"Full Circle: Pierre Bourgeix on Converged Security and the Road Ahead"

Welcome to Executive Checkpoint, where security professionals gather intel to navigate the ever-evolving world of physical and cybersecurity. I'm your host, Tino Urbina, and today we have a special guest. Frankly, a milestone for the podcast. Today is our 1-year anniversary, and for that reason, I wanted to bring one of our good friends and supporters and mentor, I should say, For many years, Mr. Pierre Bourjacks is the CEO and founder of ISI Convergent. Pierre is widely respected as a thought leader in the convergence security with decades of experience across physical, IT, and OT domains. From advising global enterprise to helping shape standards and governance models, he led the change in redefining how we move risk and resiliency. This anniversary edition, Pierre returns to give us more about his thoughts in the future and probably make some interesting predictions in the industry. So without further ado, Pierre, great to see you again, my friend. How are you?

Great, fantastic. I mean, obviously in these troubling times, it's hard to say fantastic, but, you know, absolutely wonderful to see you and and be part of your podcast.

It's been a pretty good year. It's been a good journey. I'm sure a few things have changed with you and your organization. So since our first conversation, you know, here we are. Are there any landscapes that evolved, especially in terms of convergence and governance?

Well, yeah, I think in general ESI has grown. dramatically. I mean, this year has been a banner year for our company. We really have transcended many of the challenges of coming from an IT/OT perspective into physical security, even though my background from the standpoint of technology was physical security initially. Going from there to IT and cybersecurity and then going back into physical security, I think At the end of the day, I think the interesting part of that is really understanding the challenges that the physical security domain had been going through. And really at the end of the day, the challenges of really changing in this environment, in this modern environment of technology, taking software and hardware and understanding that as we move away from just strictly hardware on-prem and moving to software and cloud and and the validation of that in a physical security world, which obviously had its challenges because innately it is the guards, guns, and gates mentality that once was, right? And still is to a certain degree because you still have that man-in-the-middle effect that you have to have in response. But if we're talking about technology, we're talking about that evolution, It's a dramatic shift. And this is also raising the tide of technology and the adoption of it across the consultant world, the end-user world, or say the— at the end of the day, the user of technology and the integrator as well. So there's a lot going on, my friend, a lot going on.

And, you know, it seems like You have to be, you know, as I always say in the introduction, in the ever-evolving world of physical and cybersecurity, more than ever it's important to keep up those— that vision of what is going to be working together on the bigger picture. In that sense, as someone who's consulting globally, what leadership traits do you see emerging in this multi-domain threat environment?

Well, I mean, if you're going to lead your organization today, You definitely have to understand, first of all, you know, your overall obviously risk, your liabilities, because those are changing consistently. You can't just rely on past successes or the challenges of what took place 20 years ago. I mean, today is September 11th, you know, a day that will live in infamy for the United States and really the world. You know, we never thought a plane could hit a tower used as a missile to kill 3,000 innocent people. The reality is, is that this is the ever-changing world we're talking about. You know, guards, guns, and gates didn't really help the World Trade Center. Intelligence would have, right? Better intelligence, processes, evaluating threat at a level that no one could even expect. Could we have stopped it? Probably not. But at the end of the day, maybe we could have at TSA. TSA and communication was better then as it is today, right? So there's a lot that we can— revisionist history. I mean, things happen. We have assassinations taking place. We have social and political strife globally. We have riots in France. These are troubling times. sociopolitically. And with that in mind, right, a leader has to adapt to that. They cannot stay stagnant. They can't assume that they know something today as if it did not change or nothing has changed over 10 years. With the rapid growth and use of technology and really communication across a global format, and with nation-states involved in, you know, and syndicates involved in threats and attacks, from the standpoint of cyber as well as physical, we have to adapt. And to adapt, you have to learn, you have to be open-minded, and you have to be able to communicate to your leaders internally. This is a challenge globally. This is— this isn't—

Yeah.

