EP243 Email Security in the AI Age: An Epic 2025 Arms Race Begins

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here, as ever, are myself, Timothy Peacock, the Senior PM for Detection, UEBA, and Risk in Google SecOps, and of course, Anton Chuvakin, a reformed analyst and senior staff in Google Cloud's Office of the CISO. You can find and subscribe to this podcast wherever you get your podcasts, as well as at our website, cloud.withgoogle.com/cloudsecurity/podcasts. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. You can follow the show, argue with us and the rest of our Cloud Security Podcast listeners all on the Google Cloud Security Community page. Anton, we have former colleagues of mine on the show and not you today, very sad. But listeners, Anton was up in Napa enjoying, I think, wine with With a toddler and a dog, but probably not all 3 together.

Not quite a toddler, but—

And not quite a dog. It's actually more like a small human and a very puppy puppy, right?

That's right, yes.

Okay.

A small human and a puppy.

But this episode I think is really fun because you wanted the show to consist of basically one question, which is, I don't wanna give it away, but I will. You wanted to just ask, why in the world are you building this company right now?

Correct, yes. I think that I felt like for this episode there's one really good question And no more questions, good or bad. And this question, to me, I want to know the answer. So, I'm super curious to listen to what Tim recorded. I promise it wasn't my skepticism. It was basically the wine and the puppy that made me skip the recording. But the idea is that for certain spaces, you sort of hear about the market segments or spaces, and you assume they're mature. Everybody knows what to do. People buy tools, tools get turned on, everything works out.

Yes.

And for some of these spaces, you feel like the problem is mostly solved, but this is really tricky. It's a very load-bearing mostly. And then somebody comes and says, I have a startup in this area. And you'd be like, what do you mean? Like, that's a solved problem.

Right.

And they say, no, not at all. And then you can have a good discussion. To me, that was really fun. And I hope, Tim, you delivered on asking them that. But where do you go from there?

Well, you'll just have to listen and find out, just like everybody else. So maybe without any further ado, let's turn things over to today's guests.

I'm delighted to introduce today's guests. Joining me live in the studio— well, not live, but recording in the studio in San Francisco, I've got with me former colleague Sai Kormeyi, the co-founder and CEO, and Ryan Luo, the co-founder and CTO of Aegis AI. Guys, welcome to Spear Street. Welcome back to Spear Street, because I think all 3 of us have had lunch in this building.

I want to get right to it.

You're doing an email security company in 2025, and you both used to work at Google. So like, what am I missing here? What's wrong with you guys? Why are you doing this?

Yeah, first of all, it's great to be back. Like, I think we all worked out of this building, so there's a lot of nostalgia to come back and see how much has transformed in the last couple years. And just for context, we worked on email security at Google.

Uh-huh.

It's this newfangled thing called email that's just coming. Yeah, we're starting to hear about it, right?

Exactly.

But no, people have been doing this for like 20 years, right?

So why a company—

Longer.

My whole life.

Yeah.

So, so Why now? Yeah.

What we really saw was that there's a whole bunch of new threats coming. AI is coming for us all, and email is not exempt. And we found it's doing a couple things. One is we're seeing way more attacks come in. We saw a 4,000% increase in the volume of attacks. And these attacks are getting a lot more sophisticated, and they're coming kind of two angles there. The first is we're seeing attacks that were typically nation-state actor, advanced persistent threat, using compromised domains, using highly targeted identity attacks become commonplace, powered by AI. And we're seeing net new attacks created by AI, so specialized fuzzing, new types of document scams, and then things to evade rule-based systems, all powered by AI. So it's an old space that's now a new attack vector with a new technology.

And what's been really exciting is that we've been able to get some early results with some of the newest technology today as well.

Yeah.

So we've run into—

So you're fighting fire with fire?

Well, you have to, right? And the idea is try to stay one step ahead, not behind or even in pace, but to really stay ahead of the adversarial evolution that's happening by making sure that we're as smart, if not smarter, about how we use our AI-native technologies within our companies, within our defenses, just to try to really keep one step ahead.

Do you have to fight AI with AI?

Why is AI necessary for this problem?

Yeah, it's something we observed. You know, if you think back when we were starting out, you know, 10 years ago in the space, the rotations would be pretty slow. You'd see the same phish kits, you'd see the same attacks for months if not years, and you defend against them with rules and you're good to go. And then that shrunk to months, and then that shrunk to weeks, and now it's minutes and seconds if not unique attacks.

