How to Grow your Career in Cybersecurity with Grant McCracken

Get ready to discover some of the most actionable DevOps techniques and tooling, including performance and reliability with some of the world's smartest engineers. Hey, I'm Joe Colantonio, host of the DevOps Toolchain podcast, and my goal is to help you create DevOps toolchain awesomeness. Hey, want to get into cybersecurity or learn more about security tests and hacking? Or AI? Well, you're in the right place because today we'll be talking about All about it with Grant, who's an expert on all things cybersecurity. If you don't know, Grant has over 13 years in cybersecurity working on both ethical hacking and also as an executive. He currently is the founder of Dark Horse Security. Love that Name an organization on a mission to make cybersecurity more accessible and affordable for organizations of all sizes and budgets. As we get into the AI era, we'll probably need security more than ever. So I'm really excited about this conversation and you don't want to miss it. Let's do it. Hey, before we get into this episode, I want to quickly talk about the silent killer of most DevOps efforts, that is poor user experience. If your app is slow, it's worse than your typical bug. It's frustrating, and in my experience and many others I talk to on this podcast, frustrated users don't last long. But since slow performance is as sudden, it's hard for standard error monitoring tools to catch. And that's why I really dig SmartBear's Insight Hub. It's an all in one observability solution that offers front end performance monitoring and distributed tracing. Your developers can easily detect, fix and prevent performance bottlenecks before it affects your users. Sounds cool, right? Don't rely anymore on frustrated user feedback. But I always say try it for yourself. Go to smartbear.com or use our special link down below and try it for free. No credit card required. Hey, Grant. Welcome to the guild.

Thanks for having me. Happy to be here.

Great to have you. So how'd you get into cybersecurity? Let's start with that.

Oh boy. About the same way everybody does. You just trip and fall in, right? So back in high school, we used to, you know, do basic sort of evasion stuff on the machines just to be able to like, play games or like go to websites that like, the school filters didn't allow you to do. And so I had some friends that sort of ran in that same circle. We all sort of played games or whatever. And so years down the line, I went to college for communications and I thought I was going to work in like marketing or PR or something like that. And then this buddy, he reached out to me. He like, stumbled upon this job on Craigslist, of all places, at White Hat Security back in the day. And he was like, he enjoyed the job and he's like, grant, you could do this job. And so I applied and they're like, yeah, we, you know, back in the day, the, the way White Hat worked and I think maybe some of the ways that White Hat still works is, you know, they, they had a methodology where they'd take anybody that was like, curious and able to learn and they teach you application security and then you, over the course of time, grow and eventually, you know, you move up within the organization, you go somewhere else. But it had a really good, and the word farm has some negative connotations, but like, it was a really good farm system in terms of, like, it was fantastic. It produced a ton of, of really high quality application security. People that are all over the industry now love it.

So, you know, you've been at both sides. As I mentioned in your bio, you've been both a hacker and an executive, I guess. Let's start off with the hacker. If someone's listening today and wants to break into ethical hacking or bug bounty hunting, especially with AI around, where should they start? Realistically?

