EP287: Creating Trust at Global Scale with Local AI: Reken-ing with Shuman Ghosemajumder

Security.

Hi there. Welcome to the Cloud Security Podcast by Google. Thanks for joining us today. Your hosts here today are me, Tim Peacock, a group PM on Google SecOps, and Nolan Karpinski, another group PM who leads detection for Google SecOps. You can find the show and subscribe wherever you get your podcasts, as well as at our website, youtube.com/@cloudsecpodcast. If you enjoy our content and want it delivered to you piping hot every Monday, please do hit that subscribe button. Nolan, we have an old friend of mine on the show. You got some good stories about a much younger me. Where do we want to go with this? What did you think?

Let's see. Most importantly, you don't have a suit on for me right now, and I feel, I feel a little sad about it. What's up with that?

Yeah, you got shortchanged on that one. I really should have worn a suit to this. That would have been, that would have been pretty funny.

Wearing a suit to Silicon Valley interview. I don't know when that was, but you must be really old.

It was 2013, and I was 22 at the time. So listeners, you can do some math to learn how old I am. I was working in DC at the time. That was what I wore to work every day, actually, at that time in my life, was a suit and tie. They told us at Brookings to wear a suit, dress like the president might walk by. While I was working there, Hillary did walk by. So yeah, there's that.

Good to be wearing a suit that day then.

Yeah, yeah, yeah, yeah, it's appropriately dressed for that. But you, you seem to really enjoy the bit in here about models. That seemed to really resonate for you.

Yeah, I, I just think that the more that we're able to do locally versus needing to trust any vendor for the data that you send, right, your PII, wherever it is— you know, I was having this conversation with a customer who had employees in Norway, and they were talking about how, you know, in the United States, you kind of think of your data when it's on a company laptop as the company's data. Like, that's at least the mindset.

Obviously.

And in certain countries across the world, that is not true. So even reading an employee's data, even if it's on their corporate laptop, is considered a privacy infringement. And so I think the more that any of these companies—

Norway, that's true.

Yeah, exactly. The more you're able to do locally, I think, is a big unlock for actually being able to offer more of these security services.

Yeah, that's a really good point that the more you can do locally, the less you need to comply with up in the cloud. It really lightens your load in a lot of ways.

Yeah. And especially as the AI attack surface continues to evolve and is nebulous and How do you detect again? Well, you don't really have to worry about that as much if you're able to check some model that runs on your local device and has no connectivity whatsoever to the cloud.

And how many times have you done your— well, not as many as me, but probably a couple of times now you've done your Jishu training to learn how much data you want to collect, which is none of it.

Which is none of it.

Exactly. Yeah. And so Schumann made a really interesting point about the early days of Google. Can you imagine a Google that looks like that and doesn't have user data. It's a crazy thought.

Yeah, I just went through one of those trainings. The answer is always don't collect.

Yeah, don't collect. Okay, so listeners, with a discussion of Jishu out of the way, let's turn things over to today's guest. Today we are joined by my good longtime friend Shuman Ghosn-Jumder, the co-founder and CEO of Reckon. Shuman, thank you for joining us on the podcast. I can't believe it's taken this long. I want to get into our little time machine and go all the way back even before we met and talk about your time launching Gmail, being the click fraud czar of Google. You're my only friend, by the way, who has been a czar of something. I've got lots of friends, but nobody else is a czar. Can you tell us about how those really early days at Google doing all this scaled anti-fraud shaped your views on internet trust? Because I think that's a fun topic.

First of all, thank you so much for having me on. And I agree, I can't believe that it's taken so long for us to do this. So it's a real pleasure and delight to be able to do this with you. So great to meet you as well, Nolan.

You as well.

