The Pitfalls of an Unchecked ITAD Program

Greetings, this is David David from Compliant Standards LLC and welcome to today's podcast. I'm excited to introduce our special guest, Kyle Marks, the founder of RetireIT. With nearly 2 decades of experience, Kyle is clearly a veteran in the IT asset disposition sector. In this episode, we'll be diving into the evolution of ITAD, its current challenges, and obviously future opportunities, drawing on Kyle's extensive insight. The ITAD industry, while relatively young, has seen significant movements and transformations over the decades. Kyle Marks, who began his journey with RetroBox before eventually creating RetireIT, is going to share with us how the industry has evolved. We'll be discussing the critical role ITAD plays in managing the lifecycle of IT assets and why it often remains underappreciated by corporate leaders, CIOs, IT and procurement managers, etc. Key challenges such as awareness and compliance highlighted by high-profile data breaches like the Morgan Stanley incident underscore some of the consequences of non-compliance with ITAD regulation. Kyle Marks emphasizes the importance of robust internal controls and regular compliance checks to eventually mitigate risks. Additionally, we'll explore opportunities for improvements, including the use of third-party trackers and auditors, enhanced tools and technologies to, you know, to track assets, greater industry collaboration, for example, proactive measures for data security, and the growing emphasis on sustainability and environmental responsibility. Join us as we unpack these insights and more with Kyle, shedding light on how companies can navigate the challenges and seize opportunities in the ITAD industry. Kyle, thank you so much for coming today. I am thrilled because you've been in this industry for a little, probably a little over 17 years if my math works. That's about half the age of the average ITAD company. Average ITAD company is about 35 years. What we did is took 30 companies that are active in the ITAD space, looked at when they were founded. We removed a couple of outliers. HP, for example, has been there since the, you know, for a long time. Many of these companies have been there. So we removed the outliers. When you take roughly 29 companies, the average is 35. How do you feel at 17 years old? 3 years from now you'll be 20.

Well, We actually turned 20 in a month. So you did? Yes. Next month we, we have our 20th anniversary and, uh, I get in, I got in the industry, uh, slightly before that. There was a company called RetroBox that was the original company that became Integra. So that's how I actually got into the industry. So, uh, it's been a while for sure.

So I, I think, uh, many of the search engines out there, including, uh, ChatGPT. Uh, say that you guys were founded in 20— in 17 years ago exactly. Uh, so you, you're no longer a teenager. How's, how's the journey so far?

Well, I have to say I've never been more excited. I've always been an optimist. I, I still, you know, the reason I got into the industry or fell in love with it was because it was fragmented, messy, and it was going to be around for a very long time, you know, for foreseeable future, there was a lot of opportunity. And I would say today I'm, you know, even more optimistic about the prospects.

So, yeah, and it's, it's a weird thing because I do recall when I was literally dragged into this market back in 2003 to give a speech on a, in a conference on the future of devices and technologies. And, you know, in the beginning I sort of dismissed it as like, who is tracking this market? Really no one. But it turned out to be a much more interesting industry than what I was tracking back then, which is the brand new equipment market. And it, it is true that it, it has a lasting effect on you in a sense that even if you try to leave it, at some point you're gonna go back to it because it, it's such an interesting dynamic market. And yet I sense that things haven't really drastically changed since I started covering this space in 2003. In terms of how the sector is perceived by, by the end user, by large companies. But there's, there's certainly traction there. I mean, there's a lot of regulations, there are norms and standards that came out since 2003. There are certifications that have hit the market. And so certainly there is traction in terms of where this industry is moving going forward, but it is still less, uh, of importance in the eyes of CIOs, uh, of corporate leaders, when, when you compare it with, with their commitment to the IT infrastructure in general. Does that make sense?

Absolutely, couldn't agree more.

And so are you witnessing any changes there? And you wrote an entire book on this.

Well, I, I wrote the book because it allows people to see the issues that, you know, many of us already understand who are in the industry. But, you know, using illustrations, you know, there's a little bit of humor. Illustrations allow you to see yourself in it. It's, you know, not, you know, vendor-specific. These are general safeguards and issues that we're talking about. But what I certainly share the sentiment that this is not a top-of-mind issue for CIOs or CTOs or, or CISOs. You know, there's only been a handful of significant events, you know, in my mind that have happened over the last 20 years. And, you know, we all talk about them, but we really don't even study them that closely. And, you know, the most, you know, recent, you know, significant one was, you know, the Morgan Stanley breach. And, you It, it still isn't that well understood. You know, the two breaches, you know, one got all the coverage, the other I view as, you know, far more important. And, you know, by its very nature, you know, ITAD was deemed cybersecurity. You know, the SEC said as much. And last December, new cybersecurity regulations went into effect. You know, the SEC But I would wager that most CISOs, if you ask them if ITAD were cybersecurity, they wouldn't, you know, naturally come to that conclusion. Right? It's, it's something that's not, you know, not top of mind. It's not, you know, their daily activity. And so it's an uphill battle to raise awareness and to even get it on the, you know, the CISO's agenda.

You look at this Morgan Stanley breach, and what you realize is sort of a disconnect between how ITAD is positioned in the ITAM structure. On the one hand, Morgan Stanley spends a little over $7 billion, pro— probably close to $8 billion in its IT infrastructure. And that's absolutely correct. That's the right thing. I mean, the entire technology is basically the, what really drives the operations of a financial corporation. So IT is absolutely the backbone of a financial services corporation. And so I'm not really surprised that they spend close to $8 billion a year. What is surprising is that at the end of that lifecycle, there is very little oversight that leads us to a breach that you have been talking about for a while that's costing the company $160 million minimum and probably more. One would argue that compared to a $7, $8 billion investment in technology, $160 million is nothing. But it is, it is at the end of the day a lot of money, and it's also reputational risk. What is it, do you think, that's making companies not so in tune with with that particular thing that is end of life, which is absolutely critical, and we can talk about that, why is it so important in a moment?

Well, I don't think companies have, you know, paid the price for noncompliance. And I'm not saying that, I'm not, you know, hoping they do, but I'm saying that, you know, it's a rational decision not to spend too much time or energy or resources on it if there aren't any consequences for, for not. And so I, I believe there's a, you know, kind of a, you know, a lack of awareness and understanding. You know, you seem to know a lot about Morgan Stanley. If you had to guess, I'm not picking on Morgan Stanley, but just in general, if you ask, you know, an organization, asset managers, you know, how accurate is their inventory? Like what percent of assets at it, you freeze time could they account for? You know, best in class. What percent of, you know, assets could a company definitively say they know exactly precisely where it's at?

