EP209 vCISO in the Cloud: Navigating the New Security Landscape (and Don't Forget Resilience!)

Security warning.

Hi there. Welcome to Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Tim Peacock, the Senior PM for Risk Analytics and Cloud Threat in Google CycOps, and Anton Chuvakin, a reformed, perhaps still reforming analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.google.com/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners all on the Google Cloud Security Community page. Anton, we are talking about what feels like a theme for us these days of resilience. What is it to be resilient?

I think that before we go further, I have to do the whole terrible revelation. Remember, I usually joke about 3 AM? Like, what's my 3 AM answer about SIEM migration? What's your 3 AM answer about GenAI for SecOps or something? So, I realized before recording this that if somebody wakes me up at 3 AM and says, Anton, define resilience for cybersecurity, I may produce a blank stare. I have an answer. I have the morning answer.

But you don't have the 3 AM answer.

I have the nuanced 10-page paper answer. I have the let's discuss resilience answer, but I do not have—

Well, that's no good at 3:00 AM.

Super crisp, can produce it even while asleep almost answer. This bothers me a little bit.

That bothers me too.

And maybe this is not like an ounce of Anton, but—

Well, listeners, you might be worried about what Anton does at 3:00 in the morning, but I'll tell you, listeners, I've lately been getting up at 3:00 in the morning to take my new puppy out to go to the bathroom. So my answers at 3 in the morning are, did you go potty or not? So maybe—

That has to do with resilience.

It does. It's more of a preparation sort of thing so that he doesn't go potty in his crate at 4 in the morning.

Well, according to my boss, namely Phil Dannebels, preparation and planning and organizing yourself is a key to resilience.

Really?

Maybe this puppy theme is on track.

Ah, well, Waffles is demonstrating resilience, listeners. This is great news. Maybe with that great side quest into puppy fatherdom, let's turn things over to today's guest.

Hi, Beth. We're joined by Beth Cartier. She's the VCsiso and the founder of Initiative Security, which provides VCsiso and security advising services. So Beth, thank you so much for joining us. Very excited.

Yeah, I'm excited to be here.

Tell us a little bit about what Initiative Security does.

Sure, absolutely. I think you sort of just nailed it. We provide security and privacy and AI advisory services, focusing mostly on small businesses, and healthcare companies. So really it came out of the need for, you know, I come from a Big 4 background starting in incident response, and then a couple startups in. And as I was talking to a bunch of other startups and advising on certain things, you realize that there's sort of this gap on like on smaller companies, right? Security tends to be very expensive. There's a couple things at play. Security is very expensive. It's also much cheaper, easier, and better if you do it earlier on. So I was at 2 different startups sort of in the hypergrowth phase, and it's sort of by the time you're ready to build a security program, you already have all this legacy technology. and sort of all these problems built in that you then have to fix. So, as I was talking to a bunch of different startups, sort of this need for these services sort of kept popping up. So, yeah, it started out with a couple of colleagues and sort of former colleagues and I, and then along the way, we just sort of started working together and conversations became sort of more business-related, and here we are.

By the way, somebody— you mentioned this security program for startups. We had somebody who works in a similar role and he had this rule of thumb. By the time a startup realizes they need a security program, it's always Yes. So, this is kind of— it's stuck in my head since that time many years ago that it's like, by the time they know, you need to roll back a year, and that's when you start. Yeah.

By the time you know and by the time you can afford it, and that's part of it too, is like by the time you can afford a full-time staff and can budget for that, it's already been built, right? You're in flight. That means your business is doing awesome things. It means you're in a really good position. But from a security perspective, it's like, wait, wait, wait. Let's take a second and reframe.

So, I had a bunch of friends who are VCs. I worked for Gartner, and some of the ex-Gartner people ended up being VCs. So, I kind of keep track of the profession, but I know it's a very popular endeavor these days, but how is it going? Like, is it becoming more popular? Do people need more vCISOs? And how does cloud change it, by the way, if it does?

The only way I would say cloud sort of changes it is a lot of the vCISO work is done for sort of smaller companies or startups. So, and a lot of those companies, for practicality purposes and for a lot of other reasons, tend to be cloud native or a lot more in the cloud. So, I think there's a lot of overlap with the vCISO services and folks that are building in the cloud. I think if you're dealing with a large sort of on-prem company, they hopefully have a security program and they've been a bit more established. So we do tend to focus on, again, those smaller companies that either can't afford a full-time CISO or, again, are sort of just beginning to touch into that sort of absolute need for the more privacy and legal services and that sort of thing.