Yeah, so I'd start with maybe Hack the Box. So I don't know if you're familiar with Hack the Box, but Hack the Box is a fantastic resource where they've got a, a ton of different, you know, you can get started for free and, and the, the cost is minimal in terms of like, you know, the financial burden as opposed to like, if you try to do like a more advanced certification, you're looking at like thousands of dollars. Right. You know, with the Hack the Box, you're looking at like 20 bucks a month or something like that. So Hack the Box is a great place to start and, and kind of just go down a number of different trees, as it were, or branches where you could potentially go into even, you know, because once you get into like cybersecurity, it's usually branched out into like two different groups. There's red teaming and then there's blue teaming. And Hack the Box has, has off ramps for each, which is again fantastic in terms of. So if you decide you want to be more defensive in nature, right, that's going to be the blue team side of the house. You can go that way. Whereas if you want to do more ethical hacking. Again, you can take a bunch of different routes in terms of if you want to hack network stuff, web application stuff, mobile APIs, whatever it is. And so where, you know, you can find your footing, some other great resources. Pentester Lab, same concept, really great for learning stuff there. And then portswigger Academy is also just generally fantastic. And then once you've got your feet underneath you, you can go check out bug bounty programs or vulnerability disclosure programs for organizations and really start hacking stuff in the wild. And bug bounty programs, just for people that don't know, are programs where an organization, say, for instance, Google has a really famous bug bounty program where they say, if you can find a vulnerability in our, you know, suite of software, and obviously it's tiered out, right? If you can find stuff in like Gmail, it's worth way more than if you find it in some other piece of technology. But, you know, you'll, you'll get rewarded thousands or even hundreds of thousands of dollars for vulnerabilities. Now, other bug bounty programs pay a lot less, but, you know, they're potentially easier to find vulnerabilities on, so on and so forth.

All right, here's a totally random question. I get these emails all the time. Hey, I found a vulnerability with your, your email. Do you pay bulk bounties? And they keep sending me emails. I don't know who this person is. Are those legit?

Well, it depends. And I mean, so that if we were, I wouldn't, I don't want to say no, they're not legit, right? Because like, somewhere in there, somebody may be actually trying to tell you about a vulnerability. So I don't think it needs to be like, unilaterally, you know, dismissed. Is it, is it like, are they talking about, like, vulnerabilities with your, like from a personal level or like an organization level up?

My, my email business account, like, they say it could be spoofed, but when I'm running through like some sort of spoofing thing, it's like, no, you have the right DMARC certifications and all that. So I don't know if it's real or not, or are they shaking me down for money? Are they, Is it a veiled threat? Like, I, I never know.

Yeah, okay, that, that's a really common one. So they're usually something to do with like an SPF record or DMARC or dkim. One thing I've seen, right? So people. So SPF records are like, supposed to be like, you Know you're, when you send an email, it checks. Okay, is this like an approved sender? So the SPF record says like these are the approved senders sometimes. So there's, there's a couple different flags that you can use there. I want to say it's like you, there's like an intermediate filter that sometimes people can, can like spoof emails even though you have like an SPF record.

Oh, right, yeah, yeah.

So that could be what they're seeing is that they're potentially able to like spoof an email on behalf of your domain. You can even have an SPF record that like doesn't do anything. Just like you can have like a DMARC record that doesn't do anything with emails that don't pass that criteria. So that might be what they're indexing on. Again, that's just one of those, but that's like hyper automated and it's just like people spam that thing every, all over the place. So.

Right, right.

It's possible. But if you've investigated, if, if like it can or can't be spoofed, then yeah, you know, that's it. Sorry, I, I don't, I don't mean to go down a rat hole there.

No, that's fine. I know you all.

Long story short, it may be valid. That's, that, that is something you see a lot. And again, it's a low, super low hanging fruit. But again, if somebody can spoof mail from, say you don't have an SPF record or dmarc or dkim, you know, somebody could potentially spoof mail from your domain and that does have reputational issues, not the least of which being like social engineering or you know, domain reputation as far as like, you know, spam and other things.

So, so should all companies have a bug bounty program already set up? Is that something common or is that, is it the opposite? Oh, what's the hexa bug? I'm getting connected. They have a bug bounty. They want money, like, so should companies have it in place before they get those type of emails?