And so I think that the early days of Google were just a very unusual and special time because it was right after the dot-com bust. And the internet was a very different place. And when I joined Google, I didn't actually know precisely what I was going to be working on. So I knew of Google the search engine, and it had become quite successful in the search space. But at that time, Google actually had no user data whatsoever in terms of consumers coming to the website and storing any kind of documents or anything like that. Like everything that we take for granted now in terms of Gmail and Google Workspace, none of that existed as products. And so It was really a very open kind of time, but it was also a very fast-growing and fast-moving time. So we quickly scaled from hundreds of employees to thousands of employees and tens of thousands of employees by the time that I left. And when we launched Gmail— and I was responsible for the ad targeting systems that were inside of Gmail at the time, which we knew were a new paradigm for being able to create that kind of monetization capability inside of something like a communications client.

Mm-hmm.

And we'd never created anything like that before, and the industry had never seen anything like that before. So we didn't know what exactly it was going to do in terms of impact on the market. And there were a number of different things that were unique about it. For example, in a world where all of the other webmail systems were allowing you to store maybe 5 megabytes—

If you're lucky.

Or 25 megabytes, where you'd have to constantly delete your messages in order to be able to continue to use your email, Gmail was launched with 1 gigabyte of storage. So we knew from the very beginning that that was going to be a potential target for abuse.

Mm.

And when we launched, it was actually in what people view as a very clever marketing move, which was an invitation-only format. So you had to get an invitation to Gmail in order to be able to join, which is now a very common model that we see because it builds up excitement. But for us, what it did was it limited usage so that we would know if the service was being abused at large scale, and we'd be able to actually trace through different branches in order to be able to see who invited that person who seems to be storing a whole bunch of software using the 1 gigabyte and then registering a whole bunch of other accounts in order to be able to do the same thing.

Hmm.

And so we started to see very clever uses of automation from the bad guys. And we saw the exact same thing in trust and safety at Google.

Mm-hmm.

So when we founded the trust and safety groups, and I founded the trust and safety product group at Google, we started to see that cybercriminals were extremely dedicated to using automation. And the automation that they had available at the time was generally hand-coded, logic-based automation. And what we've seen that evolve into over the years now is AI-based automation. But there were so many different time periods that we've experienced since then in terms of cybercriminals getting access to new tools, getting access to open source, getting access to mass quantities of user data. That was really the dawn of it, because before Google created this incredible target, essentially, in terms of the AdSense network and the AdWords network, there wasn't as much of an incentive for cybercriminals to be able to create large-scale click fraud. And now all of a sudden, when they could create click fraud bots, they had the potential to be able to make thousands or even millions of dollars from Google, in their view.

Nolan and listeners, Shuman and I used to work on disrupting multi-hundred-million-dollar automated fraud campaigns, which is crazy to imagine, but truly that was the scale of the problem. Shuman, you had a really interesting observation like 15 years ago that I still remember about criminals Cutting their teeth or sharpening their knives on really big targets and then going down to smaller targets. Can you recap that one for our listeners? Because I think that's such a scary lesson about how this kind of economy works.

You have limited resources whether or not you're a good guy or a bad guy. One of the things that I've always observed is that the bad guys are even more efficient with their resources than the good guys are. And the reason for that is because if they were willing to spend a lot of money, if they were willing to put in a lot of hard work, they'd be good guys because they would be able to make more money the legitimate, honest way. The reason that they're bad guys in the first place is because of the fact that they're looking for shortcuts. And so they always embrace new technologies. They always try and figure out what's a clever angle that nobody else has ever thought of in order to be able to gain advantage for themselves. And so it's difficult to be able to attack 100 different websites simultaneously. There's a lot that you have to figure out in order to be able to do that. So as a bad guy, you start off focused on a much smaller set of problems that have a higher payout. So concentrating on the biggest banks, the biggest airlines, the biggest federal agencies, that's how you can get the biggest payout if you can figure out how to be able to get past their defenses. And once you've figured that out, then those defenses are typically a lot more advanced than the defenses that you're going to find on the long tail of targets. So that's when you can start to automate as a cybercriminal. And so this is a pattern that we've seen many times before where you create something which is very sophisticated for its time from a cybercriminal perspective, and then they actually make it available in a commoditized kind of form to the entire ecosystem of cybercriminals. And as you guys well know, the cybercriminal ecosystem is extremely varied and vast. And so there are cybercriminals that specialize in helping those cybercriminals take their advanced technology, market it effectively, and create documentation for it, create support for it, and then enable a whole bunch of other cybercriminals that don't have the capability to create something so advanced in the first place to be able to benefit from it. So in security, I don't know if you guys have talked about the smart cow problem. But basically, if you've got one cow in a pen of cows that figures out how to be able to open the latch to the gate, none of the other cows have to be that smart to just follow that other cow outside. And so this is exactly what happens from a cybersecurity perspective with so many different types of attacks and certainly with fraud.

