Cybersecurity Perspectives for 2025 – Insights from Gary Hayslip

Welcome to the Cybersecurity Vault. I'm your host, Matthew Rosenquist, CISO, industry cybersecurity strategist and advisor. And today is part of a series where I get to pick the brains of cybersecurity leaders as to what 2025 will hold for all of us and what we should be doing about it. We'll explore 3 areas. One, how attackers are maneuvering. Second, how business conditions are changing, and third, how technology innovation is impacting cybersecurity, either for good or for bad. And today, it's my absolute pleasure because I'm going to be talking with the legendary Gary Haislip. Gary is the Chief Information Security Officer for SoftBank Investment Advisors, an experienced board member, an industry advisor, and one of the most respe— respected CISOs in the industry, renowned for his deep experience and practical insights. Welcome, Gary. Thank you for sharing your insights today.

Thank you. I appreciate the intro. I don't think I am famous, more infamous than anything else, but depending on, you know—

Take what you can get. I was going to add, you know, infamous Lego builder, but, you know, I left that one off. But it should probably be added.

Yeah, definitely.

So every year, it seems like our industry gets more and more challenging, right, from many different aspects. And the attackers are always adapting. They always maintain the initiative. And the business challenges, the expectations, right, they never seem to align with the money that's coming in or the latitude that we have. And then there's this technology wildcard that always gets thrown into the mix. And attackers many times use that before we get a chance to. So, you know, your perspective, 2025, next 12, maybe a little further than that, months out. Let's start with the attackers. How do you think those threat agents are changing in 2025 from a tactics, capabilities, or how they maneuver?

I think you're gonna see further integration with AI toolsets. I think you're going to see an expansion in scale of attacks that have been developed with those type of toolsets. I think you're going to go ahead and see that because of using the various different types of GenAI tools, and they're using these technologies and they're not slowed down by business politics or having to go get funding from procurement to go buy something or whatever, you know, they just go ahead and innovate. I mean, whether you like it or not, they're innovating just as fast as we are. And so, I'm expecting that we will see some attacks that no one had even dreamed of. And these things, when we start going ahead and doing the forensics and the after-action of these attacks, you'll see that these things were developed with AI. These things were developed by using AI tools to help write the code or AI tools to actually help come up with the attack mechanisms or the attack methodologies that were used by the perpetrators. Because again, we're not, for the most part, a lot of these large-scale attacks, you're not really dealing with teenagers in the basement at home and living with mom and dad. You're dealing with criminal syndicates. You're dealing with organizations that are very well organized. They're funded. They are very focused and mission-driven, per se. They know what they're going after to go ahead and make money. And the other thing is that all of these different groups, they're integrated, they're talking to each other, they're sharing threat intelligence with each other. You know, in fact, they're a hell of a lot more integrated and sharing more info than we are in the commercial sector, which at times scares the hell outta me. You know, you know, I, I talk about an infinite game mindset where in an infinite game mindset, you're not playing the game to win. You know, you've got a set number of rules, you got referees, you're playing, you know, 4 quarters and then you're done. For an infinite game mindset, there are no rules. They constantly change and the game doesn't end. You play the game to play. You don't play the game to end it. You know, they're in an infinite game set where they are looking long-term. They are building, they are running, they're there to make money. We keep on thinking that there's an end at the tunnel, that there's a light at the end of the tunnel. And I'm like, no guys, we need to be on that mindset because if you operate on that mindset, then it's all about resilience. Then it's all about we're in it long term. You know what I'm saying? And so I'm praying that business and even the security marketplace understands we need to be in that mindset if we're going to be able to fight that fight.

So you paint an interesting picture here, right? You're talking about integration with tools, AI, you mentioned that. You're saying that the scalability, the depth, the integration, the effectiveness of the attacks in 2025 are going up. Is this, you know, when you say going up, right, that's a normal kind of thing for every year. Are you talking a watershed moment? This is an exponential growth year in the types of attacks and effectiveness, or are you saying this is just a 2x or, you know, a 1.5x? What scale are you thinking in terms of attacks and impacts?