Look, I mean, we did a number of surveys, and I can tell you that knowledge on where devices are even physically at any given time is not there for a substantial share of the respondents. I can't remember the exact number, But it is in the double digits for sure that people that are tasked to, you know, to secure corporate assets, they themselves don't know where those assets are at any given time. Software is making progress for sure. I mean, there's a lot of online tools now that they can use to track that. But to your point, it's not a priority. And I think to your point, there's no punishment at the end of the day.

It doesn't— Well, there's not. I think if privacy advocates would actually understand that, let me just say 85% or 90% is, is a good number of, you know, hardware accuracy. You know, if, if Morgan Stanley could only account for, you know, 90% of its, you know, cash, you know, that would be an issue. If a, if a school system could only account for, you know, 90% of its students, that would be an issue. If an airline could only account for 90% of its, you know, baggage, it would be an issue.

Yeah.

You know, but with hardware asset management, it's, you know, it's, you know, a shrug of the shoulders because it's very hard, right? I mean, when a company purchases the assets, by the time they deploy them and put them into use, you're already off by a couple of percentage points, right? And, you know, and IT asset management is a series of check-ins and checkouts, you know, moves, add changes, you know, I view ITAD as the final checkout. And it's fundamentally different because it's being checked into a, you know, into a third party. And oftentimes there's, you know, there's, there's, you know, data at stake. You know, when you buy assets, if you bought 1,000, you know, laptops and only received 999, somebody in procurement would know. They'd notice. They'd cry foul. They'd get the asset or they'd get the credit. But there's no data risk. Fast forward 2 or 3 years and you're retiring them. You might only know where 90% of them are, and then you're tasked with, you know, tracking them to the disposal vendor. And this is where, you know, the Morgan Stanley case was interesting, not because of what the OCC— you know, Morgan Stanley disclosed, you know, the pair of breaches. The OCC fined them. The class action started and they were consolidated into one because, you know, federal judge doesn't want to deal with multiple, you know, cases that settled. And then 2 years later, the SEC gets involved. And the SEC is, you know, the most powerful regulatory body on the planet, arguably. You know, they typically only get involved when somebody drops the dime on somebody and a whistleblower gets involved. They not only, you know, hit Morgan Stanley with another $35 million, they also used the word astonishing, you know, the practices. And if you look at the 8 or 9 things that they said, they were really, you know, blocking and tackling. And one of them, you know, was very common, you know, what we deal with every day, which is a, you know, a records reconciliation exercise. And, you know, most companies don't even do that. You know, they, you know, they allocate the assets or they share their inventory with a disposal vendor. And, you know, if you actually kind of look at the standard trust-based IT asset disposition process, most companies are wildly non-compliant by that very definition. Right? And, you know, it, it would behoove organizations to put in place a couple of simple safeguards to bring them into compliance, especially with the SEC. So if there is an unfortunate incident, you know, where somebody, there's a whistleblower, they won't be accused of, you know, they, they won't be defenseless, right? You know, the, the, our goal is to provide defensible disposition, whether it's internal stakeholders, you know, whether it's external auditors or regulators. You have a reasonable, you know, process policy that's understood and followed, and you have the adequate controls in place that, that's, you know, monitoring. It, it can't be the wild, wild west. You know, eventually compliance will be required to be demonstrated. Right now it's not. There are very few, if any, tests. You know, when things like, you know, SOX compliance starts dictating you know, that ITAD be evaluated and tested, you know, and all of a sudden you start getting stakeholders like the fiduciaries, you know, the, the Deloits, the PwCs, the KPMGs, the Ernst Youngs coming in and they're having to attest and sign off on these practices. You know, organizations are going to have to get their house in order. You know, there's only been one company that's been put in the penalty box by the SEC.

Yeah.

When, when that becomes 2 or 3 or 5 or 10, then companies will, will pay attention. But it might be too late for the average company. And, you know, a small incident could become an existential crisis if all of a sudden the plaintiff lawyers decide not to settle. You know, the plaintiff lawyers accepted a $60 million settlement. What if they say, let's take this to the nth degree and say, You know, I don't think this is a quote unquote small number of servers. That's, you know, the 42 servers that were allegedly sent to Arrow, but they couldn't, you know, account for. What if they say, let's look at all the disposal projects, you know, that you've done in the last 10 years or since the beginning of time? And the thing about IT asset management, you mentioned tools a little bit ago, you know, the tools are becoming fantastic. They're very sophisticated.

You bet.

Yeah. It also makes the information readily discoverable, right? You have all these records at your fingertips, the procurement records, you know, the, the discovery records and the disposition records. A simple, as the SEC called it, a records reconciliation exercise would reveal unaccounted for items or assets. And the question companies need to ask themselves, are those incidents? And I think clearly they are until proven otherwise. You know, if, if there's no data or if the data has been secured, well, then that incident can be resolved. Otherwise, you have to, you know, you know, take it to the, you know, investigate it. And the SEC, you know, with their, with their regulations said, you know, a material incident must be disclosed within 4 days you know, becoming, being determined it was material. They also find a company, Blackbaum, you know, for, because there was a, they were trying to, you know, claim plausible deniability. And they said that's not the case. You need to have controls in place. You can't say I didn't know because nobody told me. You know, management's expected to put controls in place so they know. The other thing is that, um, the immaterial instance, when they collectively become material, you know, and that by definition can almost be ITAD because I don't know if you remember, but, you know, years ago, you, we actually did, did some research together and, and showed, you know, some tracking data. We looked at several hundred or several thousand projects and, you know, 4 out of 5 projects are missing at least one asset. Now, doesn't mean that was, they were at the level of breach, But they have to be researched and resolved, right?

Exactly.

If a company isn't doing that and a whistleblower drops the dime on them, or there's an incident that gets out, I don't know what would happen. I mean, I imagine it would be, you know, the penalties become a lot more severe. And that's where, you know, an ounce of prevention is worth, you know, tens of millions or hundreds of millions. Incur, right? Yeah. When we got into this industry, you know, the big, the big concern was, you know, you know, kind of twofold, environmental and, and data security. Well, you know, now there's other things. It's, you know, almost anything with an IP address could be a backdoor onto a network, right? You know, there's things that were considered dumb devices are now smart. And, you know, so it, it's better to, you know, consider almost everything an asset, you know, that could be accessed or, or have data. And then I would also say the fourth thing is compliance, because, you know, the SEC pays 30% of, up to 30% of a fine. That's incredible motivation for somebody. It could be a disgruntled employee, it could be a frustrated vendor, you know, anybody that has inside information on your IT asset management or IT asset disposition practices could, you know, file a whistleblower complaint with a couple of clicks. And minimally, there's going to be, you know, you know, kind of a regulatory inquiry. It could become worse, right? If they find, you know, that there's noncompliance and you weren't addressing it. And so, you know, environmental certainly, you know, from a circularity perspective and, you know, environmental compliance and ESG, is always gonna be important. We don't want things, you know, found in the, in the wrong place or irresponsibly discarded. You know, data security is certainly important. You know, but access and compliance are up there as well.