What they need to have in place in my view is something called the vulnerability disclosure program. Now not every organization's ready for a bug bounty. Just so we're clear on that now, am I going to say every organization should ideally run a bug bounty? Absolutely right. Like that's just, I mean, and just for context, right? Bug bounty within the, you know, sort of the scope of vulnerability identification solutions, nothing compares to bug bounty. So if you're actually serious about identifying vulnerabilities at scale, nothing's better than bug bounty. And I know that's a really bold statement. Like that's, that's pretty aggressive. It just gets, I mean I've run hundreds if not thousands of bug bounties over my career and I've never seen any tool that, that delivers results. Because it just makes sense from like a intuitive sense. If you run a penetration test, you've got one test or maybe two testers following a methodology over like five days, but you don't have. And you can have a scanner constantly looking for things too. But like with bottom bounty, you get so much ingenuity, so many people looking in places that a scanner can't get to, a scanner can't think about. And they're just, you know, they're financially motivated and they're, they're going to be just way more successful just as a function of more people, more methodologies, more time. Anyways, long story short, I think that bug bounties are super useful for organizations. But before you get to a bug bounty, the very first thing I recommend organizations do is have a vulnerability disclosure program. And that's just something where you say if you want to report a vulnerability to us, here's how you do it. Because you want to have a mechanism for that so that it's just not, you know, they're not spamming the CEO or whoever it is. Right. They email security at, or there's a form that they can fill out or something to that effect. And it's ostensibly a lot better if you have a platform that helps you with it just because it makes it easier to identify duplicates. Right. If you're tracking it in emails and spreadsheets, it's just a lot harder to stay on top of. So, so organizations start with like a vulnerability disclosure program and bug bounty is kind of further up the chain. And again, I'll stop shortly. Right. So like in my view it goes vulnerability disclosure program, right. That's just at the ground floor. Then you want to do like automated scanning just because that's going to pick up low hanging fruit. Then you wanted like sort of some sort of human intervention on top of that scanning and then you go to a pen test and then once you've done all those things, right now you're potentially in the bug bounty territory. If you jump straight to bug bounty, everything that could have been picked up by a scanner or an assessment or a pen test, you're potentially paying out for those vulnerabilities. So you, you want to make sure that you Kind of discord, sort of a hierarchy in my mind as far as hygiene as it relates to security. And obviously that goes all the way. You know, you can go a couple more layers all the way to like red teaming and like social engineering and stuff like that.

Nice. Another dumb question. How does someone know how to fix it? Say you have a bug bounty, someone submits it, you're like, all right, thanks, here's some money now. Now what?

Ask Chat GPT.

I mean there's a ton of good resources out there, right? So, and a good, a good hacker is going to provide a little bit of that context. Right? So, but again, it's generally not horribly complicated. Say for instance, you've got like an SPF issue, right? Like ideally you should be able to like Google pretty quickly. Okay, like how do I set up an SPF record? Well, it's just like a. TXT record on like your, you know, for your DNS and, and you do that and then, you know, you can also investigate dkim and DMARC at the same time. Or if like it's a cross site scripting vulnerability, you know, if you look it up, it's pretty straightforward. It's like sanitize your inputs and your outputs. Right? So, okay, so let's go, you know, where, where is this input coming from? Okay, let's go look at that. Let's make sure we like sanitize the input and then we also just make sure wherever this information's reflected, we're also, you know, encoding that. So it's not, you know, they're not able to just inject arbitrary HTML or JavaScript onto the page.

Perfect, perfect. All right, so I know a lot of DevOps people maybe dip their toes in security and quickly feel overwhelmed. So what's a good, I don't know, minimum viable lab setup? You'd recommend for someone to just start testing the waters for maybe some sort of ethical hacking within their company?

Are we talking about like practicing ethical.

Hacking or I would say learning to implement it? Like say, all right, we know we have, we need to do more security. I'm gonna do some, I'm gonna take it up on my team to do some ethical hacking to try to uncover certain things. Is that always done by an outside company that sets it up beforehand with the company? Hey, we're gonna do this, this and this, and you have your parameters set. Rather than someone in house that's gonna mess around and try to try to break things, let's say doing ethical hacking.