So you expect it to be more on the cutting edge than, say, a mid-sized but traditional company CISO. So that's actually a good sign that you would be ahead of the curve compared to, say, a CISO of a mid-sized But all the company.

Yeah, I think everyone likes to think they're on the curve. Everyone's just, everyone's disrupting, everyone's doing the next big thing. So hopefully, like, my clients are doing the next big thing, and it's a really fun way to, like, stay abreast of technologies and, like, especially in the AI space, like, what folks are doing and what they're talking about and how they're thinking about things, or how folks not in AI are applying AI. So that is a good way to stay on the cutting edge. Unfortunately, some of these companies will not survive, but some will definitely become huge, some will get acquired. So it's sort of a very big and moving space, but you are definitely constantly constantly learning, you're definitely staying up with trends, but, you know, the more things change, the more they stay the same. So it's sort of, we've solved a lot of these problems over and over and over again.

So building on your earlier point, you know, we hear so much about AI and cyber and resilience. These are all really hot topics these days. In terms of, in the context of like cloud security, how are you seeing these organizations that you look after from a VCs perspective? addressing these trends? Like, are they being managed effectively in the cloud, or is security playing catch-up to your point about, you know, smaller companies perhaps not necessarily having the resources to really build securely from the outset or implement those good practices until they're a little bit more established?

Sure, that's a really great question, a really big question, because I think, you know, cyber resilience and AI, that's pretty broad. But I think, so let's start with cyber. I think that there's a ton of opportunity with cyber in the cloud, in the smaller companies especially, but in the cloud generally. I think the focus in the cloud, we're looking more at IAM, more secure browser. And I do think it's really interesting. IT and security have tended to be sort of at odds over the years. Obviously, there's been a trend where there's so much more overlap.

Mm-hmm.

And I think you're seeing the smaller companies, if you get an IT team, or usually it's like one IT person who understands the basics of security, or is at least curious about it, they end up in a much better position than a company, even if they have an IT person, that isn't thinking about this at all because there's so much overlap, even like in your email security, if you're using Google Drive, Workspaces, that sort of thing, how that's managed there. Looking a lot more identity and access management, which is obviously way better if it's built from the beginning. The cloud really opens up a lot of opportunities with secure browsers.

Mm-hmm.

And like really understanding that for like DLP. And that's a really neat technology that's coming up that I think a lot of folks are using to manage some more classic risks. Resilience, huge topic. Super, super fun. So I started in incident response and like resilience and sort of that that topic has changed so much. It used to be like when an incident would happen, like you'd show up with like your Pelican kits and like you'd image everything and you'd be there for hours and, you know, thousands and thousands of dollars to image everything. So incident response has definitely changed. Incident preparation has changed. So if resilience is how you're able to sort of prevent, manage, and sort of reduce the impact of breaches, I think the cloud has a lot of opportunity there as far as really be able to sort of segment effectively. But it really is a team-based activity, right? Like you need to have like your devs on board if you're looking at infrastructure as code, who owns those systems. One of the best things about cloud is I think the ability to do backups is much, much easier and manage those backups, take those backups. But you need to have the business understanding of, you know, what are you backing up? What do you need to back up? Where are those dependencies? And really be able to work with those teams of like, if something happens, who's responsible for these teams? Who knows where these backups are stored and how to restore them? So tons of opportunity there, but again, definitely a very team-based exercise. And then with AI, AI is, you know, A huge topic. Everyone loves it. It's sort of everything right now.

Everyone loves it?

Wait a second.

Everyone loves AI.

I mean, what are you talking about?

Didn't you just have somebody come to us and say the most important problem with AI is how to turn it off on a product?

Yeah, it's true. Because it's a security concern.

For sure.

Yeah.

But my mother asked me about AI, and if my mother knows about AI—

She wants to turn it on, not off though, right?