And there is no clear path unless you actually look at the entire picture of your organization, because every organization is different. So understanding, you know, what your resilience strategy is, how do you adapt? How do you— what's your continuity of operation plan? What is your positioning in regards to DR and all the things that surround that? Not just writing a book and having a checklist, actually making it meaningful to the organization. So you can tie people and processes and technology in one, you a fulfilling process.

So at the end of the day, the perpetrators are evolving with the threat, right? So, and they are the first ones to implement the newest technology precisely because they see it as a vulnerability for organizations that move slow. So in that sense, what will be the recommendation for not just the leaders but down the chain? I know that at one point you talked about a kill chain model. Could you break that down for us? Expand on that.

So yeah, it's very interesting because, and it's a good point, you know, we don't know how to evaluate true risk at times. We talk about ESRM, we've got all kinds of modeling. First, you've got to start with the threat. What is that threat? Okay. And what is the landscape of threat? What can you create in regards to protection measures around that threat? To do that, you have to understand that the perpetrator has the first shot. There's no way to prevent that. You're going to end up like— I mean, Charlie Kirk's a great example. You can do protective measures, but the first shot, and you do it right and it's assassin, he's going to hit its mark.

Right.

You can protect people, create glass, create measures, create that layered effect, but the reality is that if that's not how you want to present yourself or your organization, like a school, same concept, right? We know attack happens in Colorado. We know all of these things are going to happen. Why haven't we prevented it? Well, do you want your school to be a prison?

Right? Want your school target too hard to protect?

And so the reality is, when you talk about kill chain, It's a process of evaluating a threat through a process of actionable results that take place before you— I mean, and then being prepared for those actionable results, and having a process in place, and then, and then layering in culture.

Right.

Because culture will always trump the success of security. Security is friction. If you create more friction than the culture can handle, you have less success over time. And these are the challenges for security professionals all over the world. Once there, you can go through every class. I hate to tell you, every class will tell you all of this information. So I'm not telling anybody who has, you know, an advanced degree in security, in cyber or physical, by the way, you follow the same principles, by the way. They just— one is they resemble each other, right?

Right.

All right.

So they marry each other in a way, but it's the alignment that—

That's right. That's right. Yeah. So these are all paths to the success of security, but identifying really and understanding how you measure the successful deployment or successful application of security, then it's really evaluating what the acceptable level of risk of an organization is. So if we can't really understand that and we haven't defined what that is, then you're gonna probably fail every single time because you're never gonna reach a point where there's a balance and that you can create KPIs around the measurement of things. So, you know, we use check, act, plan, do. It's a reverse Deming cycle. It's, you know, like secure state days. I can go back and there are a lot of guys from that world will laugh at me because we use that infinitum. But the reality is, is that it has a point, right? We consistently check, we act upon it, we plan and do, and first Deming cycle, or use a Deming cycle. But the reality is, is that it's based on a process to evaluate things. And we don't spend the time to do that. We don't, you know, we don't test enough, we don't evaluate enough, we don't go through the process. You know why? Costs money.

Yeah.

Who's gonna pay for it? So as long as we identify risk threat, vulnerability to business operational risk and liability, then we have a better shot because that's when the stakeholder says, oh, this could cost me a lot of money.

Right.

And we've used this concept. This is nothing new. But at the end of the day, how we do it is the key. And who's the stakeholder in the organization that's gonna be the fan that's gonna be able to help you make that happen?

Absolutely. And, you know, not to— so true. And risk is still assumed and measured by feel instead of quantifiably, like you always suggested. And in this particular scenario from yesterday's assassination, I feel that we as security professionals always have an opinion. You know, understandably, it was a soft target, but there was no layers of any kind. Minimum security, obviously, we're, you know, it's a very daring situation to try to protect an area like that. But again, there was zero preparation. And I think that's from a security standpoint of view, it's a fail on the group organizing this.

Right. I think boiling it down is they lost seconds and minutes, seconds and minutes by not having a paramedic, an ambulance sitting there as they do in typical events. Too far to get there.

Right.

