How Leaders Build a Strong Security Culture and Bridge the Gap Between Psychology and Cybersecurity

Good morning, good evening everyone, and welcome to The People Show. I'm Pooja Shimpie, I'm your host, but today I will be playing a role of moderator because I have a wonderful guest speaker Matthew Rosenquist and my co-founder Samir Gimawat with me. So over to you guys, please introduce yourself quickly.

Well, I'm Matthew Rosenquist. I'm a CISO, cybersecurity strategist. I've been in the industry for about 35 years, and I advise business, governments, and academia all around the planet.

Thanks, Matthew. Over to you, Sameer.

All right. I am Sameer Gawat. I'm basically the creative director at CyberNow, and I'm a jack of all trades, master of none. Okay. And I'm not really from the cybersecurity field, but I have about like, you know, 20, 25 years of experience in technology, um, as well as entertainment and media. So thanks, thanks, Pooja.

Thank you, guys, and welcome to the show. I'm really excited to have a nice, great discussion with you because today's topic is really very interesting where we'll be, uh, talking about how to build a positive cybersecurity culture and how leadership plays a role in it. And we'll touch base, uh, shortly upon the connection between psychology and cybersecurity. So, you know, a positive cybersecurity culture, in my opinion, is the one where, you know, people are comfortable talking about it, reporting about it. If they are seeing something, they are comfortable saying it without any fear, and leadership has complete support over it. But today I would like to hear from you, Matthew. What do you think a positive culture, positive security culture is in an organization?

Well, it's really about active participation and to get the most out of it, there's a couple of things that have to be aligned. You have to have a good set of policies, directions, and understanding of what needs to be done from a security perspective. But from the end user, right? We need to foster and have them be an excited part, a participant to help make those things a reality. So that active participation is absolutely crucial because cybersecurity doesn't get addressed simply by technology or just by processes. We have to have the people be part of that advocacy to truly make the outcomes that affect everybody, including them.

Yes, that's really— I agree to that point. And Sameer, I'm interested to know your thoughts also.

Well, yeah, I kind of like definitely agree. I think like, you know, a positive security mindset or a robust security mindset, like it should start really with being individualistic. Okay, like, you know, we have this top-down approach and we have this bottoms-up approach, right? But unless an employee or a user or, like, you know, people feel that I have to keep myself safe, my family safe, only then I'll be able to think about my organization. Like, no one wants to be a victim of cybercrime. That's like pure human psychology. You mentioned the word psychology, it's one of my favorite topics. So that's like pure human psychology. But it gets a little bit tricky when you actually start with an approach that 'Here's what you need to do to keep our organization safe.' That's where, you know, the engagement kind of like drops, because why should I bother about my organization's, organization's safety first, where I should be talking about my safety first, right? So that's where that participation which Matthew Rosenquist talks about, like, you know, should actually start from, like, you know, that approach. So that's, that's what I feel is a— it can help develop a positive security mindset in people.

Yeah, absolutely. I couldn't agree more. And, you know, the culture is getting stronger when it's— when there is open communication and then the proactive approach is there and everyone feels that it's not only their responsibility but they have a role to play when it comes to, you know, adapting the security in an organization. And, you know, while working in the industry, I realized that means back in 2015 or '16, there were— there used to be few breaches. And, you know, for example, the Equifax uh, data breach happened in 2017, and those were like the famous data breaches. But nowadays, every day there are so many breaches that I've lost count of it, and it's no longer a surprise there is a data breach. But somewhere I strongly feel that it's a representation of a poor security culture, or, you know, there is a lack of strong security culture and leadership plays a very huge role when it comes to security culture. So Matthew, I'd like to understand as a CISO, what are, what are, what are your thoughts means how leadership commitment impact the overall security culture in an organization?