Honestly, I think it's going to be an exponential growth year. I think we're not just, we're not just that we're going to see growth, you know, from a scaling perspective, but we're also going to see the type of impact and everything is going to be stuff we've never seen before, honestly. I mean, I'm talking with tons of startups that are jumping in right now because of the nature of the organization that I work for, who are jumping into the AI field. And the security side is seeming to catch up. More and more people are getting into either starting companies around AI or companies that we already have in our security stack that are mature organizations are building AI into it. And in some are even talking about, you know, hey, we're going to have an AI bot, like an AI Jarvis, that's going to be sitting there with you in the morning when you come in with your cup of coffee, you know, and your Jarvis is going to be chatting with you, you know. And whether they go out and are grabbing the latest, you know, cyber news, or whether they're grabbing, you know, threat intel from the night before, they're already talking we're going to have that before the end of the year, that we're going to have some type of, uh, an AI workmate like that with us. And we're already seeing organizations starting to try to companies are trying to build this into their platforms, and some of them are actually pretty mature that we're already starting to see in the security space. I think that's going to exponentially grow very, very quickly, and I don't think it's going to go away.

Yeah, I mean, that agentic types of AIs, that may supplant what we currently work with generative AI, ChatGPT and things like that. That may be that next whole evolution. From an attacker's perspective, do you think it's going to be the same old type of attacks— denial of service, ransomware, digital extortion, data harvesting— or do you think it's going to be something new, some evolution of those attacks?

You know, the thing about it is, is that those old types of attacks are tried and true. They're still making money from them. So I don't see them going away. I see that you're still going to have those, or probably more of those. But I also see that you're going to start seeing more of these, like, you know, the, um, you know, the deepfakes and stuff like that. You're going to see more of those that are going to, you know, they're going to exponentially scale, they're going to get better, you know. Um, so I think you're going to see both, honestly, you know. I don't think you're going to see one go away and you're going to have these new, you know, I think they're going to go ahead and keep the ones that are still making them money, and they're going to use that money to go ahead and scale these new ones And they're going to go ahead and do this whole tried and, you know, hey, does this work? Does that not work? And they're going to share info with each other and realize, hey, these type of new types of ones work. These types, not so effective. But however, the technology around those, we can break that up, package it, sell it, you know, and make money that way. So it's, yeah, it's going to be really interesting to watch it.

Well, it sounds like 2025 from an attacker's perspective, they get a big check mark for an advantage more than normal. Normal, especially through the use of tools. Okay, so we've talked about the attacker side, right? And all the great options they're going to have, a little depressing, but okay, yes, all the great options they're going to have. From a business perspective of cybersecurity, right? The people that are running teams or people working in cybersecurity teams, how does the business climate then change in 2025? Knowing that the attackers are going to have this advantage? There's going to be more attacks, they're going to be better, it's going to be more disruptive and impactful. How does that change the business?

Well, I mean, I think there's been a lot of discussion on this that people have talked about, well, the CISO role is going away, it's going to be doing da-da-da, the company's going to be doing more of the enterprise risk perspective. I don't think the CISO role is going away. And I think that, and honestly, I think, you know, the CEOs and the consultants and stuff that are saying that kind of stuff, I'm like, guys, unless you've been in a CISO seat, you know, it's not going away anytime soon. You know, now the job is going to change.

Yes.

You know, the skills that you recruit for are going to change. You know, your staff, your teams are going to need retraining, you know, for a lot of these new tools and a lot of the different things that are going to be required to work with a lot of the different GenAI toolsets and stuff. You're going to see technologies in your stack are going to change. They're going to have new offerings and new services for you that you can use to help you make decisions in real time better because they're using GenAI. And so, I think the big thing for the business to understand is that just because AI is coming out doesn't mean you're going to get rid of your security team and you're going to have a bunch of bots running anything. That's not going to be anytime soon. Instead, what it does mean though is that your team and your CISO may need to change the budget, may need to shift money around to go ahead and buy or acquire new tools or services because the threats are changing. And I can guarantee you nobody thought last year we were going to need tools to be able to deal with deepfakes and stuff. However, this year, I think it's going to be scaling a lot more, and you're going to need things to be able to see that, especially if you're in an organization that deals with fraud, you know, that you're dealing with accounts and like, you know, a bank or something like that. You know, you're going to go ahead and you're going to need to see these things. And so it's, I think what the business honestly needs to do and myself being on a board and advising boards, you know, and I've spoken about this a couple of times with you know, with, with fellow, you know, fellow board mates, you know, fellow directors that are on a board that I'm on. You're going to need to be more open and have some one-to-one, heart-to-heart talk with the CISO and everything to understand, do they understand the upcoming risks that are coming? Where does the organization sit from an impact perspective, from an exposure perspective to what we think is coming? And then how are we positioned? Do we need to shift the budget? Are things in the stack going to need to be changed? Do we need to shift You know, current companies that we're working with, hey, we're in a 3-year contract with so-and-so, but we may need to go ahead and change. And okay, are we going to eat that last 18 months on that contract and just take that because these threats that are coming, we need to be prepared now. And these are things that you need to start having a discussion on. You need to start planning in your strategic plan when you do your assessment for this year. And you're looking at where your risks are at before you report to the board, you can say, hey, I've just redone my NIST CSF reassessment. I've baselined this. Here's where we're at compared to our peers in banking and finance or in telecommunications or in whatever sector you're in now. So, you can give them that and say, okay, currently, current state, this is where we're at. However, 6 months, 12 months, 18 months, this is what I see coming. And this is what it means to the business. This is what I think the impact is going to be to current operations or current projects that we're looking at. And these are new services or things that I think we're going to need to be able to manage these risks. And we want to be preemptive. We want to be ready for them from a resilience standpoint so that as these things develop, as they scale and escalate, We're already waiting. We've already got staff trained. We're already scanning and working for it. We've already got it integrated with our SOC, you know, and we know what this kind of abnormal traffic looks like. You know what I'm saying? So, I mean, it's, so it's those kinds of things. You need to start having these discussions now.

