EP223 AI Addressable, Not AI Solvable: Reflections from RSA 2025

Secure running. Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us for a special RSA 2025 recap. Your hosts here are myself, Timothy Peacock, the Senior PM for Risk Analytics and Cloud Detection and other things in Google SecOps, and Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us, and the rest of our Cloud Security Podcast listeners all on the Google Cloud Security Community page. Anton, we remarkably still have our voices.

I almost don't.

You almost don't, but I do.

Yeah. We are here at the of late middle of RSA. We're recording this on Wednesday. It's not a big secret. And at this point, we are still processing all this hype and all the reality and all the observations we've made.

A lot of hype.

A lot of hype.

Yeah.

So let's go try handling the things we've seen and the scary thoughts they produced.

We had some scary thoughts.

We had some scary thoughts. So let's— I mean, I think the reason why we start with AI is that I was coming into the show thinking AI would be staring at me from every booth. Every vendor would repaint whatever they do as AI. And weirdly enough, when we were walking the show floor on Tuesday, it wasn't that overwhelming. I know it sounds kind of weird, but maybe I expected it to be everywhere, and it was in many places.

It was in many places for sure, but it wasn't punching us in the face as we walked down the aisles.

Yes, but we also kind of expected the punch. So at this point, I don't know.

Yeah, we were bracing for the punch. We were walking around sort of cringing and nervous the whole time. We survived without too much AI, but I think what we both didn't find, in addition to AI punches, was real AI success.

I'm going to have a sad, dramatic pause right now.

That was very sad and dramatic.

That was very sad and dramatic. You've heard that. And I feel like we are still exploring. Remember at the RSA '24 recap, we had this explanation that a lot of messy AI messaging and stories and attempts to make things is the discovery quest. for solid outcomes. Deep in my heart, at RSA 2024 recap, I expected that in a year, we will have that in evidence.

And we don't.

And we do not.

And so, what are we going to say in a year at RSA 26 recap? Are we going to say the same thing or do we expect it to be different?

I am a weird paranoid optimist.

A paranoid optimist. Okay.

Interesting. And I expect next year to see some robust outcomes produced by AI in security. At this point, we've seen good ideas. We've seen attempts to apply it. We've seen maybe decent attempts to apply it, but I don't think we've seen solid outcomes. And by the way, not just game changer outcomes, like solid, robust, we had this security thing, we added AI, or we reimagined the thing with AI. And it's just now dramatically, measurably better.

No, that is 0% of what we saw.

I'm going to make another sad, dramatic pause, but I agree.

Yeah, no, it was— we didn't see the steak. We didn't smell the steak. But there was a lot of sizzle.

And there is promise. I don't want to be like— we are not AI skeptics. Tim works for the Google SecOps. Google SecOps uses AI. for a few things that are quite effective and good.

And I think there's a reason we feel next year will be different, which is the dramatic increase in context window and the dramatic decrease in token cost that we've seen over the last 12 months. So conditions are meaningfully changing.

Correct. But also, many people are trying, and some people would try and fail and generate trash.

Eventually somebody will get it right.

Eventually many people will get it right.

Oh, that's interesting.

Yes, I think eventually many people will get it right. Like, there are many startups, there are many large companies. And many are exploring, many are trying pretty hard. Best of the best engineers, not only at Google, but elsewhere, are applying GenAI and other AI models for security. We will see stake.

Yes.

Yes.

Eventually. One of our guests today actually had a nice framework for talking about this. Do you want to share that framework? Because you're the analyst. You should talk about the framework.

Yes. This was actually interesting because we talked about MDR, managed detection response. That's substantially powered by AI. And of course, the role of humans came up. And if you believe the marketing of some AI SOC vendors, more on them in a moment, it sounds like humans aren't that important. But our guest at the podcast has said that the problem was AI addressable, but not AI solvable, which is stuck in our heads, obviously.

Yes.

And we think that AI help can help quite a lot, does help in case of Google StackOps, but It isn't going to solve the problem for good.

No.

Like, humans aren't going away from DNR. Their roles are changing. Their roles are maybe dramatically changing, but I don't think we are anywhere near fully automated SOC.

No.

SOCware, no, there are no humans.

No, no, no. And I will say there are way more car manufacturing jobs than there ever were carriage manufacturing jobs.