I have to say that not too long ago, I was at a, an IT company's facility, and they actually showed me a batch of devices that they've got, laptops and desktops essentially, that came from an OEM, the OEM being sort of the contract holder on the ITAT side, where presumably there was not supposed to be any data on those devices, and they were full of banking information. I personally connected with the OEM, and they were completely dismissive, completely not caring about the issue. It was no longer their problem. Devices were being held by their ITAT provider or their service provider. And my question to you, to what extent do you think this problem is widespread? Of course, we've heard of Morgan Stanley. It's a big company. The media, you know, got hold of the information. It's an interesting headline for data security magazines, for sure. But I have a feeling that this is the tip of the iceberg. I mean, what we saw is, to your point, maybe a company that volunteered information in the beginning, perhaps. Is that a widespread practice?

When I read the disclosure, I think it was July 9th, I think it was when it was disclosed, my first question was, why? Because if a tree falls in the woods and nobody hears it, does it really happen? Mandatory disclosure laws exist because companies wouldn't voluntarily advertise, you know, problems like this.

Shortcomings. Yeah.

Yeah. Yeah. And, and so clearly there was something that was, you know, that was going to be coming out. And, and if you look at the, there were two breaches. One, you know, was, they got a lot more attention, where, you know, assets were remarketed with data on it. Now, they actually went through several vendors' hands. Including Amy Steward, you know, before it got to the, you know, the, the end user who bought it. And then, you know, Morgan Stanley, you know, made a series of missteps. The other question that, you know, came to mind was why did they disclose two breaches that happened at two different periods of time, you know, at the same time? And I'm not, you know, gonna, you know, we could speculate about that, but it was, it was, You know, they also said that they were going to be, you know, holding vendors accountable. And, you know, that they had, you know, terminated an employee that was, you know, largely responsible for these things. You know, again, you know, I want to give Morgan Stanley a lot of credit for coming forward, you know, and disclosing these things. Or was it going to come out anyways? You know, so right now, historically, exposure for an organization has been tied to disclosure. Disclosure is voluntary, and most companies will do everything they can to avoid disclosure naturally. But now, you know, that you, you mentioned this, the contract holder was an OEM. They have skin in the game, right? So if they know about an incident and didn't, didn't, you know, disclose that, to the enterprise, you know, the covered entity, you know, that whose data it was, they could have liability.

There's certainly, you know, you know, I am speculating that basically they were acting as a transit point without, you know, looking at those devices. Essentially, they probably didn't care. You know, they have the customer on one hand. They have the ITAD processor on the other hand. They were sort of just in the middle. They wouldn't really, you even though they have their own facilities, by the way, they take possession of those devices, they do whatever they do, then they push them to an ITAD company. I think they were not aware that this was happening. What was shocking to me is their response. It's radio silence in most cases, and they probably counted on the ITAD processor to do the work on their behalf. but the, the processor was, was pushing back because it was not part of their contract.

Um, and then to wipe the data. Is that— Yeah.

And, and exactly. So they were, they were doing some other things. So the problem is, damn if we do, damn if we don't, right? Because we're, we're, you know, if we're not being paid to do it, and yet this is a big customer and we can't just, you know, turn our back on them. And so it creates all of these weird sort of environment. And the question is, at the end of the day, it's not necessarily that the executives in IT departments and compliance, et cetera, are careless about it or they don't care. I'm sure they do care. At the end of the day, it's the process that's broken. There is no stakeholder or there is no one in the IT departments, for example, on the enterprise side that's touching those devices responsible for their end of life. Who is equipped, skilled, educated to do what ought to be done, which is not, you know, at the end of the day, ITAD is not an IT operation, is it?

You know, first and foremost, you know, assets, a financial term, right? I mean, so, and, you know, I would think most executives expect or hope, you know, that, you know, every asset can be, you know, tracked from acquisition through disposition. And I do think they would be shocked if they understood, you know, it can't, you know, that a significant portion of hardware assets, you know, go unaccounted for. There's also, you mentioned that there's not accountability, right? I mean, it took a financial crisis before, you know, GAAP standards were put in place, before, you know, bookkeeping matured to become, you know, financial accounting. You know, there's no CFO in the world today would even question the need for independent auditing, right? You know, the fox can't watch the henhouse. In a lot of organizations, you know, the very person responsible for the asset life, you know, lifecycle of the assets, also responsible for disposition. That is a conflict of interest because, you know, there's only pain and, you know, potential problems if they report problems, or at least that's the perception, right? If that expectation is that they can account for everything from acquisition through disposition, you know, what, it's rational. Why would an asset manager raise their hand and say, we, you know, we, we, we can't do it if, you know, it would, it would take a very brave soul. And so the governance is completely wrong, right? You, you literally need to separate, you know, duties. And that is also a major element of every single data security, you know, law there is, right? They're— that's the first thing that, you know, auditors come in and look at is, you know, was there a conflict of interest or conflict of duty? And so that's where I say right out of the gate, most companies are wildly non-compliant because they, you know, the incentives are entirely wrong. You know, you're rewarded for sweeping problems under the rug as opposed to surfacing them. And asset managers are not magicians. You know, they, they're not physically touching every asset all the time. They rely on, you know, resources and, and technicians, and they, they can't snap their fingers and make IT or, or contractors do all this work for them. If people aren't updating systems, that's a big problem. You know, then they, they're flying blind. They can only do so much. And so it, it's, it should not be You know, asset managers should not be blamed. In a lot of ways, they're, they're victims of this situation. But they're also the ones that get blamed when something's found in the wrong place or found with data on it. So they do need to speak up. And there needs to be— I've written, you know, that I think hardware asset management's far more difficult than financial accounting, right? You know, a dollar is a dollar is a dollar. It's, it's fungible. An asset is different. It is a unique identifier. You know, it's, it's— you can't just, you know, swap out like, you know, for like kind. You know, so I don't think hardware asset management gets the respect. I know it doesn't get the respect it deserves. It's crucially important. You know, back to something you said earlier, because companies have not paid the price, they haven't done anything about it. It's not rocket science. I mean, if you ask asset managers, if you were given an unlimited budget, if you were given the resources, given the mandate and you had the support of an organization, could you track all the hardware? Absolutely. Right? Yep.

And, and it's not like you said, it's not rocket science.

