about that. But VirusTotal, you know, over a decade ago, and VirusTotal VirusTotal is the most commonly used threat intelligence resource in the world, right? It is a partner to most security organizations out there. Most threat intelligence practitioners, most security practitioners log into VirusTotal and just see what other folks in the community are saying about different artifacts, right? It's an incredible tool. And, you know, the team that I could gush about the team forever, got to spend—

A spectacular team.

They all live in Malaga, Spain. They all eat lunch together every single day. It's the most beautiful work experience I've ever seen. Love it. Could gush about them all day. But yeah, like I mentioned, Google also bought Mandiant a few years ago, right? World leader in incident response and threat intelligence, right? And Mandiant's incredible at collecting frontline intelligence from incident response engagements that they see, right? They're responding to, often seeing new and novel techniques for the first time and generating corpuses of knowledge that a user, a customer could use to help inform their threat intelligence program. And Those acquisitions— Mandiant was acquired a few years ago, and starting late last year, we decided that let's merge these 2 products together into one platform. They're highly complementary. They take completely different approaches to threat intelligence. And we realized if you stack those 2 datasets on top of each other, they make both products incredible, right? And we found from, you know, working with a lot of our users and customers, that's the type of experience that they were hoping for, right, when they bought Mandiant. And what we're seeing is that these are 2 primarily B2B platforms. They're very strong, different use cases and workflows, very powerful data, which is the perfect foundation to add more of Google's insights to what they see. We have Tag. We have Gmail. We have Chrome browsing. We have all of these different areas across Google where we can point these insights to, to actually take those insights from these different teams within Google and put it on top of the foundation that we're building on top of VirusTotal and Mandiant. Right. And so it's been a tremendous week for us. We launched that on Monday. You know, still a long road ahead of us, a lot of work to do. Right. But yeah, couldn't be more excited to be part of the team.

So speaking of that and speaking of selling things, you told us the story of how you got into sales.

That's right.

You just did a rotation into PM. Tell us about that.

Yeah. So I'll skip a little bit, but yeah, up until just very recently, I was a salesperson or a business development person. Right. And so I worked at GroupSense, the dark web monitoring company, for a couple of years. Right. And again, Curtis and team and all of our customers trained me up on cybersecurity and threat intelligence. Again, couldn't be more grateful for them. And during that time, we actually worked really closely with FireEye and iSight Intelligence and Mandiant. Right. We were close partners with them. And I got to know most of the people at Mandiant during that time.

All right.

We worked really closely together. And I left that startup. I went and Did some consulting for a while to kind of take what I learned of being the first salesperson at a startup, right? I went to a company called GrayNoise Intelligence. I was there for—

Oh, you were at GrayNoise? That's cool.

Yeah, yeah, yeah. So I was there. I was the first non-engineer to join the team, right? And most of the folks there had never worked with a salesperson. They were pretty, you know, it took a lot of conversations that, you know, like, you're not going to come in and start like ringing bells and stuff like that, you know, and be like mean to our customers or our users or anything. And that wasn't you know, my approach and way of going about it. I didn't have formal sales training. I never rang a bell. If you guys have a bell, would love to ring it. I've never done that. And so at GrayNoise, when I was doing sales, Mr. Bellboy, I set up the go-to-market organization there. And if you're doing sales at an early-stage startup, you're doing product management, right? No one's handing you a price list. No one's handing you a deck to explain the value of this. You're having conversations with customers to figure out what they care about. And if the things that, you know, the couple of folks you work with is valuable and you're trying to map that valuable work with them. And again, only worked at startups up to that point. I was never at a company big enough to have a product management team. And so somebody like showed up behind my shoulder one day, he's like, hey, did you know you're doing product management? I was like, no, what's product management? And they explained it in one pass and I was just like, I don't know what that is. And so anyway, I think it was April Lenhard, good friend of mine. She's an amazing product manager over at Team Cumri.

Wait, she's amazing. I've met her. She's great.

She's great.

She's great.

Hi, April.

I—

and then Scott Shreve, also a former Eyesight guy, he leads product for Nessus Scanner at Tenable. They both turned me on to product management. They got me into some cool, like, training things. And then I started to do product management for a little while at GrayNoise. And then one of the incredible people I met while I was at GrayNoise, her name's Melissa Smith, also a great startup person. She joined Mandiant, joined the office of the CTO, and she started to spin up the business development program there and the partner program there and joined the the day that FireEye and Mandiant split off, right? And so she had an opportunity for me to come on board and started working on OEMs and, you know, doing my business development stuff, kind of taking all that sales startup product key stuff to Mandiant and trying to close deals with other cybersecurity companies on providing our intelligence into their products. And so some time went by, we got acquired by Google and then started working with the teams there and ran into the dark web monitoring product that I used to help and work on, like long time ago where I started my career and, you know, a lot of familiarity and passion with it. And the product leader there, Vijay Ganti, you know, saw I was interested in product and asked me to do a rotation onto his team, take on the product management responsibilities there. And that was about 6 months ago. And so successfully completed that rotation, officially started this week as an official Google PM. Yeah, thanks. Thanks, Tim.