Yes, correct. But that argument works every time until it doesn't. I feel like this argument is good up to a point. And I am the— I think it's a long story about how to predict the future the best way. You just extrapolate the part past would stay, and you would win a lot of money if you bet, but then you would lose.

Well, this was your analyst betting.

Correct. That was my analyst betting where if you bet that things would stay the same, you would win, but eventually, you know, you would lose.

So speaking of things that we get to be justifiably skeptical about, what's our conclusion on AI SOC versus SOAR? And will AI SOC truly Take us beyond what SOAR was able to do.

I mean, this is really good because at this point we've spoken to some AI SOC vendors both at the show before after, and my impression was that for some of them—

Dramatic pause.

Oh, dramatic pause. That's right. Sorry, but it's not going to be a sad dramatic pause. It's going to just be dramatic pause.

Dramatic pause. The answer is probably not take us beyond where we're at.

Some of them require a SIEM, a SOAR, and a team to then use your AI SOC software.

Yes.

So, in light of that, when we drill down into one vendor-specific story, they don't produce any kind of automated remediation. They give guidance. LLM says, hey, you guys should consider doing blah, blah, and blah. And then humans have to figure out whether it works, whether it could blow up the environment, how to do it, and all the other stuff. And they said, yeah, eventually we're going to have a button. And I'm like, I'm getting flashbacks to SOAR 2015. That's how SOAR started. Those buttons are never pushed. Or very rarely pushed. And some of the fully automated playbooks ended up being in niche use. I'm nervous because I see the AI SOC vendors repeat the— not the mistakes.

No, the mistakes.

Yeah, they repeat the patterns of source.

Trend in the same direction.

Trend in the same direction, right. So it is not a magical direction. It's a direction to friction and some pain and some value as well. But ultimately, it's not going to be as magical as they say.

Yes.

So, to me, I want to use that technology. I want AI for triage. I want AI for detection engineering, detection rule creation. There are robust use cases that are emerging. But AI SOC as a vision where there are no humans, I'm sorry, but it's complete BS.

Complete BS.

Based on the data we are seeing today. Based on the data we are seeing today, complete BS. Yeah.

This is the second time I got to see Anton today use the phrase complete BS. He said that to some poor kid I saw a kid working a booth earlier today, too.

And later I spoke to his CEO, and it's an absolutely impressive company with a really good, promising AI use case. So we'll talk about them later.

Did you feel better after that conversation? Because I had to leave.

I stayed for half an hour talking to him.

No way.

Yes.

Oh, my God. Listeners, this is blowing me away. I just learned this, and honestly, I thought Anton was going to, well, tear them a new booth. It was crazy. You heard something even more out there than what that poor booth person was trying to tell us, which was from a bank.

Yes.

Tell the bank story.

So, this is the bank story is I'm going to obscure some details because I got it from—

Yeah, yeah, yeah. We're going to have some Chatham House rules here.

Yes. The story was that there's somebody's IT leader, presumably a CIO at some financial company. I honestly don't know if it's a bank.

A financial company.

Developed an impression that because of AI rapid progress, in a few years, he would have a technical team of zero people, which means that his or her impression was that you would not need technical people in a few years because AI would do all that work. And I don't mean like security technical people, like technologists at all. And it just— I was asked to comment on that in a semi-public venue, and I had to Was that hard for you? Yes, it was very hard.

Yes, you had to bite your tongue quite a bit.

I had to do deep breathing exercise for a few moments. But ultimately, I wanted to have a substantial response to this without using the word like—

Idiot.

Idiot, yes.

How do you do that?

I feel like the way I did it is created a framework on the fly, which involved rapid progress in AI, which is pointing in this direction. lack of progress in certain large-scale IT management projects, like, say, tribal knowledge in human heads, not in any kind of machines. And the fact that many bits of information aren't in any digital systems at all. And to manage IT, to run technical processes in IT, you have to deal—

At any scale.

At large scale especially, but you're right, at any scale. You will need to deal with things that aren't in computers at all. So, AI today, in theory, can pick up the phone and call a system admin to check whether he knows something. But at this point, that's not being considered. So to me, I was balancing the fact that rapid progress may lead some people to believe that, but the fact that a lot of IT is mired in inertia. Large company IT is mired in 1970s processes and sometimes technologies, mainframes.

Yes.

And imagining that all of this would be gone because AI is better. is quite absurd because it just won't connect. Some systems are snowflakes, not in the vendor sense, but they're made by humans. And it's hard to imagine how they can be robustly controlled by robotic systems, by AI. So to me—

So this is a good depressing take. I like this.