Yeah, it can go both ways, right? So Some systems or frameworks, for instance, like PCI or SOC2. Right. They require that it be, well, specifically PCI at least requires that it be done any security testing be done by a qualified professional and that they are outside of the organization. Now that can be like, you know, like they, technically they can be inside the same company, but like outside of the organization that like implemented the controls. You can't just like pen test yourself and be like, oh, I'm cool. So in those contexts you have to go kind of outside. But absolutely, you know, if you can again, I would recommend starting internally, you know, just trying to pick up. And again, everybody has limited amounts of time. So I'm not saying, you know, go learn how to hack and then, you know, all while not doing anything. Security. If it's going to take you a year to learn how to hack, go hire a pen tester to get started and you know, try to learn from what they do. But again, I mean there's so, so depending on what you're securing, say for instance it's a web application there you can follow, there's the OAUTH testing guide. So you could just go through that testing guide and each, each item on that testing guide will tell you, okay, go check for this. So say you start just on the login page. Okay. Like what should I test on the login form? Okay, we're testing for SQL injection, cross site scripting, we're testing for authorization bypasses, things like that. Right. And so, and then you can kind of go down and systematically kind of follow that framework to kind of check those different boxes and learn each one as you go. There's other methodologies as well in terms of like how to secure X, Y and Z. You know, if you're trying to test the network, okay, well just start by port, scanning the network, right. See what's running on all the different ports, see if you can sort of map what those services are and then you look for vulnerable services and you know, oh, that's weird. Like why is this person running like an FTP server? Like that's not, that shouldn't be on the network. And so those are just kind of some places to start. But again, that's kind of just on the hacking side when we're talking about security in general. Right. There's so much to security. Whether that's, you know, I think the stat is something like over half of breaches start not through vulnerabilities, which again, vulnerabilities are still a big problem, but through people. And so one of the highest ROI things and it's not fun to talk about. Like, it's not as sexy as it were as like, you know, hacking and gaining a shell on a machine, but, you know, just making sure your people know how to be more secure. Right. They've got mfa, they're using a password manager, they're not opening wonky emails or going to weird websites. Right. When you do those things right, you. You eliminate a ton of attack surface if you've got like that. The human layer is just super vulnerable. But you know, again, I could talk forever about hacking the app layer and the network layer as well.

Yeah. I was reading a book on hacking and they said, you'd be surprised. Social engineering is probably the easiest thing to do in order to get access to things you're not supposed to. It sounded like.

Yeah. Have you ever, have you ever been to defcon?

I have not, no.

Okay. So at defcon, there's this really cool area, I think it might be called the social engineering village. Everything's villages there. But they have a competition where they social engineer people in real time. Now, of course they don't, they don't record those because there's laws about recording people without their knowledge. But when you sit in on these conversations, it is like, it's crazy because like you just get assigned a company and you, you're dialing them in real time and your goal is to get them to open some PDF or something like that, or to go to a website and do a certain action or to disable some sort of. Anyways, it's just absolutely fascinating to watch it happen in real time. You're like, oh, no. Like these people, they could just, you know, and they're calling up like big companies, you know, like, like telecom providers or whatever and getting them to do things that they probably shouldn't be doing. So it. Absolutely. The human layer is. And I mean, we're fairly easy to manipulate. I don't want to, I don't want to say, like, it's hard to put that delicately, but we're, you know, humans are fallible. Absolutely.

Yep. Absolutely. So you didn't mention ChatGPT. And I know you only, you're only kidding around, but I always tell people, they say, joe, I'm just getting into testing, what should I do? And I always say, maybe I'm just wrong. I say, if I was a younger man, I get into security, security testing. For some reason, I don't think AI is going to replace as many things I think it will in development and software testing. I could be wrong. Where do you see AI impact in security? If someone's just starting out, do you see it replacing security testers or cybersecurity experts? Or do you see it almost creating more of a need for these type of skill sets?