Hmm.

And so you can no longer play the cat-and-mouse game because every attack is going to be bespoke. And so to Ryan's point, you got to catch it before you see it. You can't play this game of see the attack, have the analyst write a rule, and then you're defended, because then the adversaries will move on.

Sure.

You've got to spot the attacks before they even come in. You've got to spot those zero days or you're going to be exposed.

Okay, so how are you doing that? Because that sounds great, but like security skeptical Tim is like, uh—

It's magic.

Yeah, no, that's what I'm hearing. So tell me it's not magic and what it really is.

One thing we found that's been really helpful is Using these large language models and their natural understanding of context and the human language is just much deeper than any model that we could have trained ourselves on these proprietary datasets that we may have had access to at Google. So kind of what Sai was saying, how we were seeing this pattern of attacks kind of starting to bypass our models, what we would do at Google is retrain and redeploy a new model that learned from kind of some of the attacks that we had just seen. And what's exciting is now you've actually got this deep understanding of the human language that's much harder to invent around. And so there's a little bit of work that— or quite a bit of work that we've done around making sure that we're smart about how we use it. Because right now, these models are still very expensive to run. They can be slow and kind of not always reliable.

Non-deterministic.

Not deterministic is a good way of saying unreliable. It's crazy.

Yeah, stochastic.

Yep. But what we found is if we're selective with what we put through to the model, what context we decide to include when making these queries, we can build a pretty unique and robust system.

Okay, so I buy that in a world of basically free to iterate on your phishing content, adversaries will iterate on their phishing content faster than we can create rules. I buy that LLMs are probably a good way of understanding intent. That seems pretty standard at this point. Why a company to do this though? Isn't this just going to be like the existing established providers do this and you guys raise a bunch of money and people are then sad?

Yeah. I mean, you always think about how quickly the incumbent security vendors are able to adopt to the new threats, right?

Yeah.

Almost never, right? And so I think in this case, what we think about is these vendors have spent the last 10 to 20 years, and by the way, it really is 10 to 20 years for all the incumbent vendors to create these large rule-based systems, these massive libraries. I think at SafeBrowsing we had Tens of thousands of rules we're trying to manage. And then if you try and snap on an LLM-based system to it, you do one of two things. Either you restrict the LLM system into the rule-based system so you don't get the juice out of it, or you've got to keep reconciling these two systems, which would never end well. So we really think there needs to be a native approach where you're not making, writing, and managing tens of thousands of rules that are very specific and very kind of regex-ish. You're really trying to manage and nurture 50 or 60 of these LLM agents that are kind of learning on their own. So you really move from, uh, the perspective of a carpenter to a gardener. So we're really not there building, constructing specific— yeah, we're just kind of—

that's new—

feeding, you're tuning, you're letting the LLMs grow, mature on their own. And that's how they're able to kind of get smarter than the adversaries. They're really relying on data that we may not even have seen on our own.

And this is something we've heard echoed across the industry too. Instead of relying on things like deep fine-tuning, we're spending a lot of time investing in the technology that we have access to today. Rather, kind of let the model cook, so to speak. Let it do what it's naturally good at, and then think a little bit about what you might want to build around the entire system. So when the next model rolls around, you're ready to pick up the technology and kind of accelerate with the pace of innovation that's happening around us.

That makes a ton of sense to me. So I want to get specific for a minute about the attacks that we're seeing, because I think that'll help contextualize a lot of this. And as we all know from playing with LLMs, context is king. So tell me about the attacks that we're seeing and why are LLMs the right choice for that?

Yeah. And let me actually start by just talking about the volume we see in production at our customers. When we started, we thought we'd see dribs and drabs and email phishing maybe wasn't that big of a problem. It's a huge problem. For the average customer we have, more than half of their employees are under attack on a monthly basis. So we're seeing a massive volume coming through. And we're seeing all kinds of attacks. So one version might be fuzzing of document scams. I've seen, I don't know, hundreds of different variants. I kind of joke with Ryan, I want to wallpaper my house with every variant of a document scam I've seen.

What's a document scam?

Could be like a DocuSign fake, fake DocuSign, fake Adobe Sign, fake, you know, Microsoft encrypted invoice. It could be from Social Security. It's anything that tries to get you to sign a document where you click on it, it's urgent, you click on it, and then you go offsite to go do an action. And they're just automatically fuzzing every possible variant. So it's kind of one broad attack. They also get more specific and use compromised infrastructure. So for responsible disclosure, I won't say exactly which companies, but there's 4 or 5 Fortune 50 companies we've observed today have compromised infrastructure. They're sending phishing to their customers.