Well, yeah, there's a couple different angles here. From a CISO perspective, part of our job is to understand how do we weave that technology and the process and the behaviors to build the right or optimal level of security. We don't want too much. We don't want too little. It's really finding that right set. We don't want to overburden people or processes or cost too much to the company. But we do want to have that right level of control that gives us that comfort, that desired level of risk management for all the bad things that bad people are trying to do. So we're here as a cybersecurity leader to kind of define what that is. And it is up to us to figure out how do we communicate with the people on the behavior side, right, to get them to understand, to get them bought in, to get them to realize it's important to them, to their work, to their career, to their team, to their division, you know, to their, to the commitments to, to everybody within the organization. But from an executive level, right, from the CEO and even the board down, They have an important role to understand the value that cybersecurity brings and then to show by example, to lead and to support those programs, to help educate and bring the employee base and the contractors and the suppliers and vendors and third parties and everyone else on board so that they do create that behavioral control that really helps everyone, right? It's not just about security, or the CEO, or the shareholder. It's really helping everyone. And I think that's what Samir was talking about, right? People need to understand, hey, this is relevant to me and my work and my job and my contribution in my community and my family. This is important. I want to be a part of it.

Absolutely. And Samir, you yourself has played a senior leadership role in many organizations, though not in cybersecurity directly. But what are your thought processes coming from a non-cybersecurity background? How— what do you think that, you know, a senior leadership, how can they play a role in building a strong security culture in an organization?

Right.

Yeah, I always like, like to cite the example of like physical security, you know, like Safety is always— I think it's a no-brainer that it's always like a number one tenet of all organizations now in the world, right? Like, you know, EHS team kind of like, you know, monitors the metrics also very, very closely. I mean, coming from a data center background, uh, I, I love like, you know, talking about like, uh, safety, physical safety, because it was of paramount like importance because people can actually lose their lives. Like, you know, if they are in a construction site and they are not wearing those helmets and the like a personal protective equipment. Now, um, it is— it has been some time that in most of the organizations now safety is also considered to be a number one tenet. So it's basically as much of an importance as safe— like, you know, safety and security. So safety and security, they should be actually at par when we come— when we talk about, you know, even online safety. Because you see, uh, there's like sextortions happening and people are actually committing suicides like, you know, because of extortion. And this, like, this is all about online safety as well, right? So I think the best thing is, like, you know, for CEOs to start with a personal story. I mean, sure, surely enough, like, everybody is receiving messages on WhatsApp, okay, on, like, you know, via SMS, or even by, like, you know, phishing calls. And start with your own personal story as to how vulnerable you are as a person, right? Like, you know, and got nearly scammed because of this, like, you know, phishing exercise. That will help you connect better with the people. You know, people, um, you know, they understand stories much better, and they will then kind of like listen to what you have to say when you talk about your personal story. And then, like, you know, also talk about, like, you know, how can you keep your organization safe. So I think that would be kind of like my take on it.

Yeah, thanks for that. And I love that, um, especially, especially the story part, you know, because I also truly believe that, uh, a message through story is much more, much more stronger when it comes to providing the training. Means from my perspective, education and training is also one of the strongest pillar when it comes to security, uh, culture. So, uh, I always believe that effective training programs helps understand employees, their role in developing the culture. So Matthew Again, I'm coming back to you. You must have seen so many different programs in many organizations. So what's your take? What, what are you seeing in the industry when it comes to providing good security awareness training to employees and how it's impacting? And what's your thought on, is there any change required?