I think it's a good depressing take, but it's actually funny enough. If you want to have peak depression, you'd have— it's depressing because AI progress would not help you, but ultimately you would be dealing with some past issues in the future as well.

Yes.

It's kind of a weird combination.

So, speaking of past issues in the future, we also had the impression that a lot of things that we thought were dead, in fact, will never die.

Correct. And I think that this is an interesting point. We were walking around looking at some vendors and we were recognizing some names that perfectly competent security manager working in a 1990s bank would recognize. And even maybe not at a bank, even at some other regular company, if you look at what information security technologies your fathers and grandfathers used in the '90s, you would see some of the same vendors doing largely some of the same things. And again, it goes back into the same bucket, rapid progress of AI versus legacy.

Incredible inertia.

Incredible.

In the tools that companies choose to protect themselves with.

Yes. And I think that it's the story. Why?

Why don't companies switch to a more modern solution? Why would you still use third tier or a decade ago's third tier AV when modern AV or EDR— sorry to you for creating EDR— exist? Why do companies do this?

So I'm going to quote my Deloitte colleagues who actually shared with me the concept of capacity for change or change budget or change sort of like a fuel tank for change. And what they described to me once, and we mentioned in a paper we wrote with them, was connected to the fact that if you have a large company and you just replaced your IAM, 1980s IAM, with a modern IAM, whatever that is, and now you think, hey, let's do the same for SIEM, you realize that you run out of change budget. You run out of change willingness. And I found the concept to be quite absurd for the first 5 seconds. And then, as they say, I was enlightened. I was enlightened because that's absolutely true.

I never thought about that.

Change is hard. And if you don't change, you run out of willingness to change. Changiness. I don't think it's a willingness. It's something more a bit mysterious.

Capacity for change.

Capacity for change. Yes.

Yeah, yeah, yeah, yeah.

And so if you replaced your antivirus, then your firewall stays in the '90s, at least for some time.

So then could we perhaps infer which security technologies are most important or most vital to organizations By observing which ones get changed most often?

No. And the reason is that some of them rely on IT changes, which we can't control. So it's not just security change capacity, it's also IT change capacity, which also may be business change capacity. So I feel like some of the stuff would need to be gone all the way down. Imagine, like, we sometimes make this vague and ultimately correct boastful point about how Google is superior to many companies, but ultimately we have a lot of stuff that we build by hand. Chips. Titan chips, servers, other stuff. A lot of our stuff, a lot of our security magic works because our IT under it is different.

Yes, that is true. And you can't just take those things and slap them on a company and say, now we're magic.

Correct. And that to me is where capacity for change plays. We've changed these things.

So, you're telling me that third-tier, 54th-tier vendors can stick around simply because their customers Can't change too many things all at once.

So 54th tier SIM vendor was a typo. So please don't quote this to me ever again, but I, I, because I'm gonna have nightmares of somebody thinking, hey, I'm gonna buy the 54th tier SIM vendor and protect my company really well.

But really that's what's keeping these people around, you think, is capacity to change is limited. And once you get into enough enterprises, you can simply persist.

That is my suspicion. And I don't think AI changes it in any way. But no 54th tiers in vendors, please.

Wow.

I mean, you wanted a different kind of depressing thought, and I think that's exactly it.

That's depressing. Wow. I've been depressed in a new way, listeners. I didn't know that was possible.

So people who are experts in, I don't know, COBOL and Windows 2003 and something else probably has a job today and may have a job in 5 years.

Terrifying. Terrifying. Okay, a cheerier topic, AI security.

It's a cheery topic, but I also feel like that's the topic I did not see enough of.

Yes.

Sure, we've seen the big news with some companies being acquired, some companies that help protect AI, perhaps.

I see what you did there.

And there are also larger companies. I think we mentioned it on our booths, some of the other—

We talked about it during our demo at Cloud Next. We talked about Model Armor.

Yep. And it was not something that I've seen a lot of. And it probably means that the buyers or the buyer influencers just aren't ready to part with money to protect AI projects and workloads and efforts. I don't know.

But is that actually a good thing? Because we had that whole other conversation earlier today about why the WAF model is the wrong model for protecting AI. And it seems that our industry kind of has this You know how nature likes to evolve into crabs? It feels like our industry likes to evolve into middleware boxes. And it's almost a good thing that we're not seeing that here because we talked about why that's not the correct approach.