Hang on. You're telling me that Fortune 50 companies have been popped and their email distribution systems are being used to scam people?

That's correct.

Wow.

And it's bypassing all the traditional rule-based systems because they assume—

Fortune 50, that looks legit.

And it is legit. In fact, it passes DMARC, DKIM, SPF. All of that looks good because it is. And by the way, these attacks have unfortunately persisted for months.

Ooh.

So we have been responsible disclosures. We've talked about it to those companies months ago. And honestly, today we just saw another attack from a company we reported back, I don't know, 4 or 5 months ago. So it's a commonplace thing. And then the last is customized attacks. So we've seen what typically would be an advanced persistent threat actor. So they'll go say, hey, there's a victim. Let me choose the specific lure to use. So in this case, we had a crypto company as one of our customers. They went to France for an event. We saw an adversary compromise a French events company, compromise the identity of that director, and use that to send an ACH to that customer, to the head of marketing there. So it's a really well-tailored attack.

So you're telling me that some crypto company is at a marketing event, they've got a booth, and they get an email from the adversary that says, hey, your union guys were lugging too many boxes last night. You got to wire me another $50K today.

Something to that effect.

And they did on July 4th.

They did not.

Yeah, well, they did not.

Because you caught it.

Exactly. Because, by the way, they sent this— of course, adversaries love choosing holidays and times we're all trying to relax. Naturally, they sent the attack on July 4th. We were actually in the office and caught it because we're kind of our impromptu SOC doing what we do. And so rather than the customer, to your point, losing money, getting compromised, having an incident, nothing happened. They sat out on the beach, they enjoyed their holiday. We came back and had a great conversation about posture. We told them what happened. We said, hey, there's a more sophisticated adversary targeting you now. Let's step it up across your security posture. So that's the difference between kind of pre-Aegis and post-Aegis for us.

And that adversary, do you think they were sophisticated? Do you think those were just Like some regular crime syndicate out there?

I think it was a regular crime syndicate. So these were not folks being targeted for nation-state actor interests or anything we typically see, for example, at Google, where you deal with some really big adversaries.

Yeah, yeah, yeah.

It was for, you know, a tens of thousands of dollar invoice. It was some pretty small stuff.

But that's got to be super high ROI. I mean, like, events companies are not exactly security strongholds.

Yep.

You go pop enough events companies, you get pretty continual events flowing through spaces. You could be making 50 grand a week.

It's a good business.

Yeah, that's a great business.

Hey, I don't know, maybe, maybe our future career.

Yeah, but the point is, please don't, please don't.

You really see what you typically expect out of a nation-state adversary in the hands of common cybercriminals, and that's a massive trend we've seen across all of our customers.

And so what we're seeing is being effective at processing signals well beyond things like reputation, well beyond simple rule catching, simple logistic regression models that we used to work with, really understanding the deep context and finding the intricacies has been really effective. We've seen some attacks where HTML is being obfuscated as well, right? So instead of allowing for keyword searches to be possible within, in particular, email context, we're seeing that attacks are trying to break these kinds of chains and make it even harder for traditional methods to catch these kind of attacks.

Oh, man. Tampering with HTML to make things hard to interact with actually was a— security advance I once worked on.

Yeah, well, now you know the problem and the solution are always one and the same.

Oh man, that's, that's wild though. That, that's wild. That's amazing. So help me understand this. I'm still stuck on this, on this events model, and I'm thinking about how much money I could go home and make tonight. But how do you catch something like that? You know, how do you tell that that's actually not, you know, something you should wire the money to?

I think there's multiple layers. And the first is, of course, the traditional reputation and context that we just talked about isn't enough. But you do want those signals. Those signals are important. Then you pass it through a series of agents, we call them. And they try to make that decision with the right context available. So in this particular case, whether the email's authentication records were passed or failed, what kind of tone that the email had actually come through with, or whether or not—

Mm-hmm.

the identity of the vendors are legitimate or not, we might actually go collect content around exactly this particular identity, what their profile may be, what their position is, and whether or not we believe that's legitimate. All of this context will get wrapped up and sent to our decision-making agent that then makes some kind of determination on whether something is good or something is bad.

You can do all that work per email?