Well, there's always improvement. Every organization can improve, some a lot, and they need to, others it's refinement. But for all of the programs, and I've dealt with many different companies, organizations, over 120 different acquisitions and so forth, I really look for 3 areas. One, there needs to be a clarity of communication, right? And if you can't communicate with your audience because of either language barriers or culture barriers or simple communication, and, you know, Sameer gave a great example. Tell a story. Why? Because that's a great way to communicate. It's a great way to, to bring yourself together with an audience and for you to learn on this journey of the story. So yes, clear communication is a must. If you don't have that, you're not going to get very far. You have to be able to clearly communicate, and in some cases, sometimes some technical aspects. Which for some audiences can be a challenge. For other audiences, it isn't. For— in some cases, there may be management or business discussions, and again, some audiences may have difficulty. So you have to know your audience and you have to communicate clearly. That's number one. Number two, we touched on it a little bit already, but there has to be an air of relevance. If the audience doesn't care what you're talking about, they're going to check out. They're not going to pay attention to you. They're not going to buy in. They're not going to be an active participant. But if you can communicate that relevance, it has to do with your safety, your privacy, your productivity, your paycheck, you know, whatever. It's got to tie into the heart of what's important to that audience. If you can't find a common relevant fact connection, then it's never going to matter. So even if you are clearly communicating, it won't manifest into action. And that's really what has to happen. So that's the second thing, relevance, clear communication, relevance. Now, the third thing And this is a little unique when we talk about security. The third thing is teamwork. So often the security group is looked at as this police force, right? You don't want to get a call from security, you know you're in trouble, right? And it's, it's very oppositional. And you may not agree with, with the security policy and you may have good reason to. You may be the smartest person in the company. And if you don't agree with the security policy, there's a problem there. So it really requires teamwork. And one of the things that I'll do is, is I will talk with every single person and I'll say, hey, we're on the same team. If you don't like a security policy or you don't believe in it, talk with me. I'll change it. If you can convince me, great, but give me the opportunity to convince you. And I want you to call me, right? I may lead security, but you're where it manifests. You're the important one, right? It all comes down to you. So if you have a question, I'm here for you. You need help, I'm here for you, right? If I see something, I'm going to call you and I'm going to ask for your help, because we're on the same team, right? And if you've already established the, the credibility and the relevance to them, then there isn't that oppositional type of, oh, I don't want to talk to security. Right? I want you to call me. In fact, I want you to call me just even if you suspect something. I'm not going to yell at you. I'm, I'm part of the team. If you make a mistake, call me first. Let's, let's fix it together. I'm not going to beat you over the head or write you up. Let's work on this together. And that camaraderie, that teamwork, really starts to gain momentum. Especially if they test it out. And, and, you know, you're showcasing, you're highlighting people. Hey, Bob called me and we found— he found this issue, and we were able to resolve it for the benefit of everyone. Wow, right? It's no longer, I don't want to deal with security, right? I'm sure not going to call them. I don't want them to call me. To, hey, that's our security guy. Yeah, yeah, yeah, we worked on something together. Build that teamwork. So that's the third thing. Clear communication, relevance to that audience, and build teamwork. And that helps everyone.

I love that. It's so thoughtful and so many insights in those 3 points, and especially that policing stuff. It's quite hilarious. But I can only imagine, you know, I mean, this sounds very ideal. In an organization, I don't think people are that comfortable when it comes to approaching security teams. You know, as you rightly said, there is a fear factor first that if I approach these people, I'm in trouble.

We have to get rid of that. We really do, because it's a barrier to success. And, you know, you need cybersecurity leadership to figure out what to do, but you need every single employee and contractor and partner and vendor to actually make that a reality every day. And I would rather have a security-savvy workforce than a stack of firewalls. They're better at prevention. They're faster at detecting when something happens. And I need them to help the company recover if something bad does happen, when it does happen. So it's all about teamwork. I don't want them ever to think, "Oh no, security's calling me. I'm in trouble." I don't want that. Right. So it's teamwork. So important.

Yeah, absolutely. And, you know, I would like to add one more point to that, Vince. Recently, or I have been speaking with a lot of senior people, and I have also seen in the industry in my past organization, when there is some incident happening, you know, people are focusing on who is behind it, you know, the blame game. And also, if you are failing phishing attempts twice or thrice, I have seen that companies have put a penalty. It may impact your performance, or, you know, you will have to get in touch with HR or something. So these are some signs of some negative security culture, you know. But I would like to start with you, Sameer. What, what are your thoughts on this?