What's this big red button? It says AI on it. That's actually, I mean, There's definitely tools in every environment that now have AI that like, oh, it's an approved tool and now they have this functionality. So I think when you're looking at like third-party risk of AI, that's huge. That's obvious. That also comes into play obviously when you're looking at ChatGPT and personal use of this stuff. I think security missed a huge— when you asked, you're talking about, you know, security sort of leading from behind, how does this change in the cloud? I think the best teams I've seen working at all size companies Whether it was legal, security, even product, someone took a lead and was responsible for figuring this out, setting parameters, saying, hey, this is our policy. The policy might change all the time because things are constantly changing, but at least someone was making rules and saying, hey, this is our culture, this is how we're thinking about it. This might change, but this is what we're doing. And I think security really oftentimes sort of missed a boat there because—

Often? Meaning, like, there were cases when they didn't tell me those? I wanna put them on posters and print them.

I think security can be, I think there are gonna be definite benefits for security. That said, I'm not sure if security is really great at using the technology we have so far, right? And to use AI effectively, you need to get your hands around your data, which obviously we know is a really big problem. But I think there are some really good applications for security, and I think we should be excited to use it. I mean, compliance, that obviously falls under the CISO role as well. If we can automate compliance, if we can automate all of sort of the questionnaires that go back and forth and third-party risk stuff.

This is the topic that comes up for the third time in a freaking hour.

Really?

Questionnaire filling during the roundtables we did at the event, questionnaire filling came up. But then somebody, I think, said, what if the vendors create the questionnaires using AI and then the customer fills the questionnaires using AI? Do we really need the questionnaires?

Then it's just AI talking to AI.

But this sort of goes to an issue that we have with compliance, I think, anyways, is when you're talking to, like, the front office people, like, if you're dealing with a client and, like, they are giving you these questionnaires. So often, especially smaller companies, you get this access where, you know, you're answering the questionnaires and they're very, very strict about the answers to the questions and you have to have no vulnerabilities in your system and all of these very strict questions. And then when you talk to their client outreach teams, they're like, great, we're just gonna email you this list of Social Security numbers, right? Like huge splits in an organization.

Yep.

And that actually goes back to the resilience thing. How well are your internal teams talking? Is the left hand talking to the right hand? Are you mitigating risk across the entire organization? And I think AI is one of those places where maybe your legal team says, nope, we absolutely can't use that. And the devs are like, yeah, but ChatGPT is great and I'm using that for this and Gemini is great for this, so I'm using that. So I think it's that sort of misalignment because AI is definitely getting used. Your clients are using it, like your vendors are using it, your devs are using it, your content people are using it.

So your legal is using it and then banning it for others.

Legal's definitely using it.

Okay, Marina, cover your ears.

No, no, but it's true. It's true because we were, We were actually talking about on one of the earlier discussions that there's actually surveys out there where CISOs— what was the percentage? It was like 2/3 of CISOs strongly feel that non-sanctioned AI is being used in their organization.

Yeah.

So there's certainly this realization of either consumer-grade products or enterprise-grade products that haven't gone through the governance forums to be reviewed for particular enterprise use cases. are already being used because they're viewed as being in furtherance of business activity. And they're either sort of intentionally not being flagged to the governance committees or are flagged and very quickly risk accepted because they're deemed to be critical for whatever function they're serving.

Yes. And I think the big thing here is like business is gonna business, right? If security says no, if legal says no, like the business, it's not a matter of like, hey, can we do this or should we do this? It's a matter of, hey, we are going to do this. And then it's just like, and how do you mitigate that risk, right? It's working with the security team, the legal team, all those different kinds of risks that you have to say, like, how do we, whether it's education, user education is a lot of this. I really think that if you give teams a way to do their job safely, most people want to do the right thing, right? But you have to tell them how to do that and explain why the risks exist. But yeah, security's always saying, no, they're gonna do it, especially now you're cutting costs, devs are trying to go faster, everyone's gonna do it faster, more efficiently. That's cost savings. Tell me a security team that can be like, hey, we've saved costs lately. You're never going to win that argument. So it's definitely a developing space, but a lot of fun because there's so many possible applications for it. I think it's a huge game changer.

Yeah. I mean, that came up again, some of these. We've been trying to kind of extract use cases for AI for security during some recent events. And it's interesting that the topic turned to CISO personal use cases. And one person brought up a case when before presenting to a board, he tests the arguments on an AI bot and sees what sort of effective counterarguments they can bring up. And then he practices. So to me, that was very eye-opening because when you think about the use cases, you assume that it's either some data analysis or report summarization or some kind of something to do with SOC. And then it's just about human communication refinement and then turning your argument into something more bulletproof, more logical, more clear. By communicating with the bot. So to me, that means that a lot of lateral thinking is ongoing and some of the use cases are not what you think they are. They are somewhere else completely.