So you've covered a lot. Let me unpack a couple of things here to clarify.

Yeah, sorry. I get the rambling. This is stuff that I'm adamant about.

No, it's awesome. It's awesome because I love the train of thought. Thought, right? You started off by saying there are some voices out there that says, "Hey, CISOs are going away." And the reality is, one, nobody wants the job. There's no other VP that's dumb enough to want that job, first off. But, you know, you've painted this picture of really an evolution of cybersecurity leadership. The CISO doesn't go away. They simply evolve. They're evolving to the threats, and that means their organization and the tools that they use. You know, you also mentioned that, hey, The CISO really needs to have now closer ties with the board. The board needs to be a little more savvy. They need to be asking questions, holding the CISO more accountable, and that CISO needs to be looking ahead. But the interesting thing you said as well in there, right, is the tools and the new training and the new capabilities. And I'm thinking that's dollar signs, right? I mean, that's— you need budget to be able to go buy new tools and vet them and do POCs and integrate them and build all your processes. Do you think 2025 is an— I mean, are we going to blow the budget here? Are we not going to ask for a 25% increase? We're going to ask for a 50% and hope we get 20?

Well, what it is is that it isn't always, you know, budget either. You know, because it's things like, you know, I'm looking at right now where I can, in my stack, I can probably collapse, you know, 4 or 5 different tools down to one platform. Because I'm looking at certain platforms that I'm already using one of the tools on that platform. And they got 3 or 4 other things that I realize are almost a like for like for other things that I'm currently using. So why don't I collapse all of those down? And so instead of having my team look at 5 different dashboards, we're looking at one. Yeah. And so we're having those discussions to where we can integrate and kind of collapse down and focus on 3 or 4 primary partners instead of 8 or 9. Yeah. And that's something that, you know, CISO should be doing anyhow. And then we're also looking at things like, you know, and we are definitely a leaning forward organization where I work at, where we've been doing, you know, GenAI for the last 18 months. You know, my team is building GPTs. You know, we're already playing with doing JSON scripting and learning how to build query engineering. And, you know, and they're taking classes on Udemy and they're doing stuff to go ahead and educate themselves. We're building and breaking things and figuring out what we did. You know, SoftBank's got a partnership with OpenAI and they're coming in and training staff on how to do like query engineering, how to use ChatGPT and stuff. You got to be thinking about these things. Not everything costs money. You know, some of the stuff, there's a lot of free classes out there on AI. There's a lot of stuff, you know, and I'm talking to my team when we were setting up goals for this year, what we were going to do. Yeah, I went ahead and I told them, I said, okay, We're going to have, you know, 3 goals internally for the team that are going to be tied to the department and the organization, and they're all business related. And then you're going to have 2 personal goals that are going to be tied to your career. You know, and we looked at those and we focused those around AI. We focused those around, like, one person's working on their CISSP, sir, and someone else is working on, uh, someone who was more network engineering oriented is now getting, you know, involved in cyber, and I was focusing them on, uh, some courses courses and stuff that I wanted them to do. But it's, you know, you've gotta get, you know, you gotta start looking at not all of it is just a new tool. You know, some of it is actually just changing the methodologies that you're using right now, the processes that your staff are using. Some of it is, you know, the company itself is already using certain GenAI tools. So look at, okay, how do I use them from a security perspective? You know, is there ways in which I can go ahead and use them for things? And we found out there is, you know, You know, I'm already looking at my whole stack and looking at what technologies, what companies we're going to go ahead and keep. And I'm actively asking them, what are you doing with GenAI? What are you beta testing? And I want to be one of the beta testers. I want to see what you're doing. You know, and my team's already doing it. We're already doing roadmaps with a bunch of our companies. And we've already been testing several of them, you know, some of their tools. And then, you know, some of the startups we've had that have reached out and said, you know, hey, We want you to use this platform. And I'm like, I don't have money to buy a new tool. Oh, we don't care about the money. We just want you to use it. We want your staff to use it. We want to get input from you. We want you to work with us. You know, I'm like, okay, well, let's hook a brother up. Let's go ahead.