I hadn't heard of the smart cow problem.

I just think that it's interesting to think of these cyber organizations As they have bosses too. They have P&L just like everyone else. And what you're describing is sort of an R&D function where you're testing out new methodologies, and then once you find one that works, then you can go mass market. I think it's always sort of hidden behind a cloak of mystique, but they're businesses just like anybody else. And I like the way that you described they're trying to They're trying to take a shortcut route. And yeah, that economy exists just like anywhere else. I heard from Tim that you have a funny story about Anton and the origin of the term credential stuffing. What happened there back in your Shape Security days?

So when we started building the Shape Security platform, we had to figure out how to be able to explain this to the rest of the world and explain the types of attacks that we were dealing with. In particular, what we saw was cybercriminals taking these large data breaches and the usernames and passwords that they were able to steal from them and rely upon the fact that users have terrible password hygiene and constantly reuse their passwords.

Yeah.

And so there's a guaranteed statistical likelihood that if you take a set of usernames and passwords from one website and then try them on another website, that you're going to get typically between a 0.5% and 2% success rate. So that means you can take 1 million stolen usernames and passwords and quickly take over 10,000 to 20,000 accounts in a lot of cases.

That number almost seems low.

Well, the thing is that 1 million passwords is a pretty small website. So if we're talking about a major bank or we're talking about a social network, now we're talking about hundreds of millions of passwords. And the reality is that cybercriminals have had access to billions of usernames and passwords for many years now. So, you know, multiply that 10,000 accounts by 10 or 100 or 1,000 depending on the particular overlaps that you're looking at. And so this was a new form of attack that people hadn't really observed before and they didn't really understand. So we would often see that cybersecurity teams within large organizations would look at an attack like that and they would say, Well, that's not really a cybersecurity problem. The user who is attempting to log in provided the valid password. And so the authentication mechanism is working the way that it's supposed to.

Yeah, working as intended.

Yeah. Won't fix.

That's right. Exactly. And so it took a few years for the fraud teams who would have to deal with that and the cybersecurity teams who were implementing the authentication layers to be able to figure out, you know, how do we want to tackle this and how do we want to own this within each company? And, you know, that was when we started to see the creation of cyber fusion centers. across various large organizations where they would share data, which of course was the way that we had always been structured at Google many years earlier. But when we were explaining this type of attack to the marketplace, we realized that we had the opportunity to introduce a new term to the entire industry, which is a fun thing to be able to do. And so our co-founder, Sumit Agarwal, he had coined the term credential stuffing when he was at the Department of Defense. And so If you searched for credential stuffing on Google at that time, it would come up with fewer than 10 web results, and all of those results would be about people who were padding their resumes. That was the only interpretation of credential stuffing that anybody could make sense of. And so we decided that rather than telling the world, here is a new type of attack and a new term that we've given it, Let's just start using this term and see what happens. Let's see if it catches on. And so we did this with many different stakeholders, but we especially had fun doing it with industry analysts.

Mm-hmm.

So we would go to industry analysts and we would say, oh yeah, we protect against credential stuffing attacks. And they would vigorously nod their heads and, you know, that they would generally not admit that they'd never heard this term before, except One analyst in particular that we spoke with—

Ah, I see.