Well, yeah, actually the one which you talked about, like, you know, there's one of India's largest banks which actually penalizes people, like, you know, and they have to pay ₹1,000 in case they fail a simulated phishing attempt. And I have seen, like, you know, RFPs of, like, you know, some of the large banks, and they have, like, a very, very strict, like, you know, policing, which apparently is not working. In fact, like, you know, the more we are talking to people, the more we are realizing that that's actually not working. Even simulated phishing is not working and they have like very, very high click rates. Out of 8,000 people, about 1,500 people are actually clicking those emails. So I think that's a negative security culture for sure. So I kind of like totally agree with what Matthew said, like, you know, there is a process to this, like, you know, entire madness, right? There is a process. And then the last piece which you talked about is like teamwork is absolutely essential. Like, you know, we conducted one of these sessions with about 30-35 odd people who are not from cybersecurity but from different areas. Joining the cybersecurity team. And we actually used that to our advantage as to, like, you know, people were talking most of the times because they already know. I mean, cybercrime is no, like, you know, kind of, uh, something which you're not seeing. You're seeing every day, every moment in your life, right? So people are already aware of it, right? So how do we kind of use that to the advantage of the organization is something which people need to think about. Now, again, like, you know, safety and security was, like, you know, number one tenet in my previous organization. And there, what we did is basically started, uh, like measuring good saves and near misses, uh, for employees, you know. So the employees used to report like, you know, okay, like, you know, why don't you report some like, you know, 3 good saves in a month or 3 like, you know, near misses in a month related to cyber security or like, you know, staying safe online. And that kind of worked because people started competing with each other. So like, which is the best like good save of the month? Okay, so in a team, like, you know, this kind of stands out. Like, you know, make it a little little bit of competition because people love games, right? Like, you know, this would be a good point where we kind of get gamification in so that, like, you know, people, they compete for, like, you know, basically showcasing that they are actually displaying the, the safest behavior online. And that kind of helps save the organization, themselves, their friends, and family, right? So that could be a, like, good way to promote positive security culture in an organization.

Yeah, all good points. And I miss— you know, we often overlook the crucial part when it comes to building a positive cybersecurity culture is also understanding the importance of understanding psychology and the connection with cybersecurity, you know. And Matthew, we have spoken a lot on this topic in Montreal during my presentation after it, and I know you have asked fantastic questions over there, but it's my turn now. So I'm asking you, what is your thought on this topic of psychology and cybersecurity?