Yeah, it's explained to me at this level. What are the issues you would have with this? It really becomes a sounding board and such a friendly sounding board. It doesn't get exhausted, it doesn't get tired, and it really does have some like, oh, I haven't thought about that, or at this level I wouldn't have framed it that way. So yeah, I think there's really novel use cases that everyone comes up with. And I always say sort of as a security person, like my security team is never going to know how to do the other team's jobs for them. So I always say like, if you can just be a little bit suspicious, you know, we don't have to be suspicious all the time. But that goes to AI too, right? Like I will never understand fully how you're gonna do this. I cannot imagine all of the use cases. All I can do is try to educate and say like, hey, these are the risks, you know, let's work through them together.

So, you made a very interesting point in the beginning about security leading from behind. And I was about to make snide remarks about how leading from behind, by this, you really mean being dragged behind, not even following. I think that there's leading from behind, there's following, and there's being dragged by the business like a tail behind them. But here, we are still in that domain where the conversations seem to have been the same 10 years ago, 20 years ago, and maybe I'm not old enough, but maybe even more years ago. So, security needs the seat at the table, but we still sometimes don't. And so, how do we, you know, break the silos? How do we regain this? Like, I feel like we're in the '90s having this discussion, but it's still a question today. So, help us here.

I'm not gonna cop to having these conversations in the '90s. I think I was talking with Hootie and the Blowfish in the '90s. So, I think security definitely, and I think the more mature organizations, you see security having more of a seat at the table. I think there's 2 sort of major reasons why the security doesn't have that it necessarily should. One is I think if you're dealing especially with smaller companies, if they're seeing every cost as existential, security is definitely still seen as a cost center. If you can spend a dollar on marketing that makes sure your business still exists next week, that's gonna always take priority. But on the flip side, I think that security, even at your more medium and large organizations, when it's having a harder time getting purchased, it's like, hey, I think we get too technical when we talk to executives. And frankly, people don't care about what endpoint solution we're using. Nobody cares. So why are we still talking about that? And I still think it's very hard to explain cost savings. It's one thing to say, how do you explain if you've had no incidents? That's great. It's great. Let's cut all the funding.

Cost avoidance.

Cost avoidance. But what did you avoid? And I think security was so expensive for so long. We've all been to the security conferences with the very fancy water and this, that, and the other thing. Well, that's coming from somewhere, right? So eventually you have to start explaining all of this money. And as a security person, you're always just going saying, hey, give me more budget. I think that's a harder conversation to have. So I do think security needs to, when you're talking about how to move forward, I think it's really understanding how to explain security's value to the business. I think there's 2 ways to do that. I think one is at the executive level, find the people who, different executives and different board members care about different things, right? Speaking their language. What does the CEO want? What is the product strategy? What are their concerns and how do you meet them at their level, right? So, that's gonna change organization to organization. And then internal to an organization, it's just like, what's your internal culture? How do you use that culture to change it, right? I think I'm hilarious, so I tend to try to use humor. Maybe that works, maybe it doesn't. I think it probably depends. My dad thinks I'm hilarious, so that's good. But, you know, how do you use that internal culture, right? Like, do you get the executives involved? Do you find champions at lower levels? Do you work with engineers who are on your team? sort of team per team champions. Like, do you work with the sales team, right? Where are the people who care about security and how do you spread that message? So I think you sort of have to, hopefully it starts at the top and it's like, sort of just changes culture from the top down. But if you have to work from the bottom up and really sort of influence at all those levels. And then also just like really explaining security as a risk. How does security talk to your overall valuation as a company and really be able to speak to like the understanding of the costs associated with the security and explaining how to reduce overall risk because of that.

Has cloud made it easier because somebody else carries the heavy load, like the cloud provider? Because the context for this, and it's kind of off-script in a sense, but I've met people who are actually more troubled with building bridges to the business in the cloud era. And initially, I thought that's not very logical. I thought that cloud would raise the importance of risks in the minds of the non-security, non-technology executives. But it turns out that because of some misconceptions, like, oh, yeah, what do you mean security? We moved to cloud. We are secure now, or something of that sort. How does the cloud affect this debate, conversation, if you can share some views on this?