Let's do it.

You know, that's what I'm saying is it isn't all about money. What it is is you and the business making the decision that we're going to lean forward. How much risk are we willing to deal with? You know, let's put the policy together, you know, for the organization. Let's train staff on what's acceptable. Here's the use cases on what we're going to do with these new technologies, how we're going to use them. And then security makes the decisions of, okay, this is how it changed our overall security policy. This is going to— how it's going to change our daily operations. You know, this is how we're going to use the tools on our side of the house for doing monitoring, for doing enforcement. And then you start laying out, okay, what changes we need to make. And some of these will be from a controls perspective, yeah, they're going to have to be a new technology. And so the discussion is, do we go buy something outright? Or does one of our technologies we already currently have, is that available? Is it already available on a platform that, and we just didn't know about it? You know, so we're doing a lot of that right now. January is a big education month for us. We're doing tons of meetings, just putting together our roadmap because our fiscal year doesn't start till the beginning of April. And so we're in the process right now of looking at I've already done our assessment and baseline risk where we're at, and now we're already putting together our strategic plan for the next 18 months, pulling all of this data. And I'm actually sitting with IT because their teams and our teams work really, really close together, and our stacks are integrated together. And so, I've pulled them in and they've agreed as well. We're both looking at our stacks and we're looking at where we're going to make changes because we're going to have to help and support each other. And so that's actively going on right now. And I think honestly, if you know, all CISOs, CIOs, CTOs, you need to be doing it now. And I figure most of us are, you know, coming into 2025, because I think 2025 is going to be an escalation year on both sides, good guys and bad guys. It's going to be really, really interesting.

So everybody should be working with their vendors, right? Instead of just automatically going to try and buy a new tool, right? See what your current vendors are, what their roadmaps are. They may be able to cover it. Right? So you might be able to manage not only the friction of your own operations people because they don't have to learn a new tool, but also be able to manage some of that cost to be able to intercept some of the new AI, you know, kind of based attacks coming in. But some of what you talked about, I'm sure, has got to scare the pants off many CISOs. You were saying, hey, you know, I want my staff to go learn, you know, JSON and writing scripts and AI and this and that. And I know a lot of them are thinking, wait, I'm already 150% saturated. There's no way I have time to tell my people to go do this, right? They're all going to leave in droves. It's just not fair. I don't have the bandwidth to do that. Is there, you know, I mean, what are your thoughts around that? What kind of balance or fine edge do you have to walk to be able to get into that capability? What do you think?

Well, it's, and the thing about it is, is, I mean, you know, don't mistake me. It isn't like I've got a whole fricking bunch of time that, you know, that my staff's running around.

You're bored. Your staff is looking for stuff to do.

The thing about it is, I mean, New York Times crosswords, you know? Okay. No, I mean, you know, I mean, because we go ahead and we do cyber operations. We do physical security as well. You know, we're involved in audit. We're involved in risk. I'm doing due diligence on new investments. I mean, we got more than what we need to do. But we started small. We made the decision, first off, we're going to go ahead and we're going to use, like, hey, we're going to go ahead and authorize ChatGPT and we're going to authorize Perplexity. We're going to authorize a couple of tools. So staff got it, you know, and then they're expected to go ahead and use them. We're writing policy. We're, you know, having, you know, we're putting together an architectural diagram and I need to write ups. So they're starting to use it to do different things. You know, so they start getting comfortable with it. And then from a project perspective, what I told them to do is, hey, on Thursdays in the afternoon, you got 2 hours open. Pick whatever project you want to do. Build something, break something, I don't care. And so we started doing stuff like that, you know, and so, you know, Thursdays in the afternoon, they got 2 hours, they're working around the project. I told them to purposely block the time. You know, so they can do that. And once we, and then once you kind of get that up and running, you know, and you're doing that and you go ahead and you do that. And then we have a security sync that we go ahead or where the security team syncs up and somebody's picked the brief to brief out what you're working on.