And that's kind of the key. The key is really around economics, around when it makes sense to do this deep dive. And there are a series of checks, as I was referencing before, where we're not, you know, revolutionary enough to say like, hey, we're not going to do anything but put it in front of the LLM, right? Like there's a lot more work that we put around it.

We had a guest on the show say basically that once though.

Yeah. Well, I'm sure they're well-funded.

Yeah.

They seemed extremely well-funded.

Right.

Yeah.

Yes.

And so what we found is that the system around the LLM is actually as important, if not more important, than the actual LLM itself. But of course, the secret sauce is the knowledge and the deep understanding of context that our detection engines have nowadays. And then there's the verification process, which is sometimes just as fun as the development process, where Cy and some of our other, I guess, SOC analysts were able to—

I wear many hats.

We don't have a big team, so they were able to trace the attack by actually clicking through some of the links and kind of like put together this puzzle that we could then present to our customer.

Yeah. And by the way, specifically for that attack, to get into exactly what signals the AI was observing for that specific one, is it observed, first of all, there was a suspicious ask. So there's already an ACH flag 1, right? Flag 2 is you follow the domain it came from and oh, they've got some misconfiguration records. All right, so they're potentially vulnerable to spoofing or another one of these attacks. Okay, flag 2. Flag 3, and this is the funniest one, If you follow it, it sends you to a fake reCAPTCHA. And we always love about this, how we've worked on reCAPTCHA. It says, click any 5 images.

Any 5.

And it's a very customer-friendly CAPTCHA. So we appreciate the adversaries are innovating on their UI.

Maybe a new feature request for reCAPTCHA.

Exactly.

Make CAPTCHAs a little easier.

Our old friends there can take that. But, you know, then they kind of unders— they understand that phishing detection systems and link crawlers struggle to use— do user interaction.

Of course.

And so it fails there.

By stringing together that and a few other signals, you can actually recognize you're actually putting together a bunch of very diverse signals that you would never have as one ML model. No one would ever go and model that. Sure, sure, sure. It's got to be emergent. And that's really where these kind of unsupervised learning techniques that essentially are LLMs really shine. It's kind of piecing together this disparate data into a threat in a way an analyst would. And then Ryan also kind of alluded to how our agents kind of work together. They work together like analysts where they can ask each other questions, they can decide to go deeper, lighter. So it is kind of helping us make this economic where we don't have to do the full deep dive unless we see something bad, and then more and more investigation is necessary. Just as you'd escalate from tier 1 to tier 3 analysts, our agents working the exact same way.

And do you have Gemini Flash as the tier 1 and Gemini Pro as the expensive one?

So about model selection, we're very careful with what models we use. We actually don't use Gemini for a variety of reasons. Mostly because we don't send data to any third parties, right? We keep everything as in-house as possible, which means no closed-source models, all open-source models. Listeners of the podcast will be pleased to find that we did do a comparison of DeepSeek versus Gemma. Gemma so far is the winner.

Ah, nice.

For various different reasons.

So it's not Gemini, but it is Gemma.

Right.

It's not Llama, it's not DeepSeek.

It came from Gemini, right? And we found that in some cases, model selection is another topic that Sai and I talk about a lot. Trying to make sure that we stay on top of everything that's coming out and testing all the new models that come out, making sure we have the right observability setup so that we can do quick evals when new models come out, new techniques come out, to make sure that we are making good decisions.

Yeah.

Always a plus to not fly in the dark.

Right. And have you built that from scratch? Are there good tools out there for that?

What's that like?

Great open-source tools.

Yeah.

But of course, you know, you have to build the connections yourself.

Of course.

And, but it's been super fun to make sure that, you know, We have a way of parsing through the noise, so to speak, of making sure we understand what is helpful and what is not helpful when it comes to improving our detection.

That makes a ton of sense. Today's episode, when we were recording this, the episode that came out today, listeners, was Dominic's episode where he talked about the importance of, you know, good data hygiene early on in the process so you can do that evaluation later on when you get new models.

Yep. And when we say new models, it's happening on a weekly basis or biweekly basis. So everything we're doing kind of starts from a point we know we're going to have to rewrite the playbook. Every month at best. So everything we've done in the business, it is exhausting. But with us, we've got a great team together. Actually, a lot of— I think the majority of our team is former Googlers, actually.

Nice.