Yeah, for sure. I think the whole shared responsibility model is something that we work with on a regular basis. And I understand that if GCP's job is to secure the overall infrastructure of the apartment building, how you put the keys on your door is sort of your responsibility. But folks are like, oh, we're in the cloud, we're secure, they're taking care of it. Google's security team is fantastic. That's what they do. Well, you still need to lock your door. Same thing with compliance, actually. If you work really hard and you say, oh, we're compliant, they say, oh, we're compliant, we're secure. And I was like, no, no, it's part of the journey to get there, but they're not necessarily the same thing. So I do think the cloud, like, while it does actually offload some of the responsibility because you're able to do more security by default, if you're able to set settings, you can do more security by design in some ways.

Mm-hmm.

So it does give you ability to manage it on a more foundational level in a clearer way. But you do have to continually explain that, like, no, we do have our own responsibilities as well.

Can you use the hot topics to drive that messaging? So I'm wondering, for instance, if in a traditional setting, explaining security to folks who don't necessarily, who aren't interested in it for the moment, for instance, is kind of a difficult lift, right? But can you use the emerging tech that we've seen come out, let's say AI as an example, to drive that conversation? Because actually, when you talk to people, when you say, what is your biggest challenge or concern about AI? 9 times out of 10, it's going to be security/privacy. And so does that give you an opportunity to then educate them in terms of security best practices using that emerging tech as the way in and then broadening the message and driving the culture that way?

I will take every opportunity I can to bang the drum, right?

So basically, your answer is always yes.

Yes, absolutely I will.

Can I use this?

Yes, I will.

Yes?

Yes. But that question is sort of predicated on the fact that people care about security and privacy, right? So often when you talk to folks about privacy, especially of, I wanna say younger generations, although that's actually changing. But so it's like, it's already out there. Like, who cares?

And they put it out themselves.

Exactly.

Right.

So I think the relationship to privacy, I think, is different. I think enterprise privacy is a bit different, but that's a really great question. Is your CEO worried about financial and business information or are they worried about their client information? So it can be a little bit different person to person, but yes, I will use every opportunity to, explain technological ideas, to explain philosophy, like, anything that can come through, I will definitely use that opportunity.

So, maybe even broader than this. So, when you encounter an organization when security seems to be, well, quote-unquote, falling from behind or being dragged behind, so, what are the approaches or maybe tips that you found that work well in elevating the importance of security, including cloud, but I don't wanna obsess about cloud in this case, within organizations. So, do you have, like, a list of your favorite things that you would use to sort of either reintegrate or elevate the importance of security? I think it's a tall ask. So, maybe I don't expect, like, you say, oh yeah, there's a secret, do this, and everybody's like, oh wow, she just said that, we'll do that.

Yes. If I could do that, I would happily do that for free everywhere because we, you know, I do think, like, a rising tide sort of raises all boats. And I wish I had an answer. I think we touched on it a bit earlier when we were talking about, you know, really speaking at the risk level, communicating about the overall risk to the company, and understanding what they care about. Again, going back to that existential risk. If the business doesn't exist, there's nothing to secure, so sort of what's the point? The other thing I actually have had a lot of luck with is really meeting different departments where they are. So at one of my previous companies, I had this wonderful group of executive assistants I was meeting with. They all happened to be probably in their mid-20s, they all happened to be female. And we were talking about where it was appropriate to store information. And I was like, okay, ladies, if we were at a bar together, would you give my phone number to a stranger? And they were like, absolutely not. And I was like, great, awesome. I was like, so therefore, why would you put it here? Why would you give it to these people? Like, oh, that's a really good point, right? So really breaking it down into concepts that folks understand and have familiarity with, whatever that is for any certain group of people.

Mm-hmm.

That sort of communicating and really meeting people at their level and not expecting them to meet you at your level, I think really helps.

I think that that context is really interesting too, because it's also taking it out of the enterprise setting and making it a real-world situation. If you ask anybody that question, I would hope the majority of folks would answer it the same way. How does that change? I mean, the tone and context is important, right? So there's driving the messaging within your organization. There's also driving the messaging when it comes to peers, which is going to be a different tone, right? and also up to the board or to regular or to external parties. Do you take the same approach? Do you also kind of go for that collaborative view and also trying to meet— the board will have different things that matter, different priorities, right? Not necessarily different things that matter, but different prioritization of the things that matter than, for instance, peers within your organization. So, do you take that same approach of trying, like, Do you kind of build consensus within the organization and go to the board together, or do you just try to revise the messaging to something that's more aligned to their particular priority to ensure that you're speaking the same language?