It's not, it's not rocket science. So there's literally, there's not, there's a lack of interest or, you know, discipline. And so, you know, it could result from, you know, sort of the mother of all disclosures happening before companies actually wake up. Yes. The next— I fear or I feel sorry for the next Morgan Stanley. You know, I use that as, you know, the next company because I don't believe the plaintiffs are going to stop at a simple settlement. These issues have now been, you know, understood. You know, the SEC has called them astonishing. Right. There's also the gatekeepers, which is what the SEC calls the fiduciaries, you know, the independent auditors. You know, what they explicitly say, they rely on them, you know, for attestation in, in looking at controls in practice. You know, so I see a scenario where the next Morgan Stanley type of event results not only in an extremely expensive, time-consuming, painful process, you know, that goes far beyond the isolated incident, you know, where basically asset management is put on trial. I think it's also going to extend to those who should have been evaluating and, and attesting, you know, putting, you know, testing the controls and evaluating it. Because they're, they're signing off on it, right? Does a company have reasonable, adequate controls? And I also see, you know, depending on the size of the, you know, the, the penalty and I also see shareholders becoming interested. I'm old enough to remember when Enron left a, you know, $50-some billion hole in our economy. It was because, you know, not only was there a lot of, you know, fraud involved and a lot of cover-up, it was also, you know, being swept under the rug. And, and, and there was a, you know, there used to be the Big Eight, became the, you know, later became the Big Four, and Arthur Andersen doesn't exist anymore. Right. So when there is a disclosure, it's a rush to the courthouse. You know, I can't remember exactly how many there were, you know, when Morgan Stanley disclosed. But it's also oftentimes the first to file, you know, gets appointed the lead plaintiff. And, you know, now, you know, there's already a playbook. Of, you know, what they're looking at, what they're looking for, even more so now that the SEC has come out and said these things. So either a company should be taking steps to, you know, put safeguards in place and modernize and professionalize this business activity that happens every single day. You know, companies run on technology. Hardware is vital, right? You know, or they're just, you know, crossing their fingers hoping that, you know, it's not them. It's, I don't have to be, you know, faster than the bear, just faster than my fellow camper, right? I mean, that's not really the best, you know, way to look at this. Does that make sense?

Oh, no, absolutely. Look, I think there are huge expectations about what an ITAD operation within an enterprise ought to do. And the responsibilities that ITAD has, and by ITAD, I mean here ITAD in an enterprise. So these are folks in IT management, et cetera, versus the skill sets and the resources that they have are completely mismatched, right? Completely mismatched. We have an end of life that is loaded in terms of data security risk, as we've been talking about the past 30 minutes. We have an end of life that is arguably the most loaded in terms of environmental risk in the entire chain of ITAM. Where else would you be more exposed environmentally than in the ITAD space, right? It's not during the procurement, it's not during the management of those assets, it's at the end of life. It's an area where we're talking about secondary markets, which means now we have to have visibility on pricing in the secondary market. We have to have visibility on financial issues. We have to have a clear understanding of things that your IT management is not skilled to do. And so my point being, is it possible that this mismatch means that corporations are not, you know, have to create a different set of job skills that would You know, that would ensure that they are complying with all the regulations, be they on the data security front, be they on the environmental front, be they optimizing operations so that there's no disruptions. Are we at that stage where basically the staffs involved in ITAD in enterprise are not, you know, ready for this? They need more, more resources. But more importantly, really more skills to get things done.

Absolutely. And I mean, from it, I'm an asset manager. I mean, I'm a consultant. You know, I, I, I believe it's, you know, the most, you know, it deserves more recognition, more resources. You can't, you know, do this without, you know, half the time, you know, companies contact us, you know, find us on the internet. ITAD's not even a budgeted activity, right? They fundamentally don't understand the cost and it's, they hope the value of the equipment pays for the services required. So they do break even or better. So companies don't even budget for it properly. But to the point about the skillset and the way, I believe there's a— IT asset disposition management is fundamentally different than ITAM, right? It needs to be done by two different people. And outsourcing is different than managing. You know, clearly a company would be irresponsible if it didn't work with an R2 or e-steward enterprise. But just by working with one of them does not guarantee compliance, you know, far from it. And not all R2 certified processors are created equal. In fact, you know, these standards, you know, permit things, you know, that, you know, I believe that's literally just the base case, you know, that gives you some assurance that they're not illegally shipping things or burying stuff in the, you know, in the backyard or chucking it in a landfill. But these are, you know, that compliance And nobody was happier when these environmental standards, you know, industry standards were put forward because before that I had to go visit every facility. I had my own checklist of the things that I was looking for before I felt comfortable in working with one of these vendors. I was very happy that the industry got together and agreed on some basic, you know, things. But that, you know, there's a difference. The easy part is selecting the qualified vendor. The hard part is managing it. You know, no vendor can protect an asset it doesn't receive. And that's what gets companies in trouble, right? If you're doing things like sharing your inventory with a vendor and expecting them to do the cross-check and reconciliation, you've just put them in harm's way and you've demonstrated your lack of understanding in terms of compliance. If I were an ITAD, you know, and a client wants to give you their inventory, I would say thank you. You know, you can give it to us, but we're not going to look at it. Because there should not be an expectation that we're going to vouch that everything's here. You know, we will inventory everything, we'll report what we have. But that going back and reconciling, and anybody who's ever reconciled knows how difficult it is. That can't be done. Again, you know, you teachers shouldn't give answers to the student and expect them to grade their own tests. It's, you know, and so if I were an ITAD, I would say that is not our business. We can either, you know, hire a third party to do it for us, and so we can sit on the same side of the table together, you know, or we can provide it to you. But I see this as a huge opportunity for ITADs, you know, providing additional services and going, you know, but you mentioned the book. I mean, I think it is fundamental that a company, that processors receive and hold the equipment. 99% of problems can be— inventory problems can be cleared up if you get a second look at the equipment. If you receive and go ahead and push the stuff down the line, it gets recycled or broken down or refurbished and resold. You're never going to get a second look at the equipment. Right. And so, you know, ITADs should be offering these services to help their clients become compliant. Right. It's a value-add, optional premium service that they can be offering, you know, and they should be a partner and they should operate like a fiduciary, you know, which is where you're operating in the best interest of the client. That means telling them what they need to hear, not necessarily what they want to hear. Right. Because if there is another Morgan Stanley type of event and it is discovered that, you know, the processor, the iPad was complicit in kind of concealing the problems, that company's probably out of business. Yeah.

Yeah. Absolutely. Absolutely.

It's existential.

You've defined the problems and the issues in general. And what would be some of the basic steps you would recommend, let's say, for those viewers who either are new to this work for an IT department, for procurement, for ESG, for whatever, for a corporate— for the— on the corporate side, or may already have a program, but again, witnessing what's been happening, looking at some of the changes taking place in the industry, looking at the impact of ESG and other things. What are the steps you would recommend for them to follow?