Who was Anton at Gartner, who had, you know, a tremendous security background and enough self-confidence to say, credential stuffing, what's that? I've never heard of that before. And so I told Anton this later that we were very impressed that you were able to call us on that. But of course, credential stuffing became a term of art and it's used throughout the industry now. And in 2019, In fact, it became the number one security threat on the entire internet according to many different industry publications. And so today, the legacy of that is it's just common knowledge that cybercriminals tend to log in rather than hacking it. So being able to find stolen credentials or being able to guess credentials in various ways, that's the easiest way. Again, cybercriminals are looking for that shortcut.

Yeah.

They don't want to have to figure out some kind of vulnerability in infrastructure if they don't have to. And, you know, there's so many credentials around and so much credential reuse that it becomes an easy problem for them.

Right.

So brief point of order before we move on to talking about your new company, which is you were an APTA debater just like me. And I think it was our experience working together that has given you some kind of pro-debater bias in your hiring. Is that right? I assume it's not like a no homers club, no peacocks rule. It's like a pro-debater thing that you're doing. I reckon. Is that right?

You know, one of the things that stood out to me about Tim was the fact that he was an excellent debater at Brown. And so when we interviewed him at Shape, I remember— and it was funny, you showed up in a suit and tie just like a debater would be dressed at the time because you were coming from the Brookings Institution.

No, get this. I wore a suit and tie to an interview in Silicon Valley and they still hired me. That's the craziest part of the whole thing.

They needed outsiders.

And of course, what I was thinking was, you know, he looks exactly like a debater should. And so I think that, you know, some of the things that Tim in particular did for us at Shape were part of why I have such faith in debaters. Because, you know, in addition to doing product work, he wrote a paper that he presented at an international economics conference. That's not something that a product manager is typically going to be tasked with doing. And I think that it was the debater in him that gave him, you know, that skill set as well as that set of interests to be able to be very broad in terms of how he could help the company, which is one of the things that's so important in a startup. And so this is a tradition that I've carried on since then. So at Reckon, I actually hired a young woman who was the youngest person to ever win the North American Debating Championship. And so we brought her out to Silicon Valley and had a tremendous summer. She was an intern with us while she was still at Dartmouth. And then she went on to win the World Debating Championship. And one of the remarkable things about that is that we hired 2 more outstanding debaters after that because of the great experience that we had with the contributions that she was able to make. And so I think that it, it doesn't even necessarily have to be debating. I think that the general principle that we've discovered is that if you can identify someone who has a great desire to do great things, whether it's in some kind of competitive realm or working on a passion project that shows that they can do things that others can't, then that's often developing a set of skills in them that translates into being able to do great things at work.

Yeah, well, I love the premise of debate where you're choosing a side, and that side might be the one that you feel the most confident in, it might not be. And so being able to understand the limitations of your particular argument are just as important as sort of the pro side. And I can tell you from experience that the debater in Tim is still alive and well here at Google. But let's talk about Reckon and your new startup. I understand that the core premise is that trust on the internet is fundamentally broken. And not just amongst security buyers of security products. Yeah, what are you trying to solve there? And, you know, are we really going to know who's a dog and who's not a dog?

You know, we're trying to deal with the fact that we are now just getting swamped in fraud and in scams through every single one of our communication channels. And we know what this looks like in its end state. Because we already have a channel that has become nonfunctional, which is telephones. So if you get a phone call from a number that you don't recognize, basically it's guaranteed for everyone that it's going to be fraud or some kind of scam. So this is the reverse of the way phones used to work and the way that they were intended to work. So 30, 40 years ago, if you got a phone call, you always picked it up. Because that was a highly trusted channel, and it was simply the way that people communicated in their personal lives as well as in business. And now, one of our teammates observed that we are paying for phone companies to not deliver calls to us. So first, we pay the phone company to be able to deliver the calls. Scammers take over that channel, and then we pay an extra fee in order to get those scam calls blocked.

Stop.

So yeah, but what's crazy is 30 years ago our phone numbers were in a book for anybody to see. I don't have my cell phone in a phone book now, but 30 years ago I did, and I would for sure have picked up that phone whenever it rang.

And that is a great observation because you would think that the information was more freely available then, but of course the information is much more freely available now.

Of course.