Psychology has such an important part, and there's so many lessons that we can draw in to help maximize the overall outcomes, positive outcomes for everyone, right? When we talk about punishment, and we've seen this, right? We've seen embarrassment, shaming, punishment, all this negativity, And the simple fact is psychology teaches us that positive reinforcement trumps negativity and punishment. Right? We see this, we see this in animals, you know, rats and so forth. We see it in humans. We see it across sociology. We see all those things. That's why gamification, again, is, is one of those great little stratagems to reinforce that positivity. So, you know, I've seen organizations, and I can think of one in particular where, you know, we did testing to see how susceptible the organization was to social engineering attacks, right? And these were simulated phishing and social— other types of social engineering. And, you know, we had a group that had a 20% failure rate, right? Which is which is pretty high, but it's not unheard of, right? If you've got a good crafted, for example, phishing, phishing is just one of many, but another one is great is dropping USB drives and seeing how many people will actually plug them into their system, right? But it's 20% failure rate. They brought in some vendors to help with training and forced all these things. And the reality is they, and their goal was, a 5%. They wanted to drop that down significantly from 20% to 5%. And they were almost able to get there. And I said, you know what, you know, you're going about it the wrong way. The training was not well embraced. There was still a lot of negativity and shaming and things of that sort. So people were acting out of fear and the numbers started to creep back up. And so I sat down with them and devised a plan of positive reinforcement, so on and so forth. Much more relevance in their communication and training and a lot more teamwork. And we very quickly dropped it to a fraction of 1%, and it continued to trend down. So, you know, bringing in and using human nature, our own minds, and how we see rewards and benefits versus punishment and failure, right, really can make a difference. So bringing the right team and using the right kinds of programs and approaches can make a massive difference. And in cybersecurity, that's important, right? We, you know, even a small failure can cause a catastrophic effect downstream. But, you know, when you've got that teamwork and you've got security-savvy people, it makes a huge difference. I cannot tell you, not just the prevention of bad things, but again, the rapid detection when it happens. And then the resolution of that is much shorter. The overall impact becomes minuscule compared to what it is if you don't have you know, that psychology behind you. And I'll give one example here, and maybe some of us can kind of understand it. If you're in a culture where you're going to be punished for accidentally clicking something, right? You're not sure you clicked on something. You're not sure. Maybe the screen flashed. You know, if you're going to be punished, chances are you're not going to tell anyone because maybe it was okay, maybe it didn't do anything, maybe the antivirus caught it. I, I don't know, right? And in a positive culture, right, you're gonna pick up the phone or you're gonna send a text message going, hey, security guys, I might have just done something, can you take a look? And if they come in and go, hey, oh, thanks for calling us, awesome, yeah, let's take a look together, show me what you did. Hey, thanks so much for calling. Hey, this time it was nothing, but good job. We wanted that call. We wanted to be involved, right? And rewarding them and, you know, hey, here's a cup of tea or a cup of coffee. Thank you. Right. And when they talk about that experience with their coworkers, what do you think those coworkers are going to do? They're going to do the same thing. I clicked on something. I called and hey, it was something this time. Thanks for letting us know. Really early, right? I mean, I'm gonna find out eventually if it was bad. Something down the line really bad is gonna happen. I'm gonna find out. But if you let me know really early, I can jump on that. I can contain that. I can greatly minimize the impact and risk. So yes, building that culture in a positive way has rewards that most people can't even understand. But it's great when an organization embraces that and realizes, wow, wow, this is a huge difference. Right? And just having that teamwork and having that positivity makes an important difference. And it all comes back to psychology.

Yeah, absolutely. I couldn't agree more. And I love that piece of rewarding with a coffee for highlighting an issue. But I'm not sure about that.

I always have coffee, so yeah.

Uh, Samir, I have one question for you. You know, uh, recently I read that and, and realized that, you know, the insider threat is growing a lot. And so, uh, organizations are putting so many controls in place, for example, the monitoring software which will track all your activities, what you are doing, you know, to tackle the risk of insider threat.

You mean the Jiggler Mouse?

Yeah, including that and everything, whatever you're doing, whatever you're typing and sending emails or chatting with someone. So, uh, what do you think is this— I mean, do you think employees will feel comfortable about it, or is it required?