Yep.

Yeah. And you want to do that with your juniors so they get used to talking in front of people. They used to putting together how to communicate, how to talk about a technical project, how to discuss what they're doing. And get comfortable, you know, talking in front of people. But also at the same time, you know, I want my staff to be comfortable being innovative and exploring, breaking things, figuring out how things work, you know? And it isn't like taking up a whole day. It's only a couple hours. You know? I mean— Yeah.

And I love it because essentially what you're saying is you are thinking more strategically, right? Instead of, you know, worrying about AI and trying to figure out how to block it, you're saying, no, we're going to approve these and we're going to write the policies that ahead of time and maybe do the training and work with the different business units, right, to help them because they're going to go there anyway. And so, instead of waiting for things to break and just focus on cleaning up, you're thinking ahead. You're working with your staff to say, "Hey, you know, use your own intuition. Go break things or go build something that we're going to need," right? And you're, you know, not only, you know, helping them communicate, but you as a manager, It also gives you the ability to start identifying those junior superstars, right? The ones that really do have great creativity or are in tune with some type of threat, you know, and that is great from an organization perspective long term. So everything you said to me says that strategic thinking, strategic thinking on the tools and the policies and the people and the partnerships with the different business units. I love it. I absolutely love it, right? Because if we stay in the firefight mode, we're only responding to all the bad things happening. There's no way we can think ahead. And then it is just a linear, I need more money, I need more tools, I need more people, and you're going to lose at some point, right? That eventually ends. So I love it. I absolutely love it. So last area here, and we talked a lot about AI, but what disruptive technologies do you think are going to change the landscape in 2025 for us? You mentioned AI, but I didn't hear you mention quantum or blockchain, distributive computing, next-gen AI. You know, mention, uh, agentic AI, um, you know, or next-gen cloud. What, what do you think is gonna be on the menu from a technology, either good or bad?

Yeah, I mean, well, I mean, there's, there's, there's different things that I'm seeing. Um, you know, I think AI is a given. I think quantum is still developing. We're probably a couple of years out before we kind of see it at scale, um, where it's just gonna massively disrupt things. It doesn't mean that it's not coming, but it is coming. Um, we can hear the train in the distance, but yeah, you can hear the train in the distance, but you know, you've got a chance to get the truck over the, uh, you know, over the tracks, you know, before that, before the, you know, the gate drops down. Um, yeah, and like I said, I've already spoken about AI. You know, some of the things I'm seeing, you know, in, um, in the space is just some of the unique things that are being done with technologies. Like I mentioned, deepfake, you know, and some of the technologies that are being used to be able to detect deepfake, not just in video, but in audio and stuff like that. And it used to be, there was no easy tools. You'd hear about it. You hear companies go ahead and are susceptible to it, but there was nothing to go ahead and be able to, you know, that, you know, for me to go online someplace, download it, and be able to run this and say, oh yeah, this isn't real. I think that's going to be— I think that's changing and that we will go ahead and see more readily available tools, you know, for that type of threat this year. You know, I already know one or two companies that are maturing it. I think others are going to jump in. Is it a niche? Yeah. But I think, you know, I think more people will, especially as more attacks with it happen. And these are big number attacks, like, you know, you're losing millions of dollars from these attacks. Some of the things I'm also kind of seeing from a technology perspective are things that are really unique where, you know, you're already seeing a movement towards platforms and, you know, you're seeing, you know, different cloud security platforms that are adding all types of different services and stuff. And then like, you know, there were things where there were platforms that used to be just a secure browser, but when you look at them now, they're no longer a secure browser. They're more of a secure operating system that's sitting in a browser because now there's like 10 different things that you can do with this stuff. You know, and so now you start running through your head, oh, you know, I can collapse 4 or 5 of my tools down to this. Because I'm at an organization that's 100% SaaS. I don't have anything on-prem. I don't have any data centers. Everything is SaaS-oriented. You've got a laptop, you've got a phone, internet connection, that's it. You can work anywhere on the planet, you know, and we've designed it to where it's total zero-trust architecture. As soon as you turn your laptop in, boom, you're immediately into an encrypted VPN. You go through Okta, you're logged in, there's your apps that are assigned to you, and you can go to work. All of that is running through a browser, you know, and I think, you know, people are catching on that, you know, you can do really interesting things with that browser is becoming more than just a browser. It's becoming an interface where you can collapse all kinds of different tools and different types of methodologies. And I'm just seeing things where I don't need all of these different tools anymore. I can use one that does 5, 6, 8, 10 things for me. For me. And it's just fascinating because now all of a sudden I'm thinking, well, I've got remote users in Mumbai that can use this, that can log in and be able to access stuff. And what I'm thinking of now is, how do I get to the point to where I don't want to be issuing laptops anymore and having to manage hardware? How can I go ahead and do BYOD and let them go ahead and use a laptop that meets specific specs that I want? And when they log in, they just have to have my software of choice, And that software of choice just checks, are you meeting these security? Are you meeting these patches? Do you meet all of these? Okay, you do. All right, you've got this account, you've got this 2FA, boom, you know, through Okta or whatever IDP you choose, and then boom, you're in. You know, I'm already, you know, myself and our head of IT, we're already sitting there thinking of ways in which when you're in a cloud-first like architecture like that, there's so many different options that you can have. And, you know, from a security perspective, cyber is still cyber. You still have risks to deal with. You still have controls to deal with. It makes it interesting when you're talking to auditors and they want to go see your Active Directory server. And I'm like, go talk to Microsoft because, you know, I don't have any servers, you know, and they're like, well, don't you use, you know, uh, Entra, or don't you use AD to go ahead and run everything? I'm like, no, I use Okta. Tied into my BambooHR to go ahead and run everything. I don't need that. Oh, you know, and then you got to go ahead and show them some screenshots and show them what it looks like because they've never seen that before.