I don't know. That one gets a little really esoteric really quickly because a lot of people do assume—

Oh, you think making a reference to how nature likes to evolve into crabs is esoteric? Yes, I agree. But listeners, if you don't believe me, look it up. It's called carcinization. And many of the things that you think of as related crab species have evolved independently into the shape we know as the crab. Fun fact.

So it is esoteric. And it's also esoteric because why everything eventually becomes a firewall is— I mean, I'm sorry, Tim, but this is a depressing thought that actually finally got to me.

Did I get to depress you?

You really did get to depress me. Wow, yes. Okay.

That's a win.

I mean—

Usually it's the other way around.

It becomes— what do you mean? Like every security measure becomes either a firewall or an endpoint agent?

I think there's a tendency for our industry to evolve solutions into things that look like firewalls. Yeah. I mean, that's the story of the WAF. That's the story of email filters. That's the story of the firewall and the IPS and the IDS. Corelight had a big booth this year. I mean, there's a tendency in our industry to evolve into something that you plug into a network.

Sure. And I think that we also, in one other special we recorded on AI red teaming, the point about filters and their pervasiveness came up. People may want to have an input filter. People want to have an output filter. But ultimately, we need to remind them that if you have a really great input filter and a really good output filter, you are not done. You have not solved the problem.

What was the quote? The quote was something like, in application security, 99% is not a passing grade?

Yes, that was the line. I think we need to find the source for who said that, but it's the interesting bit. And to me, that was quite striking. I do expect to see a lot more securing AI in the coming future, both from us and from others. And I hope we won't have the All firewall all the way approach.

I hope not as well. That would be very depressing. So this is the Cloud Security Podcast by Google. What cloud things did we observe?

I would say that there's a decent chance that we'll just obsess about Wiz for a few moments and call it a day. We did see some of the maybe more niche markets. There are still vendors who do maybe ITDR in the cloud or My least favorite acronym, KIM, a few others.

What is KIM? Remind our listeners what is KIM.

You know, it's the Cloud Infrastructure Entitlement Management.

How is that KIM?

Because it starts with a C. It can't be SIM because there's already a SIM. Okay, but it's like, I can blame my Gartner colleagues, but pretty much every acronym, every cloud acronym has to start with a C. So that's why it's a KIM. It makes absolutely no sense.

Depressing.

In any case, I just feel like we are in the platforming stage of cloud security, and Wiz is definitely a very visible presence. There would be startups that deal with specific problems that emerge, but for some of the hardcore problems across clouds, Wiz is probably the answer.

Well, we would say that now.

You would say that.

We would say that. I do want to talk about their booth.

Oh, God. Amazing.

Amazing. But did it say anything about what they did? It did not. And I think what's so interesting, having worked on a booth a long time ago, is when you're building a booth, you have all this challenge of how do I get my message through the noise of the show floor? Everybody's booth says AI, everybody's booth says we're the best. Some of the booths say we shred adversaries, some of them say we obliterate adversaries.

Annihilate.

Annihilate. Their booth didn't say anything. Their booth just said, hi, we're Wiz, and we made 100 not very funny jokes involving cloud security and board games this time. I think there's this kind of almost flipping the equation on its head thing where instead of trying to get their signal through the noise, they've removed any signal other than we are Wiz. And so rather than try to push signal through, they've removed all the signal.

Yes. And weirdly enough, It works great. It resonated.

Yeah, it's charming.

I mean, what didn't resonate with me is people who say on things like, we do good security, or we do good outcomes, or we are— what was it? Efficient. Last year we made fun of some vendor.

Yeah, we made fun of a lot of vendors.

Efficient security vendor. And it's like, if you spout blatant generalities, platitudes, you would never be noticed. You won't be remembered.

So you won't be here. Yeah, we'll make fun of you on the show for saying shred attackers.

I'd rather have goats. Oh, well, we'll get to goats in a moment. Goats are kind of a thing that got your goat. Yeah, they did get it. Yes. So I want to briefly touch our beloved domain of DNR, SOAR, and we sort of touched on AI SOC.

We really could have been the detection podcast by Google.

Yeah, maybe one quarter of our content at least, and maybe one half of our best content is DNR. Yeah, yeah, yeah. But the reason I want to go to this topic of SOC, SIEM, SOAR is because The theme emerged of AI native.