And it's for a few different reasons. So one reason, and the biggest reason, is the internet. So just because you've got a Palo Alto phone book that lists everybody's phone numbers, that doesn't mean that someone halfway around the world—

Of course.

—is going to be able to order that Palo Alto phone book and justify paying for the shipping of that in order to be able to manually then dial a whole bunch of people in Palo Alto.

Can you imagine?

Yeah.

I mean, that's simply enough friction that we didn't have to deal with very much of those types of attacks. Now, there were still mailing lists and marketing lists that your phone number would get on, but The number of such calls that we had to deal with were much lower than they are right now because of the lack of availability of free information and automation. And so now all of that has changed. You know, the other thing that has changed is the fact that you've got all of this new infrastructure that's available to be able to make phone calls and to be able to automate any kind of operation that you want to engage with. And so All of this was already headed in a very bad direction. We're, we're talking about phone calls specifically for a second here, but we're talking about all communication channels with RECKON. But with phone calls, this was headed in a very negative direction for many years. And then all of a sudden, generative AI came on the scene, and now cybercriminals are able to fully simulate their side of the phone call in order to be able to imitate whatever accent they want, in order to be able to pull information from social networks, in order to be able to completely simulate what it's like to talk with somebody that you would trust. And so what we want to do is deal with this problem across all of our communication channels, across email, across direct messaging, across all the different platforms that we communicate through before it spins out of control. And this is something that I think of like a giant AI DDoS that we're experiencing right now. Because ultimately, if you have all of those communication channels swamped with fraud and with scams and with cybercriminals who are trying to contact you, then those channels become nonfunctional and you have to switch to a new channel.

And I've heard you talk about this, or I saw you talk about this, and it's an experience that I've had getting into a Waymo car where the first time you're in a Waymo car, you're like, oh my goodness, this is crazy. And maybe that's where we were a couple, 3 years ago with deepfakes and AI videos. But I don't know, for me, it was within 30 seconds. You just stop paying attention. It becomes boring. And you've said that that's one of the concerns that you have with some of these AI DDoS that you're talking about, where your brain just kind of shuts off, right? It no longer recognizes that this might be fishy. And we're sort of reaching that point now where anything you see, your brain isn't going to be able to pick it up. And so you just sort of assume and you start taking those next logical leaps without that sort of voice in the back of your head being like, oh, should I ask for double verification? Should I make sure that this person is actually who I think that they are? So what do we do about that? I mean, you've chosen one of the, I think, biggest problems that exists out there with AI slop and AI DDoS. What are some of the things that you're doing to fight that battle?

Well, there's one very foundational thing that we're doing, and this is the long-term goal of everything that we're doing, and that's to be able to build a new type of trust layer for the internet. So the internet was designed without strong security and trust mechanisms, and we've been dealing with that ever since with all of the commercial use that the internet is now used for. And so we've created some great layers of security, but in terms of trust, this has always been a difficult one because of the fact that nobody wants to have an ID required to use the internet. Nobody wants to have to go through multiple layers of authentication in order to use the internet. And yet that's the only way to be able to guarantee that you can truly have trust by having every single user of the network go through some set of assurance or authentication processes. And this is why there are a number of different countries who have proposed creating mechanisms like this, and states as well.

Mm-hmm.

And one of the big problems with that as a solution is that you still have the rest of the internet to contend with. So if you've got folks that are from outside of your country or outside of your particular network who are going to continue to operate the way that they always have on the internet without any of those layers, then you either have to decide that you're going to still communicate with them and you're not going to get any of the benefits of your network, or you're going to say that I'm not gonna be able to communicate with them at all, which is what you can do in certain very limited instances, like inside of air-gapped military installations. But if you want to communicate with the rest of the world, then you have to figure out a better way to be able to scale that kind of trust layer. And that's exactly what we're doing. So, we're introducing a platform that we've been working on for the last couple of years that simultaneously solves a few of these problems that are related. So, you know, one of the problems is that you want to be able to balance privacy and security. So, if we had the ability to just take all of the emails that an organization receives or all of the emails that consumers receive and analyze them in a separate database, then, of course, you'd be able to provide a lot of insights, and you'd be able to improve security if everyone was part of that. But there's a huge privacy cost associated with having everyone's confidential data. And so how do you do this in a way that it doesn't introduce that kind of privacy cost? And our answer to this is to be able to do as much as you possibly can on device.