Well, first and foremost, Most of the metrics that are, you know, I would, I'd define what success means. What are the metrics we're going to measure? And, you know, most of the metrics in our industry are what I call vanity metrics. You know, they come down, you know, how many, you know, what, what's the impact from a, you know, ESG perspective? I'm talking more about the, you know, the metrics that drive performance and success, you know, And starting with chain of custody, right? And, you know, if you're not tracking something, if you're not measuring it, you're not managing it, right? So if, how, how do you define chain of custody? How are you measuring it? You know, oftentimes when there's something that's untracked, it, you know, I would argue it's an incident. Most companies don't even look at incidents or catalog incidents when it comes to this. So the second thing I would do is is I would define all the incidents. Now we have a database, you know, I've tracked over, over 140 different things that, you know, can happen. Most people, you know, can think of a handful off the top of their head. If something's found in the wrong place or found with data on it, you know, if a driver steals something, you know, these are very basic handful of scenarios. There's a lot of scenarios. And you— so defining the incidents, what can happen, and then What can we do to mitigate these things? And then what's the incident response? These are things that are irrespective of the vendor. Before you even entertain, you know, doing an RFP and selecting a vendor, you have to get your house in order. So looking at metrics, looking at, you know, what incidents are in place, and then developing your process. And your process should be independent of the processor, you know, because In our industry, you know, vendors, you know, can become unresponsive. They can go out of business. There's, there's a lot of things. And, you know, maybe you have a policy of doing an RFP every 2 or 3 years. Your process should not change every time you want to add a vendor or change a vendor, right? And so, you know, again, it, it's the science of managing ITAD that is lacking. Right? Right. You know, anybody can pick a qualified vendor. You know, how you manage it is far more important, and it's independent.

And from your perspective, who is the best suited to do that in the enterprise? Who is that person who has to sit down and reimagine or fix the way ITAD works? Is there a particular title, or is it all over the map?

It's all over the map. And it— I mean, honestly, asset managers are phenomenal at it, but they can't report to the same person. You know, so it's, it's not not necessarily the title. It's also where it reports into, right? So it could be under procurement. It could be, you know, under cybersecurity, honestly, is where if you look at where the resources are, that is cybersecurity. I mean, companies are spending a boatload of money. And, you know, the squeaky wheel gets the grease, you know, where asset managers are often reluctant to report an incident. You know, because they fear consequences. Whereas you talk to a cybersecurity person, they literally brag about how many incidents they had to handle that day or that hour or that minute. Right? And we're scared to even, you know, discuss what could possibly be defined as an incident. Right? And so it, that's a great question. You know, I would say, I hope my book allows the conversation to flourish, right? To start the conversation. I don't think there's any one way to do it. You know, it could fall under IT procurement or IT finance. It could fall under cybersecurity. It could fall under, you know, IT, it could be a business analyst. It probably, it should not be the same person that's responsible for managing the lifecycle?

Yeah. My position, Kyle, has been you have to have a champion, a skilled— call it an ITAD analyst, who is generally housed in the IT department because the IT department tends to sort of have the technical ownership of the device, even though in a lot of cases, the devices are owned by the business unit or et cetera. They are sort of the gatekeepers, if you will. So an ITAD specialist that is not necessarily just tied to ITAD, he could be doing a bunch of other things within the IT department. So it's not necessarily a deadweight on the IT department's budget. That person would champion the end-of-life of IT equipment by interfacing with all of the stakeholders, whether they are on the ESG front, on the finance side, on the compliance and legal front. All of that, having that additional skill set of knowing all of the above is required. Doesn't have to be a master's in finance, but understanding the secondary market and how prices are set and what to ask and how to determine the life of a device with within the primary lifecycle to generate perhaps better revenue in the secondary market. All of that to me ought to be housed within the IT department with an IT and an IT analyst who has the, you know, this mandate to look at support within and across the organization. To me, sort of, that's probably the most sensitive thing to do without breaking the bank.

I definitely think it needs to be, you know, there has to be a point person. I definitely think it there needs to be a bigger, broader team because obviously there's governance, risk compliance, there's sort of the ESG, there's a lot of stakeholders and they should certainly meet to establish the policies, establish the objectives, and they should meet periodically to review the results. I'm an advocate of an independent third party manager doing this because it allows the rest of the team to sit on the same side of the table along with the vendor. Right? Now, you know, there's, there are certain individuals that, or certain parties that are conflicted and they can't play that role. Right? So clearly the iPad itself can't do it and the asset manager managing the lifecycle can't do it. So by definition, it has to be somebody else. But there should also be, you know, a kind of a due review, approve, you know, you know, there, there, you can't have an individual, you know, sweeping problems under the rug. So there has to be multiple parties involved. This is where, you know, the, the sort of reconciliation exercises, if you don't have a standard way to do it, if you're literally doing it in spreadsheets, that's not scalable, it's not reliable. You know, if David did it and Kyle wanted to proof it, I would have to redo the same thing. Yeah, I'd probably come up with the same different results. You know, so you got to get out of the spreadsheets and you got to get into, you know, a very defined protocol, right? A consensus protocol. And whether David does it or Kyle does it or somebody else does it, we all get the same results each and every time. I've also written about the fact that, you know, incidents, when they're detected right away, there's kind of a golden hour of ITAD. And it's, you know, kind of taken from the, you know, when there's a crisis, you know, that first hour means oftentimes the difference between life and death. You know, we're not first responders, but the same concept. If you identify an issue right away, it usually can get resolved, right? And if you have the process and procedures in place, you know, you can pinpoint it and certainly neutralize the problem. Oftentimes it becomes a non-event. If where what happened with Morgan Stanley, if you believe what, you know, was said, you know, it was a significant amount of time had lapsed, right? And when a subsequent inventory was, you know, done, a reconciliation was done after Arrow announced it was leaving the industry, right? That reconciliation should have been done the day the equipment was received, right? And then if there's a problem, it gets fixed right away, not a year later, not a month later, not a week later, because you could have resolved. And if you actually— you've been inside of a lot of facilities, you know, Arrow was phenomenal. They were very tight. You know, very well certified. You know, there's— I could make a strong argument those assets were never lost, those 42 servers, because if David and Kyle were working at the Arrow facility that day, I'm working on one client, one pallet of equipment, David's working on another. I take something off, I put it on the floor as I'm unpacking it. You trip on it, you think you put it down, you put it on your pallet. That asset is not lost. It's lost in the building and lost from reporting. And unless somebody's on top of it right away, it probably will not get corrected, right? And you can't wait a year to do that because those assets would be long gone. And so there, there's a lot of things from, again, from the management of ITAD that if, if somebody knows what they're doing, can mitigate these risks, right? And, and again, you know, it goes back to the you know, the interest and the appetite of, of senior management. You know, nobody became a CIO because they focused on ITAM or ITAD. Nobody became a CTO because they focused on ITAM or ITAD, right? It is, you know, but it becomes critically important. You know, I say nobody cares about ITAD until everybody cares, and then it's too late, right? And so this is— I'm, I'm urging people to take you know, some simple practical steps now so they avoid a lot of pain, you know, later.