Yes.

There was actually an AI native SIEM, AI native SOAR, AI native MDR, AI native pipeline vendor, funny enough. And it led me down an interesting path, maybe a bit of a rabbit hole. The vendors who claim that they're AI native point out that they are essentially the technology you had before, but instead of adding AI to something that existed, like 2007 SIEM plus AI module, They are AI native, and that's why they're better.

And that alone doesn't seem to make them better.

I mean, don't say no. It needs some analysis. The reason it needs some analysis is that I can see areas where retrofitting AI to existing capability would be tricky. But I also see areas where existing capability has to exist. And just saying, instead of this, we have AI, won't cut it. Like parsers. Sure, LLM can help you write parsers, but Saying that because we have LLM, you still need parsers and you still need parsers that actually work in real world.

And are maintainable by, well, I guess AI.

By anybody, by AI.

By something.

By something. And to me, AI native in theory may be better for some things, but I am kind of for now in the, I'm not sure why it's better in general.

AI native, it's funny because if we had been talking 10 years ago about something being cloud native versus not cloud native, I think it would be very clear that a cloud-native vulnerability scanner that does disk snapshotting versus an ancient on-prem native vulnerability scanner that SSHs into boxes is worse. I think that much is clear for a cloud environment where all of a sudden we have this new thing called a disk snapshot that's easy to do at scale. But I don't know if there are AI-native things that are like that.

I think I want to leave this one be for now because I almost, I buy the argument. That instead of adding AI to DLP, I'm going to reimagine DLP given that I have AI from day one. But there is merit in this argument.

No, no, no, no, no. I think that is the trap. And I think the real thing to do is not reimagine DLP with AI. I think the real thing to do is, how do I reimagine the problem of keeping my organization's data safe now that I have AI? Not rebuild DLP using AI.

Okay, that's a fair point. But it still doesn't answer whether AI-native technology acts—

No, it doesn't.

Yeah. And I think to me, this is— we love to sometimes pass judgment on things, but this one, I'm unwilling to pass judgment. I just want to wait and research things to see—

To not pass judgment.

To not pass judgment. I want to see in what areas AI native wins because it's better and AI bolt-on would not succeed. I don't know what those areas are, but I'm willing to hypothesize that they do exist.

The jury of Anton has not returned a verdict.

Correct. On whether AI-native is better for security, that's where I would leave be.

Okay.

I mean, let me also touch the pipelines. Pipelines.

Oh, yeah, pipelines.

I'm going to touch the pipelines now. Hopefully no water flows out or no logs. So there's this whole pipeline business, right? We had a podcast on this, Security Fabric. Good discussions. Google SecOps, of course, incorporates pipeline functionality inside. And it feels very natural that your SIM vendor will either currently or in the near future have that. But there are many vendors launched in recent years who do that. In fact, some of them launched very recently. And when we asked them, well, are you guys just basically Cribble but reimplemented, reimagined, or what is it? Are you AI-based?

Well, one we talked to was Cribble but faster.

Some of them said that they are faster. Others said that they have a better UX. I don't know. I understand the problem. My former Gartner colleagues tell me that people do come to them with questions about scalable log collection, telemetry collection. But I'm also torn that we now have legacy pipeline vendors versus new pipeline vendors. The need is real, but do we need a dozen pipeline vendors? I don't know. I'm a bit torn about this.

Well, we will find out in a couple of years how many of those pipeline vendors survive, and that will tell us exactly how many we need.

Excellent point. Yes.

Yes. That is not something we need to reach judgment on. That's something we can just wait and find out. So miscellaneous section for the podcast listeners. Anton and I, sometimes we collect our thoughts, sometimes we collect our thoughts roughly. A couple of miscellaneous thoughts. We saw returning frequent flyer countries, Germany.

Yes. No AI on the booth. That's important.

Germany was interesting. Germany's industries, they mentioned on the booth, Felt very Teutonic to me. Business continuity management.

Yeah, that's right. That's not Titanic. That's Teutonic. Teutonic, not Titanic. Yes. But you're right. And also, people who eventually expect to have a technical team of zero would be quite disappointed.

Yes.

Because a lot of these industries are heavily regulated. A lot of the needs are heavily controlled by standards. And a lot of them kind of need humans and would need humans for the foreseeable.