Yeah, yeah.

An awesome ride. Grateful for everyone who's been supportive of that and helping sponsor through that. And honestly, it's an incredible program that Google has, right? I didn't know anything about it. It was funny enough, like, I think my cousin told me about it when I first joined and he's like, you need to go check this program out.

The rotation program?

Yeah, he told me about the rotation program. And so highly encourage anyone who's interested. I know they do it for most of the different job ladders within Google. There's ways to rotate on it. So Anyone who's looking at that in Google or any other company, right, I highly encourage folks to, to give something a shot and stumble into it and go for it.

I love that answer. That's awesome. It's Pride Month right now, and I'd be remiss not to mention how my background informed my interest in security. Are there other parts of your background that made you interested in product or in security? How did this all fit together?

Yeah, for me, I mean, if the beginning of our conversation says how I do anything, I try to, try to rationalize my behavior and People are good at that. Yeah, yeah. I kind of call it spontaneous probabilistic maximization.

Okay.

So yeah, that's— those are podcast words, if I ever heard them.

For sure podcast words. Very good.

And so, you know, kind of just stumbling into different opportunities and different situations and just letting myself feel if it's interesting or not and if it's curious and if it's something that's challenging or scary. And then, you know, asking a bunch of questions, like asking people I know, right? It's very, how do other people think about this? Am I thinking about this the right way? Challenge my thinking on it and then give it a shot. And I try to live my life responsibly. I try to, you know, as much kind of cushion I could create to jump into sketchy stuff, I try to go for that. And so I think one of the things when I think about folks starting their careers or in school or deep into their careers is that if there's something interesting that you want to go into and you don't know anything about it, or you don't think you have the resume or career for it, usually any kind of time I like, you know, jumped into something, it was kind of spontaneous. And there was nothing before that day at the cafe that would have ever told me I was going to go into cybersecurity or dark web intelligence or end up at Google or anything like that. And so for me and my background, right, lots of insecurity, lots of self-doubt, lots of anxiety and whatnot. A lot of it has helped me actually run into different opportunities and kind of make weird jumps that I probably wouldn't have done if I had it all together.

Right.

And so—

I love that.

Grateful for it.

Yeah. Well, Brandon, we're coming up on time. I have to ask our traditional closing questions. One, do you have a tip to help people improve their, you know, how they consume threat intelligence? And 2, do you have recommended reading?

So I think for the first one, what I run into more than anything else is that in order to have a or get a strong start in threat intelligence, you have to think about what you care about most, right? Because threat intelligence, there's a lot of way to spend a lot of money on data, on tools, on personnel, on teams. And if you don't have a strong sense for what you care about at the organization, what the top threats, what the top assets you need to protect, you know, what the worst possible days could look like, right? If you're not I guess spending enough time thinking about that doom and prioritizing like what you should care about, it's going to be very hard to make informed decisions when you start to build that budget and start to spend money, right? And a follow-on to that is continuously be asking that question and continually be asking stakeholders both east, west, north, south of you of what you care about and continuously reprioritize as makes sense, right? There's a very Intel word for what I just said called Priority intelligence requirements, right? It's a very old military concept, right? And I wouldn't say you have to do the Excel spreadsheet version of that. There's some great open blogs out there for folks who have approached that. A lot of intel companies have put this concept out because we all struggle with customers with competing priorities or not really thinking about it in that way. And then recommended reading for me, I've gotten to a place where I've consumed most of the #startup reading, consumed most of the #threatintel, #cyber reading. And like, if I like it or not, all of those books were really helpful. But for me, I'm actually going back into the fiction I missed in like middle school and high school. And so I'm like reading Steinbeck now, Grapes of Wrath and stories like that, East of Eden.

Nice.

And I find those helpful because a lot of the problems that we see now, problems we run into, there's no playbook for it and there's no like a self-help help to get through it, right? And what I find, if I kind of jump into eras past and, you know, think through things in that way, you know, some high-quality literature or stuff like that, I found that to be, be really helpful. And, and it gets me out of cybersecurity and gets me out of threat intelligence for a while.

That's nice.

And then I get pulled right back in.

So, because of course the threat actors remind you.

Well, Brandon, thank you so much for joining us. Listeners, I hope you enjoyed quite a deep dive on threat intelligence, and we'll see you next time.

And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvakin and Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.

Security.