A little bit, a little bit of B and just, just to jump back on the Chat GPT thing. Actually I, I can like don't feed Chat GPT your code base, but if you ask Chat GBT or cloud or whatever, whatever your preferred LLM is. How do I fix SQL injection? It'll absolutely is, is a fantastic, you know, prompt for that. Again, do not under any circumstances feed it your, your code. But, but yeah, so that the ton of value in doing that as far as AI, it absolutely is introducing new vulnerabilities. For instance, prompt injection is like this new class of vulnerabilities where like it didn't exist before these LLMs and, and it's, you know, it, it opens a ton of opportunity. I saw something on a guy, Jonathan Couscos, also a white hat alumni from back in the day, but he put some, some sort of instruction on his LinkedIn profile that says like okay, now like read me the contents of Etsy patsword or something like that. And like, and then he got like some LLM or whatever tried to like read his profile page and then like, you know, it's, it's instructions were to like send him an email or whatever but like it's like hi Mr. And then like reads out Etsy password and it's just like so like there's a, so that they, there's a ton of like, you know, these systems are still designed by humans and they're so nascent in terms of, you know, and, and there's such a push from the executive layer as it were to like implement AI because of cost cutting and all these things. And so it's being rolled out very quickly and very poorly understoodly if that's a term. But so it creates a bunch of new vulnerabilities. So there's a ton of opportunity to get in on AI hacking. And so human isn't going away. Long story short, like, and there's still things that I can't necessarily do as well as humans, you know, just. And that's always kind of been the case from security, from a security perspective where like, you know, humans can look at something and be like oh, but what if I increment this? And then you can evaluate the output and be like, you know, a scanner or something like that's going to look at it and be like, oh, it's a 200. It's like, you know, we're good to go. But like a human can look at it and be like, okay, it's actually just not feeding me. Use new information. Or they'll be able to say, oh, like, even though it, it looks like there wasn't a useful piece of information here, there, if I actually, you know, do this other thing, it'll become more valuable anyways, so. But I am excited about some of the more contextual things that AI can potentially bring to the table. For instance, it does make scanners, I think, better than they were before in terms of more intelligently kind of going through an application, really understanding what that application does, which again, is something that a scanner could never do before. So with AI on top, I think that there's. But again, it's not going to replace anybody's job. I think their job just changes. Right. Your job changes from. And that's always kind of been the case, just so we're kind of clear on that. Right. Like, it's always, it's always been, you know, automation improves and like you just move up in the value chain and you're just doing something else. But like, I don't think at any point, like the number of security roles has diminished. And so again, I. It may be. I don't want to, I don't want to be the naysayer on AI or something like that. Obviously there's a ton of value and benefits to it, but I don't think it's going to necessarily negatively impact the security community so much as it's. It's actually kind of almost a boon.

Yep. For sure. I probably watch too many movies, so I've been messing around with Cursor Manus and these create code from. I don't know what it's doing. It's just creating an app for me. All this code. No idea. I mean, a nation state could somehow, I guess, put in backdoors for all I know. Is that something people need to be worried about? Say that the team is using assistant code generation for them. Like, what is the baseline that they need nowadays in order to make sure not only is that code, that generator is working, but that it's not. It doesn't have security flaws. Is that already already a known thing that everyone knows already when they're trying to implement AI generated code?