Really those routes of potential threat. But again, it's the reality. The reality is that people don't take that seriously usually. They don't say, they don't take into account that type of situation. And having situational awareness is one thing, but predicting or creating a prevention measure to potential events is really having that aligned in your— and let's just say, you know, for businesses, business resilience. Are you prepared for a catastrophe? Do you have continuity of operation? And what is those results in terms of situational awareness that allows you to make sure that when something takes place or something happens, you can immediately respond within seconds.

Yeah. And you look in this, for instance, it was very simple emergency response and a ring of fire around the perimeter to make sure, you know, at least there was some level of, you know, response on the protective side. Very sad where, you know, it's a very not the way to go about when—

Well, it comes down to money, Tino. I mean, at the end of the day, we all know it comes down to money. You know, we all talk about the importance of events or people, but, you know, we typically don't layer the money that is needed to take care of the problem. It's just a reality. And I can tell you that in critical infrastructure, as important as it is, you would be amazed how little interest there is in ensuring security measures. I mean, we're getting better.

Right.

We're getting better, but in certain areas of critical infrastructure, specifically, you know, on the utility level, and I would say better in energy, but less in other areas of utilities, I would say that we are still, you know, adolescent at best. So the immaturity of our security measures, and going back to your first question about kill chain and developing that process that allows this, It goes through an entire process of evaluation. We go through and analyze and define what that looks like. And we look at IT/OT measures that tie into that physical security response. That's where the convergence of conversation takes place. People, process, and technology. It's not just, is a system converged? I mean, I hate to say it, but that's not the point.

Right.

Because today virtually everything has been digitized, right? We have a digital domain now. Right? Would you say yes, we're absolutely— but that's not— now we need to separate it. So at the end of the day, there's a whole conversation about that.

And you know what, it's interesting, you talk about maturity of an organization. And it's interesting to see that some groups, right, they leave it all to security and IT, where the reality, if it was a mature organization, should include legal, HR, the, you know, C-suite and all the executives. Because if you're talking about culture, implementation of something like this with friction without culture is a fail, or it will, it will sort of work, right? Well, let me ask you on the technology side, what technologies have you been impressed, um, are in the move on the past year, either innovation or, you know?

Yeah, that's a good question. I mean, I think that, you know, the camera market has gone further in terms of building, uh, more analytics through neural chips, such as using Jetson and Umbrella and Halo. I think that the improvements to that technology is good. It's good. It allows us to gain more knowledge and information for ingestion purposes and create scenarios and at the end of the day create use cases that can help. I do believe that, you know, the use of drones, LiDAR, I mean, I think that, you know, it's funny because, you know, 10 years ago I would say, oh, you know, we're really far away from that concept. But I think the use of drones have improved. I think obviously that's because of what's happened in Ukraine, you know, in an obviously bad way in many ways, but it's been— it's improved our way of using drones. Drone detection also has been interesting. I think LiDAR in the perimeter, LiDAR uses have been getting better and more accurate. I think there's— I think what I'm seeing more than anything is more accuracy and much more of a clear path to a sequence of design or sequence of operation that makes sense, right? Right. You know, there are companies that are, you know, coordinating, obviously integrating themselves, like, you know, Honeywell and Lenel. And, you know, we have kind of this world, like what Genetech has built up. And I do believe there is a new frontier in AI, but it's not going to be the same thing that people think. I think that There's been a lot of talk about generative AI and all of this. We're not quite where people think they are. I think that the use of technology is a challenge if you think you're somewhere when you're not, because you're assuming that things can be done which can't be done because you have an entire ecosystem that needs to know this. So, you know, you can create the best ideas and slice bread, Right. But if you don't have an integrator who has the capability of really making that happen, and they're the catch in the sequence of design, and then, you know, so, you know, my world where I'm now building, you know, and now we're doing design and spec work, which I was, I was fearful of for many years, because I really just wanted to get to that point of helping organizations from an IT physical security perspective, get them to position so that they can get help by a great design firm, but frankly, I'm getting a lot of companies who are coming to us, Pierre, we need you to design this because we need you to understand the OT and IT perspective as well. And we realize that a lot of design organizations just don't do that as well. And so, and that incorporates frankly the sequence of design and the sequence of operation. We need you to really understand and work with IT, work with the physical security guys, work with OT, SCADA, and know that it's separated. But we have to know, hey, what's really going on? What can we do? And how do we protect a lot of the organization that used to not be protected and understand how we do it?