Yeah, that's, that's a very tricky question, and that's a very good question. I don't think so. I mean, personally speaking, I don't think so. Too much, too many controls, they kind of like kill the purpose altogether, okay? Because if you actually start dealing with like Gen Z and Millennials, okay, they are much more exposed to technology. They are like born with cell phones in their, like smartphones in their hands, right? They have been using it since they were like probably 1 or 2 years of age. They know the tricks around it, they know how to bypass all the parental controls as well. They are like really, really smart, right? And if you keep putting on controls, they are going to find some ways to kind of like bypass it. I mean, definitely like technology, automation, you know, artificial intelligence and all of this can actually help, but then it becomes a privacy issue as well. Like, and as to whether you are— how, how safely you are like, you know, kind of like monitoring and controlling the privacy of like individual behaviors, right? You can say like, you know, okay, do not, you know, go to these sites, or kind of these sites are anyways blocked, you know, that could be a better way. But then if you are keeping on, like, you know, monitoring them, that's gonna not help in the long run, you know. So I think from my point of view, too many controls will actually kill the purpose, you know. People are going to find ways out, and that's how cyber criminals are finding ways out to kind of sneak into the organization, right? They know the technology is like, you know, getting, you know, better and better, so they are like manipulating humans more because nobody is like, you know, targeting, you know, technology to be kind of like, you know, put inside human brains that, you know, that insider threats won't agree. And, um, first of all, like, you know, we have to really understand ourselves, like, you know, when it comes comes to psychology and emotions. And like, just yesterday we saw like, you know, Inside Out 2, and I was like wondering why it took actually 13 or 14 years to make the second Inside Out, because we need to really understand our emotions. If we are going to penalize people, embarrassment is going to follow, insider threats are going to, you know, increase. You've seen the recent case of like Singapore, which is a very, you know, kind of, you know, a strict country where it comes to law, like, you know, and placement of law. There was an employee, actually an ex-employee, a disgruntled employee who kind of like left the country and sneaked into the servers and caused some $800,000 or $900,000 worth of damage. He went back to Singapore to take up another job and he got caught and he's now in jail, right? So, you know, this is going to be a tricky situation. So I think the sooner we understand people, the sooner we make people a part of this game, okay, to understand cybercrime is going to be much better for the organizations. That's what I feel.

Yeah, thanks for that. I love that you have to involve people in everything you do. And so we are coming towards the end of the show. So Matthew, any last thoughts or tips for our audience?

Yeah, sorry to interrupt you. I think we have one question by Mandar. So if you, if you know, probably Matthew can take that question. He's mentioned great points, team. I just had a quick query. How do you see organizations leveraging AI and automation to enhance its cybersecurity posture, be it people or infra?

Yeah, that's a, that's a great question. And I'm seeing a lot of startups and established companies because I work all over the industry. They're using AI in many different ways. And there's some exciting things. But again, it comes back to kind of those three things. Clear communication, AI can do that. We see GenAI being able to communicate local language, you know, great word choice and so forth, and being able to communicate difficult or challenging ideas. And cybersecurity, there's a lot of ambiguity and chaos there. So AI can help with that clear communication. With relevance, the same thing. We can customize with AI the specific messages for individuals or groups or subgroups within the organization. The training and communication for HR may be different than accounts payable, which may be different than the engineering staff. So instead of having just one common monolithic training program, you can start to customize it to make it more relevant to the individual audiences, right? And then, when we talk about teamwork, again, AI can help with those agents and connections and communication because if it's 2:00 AM in the morning, you may not have anybody in your help desk to take a call. But if one of your foreign travelers sees something or does something, they may need help, right? So going to a chatbot or going, "Hey, I think I just did something wrong," Right. And having that start the process can really help. It can bolster the assets and resources available to the employees as well as security. And the security tools are embedding AI to be able to do what we do faster, being able to assess, understand risks, track attacks, and then interdict them much faster with a higher degree of fidelity and efficiency. So AI is coming in across the board as a powerful transformative tool to help cybersecurity.

That's all great points, Matthew Rosenquist. Thank you so much. And yeah, as I was saying that we are reaching towards the end of our show. So any last comment from both of you for our audience? Any last tips which will be helpful in building or strengthening the security culture?

Well, I'll say that there are many different ways to train and involve the employees to help get the end result of a good security posture. One of the underutilized ones that is very, very helpful, and I always do whenever I go into an organization, is identify those people that are already kind of security champions. Right? The people who are already interested in security and want to do the right thing, leverage them, right? Because you want to foster that and empower them, and they become a force of good practices, and they tend to lead the charge to help that teamwork really foster within the groups. And on the other side of that coin, there will always be people who are resistant Many times they are people who think they know better, right? And oh, well, I don't have to do this because I know I'm already secure, right? Identify those people and let's give them extra attention with full respect, right? I'll sit down with brilliant and world-class engineers who go, oh no, no, I don't need to do security because of X, Y, and Z. And I'll sit down with them even one-on-one and go, well, this is why the policy is— let's talk about it. And if you can convince me, I'll change it. But allow me to convince you because there's probably things that you don't understand, risks that you don't see that I do. But let's communicate together, figure it out, and then you can see both sides of the picture why that policy is relevant. And to date, right after 30-something years, I've never had to change a policy when sitting down with somebody like that. That on that initial discussion. So, and that solves problems ahead of time.