They're not familiar with the architecture, right? They don't understand.

You know, and more and more companies are doing architectures like this. And you know, what it does is it slims down things that you don't need. You're relying more on third parties, but now your risk comes to, okay, You're going to be using these type of architectures that make you more innovative and more resilient, honestly. But your risk changed because now you are relying on these partners. You're relying on these third parties and you're like, okay, what about their risks? What do they access?

Yeah.

You know, who's controlling how they authenticate, what they access from a data perspective, you know? And so it's really interesting, you know, and I see more of that happening. And scaling and changing. When you go ahead and go into these cloud-first type of architectures, security becomes extremely focused on identity, access, data, especially data protection. I mean, it's just extensive, the things that you're doing now. And it's fun. It's honestly fun to build something like that. And then when you throw AI in there, then it's like throwing a grenade in there. It becomes real awesome.

Well, you know, I think 2025 is an opportunity to look at those kind of sandboxed, more controlled online virtual-type environments, you know, cloud-first. But again, you know, I caution people and say that's great. And there are some tremendous security and privacy and, well, data protection benefits there. But also, as you mentioned, the risks are still there. In many cases, you're transferring the risk to those third parties and you're trusting them. And if you're going through that, Okta, you're going through that and they have an issue, guess what? You're one of many victims. And you may have very little control over responding to that. And you're just waiting. Hey, they have to close this. They have to fix it. They have to tell me what happened. You know, so there are trade-offs too. Just understand that when you evaluate these things.

There are trade-offs. You still have to do hygiene. You still have to do your basic security maintenance and you have to do it continuously from an operational perspective. And what happens when you go with these type of architectures, this is when you start having discussions about resilience. Like you said, the primary partner's down, what's secondary, what's tertiary? And you start having these discussions. Hey, if we just lost Slack, how are we going to communicate? What other methods are we going to use? If we've just lost Zoom, what other—

The world ends. That's it. The world ends.