Yeah, and, and look, I mean, I do agree with you that we, we do surveys that question companies on what, what are their sources of learning? What do they learn? Where do they learn about ITADA? Who influences them? And the striking responses, Kyle, is the preeminent position of the ITAD vendor. ITAD vendors, because there's no other sources of educating folks in the enterprise, they lean heavily on the ITAD company to teach them a number of things, including ironically a description of the competitive landscape, which to me, you know, you don't ask a company to describe their competitive landscape because they have a stake in ensuring that they are defined as the best company out there. So I completely agree with you that there is the need for third-party folks that would be out in there to help these companies deal with their IT needs. And in addition to obviously having an educated staff that knows how to understand the various aspects of ITS at this position, they don't have to do most of the work. They can sort of outsource a number of that as consulting, if you will, and that would make sense. Two more questions, if you may. The first is related to your company. I would love to know more about what you're doing. And the second one is about your book. So let's begin with your company, what you offer. This is again a message for end users who may not know your company and you know, would like to know where, you know, what Kyle is managing.

Well, I appreciate that. And we go to great lengths, you know, in the book and stuff to be, you know, vendor agnostic. I started RetireIT to be a cost savings, to be a cost play. The original concept was to be more like AAA than a tow truck or more like Travelocity than the airline. It didn't make sense, you know, economically, you know, to ship things around the country. Certainly it increased the likelihood things would be lost, stolen, or damaged in transit. And so, you know, keeping things in state, you know, with a network of certified processing partners, that was the goal, right? I immediately recognized a bigger issue because of chain of custody. I would, you know, a client would give me their inventory and I'd pick up 100 laptops and we'd get a corresponding report from my downstream vendor. And I'd try to reconcile it and I couldn't, you know, it wouldn't make sense. Only two-thirds of the serial numbers would match. I couldn't prove definitively. Yeah. I had moved around the country enough times that some of my furniture had moving tags. And so I had an idea. I bought a label printer. I started printing barcodes and I started sending them to my client and they, you know, they look like this, you know, and simple stickers. And I'd asked my clients to sticker the equipment before we scheduled a pickup. And then I told my downstream partners that I wouldn't pay them unless they scanned the barcodes. And of course, it's easier to scan a barcode than capture a serial number. So they were actually pretty happy about that. And all of a sudden, we were tracking, you know, virtually 100%. I had to write a lot of software because now you're dealing with what I call two-key tracking. And there's a lot of different scenarios. At the end of the day, RetireIT is a technology-enabled process. We operate like a company's IT disposal department, if they ever had one. We sit between a company and the vendors that do the processing. And we have a very defined process to make sure, you know, everything is accounted for. In a very standardized, systematic way. And we do a lot of services, you know, certainly with COVID there was, you know, a lot of work-from-home people. So we've rolled out, you know, you know, a QR code program with FedEx, you know, so it's like a no box, no label, almost like an Amazon return. Most of the time we're doing standard pickups, right? And we rely exclusively, you know, probably the only person in the industry that's not trying to get my hands on an asset. We never touch them. We never see them. So 100% is done by trusted partners. And, you know, they— I love working with, you know, my partners because unlike, you know, say, a third-party freight company where it's sort of a mixed bag, you know, where a driver might not know the difference between a toaster and a server, you know, good ITADs have trained, you know, crew and they can navigate environments, get in and out with minimal disruption. They can do a lot of other value-added services. You know, but at the end of the day, we, you know, we manage the process for a company. We also have, you know, a subscription service for a couple of clients where we call it Disposal Desk, where they literally, you know, all of the requests come through us. You know, we have very defined ways of handling it, but, you know, they have a, you know, a help desk, they have a service desk. We operate like their disposal desk. And one of our clients called us that. And so we kind of coined the phrase. And, you know, we, we actually will work with other vendors if they already have them in place. But at the end of the day, we, we have a, there's a manifest record of every single disposal event that occurred. And that's required by RCRA and CERCLA, you know, from back to the sort of environmental piece, right? If a company's getting rid of more than, I think it's 220 pounds of covered waste in a calendar month, which is nothing. They have to have a manifest record of all of them, right? Absolutely. You know, and look at what happened to Home Depot in California. You know, a few boxes of e-waste, you know, in a dumpster behind a store cost them $27 million. Right? Right. And so putting this sort of, you know, disposal desk approach in place saves a lot of problems down the road.

So you are in some sense what I would you know, Koin as an operating system. You are not necessarily handling the devices themselves. What's, you know, what's your connection with the processor side? I mean, I'm assuming you have a—

We're paying clients. So we pay our bills and rely on them. We add a couple of steps, like they have to receive and hold the equipment for a day so we can firm, we have it all. And no, but we, we, we, we work exclusively with certified processors.

And how, how do you gain access to the outcome of their work that you have then to probably, you know, report back to your customer?

So our software, we, we have the expected inventory from the client. We get the receiving inventory, the actual inventory from the processor. And our software does the reconciliation, right? So we're kind of the middleware between a company's asset repository and a processor's, you know, ERP system or reporting system like, you know, Razor or Maker or some homegrown system. And because we do it in such a systematic standardized way, we also, we have a plugin with, you know, say for instance ServiceNow. If you took a direct feed, you know, from a vendor and tried to update records in ServiceNow, you wouldn't— it wouldn't work, right? Because you have to reconcile it and you have to have all kinds of business rules. And so the fact that we've reconciled it makes it a lot easier to update the status, you know. Absolutely. And, you know, from an end user perspective, they should not retire an asset until they have the receipt, until they have the report, right? And, you know, it should go into a status like pending disposal or, you know, until you've reconciled it, right? So, yes, we're middleware. We're the operating— an ITAD operating system.

So a client of yours, when they host a processor, are these processors introducing themselves as ITAD company XYZ, or are they introducing themselves as—

We orchestrate it. No, I mean, we schedule. There's over 100 120 steps in our standard process, you know, scheduling a pickup. Um, you know, so no, we're quarterbacking the whole thing. You know, our clients know who's coming, they know when they're coming. You know, oftentimes we're, you know, having to, um, you provide a lot of information, but it is the ITADs that's showing up on behalf of Retire IT. Interesting. Um, and they also— we protect our vendor, you know, vendors as well. I mean, I don't know if you recall, but it was over— it was 2013. I wrote an article for Harvard Business Review. You could still Google it. It's the most overlooked part of data security is what the title was. And that's a true story. And what we didn't reveal is that, you know, the vendor was accused. You know, we'd worked with this bank and done lots of pickups with them. And we determined that right away that a couple assets were missing. You know, the client or the vendor quarantined the equipment, reinventoried it. We didn't ask them to do anything else. We didn't tell them what was going on. We went back to our client, told them what was happening. You can read the article, but, you know, bottom line is a, you know, veteran of the bank, you know, loses her job because she took the assets for, you know, for her daughter's school, I think it was. We— it was weeks later we told the vendor what had happened, that their driver was accused of stealing that they said he looked nervous. I think his name was Steve. And the vendor actually, when I told the owner of the iPad that Steve the driver had been accused, he was like, no, he was shocked. He said, this guy's like the deacon in his church. I mean, he's like the most honest, nicest, you know, trustworthy guy ever.