Do the math there. But yeah, it's a lot of familiar faces from the old Safe Browsing reCAPTCHA crew. Phenomenal talent, right? Yep. Coming together and exploring this world from a place of honestly ignorance where like, I've been in the NLP space for 20+ years. I feel like I don't know anything week to week. You just got to dive into the new week. Learn what's happening. Be really open to saying, hey, the world's going to change. Never get stuck in what's happening in the past, what happened even a month ago. We've got to let it go and just build a net new thing because the technology is moving so fast. And I'll tell you what, the adversaries are certainly taking advantage of the new technology, so we have to as well.

So what else have you seen the adversaries doing with AI? Clearly they can iterate on docs. Clearly they can change their lures. They could probably develop their new lures. What are they doing out there? What are you seeing?

Yeah, I mean, there's all kinds of things like that. We're also seeing them leverage a lot of new compromised infrastructure. So we're looking at SMS, we're looking at voice, we're looking at phone. We haven't seen video on our platform yet, but I've definitely heard that's a thing coming out.

Yeah.

And you're looking at them also creating high-fidelity lures of all kinds. And this could be QR codes, this could be images. So they'll embed threats in images because, again, they know other rule-based systems can't detect that. And they'll even start to create fake content around a threat to make it seem more real. So rather than compromising a site, I could send you an email from a net new domain that say Bob's Builders, not to pick on Bob, but Bob's Builders, and then create a Bob's Builders website and make it so real that maybe a SOC 2, SOC 3 analyst that does an investigation sees a business relevant company.

Hmm.

Sees a real website, sees a real human on LinkedIn. And it's all AI generated as a facade just to support this one attack. And again, this would be a thing that would take a ton of time and energy for a real human to do.

Yeah, of course.

But I can have an AI spin this thing up in every possible variant, even start A/B testing them.

Yeah, you could have Bob's building, you could have Will's building. That's amazing.

And so every business, we're starting to see very bespoke attacks. We serve folks in crypto, in finance, in healthcare, in, of course, SaaS technology and security and privacy. And we're seeing different lures that are customized not just to the industry, but to the person themselves. And so they're ingesting all the data from you on LinkedIn, from whatever sources they have. They're using that to create these lures and they're custom targeting to you, which again goes back to our theme of we've gotta focus on making these defenses that are able to spot the zero days. They're able to spot things before we've seen them before, because I believe we're gonna go to a world where all the attacks are unique and bespoke. to us, we're not going to have any of these mass-marketed attacks anymore, just like all the other things we expect out of AI.

This isn't too surprising. I mean, we saw this with malware, right? Like, this is the story of polymorphic malware.

Yep.

This is the story of evolving from hashes for malware identification to everything.

Are you saying hashes don't work anymore?

I'm afraid so. Yes.

Uh-oh.

Yeah, I know.

So we've talked a lot about what the adversaries are up to.

We've talked a lot about the technology. You were one of my favorite Googlers to work with back in the day. Why did you start a company and what are you trying to do with the company other than obviously, you know, make a lot of money?

Yeah, I mean, the number one thing was just keep the world safe. I mean, this is the thing, like, I count myself and us both like so lucky to have gotten to work early in our careers with Gordon and Panos and Niels and some of the absolute titans of this industry and really got us inspired on the mission. Like, I've strayed a couple times away from the security mission in my career and I always really missed it. I always had a hole in my heart for security. And so for us, that was the thing we really desperately wanted to do. And then 2 is we wanted to run something in security in an AI-native way. So we really believe that across the board, it's not enough just to do AI as a conventional company. You actually have to do everything in a completely different way that's going to evolve with the pace of AI. And look, I teach AI at UCLA. I've been developing technology in this space my whole career. This is different, man. This is different than anything I've seen, even as a devout NLP guy. This is different than anything I've seen. And so we had to create a whole organization to move at this speed, to explore and see what that next frontier is.

And that's what I think was that big challenge for me and Sai. We were both surfing in Ericeira in Portugal when we were thinking about like, oh, what should we do next?

Yep.

And this idea that building from the ground up to make sure that we could keep pace was super important because we've, you know, we've been in these large organizations 10 years for me within Safe Browsing, almost 10 years.

Mm-hmm.

And then for Sy, another 5 years, so 15 between the two of us. We've kind of seen how effective these large systems that can protect billions of devices— billions of devices on the Safe Browsing side, millions of web pages on the reCAPTCHA side— how effective they are at protecting the world. And what we saw was a new threat coming up so quick— that was moving so quickly that we had to think about a way to move just as quickly as they were. They could. Yeah. And who knows what happens next, but yeah.