And that's what I'm saying. You start having these discussions, you know, I mean, the interesting thing is, you know, it does give you other capabilities. Yeah. I mean, you know, hey, the office just lost power. All right. Send everybody home. They just get home, log in and they just go right back to work. You don't need to be in the office to work, you know, because of the fact that, you know, you're all you need is an internet connection. You know, it's, I'm saying, so I mean, it's, uh, you know, so there's, there's flexibilities with it. But you do have to do your homework. You do. It makes tabletops interesting as well, because you start thinking of, you know, from a resilience standpoint, you know, you definitely do third-party tabletops because, you know, you know, you know, certain partners of yours you've lost, you know, they're not meeting their SLAs, they're not doing something, you know, do you then go ahead and, you know, roll with a secondary? You know, there's discussions of, you know, Do you have a secondary on hot standby? You know, I honestly think that that's a whole other business that would be interesting to where, you know, it's like, uh, hey, you don't have to sign up, you know, like if I go ahead and I use, you know, one company as my IDP and like you said, they go ahead and they crash and burn. Is there somebody that I can use as a secondary if they're unavailable?

Hot standby.

Yeah.

Failover network. Do you want to log into your primary network or if unavailable, log into your secondary network? Network, right?

And then, you know, and that company that's doing the secondary, they're like, you know, hey, we're not going to charge you the full price because we know it's only temporary, but just hot standby. Yeah, yeah, yeah. There you go.

You need to use us, it'll be based on hourly or usage during the year, whatever it is. Flexible billing there.

Yeah. And so, I mean, so there's ways— so it's really interesting, there's ways that, you know, I've always thought that we should be able to do that. Yeah.

Oh, I love that. You know, and that could fundamentally change how we approach. It gives very diverse sets of environments, which I love because that confounds attackers, right? They can't create a tool just expecting you've got AD on-prem, you've got, you know, inner and outer firewalls, and that's how they're going to craft all their attacks. You start introducing all these different architectures, and because of that diversity, it becomes really tough to scale those attacks. And so that undermines— and even the big players, right? That undermines some of those, even the organized criminals out there, if they're trying to hit many different targets at the same time. So I love that direction.

Yeah. My thing is— Yeah, no problem.

Well, last question here, because I know we're coming up on time. If you were to give advice, right, to a security director or a CISO, a leader, The one thing looking into 2025, what should they do now to get in front of something, some challenge or see some opportunity? What would be the one recommendation you would give them?

Don't do it alone. You should already be actively in the community talking with your peers because everybody right now is dealing with this. You know, we're all kind of getting together and sharing information. Hey, what are your projects this year? What issues are you having? What vendors are you talking to? You've already got the community. We're already here working on this. Don't do this alone. Don't do this thing. Hey, I've got this contractor over. I'm just going to call them and they'll give me whatever. No, no, no, no, no. You can use them to go ahead and give you, hey, this is what they kind of recommend. Now go back to the community, to your peers who are actively in the seat, who are actively doing this and say, hey, you know, my blah, blah, blah, who's working with me recommends this. These are kind of things that we're working on. What are you guys doing? That's what I'm saying is this, you know, if you look at it from, you know, the, you know, the infinite game set, you're not in this alone. We're all players in this long-term game where the rules are constantly changing. So we should be talking to each other. You know, we have adversaries.

It's not our competitors though. It's the bad guys trying to attack all of us.

Because the thing about it is I can guarantee you the adversaries are talking to each other. Oh yeah. They're sharing information back and forth to each other. They're selling code and different shit back and forth to each other. They're escalating and piggybacking on attacks. Hey, I've just broken in. Now I'm handing it off to another company that, and they'll do this and then they'll hand it off. I mean, it's like, why are we not operating the same way? We should be working to where we are assisting each other. You know? So I mean, that's what I'm saying is that we should already be doing that.

That's outstanding advice. See, this is why you're infamous in our industry, right? It's not go it alone, right? We have to communicate and collaborate with each We've all got experiences that come to the table. We've got mistakes, we've got successes, but that collective knowledge and wisdom is something we should all be tapping into. And unfortunately, there's so many of us that are just shy, you know, I don't want to air my dirty laundry. I don't want to say what I'm working on. I don't want to sound stupid. I don't want to, you know, and they're not leveraging the most important resources out there. And it's not the vendors or the vendor salespeople, right? Those aren't the experts. It's your peers in the industry. In your sector, right? They've felt the pain. You're feeling pain, right? Share, work together, figure out you're not alone. I think it's a great piece of advice for 2025. So Gary Hayslip is the Chief Information Security Officer for SoftBank Investment Advisor. Thank you, sir, for sharing your cybersecurity insights today.

Thank you for having me. It was fun being here.

And thank you all for watching. Be sure to subscribe and catch all the Cybersecurity Vault episodes where we chat with industry leaders and infamous individuals to dive into the most relevant and interesting cybersecurity challenges, perspectives, and best practices. We'll see you next time.