I was going to say locally. Yeah, exactly. Yeah. And as models get more and more capable, and as the, you know, devices that we have have more and more compute power within them, maybe that becomes more possible, right?

In fact, it's possible now, we've discovered. And a big part of our R&D over the last couple of years was figuring out if it was possible to be able to create a set of local models that could perform fast enough to be able to provide the type of analysis that we need without sending any of that communications data to a third-party cloud, even our own. And so right now, the model is to do all of the analysis— like, the model for communication security is to do all of the analysis in the cloud because, you know, it's just simpler that way. Mm-hmm. But there's a huge risk that every organization is taking when they're exporting all of their emails or all of their direct messages into a third-party security company's cloud. What we're saying is you don't have to do that with Reckon. You can perform the analysis on device. And it's kind of funny, in order to make sure that our models could perform well enough, I actually went to Best Buy and bought the worst laptop I could possibly find.

Okay.

And that's been my testing laptop personally, you know, during the entire R&D phase. But on regular Fortune 500 laptops, our models are able to perform in exemplary fashion. And so this is a big part of the core of the approach.

Yeah, I see that model gaining traction in a number of different areas, just in voice-to-text or sort of mistyping and being able to recreate the messages that you have. All of those things can run locally. There's no reason to go send that to the cloud anymore. So yeah, I see that as a thread that's being pulled by a number of security-like vendors that you're describing. That's very interesting.

I'm trying to picture you using a netbook on a daily basis, and it's, it's breaking my brain a little bit.

Oh, I won't name which manufacturer it was, but the laptop is terrible.

Yeah, well, you did preface by saying, I bought the worst laptop, so I'm not too surprised it's terrible. So is the premise really that you're going to defend against, you know, globally scaled slop cannons with local models? That's, that's pretty wild.

So it's all about being able to build that layer.

Mm.

So when you've got multiple folks that are using this component, which we call the Reckon Private Core, that incorporates more than just the local models, it also incorporates trust sensors that allow us to determine if a machine is being remotely controlled and if it's been compromised by malware, even if we don't know what that malware is. What that gives us is the ability to provide bidirectional protection for communications for every single device. Now, when one device that has the Private Core communicates with another device that has the Private Core, that's when you start to build a network.

Yeah.

And the really cool thing about this is that there are very few strong network effects in security. So when you think about network effects, there are weak network effects and strong network effects. So a weak network effect is one where Someone uses a system and they start contributing data to that system, and the system gets smarter over time. Then if somebody else uses that system, maybe what that system has learned will help the second buyer as well. Maybe it won't, but maybe it will. That's a weak network effect. And that's why people tend not to say, you're using this kind of fraud protection software, therefore I'm going to use it as well, because ultimately you don't really care. You care how well it performs in your environment as opposed to in somebody else's environment. But a strong network effect occurs when you get a benefit from using the same technology as somebody else, because now you can do something with those other people in a social kind of context that you wouldn't be able to do before.

Mm-hmm.

So for example, there's a strong network effect associated with all of us using browsers that support TLS. There's a strong network effect that's associated with all of us being able to use encrypted messaging services. And so basically what we're trying to do is build that strong network effect by offering something that offers direct value to each individual node first. And then over time, the nodes that are part of that network are able to form that trust layer. And we can build many different applications on top of that. So if you had assurance that a device in your supply chain was actually protected against being remotely compromised and was being protected bidirectionally in terms of all the communications that were being sent to and from it. Now, all of a sudden, you can transact with a lot more confidence than you could in the past. And so that's something that doesn't rely on selling the network effect. It actually relies on providing direct protection in a unique way, and then the network effect automatically Yeah, that's very cool.