And maybe by that we can solve the problem. By the way, so you mentioned email and email security is not new, right? But every Verizon DBIR, it's in the top 3 to 5. In fact, they even have to start changing the names. The last one they called it pretexting versus BEC.

Yeah.

But it's the same thing.

Yeah.

Yeah.

They just got sick of calling it BEC or they got sick of calling it phishing, right? It's the same unsolved problem that happens over and over and over again. And we see practitioners struggle and try and train their workforce, trying to like, Make people smarter than AI.

Yeah, like that's going to work.

Which is not going to work. We're like, there must be a solution. I actually think what we have now has actual potential to get to a solution where we take that off the list. So if at some point email and social engineering drops below the top 10 of attacks, we would be super happy. And we think we've got a shot at that because when you use these large connected systems, when you take email security from a problem that everyone struggles with individually in their own organizations to one centralized organization, just as By the way, CrowdStrike did with malware.

Sure, sure.

You really give good the advantage, right? You give the person with the most data—

Yeah, that's a Chronicle slogan.

Chronicle slogan? Oh, there you go.

Yeah, nice.

I remember that from somewhere.

Yeah.

Someone had a sticker he gave me that had this on it.

It's a great slogan, giving good the advantage, but that's Chronicles. You can't have it.

Oh, I still like it. Either way, like data, like people coming together and contributing data to one place gives defenders the advantage where they otherwise have a disadvantage in trying to defend the large moat. Totally. And so with email, we want that to happen. We want it to go from every department having their own analysts trying to configure tools on their own, which nobody enjoys, to one centralized place that just solves it across the whole industry and does so with visibility across the entire industry. That will make it very difficult for adversaries. And by the way, we found that with Safe Browsing and with reCAPTCHA, it's very scary as an adversary to touch the reCAPTCHA ecosystem because you get burned across 7 million websites if you make a mistake.

Oh, yeah.

And that's what we want. We want it to be dangerous. We want it to be hard. We want you to go somewhere else. And so that's kind of our goal.

I love it. Okay, so least favorite part of the show. I have to ask our closing questions. One for you, Ryan. Do you have a tip to help people with their LLM-driven development? And 2, do you have recommended reading? Recommended reading. Maybe Sai takes the recommended reading portion.

I think on my side, what we've found is to actually Kind of what we had talked about earlier before is really around not doing too much with the model itself. So we had thought about— one of some of our initial experiments involved heavy fine-tuning and trying our best to kind of make the model a good security agent. But you're taking now a model that's just generally intelligent and forcing it down this pigeonhole of suddenly learning how to operate as a phishing analyst, which is very, very difficult. Instead, what we found is orchestrating across several different agents, breaking down the problem, And as much as possible, leveraging the native intelligence was much, much more important.

That's interesting.

So that same, you know, the same message that we've heard resonated across the industry of think about what's happening around the model versus what the model is doing itself. Adding too much context— this is a very valuable resource, attention, for the models. So you want to be very careful about what you feed the model. And so I'd advise, you know, any of the engineers experimenting with models today to think a lot about how to carefully use that resource. I guess recommended reading, nothing on the top of my head, but Cy, you?

I have one suggestion that may not be totally new, but it's, it's maybe helpful. So we got a chance to chat with George Kurtz a while back because we're, we're both Accel companies. And so every once in a while we get to talk to big brother.

Yeah.

And, you know, one of the things he mentioned was like, look, you're seeing all these attacks from adversaries, advanced adversaries, come down to be democratized to everyone, cybercriminals.

The history of cybercrime in a nutshell.

And one of the best writings I found on that was really CrowdStrike's Global Threat Report. So I'll give a shout out to them and especially coverage of Scattered Spider. It's one of the scariest things out there because you're really seeing the arms distribution across the whole ecosystem.

Yes.

And I don't think anyone's ready for it or truly appreciates what is in the hand of the average script kiddie these days. So, oh yeah, if you haven't read it, dig into the latest version. It's really worth a read.

Okay. Well, Cy, Ryan, thank you so much for joining us today.

Thanks for having us, Tim. Love to be back.

It's great to be back. Thanks.

And now we are out of time. Thank you very much for listening and, of course, for subscribing. Please subscribe so you can get new episodes piping hot.

And if you love our content, please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcasts. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com/security.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us, and if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.