Yeah.

But when somebody's trying to sweep a problem under the rug, they're going to throw everybody else, you know, Next.

Overboard.

Yeah. And, you know, so we protect our vendors, you know, because again, 99% of problems happen before a vendor is involved. I don't want to, I don't want to be accused and I certainly don't want my partners to be accused of some wrongdoing. And so they, you know, they're tasked with capturing inventory, nothing more, nothing less from that, you know, from a reporting perspective. Tell us what we need to hear, not what we want to hear.

I guess my next question is, are you guys the only ones that are doing this with the exception of the OEMs? Because the OEMs have the relationship with their large customers, and therefore they're there to sort of coordinate all ITAD operations.

I don't know if the OEMs do what we do. I don't believe they do. Well, I mean, I'm told they, you know, they have a process. They're very good at vetting the vendors. But in terms of managing the iPad, I see— I foresee a problem. You know, if you trust an OEM, you put all your eggs in one basket and literally, you know, they're orchestrating the iPad for you and they're not putting these controls in place. If there's another Morgan Stanley type of event, you know, naturally the client would say, hey, we trusted you to cross the T's, dot the I's, to alert us that there's a problem. What do you mean? You know, how did this happen? Right. You know, and so it is at the end of the day, you know, the end user is responsible. You can't outsource responsibility.

No.

You know, but, you know, there may be a day when the vendors, you know, the OEMs might say, look, the juice isn't worth the squeeze. You know, we don't want to have all of our clients suing us. You know, it's hard. It is very difficult to do IT asset disposition management. Right?

Yeah.

And it's easy to pick the vendor. It's difficult to manage the process. And if they're just kind of throwing it over the wall, farming it out to vendors, and, you know, providing a report and a certificate, that's not adequate. Right? Right. Right. And they should be advising their clients at least, you know, to be doing it themselves. You know, a certificate isn't worth the paper it's printed on. They're all digital anyways. You know, certificate is a participation trophy. It's the data behind it, right? And again, so, you know, these OEMs and these solution providers, where in the past it's been okay, you know, almost every system integrator, VAR, solution provider has somebody, right, you know, that handles ITAD because they have a couple of relationships. They know somebody who knows somebody. They can get a pickup to take place. And, you know, that's not really, you know, the ultimate solution for sure.

Yeah, no, I'm just saying that, you know, at the end of the day though, I mean, a number of these OEMs, the leasing and financing companies, are responsible for bringing back those devices, whether it's a 3-year later because of the end of a lease cycle, or whether they have a, you know, a services contract that requires them to take those devices. At the end of the day, they do sort of hold the hand of the end-user customer. And so they, you know, they're important in the way sort of they approach the end-user customer. But going back to my question though, you know, you are a channel, you're an additional channel to the ITAD programs. Are there many companies like yours? Yeah, I know there are a number of ITAD companies, probably upward of 1,000 or more in the US, but you're the only one that I know that has this unique business platform where essentially you are holding the hands of both on the ITAD and the customer. So that's, to me, that's kind of a one specific channel. Is that channel developed or are you the only one that you know that is?

Oh, no. It's a niche, you know, that, no, we, and I'd be, you know, I would, I think a lot of our clients misunderstood, you know, you know, we have, you know, people who have used us every year for the last 20 years, right? And it's, and they think we are the recycler, right? You know, it's, it's in some way, you know, but I don't own a truck. I don't own a shredder. I don't own a warehouse. If I turned this camera and you looked outside my office, you'd see a, you know, a handful of people, you know, doing reconciliations and spreadsheets or orchestrating pickups, right? My office looks more like a law firm than a, you know, than an ITAD facility.

So I would qualify you as an ITAD management consultant more than, more than an ITAD company, if that makes sense.

And, you know, really the, you know, the software does a lot of the heavy lifting. Our process does a lot of the heavy lifting. And, you know, we're, even though we certainly preference and have contracts with, you know, a number of really great ITAD partners we have for years, you know, if a company is working with one and they've established a great working relationship and they're, you know, we could certainly take over that relationship and manage it, right? It's, you know, that has happened and we've been introduced to some great processing partners because a client, you know, said we've done an RFP, we've picked this company, but we need, we want to use your tags, we want these reports. And, and so we've inherited those. That's certainly the exception, not the norm. Right. But yeah, we, we view ourselves as a process.

Final question, Kyle, your book, I saw a, even your, I think even you have a, a YouTube video on it. Brilliant the way you put it. I mean, it's clearly meant to do two things in my opinion, and correct me if I'm wrong. One is to simplify the explanation of what the issue is, make it very simple, and to speak specifically to the people that are in charge of IP asset disposition. Specifically, the last one, last book is about data security. Does that make sense? Is that Yeah. What are your goals in putting together this piece?

Well, it was actually— wasn't that long ago when I was doing a presentation. I used a handful of illustrations. Yeah. And somebody asked me, have you ever thought about putting this into a book or a booklet? And I thought, no. I mean, I've been using illustrations for quite some time. It took a lot longer because, you know, there's copy next to every illustration, and I probably have twice as many. There's a lot I left on the cutting room floor. I wanted it to be— I wanted to simplify, you know, the issues. I wanted it to be timeless. I wanted it to be, you know, to illustrate there's also a solution if you put a couple of simple safeguards in place. You know, use tags, you know, two-key tracking. Yeah. Having equipment verification holds, and segregation of duties, which are vendor agnostic. But yeah, no, I appreciate it. It, you know, I actually got a sort of a working on a second book that's, you know, won't happen for a while. But, that's awesome. But no, the illustrations are fun and nice. I hope, it sparks conversation, right? I almost wish I didn't call it a book because people think it's a heavy lift. I mean, honestly, you can, you could read it in 5 minutes. Yeah. You know, leave your phone, you know, you know, and, and pick up the book and you can finish it in 5 minutes. I like the fact that some people have like literally sent me pictures of them and they have notes on and, and on every page and they said they, you know, they, you know, bought a copy that they could give to somebody because they'd mark up theirs. I think that's wonderful, right? And, you know, there's— I've had somebody say, you know, what would be great is if you did it where it's like a book where it was where you created something where it's like an exercise where it's like come up with your own caption and that would be a facilitated discussion. Like, you know, look at this illustration. What does it say to you? And it would be, you know, so there's a lot of utility and, you know, I did that video. I hate hearing myself speak, right? I mean, this is, you know, I think everybody does, but I particularly don't like hearing myself speak. And, you know, I wanted to make a video. And so I, there's so such cool tools out there. So I literally found an AI agent that would read it and you could I could pick a voice that sounds like yours, or, you know, yeah, yeah. And it was neat. I mean, like, literally within a couple hours, you know, and it can do and summarize in 8 minutes. So it was kind of cool to do that.