Probably need humans that you can arrest when things go wrong as well.

You probably need humans to— Yes.

To be responsible.

Yes.

Yes. But there were some new country booths or ones that we didn't remember from the past. We had the Kingdom of Saudi Arabia.

I don't remember Italian booth from last time.

We had an Italian booth. We had Italy, the Netherlands. We even had the Canadian province of Ontario.

That's right. And it sounds like that province have more security vendors than many US states.

Yes, it might well.

Than most US states, probably.

Yes. So, speaking of unexpected things we found, we found goats.

We did find goats. And I think that you talked about Wiz and how they beautifully decoupled the substantial messaging from attractive story. The goats kind of went too far because even today—

I couldn't tell you who had the goats.

I had the pictures of the booth and I don't even know which vendor had the goats. So—

Yeah. Yeah, that's true.

And what they did and why they did this, and of course, why there are goats.

I don't know why they had goats, honestly.

I mean, we talk about goats, but I think that in this case, the marketing gimmick got decoupled. It got unmoored from the foundations, and we don't know who the vendor was, but we do know goats.

And, you know, I don't even feel sheepish about not knowing.

Right. I would go with that. Yeah. So let's switch to puppies because I could—

Puppies. There were puppies.

There were puppies, but puppies also produced— I almost get puppies. I mean, security, mental health of security professionals, all this stuff came up on our special episodes.

I'm a lot happier now that I have a puppy.

Yes, correct. And puppies actually help. There are measurable ROI from puppies.

There is a puppy ROI. Yes.

And at the same time, I think the same booth mentioned something about cuddling puppies and then annihilating adversaries.

Yes. The juxtaposition was a very, very strange one to have cuddly puppies and annihilation. That was the word they used.

Correct. Correct. One of the vendors wanted to shred adversaries. And I think when we were talking about this episode—

With microsegmentation of all Yes, correct. It was giving me Fargo vibes.

Shred them with microsegmentation. Nobody promised to eviscerate adversaries. So if you want to have a free marketing message for next year, consider this: eviscerate adversaries.

But I don't know, listeners, consider this one: defenestrate your adversaries. You could construct a booth thing where people throw adversaries through a window.

That is dangerous because Microsoft may get upset.

Why? Oh!

I got you.

You're right! You got me with that. All right, all right. One thing I was very sad to miss this year was the NSA booth.

We could not find it.

I asked the FBI.

Oh, right, because of course, who else would know?

Because who else would know? And the FBI person, first she rolled her eyes at me, and clearly I was not the first person to say, oh, you're kind of like them, do you know where they are? And apparently the NSA was not here this year. And so I did not get to have my annual ritual of showing one of my engineers how cool it is that they have an Enigma machine.

So no such agency.

No such agency. They were in fact hiding. They were in stealth mode, perhaps. I don't know. But I think, I think those are our things. Do we have other things we want to say about this year's RSI?

I mean, we love RSA. We are weird. Some of the security professionals we talk to—

This is my 11th RSI. How many RSAs have you been to?

Tim, you're old.

Yes. I'm not as young as I used to be.

I don't know, actually. I probably should go look. This time they did not give me the badge that says legacy or loyalty. So maybe my— maybe loyal— I think loyalty plus is what they give to people who went to too many RSAs to admit it. But this time I did not get it. So maybe my history was lost or removed for privacy or something. But yes, I do like RSA. Maybe I'm weird. I should go link to my old blogs.

You're definitely weird.

I am definitely weird. So it's a fun show. Are we going to do closing questions or are we kind of done?

I mean, do you have recommended reading?

I think I just want to copy one of our special guests and point people to this website.

Camel Paper?

Not that one. No, the mental health. Oh, the mental health. The physical health. No, no, no. We Hack— I think it was We Hack Health.

I think it was both mental and physical, wasn't it?

Yes, that's right. We should probably put it in the notes because it just stuck in my head because of all the stress, including stress because of AI.

And stress of RSI.

In terms of RSA, yes.

I mean, literally our bodies, our voices are leaving our bodies from this experience.

Correct. I mean, I think the positive thing is that it's almost over.

Yes.

But at the same time, you're right.

Yes. Well, listeners, with that cheery take on RSA and all of the above, I think that ends things for today's episode. Thanks for joining us. And now we are at time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcasts. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode. See you in the next episode.

Welcome to another episode of the Cloud Security Podcast by Google.

Security.