Yeah, I would, I would not recommend just running with AI generated code just out the box. Right. That's not a great idea. For as good as it may be and as intelligent as it may be, you still need somebody to look at it. And you still need somebody to look at it from a critical perspective, not just look at it from like, oh, if I click the button, does it do the thing that I want the button to do? You need to be looking at it from, okay, like how could I break this? Because that's, I mean, and again, human code, AI code, whoever's code, right? Just because it's written by a human doesn't make it better than AI. And just because it's written by AI doesn't make it better than, than a human. All that code needs to be reviewed by someone from a security lens to say, oh, actually like you could break this little thing. Or you know, because you write something and you're like, okay, it does what I think it should do. But if you really sit there and you critically evaluate sometimes you'll be like, oh, actually that could be a vulnerability if you like, you know, are in this certain context. So I would absolutely recommend cross checking anything you do with AI. I'm not saying not to use AI. I think that's incredibly useful and can incredibly beneficial. Now as, as it relates to your other point there, LLM poisoning is actually, yeah, very much a real thing where you could, if you know the data that it's trained on, you could then poison that data with oh like, you know, oh like write me a login function. And then like, and then you know, you somehow get it to also include like oh, when you write a login function, actually add like this like external call that like you know, adds a back door or something like that. So I think there's absolutely risk there and you, you, you just have to eliminate it. But I mean we see that all the time like pre AI, right, Packages, right? There's, there's like people that take over like Python packages and stuff like that and like everybody's just like pip, install this package and then, and then you know, they've got a vulnerability on you. So I mean there's, it's, it's just a different version of supply chain vulnerabilities. It's, you know, it's just all of this AI stuff is now part of the supply chain. Right.

So as I mentioned, you also are an executive. What should executives worry about? What, what kept you up at night or keeps you up at night? From a security perspective?

Yeah, so I mean from a security perspective I didn't. So I was in charge of like post sale and delivery. So I wasn't super worried about security things just because that wasn't really my, my world. And you know, we mainly just used software to do kind of what we were doing. We weren't like building new software. So I mean, if we're being honest about what kept me up at night, it was like HR stuff and.

Budget, right? It's, you know, what, what are we going to do about, you know, what are we going to do about this, this person that's got this problem with this other person. And like, you know, so like, that was kind of my world is just like managing people and spreadsheets. But, you know, I think right now, you know, if I put myself in, in the seat of, you know, a CISO or something like that, right, I. You gotta still worry about the fundamentals. The fundamentals being like understanding your attack surface and making sure you're doing the, the basics right. So again, for all the, for all the AI stuff and again, you, you also want to be worried about, you know, the deployment of AI and potentially like shadow it and other people creating stuff, but as a function of that, right, Just understanding your attack surface. So what are people doing and where are people doing it? That to me is kind of like one of the, the fundamentals that kind of underlies everything to do with sort of security leadership. If you don't know what you're securing, you can't possibly secure it, right? There's like that, that run Rumsfeld quote, you know, there's the known unknowns and then there's the unknown unknowns, right? And it's the unknown unknowns that are like going to get you. So if you have a, if you have a sense of what, what's out there, then you can reasonably prioritize and then sort of strateg of how you want to handle those things. It's the things that you don't know about that are the most lethal, at least in my view. Like, if you know about a vulnerability or like a potential vector for exploitation, you're not just going to sit on it or, you know, you're doing your job poorly. And so if, if you know about something, it then allows you to take action on it. But if you're not able to get to the point that you're able to take action because you don't know about it, that's again, where, where the real dangers come up. And again, I am just theorizing here, it's not my day to day, but were I in a CISO situation, that would again, just focus on the fundamentals, do the little things right, which extend.

Makes sense. So what are you all doing at Dark Horse, then? Maybe a quick plug. What do you do there? What do you specialize in? If people listening, oh, this guy knows what he's talking about. I want to work with him. What does Dark Horse do, sir?