Nolan, I should have mentioned that Shuman, in addition to having this product management background, also has a very strong econ background and did an MBA at MIT back in the day.

Soft network effects, strong network effects. I like it.

Yeah, exactly. Okay, so I hate to do this, and I suspect we could keep doing this conversation all day, but I have to ask our traditional closing questions because we're actually way over time. One, do you have one piece of advice to help our listeners tell slop from substance? And 2, do you have recommended reading for our listeners? Could be anything except Anton's blog or except that paper I wrote 15 years ago.

In terms of advice overall, I think that one question that I frequently get asked is, with the proliferation of AI slop and deepfakes and all of the fraud that's so difficult for people to be able to spot, what can I do? And in some cases, especially while we were in stealth, I would say, yeah, there's nothing you can do. You're, you're just kind of in a bad situation. I realized that that wasn't a very satisfying answer or very hopeful answer. But what I do, and I think what we all do in the security industry, is something that most people are not willing to do, which is constantly be paranoid and distrustful of all information that we get, always analyzing it. And I don't think that it depresses us because it's just become second nature now. Like, we recognize that there are many different kinds of fraud. And in fact, you're kind of entertained when you see a new type of fraud that enters your inbox. I had multiple phishing messages that were sent to me this morning, and I shared them with my team. I said, you know, look at this clever attempt. And so I think that that can actually protect you. And if you adopt that mindset, I think that more people over time will just recognize that, yeah, the internet is a place where there's a lot of untrustworthy information. And we have to ask ourselves before we believe something or before we engage with a piece of content or a communication, who did this come from? How do I know that it actually came from them? And this is really a good principle in life in general to be able to protect yourself. And I don't think that it's necessarily a negative thing. The real answer is we need some help from technology, too.

Mm-hmm.

And so this is one of the reasons why having an application that works for you, that uses AI in a way that is particularly appropriate to be able to understand natural language and to be able to analyze all of the things that you can't see with your own eyes to be able to warn you of threats. That's why we need something like this. And it's so important for humans with the right mindset And technology to be able to work together.

That right mindset— I'm going to throw in a Harry Potter reference here. When Mr. Weasley goes up to Kingsley Shacklebolt and he says, what was the last words that Dumbledore said to me? Because he wasn't sure whether Shacklebolt was an imposter or not. And it was something that only the two of them would have known that the other had heard. And that kind of paranoia, I don't know, that's just like this this image that sticks in my head when I think of, I don't know, elderly people picking up the phone and trying to understand whether this actually is my grandkid on the other end of the line. And that level of paranoia is healthy. And I think that mindset of trust but verify is something that we can all probably do a little bit more, especially when you're engaging in technology.

Right.

This is not something that you need to do when You know, I walk up to you on the street, Tim, right? But maybe when I'm chatting with you over some digital airwaves, that could be a mindset worth taking.

I had to do this with my father the other day. It seemed like my father was asking me, what's your Social Security number? I didn't know if it was him, and so I asked him a question that would be very difficult for somebody to answer that wasn't my, my actual father. Yeah, yeah. And not, you know, how tall am I, because anybody can find that on the internet. Shuman, thank you so much for joining us today. There are so many things we could have talked about, like who you debated with at the Worlds back in the day. We, we could have talked about so many other things from our days at Shape, your days at Google, but I really enjoyed this conversation. So thank you so much for joining us today.

Thank you. It was a pleasure being on.

And now we are out of time. Thank you very much for listening and of course for subscribing. Please subscribe so you can get new episodes piping hot. And if you love our content, Please drop us a review on your platform of choice.

You can find this podcast on YouTube, Apple Podcasts, Spotify, or wherever you get your podcasts. Also, you can find us on our website, cloud.withgoogle.com/cloudsecurity/podcast. You can argue with us on the Google Cloud Security Community site, googlecloudcommunity.com.

You can follow us on X, x.com/cloudsecpodcast. Tweet at us, email us, argue with us. And if we like or hate what we hear, we can invite you to the next episode.

See you on the next episode of the Cloud Security Podcast by Google.