Sure. Thank you so much for all these insights. Samir, over to you quickly.

No, I think let's flip the script and like over to you. I think you have been like a very good moderator. Thanks for the opportunity to kind of like let me kind of also speak in, even though I'm not from cybersecurity, but I'm very, very passionate about people. So what would your take be on like, you know, the whole like, you know, security culture or like a positive security culture mindset?

Yeah, so see, from this conversation I can just say that it's building a positive security culture is a continuous process and it requires a commitment from the senior leadership and there should be a relevance as per Matthew said. And you know, it's also important to understand the psychological aspects of it. A regular good, uh, kind of security awareness training is absolutely important for employees. And also provide them some reasoning why we are doing it, what we are doing it, and how they come into picture. So, and that will really help you know, build a positive security culture. And there should be no blame game. Rather than, you know, focusing on who is behind it, the focus should be on how and why, what really happened and how we can improve on it. So all these small steps and commitment from senior leadership can really help improve the security culture of an organization. So that's it from me.

And, uh, and I think as Mandar also says, uh, communication and trust wins the battle. That's definitely for sure. Like, totally agree with it. Like, you know, we are dealing with people. They are the soul of the organization. They are the soul of the planet. So it's very, very important to inculcate a positive mindset in whatever we do with people or when we deal with people. So it's— that's important.

Right. And today is International Yoga Day. So I know we have already added a post on how I enjoy yoga and how I find it really helpful in my day-to-day activity. So Matthew, what keeps you going in cybersecurity? Quickly, any just hobby you really enjoy? Or do you— have you experienced yoga anytime in your lifetime?

I actually love my job. And I love the challenges, that ambiguity, that chaos. And working against an intelligent adversary who is smarter than me, has more resources than me, that has all the advantages. I love working against that to help make digital technology more trustworthy for everyone. And so that's my passion. So my hobby is also fortunately my career.

Nice, nice to know that. Sameer, to you quickly.

Okay, no, I'm, yeah, I'm really bad at yoga. I'm like still trying, like, you know, Pooja, Pooja is my yoga guru, but like, you know, I cannot be even like, you know, 10% as flexible as she is. So I keep trying, but I celebrate the World Music Day today because I'm like a big fan of music and movies and entertainment. So I cannot live without music. So I think music keeps me going and, you know, and I believe like, you know, cybercrime is just another form of crime. In fact, it's very, very interesting because there are so many stories to tell. And so we really don't want to bore people with more PowerPoints. As to what to do and what not to do. They can actually learn from the stories. Like, and they are— they are like— cyber criminals are churning out stories quicker than even the film industries. So we should— we should be actually using them in our, like, you know, day-to-day lives when we actually, you know, train people. And there's a dog barking. I'm not sure from where, but yeah, okay.

All right, all right. So thank you so much. You both are wonderful, and I really enjoyed today's conversation. Session. And I can't believe it's already 35-40 minutes since we are speaking, and we can, I think, go, uh, long speaking for another 1 hour or so. But I would like to end today's show, and we will continue the same in future. And thank you so much, Matthew, for joining us today, and I hope our audience also enjoy these discussions and insights from you, you both. So thank you so much.

My pleasure.

Thanks a lot, Matthew. Thank you very much.

Bye guys. Thank you.

Bye-bye. Bye, Mandar and everyone on the, on the call. Thanks. Thank you very much.

Thanks. Thanks. Bye.