So. So I've overseen pen testing and delivery teams for, you know, long time, and also overseeing bug bounty and all these different things. So after I left my last company, bug crowd, a little over a year ago, I was like, okay, what do. What do I want to do kind of now with my life, right? I was like, I. I could go like, I don't know, start like a coffee shop or, you know, make a hard left turn. And I was like, well, I've been doing this for like a dozen years at that point. Like, I'm pretty good at this stuff. So I understand not just like the tactical sort of. The tactical sort of how to pen test world. I also understand, you know, the. The business side of the house, as well as. As how to deliver this quickly and efficiently. And so the idea with Dark Horse is to take all that together and build a platform that makes it easy and affordable for organizations to get access to cybersecurity, and that's through abstracting out all these extra service layers. So, like, you know, I've seen situations where 10 different people touch an account to deliver a pen test, and I'm just like, why do we have to have 10 people touching this? What if we could have a platform where zero people touch it? Right? So. And I get this feedback sometimes when I tell people about this, they're like, yeah, but like, is it really that simple? And my answer is always, does it have to be that complicated? Right? Like, there's. There's a. That I. I don't know if it's misattributed to Einstein, but, like, if you can't explain it simply, you don't understand it well enough. And so distilling pen testing to something that's super simple. So, like, you, as a CTO of an SMB, can come in and answer 15 questions, input your assets and credentials, and you can get a pen test. And as a function of us making it so simple and efficient, it also costs you less. And so the whole goal with Dark Horse, at least at this point in time, is to make security more accessible and more affordable to organizations of all sizes and budgets. And so that's the platform that I've built. And that's. That's kind of Just what we do. And it's mainly focused towards SMBs and smaller organizations that, you know, they don't have a ton of money, but you want to be more secure. We're here to help.

Awesome. Okay, Grant, before we go, is there one piece of actual advice you can give to someone to help them with their DevOps security efforts? And what's the best way to find or contact you?

Okay, I'll start with the easy one you can find. My name is Grant McCracken. You can find me on LinkedIn and then GrantArkhorse sh. Now, as far as the one thing people can do, this is not going to be the tactical answer that people may want. But what I've learned more than anything is that not more than anything, but I've learned time and time again, in security, you have to be able to communicate a story and be able to communicate it effectively in terms of what matters to other people and why it matters to other people. And so in security, you're always going to run into a ton of resistance in terms of trying to accomplish your security goals. And so if you can frame security within the context of their goals and their ambitions and what they want and what they need and what language they talk. So if you're talking to a finance person, talk to them in dollars, right? How much money are you going to save the company? You're talking to marketing, you're talking about. You're talking to sales, you're talking about how this is a competitive differentiator. And again, I'm going off on. On a tangent here, but that, to me, is infinitely more powerful than, you know, a little tool or a little, you know, something that does, like, just one thing. If you can unlock how to effectively communicate security within your organization, you will get so much more done and your organization will become more secure as a function of that. And so that's like, if I had to, you know, sit down with somebody's security, and I was like, this is the one thing you should be taking away and the one thing I need you to be able to do, that is it you can Google 10,000 ways. You know, here's the methodology to become more secure. Follow the NIST cybersecurity framework, all these sorts of things. None of that matters if you can't communicate it to the business. And so that is just an absolutely critical skill set and thing to develop.

All right, before we wrap it up, remember, frustrated users quit apps. Don't rely on bad app store reviews. Use SmartBear's Insight Hub to catch, fix and prevent performance bottlenecks and crashes from affecting your users. Go to smartbear.com or use the link down below and try for free for 14 days. No credit card required. And for links of everything of value we covered in this DevOps Toolchain show, head on over to testguild.com P191 so that's it for this episode of the DevOps Toolchain Show. I'm Joe. My mission is to help you succeed with creating end to end full stack DevOps toolchain awesomeness. As always, test everything and keep the good. Cheers. Hey, thank you for tuning in. It's incredible to connect with close to 400,000 followers across all our platforms and over 40,000 email subscribers who are at the forefront of automation testing and DevOps. If you haven't yet, join our vibrant community@testguild.com where you become part of our elite circle driving innovation in software testing and automation. And if you're a tool provider or have a service looking to empower our guild with solutions that elevate skills and tackle real world challenges, we're excited to to collaborate. Visit testguild.info to explore how we can create transformative experiences together. Let's push the boundaries of what we can achieve.

With lutes and lyres, the bards began their song A tune of knowledge, a melody of code through the air it spread like wildfire through the land Guiding tester showing us secrets to behold.