But so it took you a couple hours to put it together?

Oh, well, I had the content already.

Okay. You did have the content. Okay. So it's really— oh, they put it together. It was quick because of AI.

Correct. Yeah. I mean, you have to figure out what to do because there's roughly 30-some pages, but yeah, it didn't take very long to stitch it together. I found an AI that trained on my voice. So it took a couple of, you know, podcasts and webinars that I'd done. And so I have a version of it with, which is me reading it.

The last question that I have is a lot of what you've been doing, a lot of what the ITAD sector has been doing, a lot of what everybody has been doing is going to be challenged by AI without any doubt. We are in the business of information. And boy, I think information is the first target of AI. How do you integrate that? First, are you worried about that? And I'm assuming you are looking more at it as an opportunity than a risk. That's the way I look at it, by the way, Kyle, as an opportunity.

Interesting. I don't view it as an issue for what we do because, you know, we spend an awful lot of time scheduling, confirming, reconfirming, literally these activities, like almost like a travel agent, you know, the reconciliation. You know, we have a very set procedure, you know, to get the information into the database. I mean, you know, if you, if you came to work, you know, one of the first things I'd do is you'd be doing reconciliations and we teach you how to turn a spreadsheet into the, you know, it's a process and it's very defined that, you know, the goal is whether David does it or Cass does it or Kyle does it or, you know, Francis does it, it's going to be the same. And so, you know, AI cannot, would not easily replace that. Now, where I see AI being tremendously valuable is in for hardware asset managers. Because most companies have, you know, a couple dozen discovery tools, right? They have these data lakes of assets, you know, it's like, and, and how do you normalize? It's like, you know, it's so I, I'm assuming these, you know, platforms and these asset management tools are doing a better job of getting, you know, to be that single pane of, you know, glass pane of truth, right? Where It's a, you know, most companies, I mean, they don't know where 20% of their assets are. They're not even sure if their CMDB is accurate, right? It's like, and it's like, so, you know, unleash the, you know, the bots to go out there and be compiling, you know, stuff from SCCM and from, you know, all these different tools and then normalizing it. In making it actionable, I definitely see some use for that. I don't see it being— and maybe, you know, I could show you what our ServiceNow app looks like. We— this is not AI, but we had to come up with rules. So the mathematical discipline is called combinatorics. And when you're dealing with just serial numbers, You, you have like 3 scenarios. It was expected and received, which is perfect. It was expected but not received, that's a problem. It was not expected but received and you have something extra, right? There's only 3 scenarios. You introduce 2 keys, a tag and a serial number. Now there are so many, you know, scenarios because there can be mismatches and other things that happen, right? We've defined it down to about 18 or 19. Wow. You think of it like, you know, the old Price is Right, you know, game on TV where you go up and you drop a puck and it bounces down and will end up in one of one slot or another. Yep. Yep. It's called a data state. You know, every single asset a company says they're getting rid of is going to end up in one of these data states. Has to by definition mutually exclusive, collectively exhausted. You know, kind of what I showed you when we did our analysis a decade or so ago. Same thing. I mean, very precise language. You know, when you've done that reconciliation, like in ServiceNow, when we pull that in, you could say, okay, a perfect match, we'll call it retired. You know, we're 100% confident tag and serial number match. You know, a logical match where we have a tag and the serial number is nearly perfect. You know, the 8 might be a G or the 8 might be a B, but it's a logical match. Again, you know, let it update. But then you start getting into mismatch type 2 or mismatch type 3, and then you might say we want an asset manager to make a judgment call. Is that the right asset? You know, it's a, you know, the tag doesn't match and the serial number doesn't match, but they're both Dell ProLiant, whatever, you know, it's like, and then certainly if something is missing or untracked, it could easily be identified as an incident that, you know, security's on it right away. Did it get left behind? Is it, you know, anyways, The business logic could be improved a little bit with AI. For instance, fuzzy matching, which is a term, you know, for imprecise matching, you know, where you might have 1, 2, 3, 4, 5, 6, 7, 8, and there you have 1, 2, 3, 4, 5, 6, 7B. You know, you could come up with a, you know, a, an index, a score that would say, yeah, we're 99% sure that's the right, right, that is the asset, right? And so have I done that? No. Ours is very rudimentary. It's like an index, right? It's like 75% of the characters match, you know, it's a crutch, it's a tool, but I don't have endless resources. But if I had a data scientist and AI, I would, I could literally have an index, you know, it would be like probabilistic. Yeah. Again, that's not where the juice You know, I don't think the juice is worth the squeeze. Most companies are still struggling with getting their procurement data into their CMDB.

Yeah. Imagine that.

Right?

It's, it's insane.

It is gonna be the mother of all disclosures.

Yeah.

And, you know, I, I obviously didn't put this in a book, but how can privacy advocates not be aware of this? You know, it's a bigger thing. They're worried about Mark Zuckerberg's, you know, comments on a congressional hearing. You know, they're worried about AI. You know, they should be worried the fact that companies can't account for 20% of the hardware. Because how can a company credibly claim to be protecting data if it doesn't know where the hell the hardware is? Right?

Yeah. Yeah. No, no, absolutely.

I think that's, that's the dilemma of what is But I honestly think it's because the problem is so big.

Yeah. Widespread.

It's so widespread. It can't— no one individual can handle it all. You know, it requires IT, it requires procurement, it requires cyber, it requires, you know, vendors. It requires, you know, everybody to get together. And unless there is a mandate, it's just not going to happen. And it's kind of like, you know, it's an open secret. Everybody agrees. Everybody who's commented sent me messages like, oh my gosh, I can't believe you wrote that book, right? You can't believe you said these things, you know, but everyone's like, yeah, that is what it is. I mean, if you were like a, if you were a privacy advocate, you'd be like, what do you mean 20% of like, Yeah, you would think they would be, you know, freaking out about that, the implications, but they're not. It's either because it's a sort of cognitive dissonance. They can't, you know, hold those competing thoughts in their head at the same time because it is such a widespread problem.

And with that, Kyle, thank you so much for your time. Appreciate it, and hopefully we'll have more of these discussions going forward.

Absolutely, enjoyed it.