I think it depends on the individuals that you're dealing with, and I think it depends on sort of the direction and prioritization of the board. I think one thing that security people suffer from, like myself as an example, like I started in security doing incident response. So like my first 5 years was just watching bad things happen. So like my perception of risk and my interaction with risk is going to be very, very different. So, you know, they're saying like, oh, that's never gonna happen. You can— I'm like, it always happens. That was my life, right? But you can point to some of the larger breaches and say like, hey, this does happen and sort of draw on those examples. I do think when you're talking to the board, and I know again, like security folks or technical folks tend to go too technically deep, Nobody likes to feel ignorant. Nobody likes to feel like out of the loop or talked down to. So I really do think it's communication. Like the point is to get your message across and however you have to do that is meeting them where they are. What do they care about? Like why are they there? Some folks are gonna be savvier about security. Some folks are gonna care more. Some folks aren't. Meet them at their level and go. As far as like messaging together, hopefully you're able to find the people at your company that you work with on this stuff. And so you can reflect each other's priorities and you shouldn't be so siloed, right? That's sort of the scary— When we used to do incident response preparation, You'd go into folks and like you'd be running a tabletop exercise and they'd be like, oh, you know, hi, I'm Carla, I'm the general counsel. I'd be like, oh, I'm Mandy, I'm the SOC leader. I'm like, you've never met before, right? So to really break down those silos, like you should be having that same message. You should be able to sort of overlap a little bit when you go and have those conversations.

All right, so I think we're coming up on time. This has been a really fantastic discussion, but we have one more question for you before we let you go. Kind of a lightning round, so very quick. What tips would you have for cyber professionals in terms of staying on top of these developments, being able to provide that type of broader guidance to their stakeholders, whoever they may be? Like, do you have any like go-to resources that you found to be really helpful?

Sure. Not to, I mean, we are on a podcast, so I would have to say podcasts, but I do think for some of like, especially like learning, it's great to read about some of this stuff, but sometimes it's great to like hear different conversations about some of the more cutting-edge trends and sort of how other folks are thinking about it. I think communities are huge for security folks, CISOs, communities, but there's so many security communities that are not just at the executive level, which I think is great because I think we need to have, you know, the next generation coming up behind us. Again, new problems are the same as old problems, just repackaged slightly differently. SANS is obviously a great resource when it comes to straight security stuff. Talking to folks like Google because there are so many conversations, and as a Google customer, being able to sort of embrace that. And a lot of the communities that some of like the vendors have, and obviously Google has, has are really, really priceless.

Perfect. Thank you very much for this. Really appreciate you being on the show and, of course, your advice. And I want to make a super short summary is that some of the stuff you mentioned, people may have heard before, but I think that it clearly works if you work it well. So, like, for example, security, you need to learn the business. I bet I can find maybe a 1990s book that said that, but the number of people even today who actually do that is it's kind of not that high. So I feel like the advice was the right one, and the advice that you confirmed is the correct advice. It's just like doing it is a little unpopular.

Yeah, it's hard, right? But I think slow progress is still progress, right? And I think that's part of it too. You're not going to fix all these problems in a year, and even if you did, there would be a bunch of new problems, right? There's new people, there's new communication issues, there's new technology. So I do think it is a process. I think in security we're getting better at being more holistic about this stuff. I really think we're communicating better, you know, but then new technology comes along the way and screws everything up.

It keeps things interesting.

It does.

Thank you for this opportunity.

Thank you so much for having me. It was lovely. Thank you.

Thank you very much. And now we are at time. Thank you very much for listening and, of course, for subscribing. You can find this podcast at Google Podcasts, Apple Podcasts, Spotify, or wherever else you get your podcasts. Also, you can find us at our website, cloud.withgoogle.com/cloudsecurity/podcast. Please subscribe so that you don't miss episodes. You can follow us on Twitter, twitter.com/cloudsecpodcast. Your hosts are also on Twitter at Anton_Chuvaikin and TimPico. Tweet at us, email us, argue with us, and if you like or hate what we hear, we can invite you to the next episode. See you on the next Cloud Security Podcast episode.