Right?

So there's a lot going on. It's, it's crazy.

Well, and you know, you mentioned, you know, that convergence, IT, OT, physical and cyber. Are companies moving farther along than we wish they were moving farther along? Or are there still a lot of silos in these organizations that kind of—

For good reason, some cases. There are good reasons in some cases. Because of— so, you know, if you look at OT and SCADA, the merging of documentation information between the two are very dangerous. Because what we have is we have a potential failure if we rely on an IT stack to support OT, which is a completely different vulnerable environment because you have PLC, programmable logical controllers, you have SCADA systems which recognize technology and absorb that and make decisions, but they're very rudimentary. The reality is that if we have a connected system on an OT controller that inevitably could be hacked by a side-channel attack, All of a sudden, because we have no, we have no systems in place like we do in IT. IT has been nurtured by, you know, decades of security measures. OT has never been secure because it never was supposed to be connected. Now everything is becoming connected and has its own domain controller. But the reality is, is that when a company says, I want to use that data, we have to do it carefully. Very carefully. And, and, you know, I would say your DMZ is your biggest ally. You have to be careful on how you do it. Directional communication, critical. Bidirectional, bad. So we have to really understand. And everything I'm saying right now, some people are going, what is he talking about?

I'm afraid you're right.

Yes. And I know that. I know that. I'm saying it because it needs to be documented. Right. Invariably, if you really want to know more, you have to call us. I mean, at the end of the day, I mean, you can't— ESI Convergent does this. So if you want more information, you have to call the source. But the reality is, that's how it works. And it's a plug, shamelessly. But at the end of the day, that's how it works.

Well, and you know what, I was in a conversation with a couple professionals a couple weeks ago. And I was saying, so what's, what's the plan, right, to move something like AI into actual business processes. Right. And it's almost like we're going back 8, 9 years ago, Pierre, where we were talking about, you know, just, you know, the internet and the expedited implementation of this. Like you said, there is a risk. And my comment and advice was incremental implementation with all the security and certifications for cyber first and clear understanding, do not move forward with your IT group saying, hey, you're IT, right? You should learn this AI thing and put it into the next box because that's going to be a big problem. My suggestion is, to your point, hire a professional, bring the expert. You know, manufacturing is bringing some of those expertise because they design and they invest money, resources on the cyber certifications and manufacturing and design. However, it's still so new that my suggestion is by implementing 5 to 10% of the R&D or just security budget and training at first and then implementation later, 4 or 5 years down the road, that's, that's, that's gonna, they're gonna be so far away from their competition that, but it needs to start now.

And, you know, I think that the conversation of AI is, and we'll just say deep learning, machine learning, and all the things that are required to gain knowledge. So we have to first align ourselves with understanding what are we ingesting, what are we ingesting, right, in terms of information.

Right.

That's important right off the bat, but you have to understand the use case. What's the use case and what is the specific, you know, requirement outcome that you're looking for? And I think that's our biggest challenge because we're lazy. Humans are lazy. Let's just be frank. We're all lazy. We don't do the extra work. We don't— we try to get the easy answer. Hey, AI, let's get the easy answer. And then, in fact, AI is being used correctly in some cases. I mean, hell, we use AI too. Everyone does, right? But we do it in a way that's very prudent. We align and evaluate what we can do to streamline that conversation, that decision. But we don't use it as the primary perspective. That would be wrong.

It's a tool, right?

It's a tool. Now, here's the problem. As I said, people are lazy. They will use it as the actual premise and just put a couple, you know, certain points of reference and hope that, well, they can build up an entire program around it. And I would be very cautious to do that. In fact, I would show— I would see that that would be something that I would absolutely point out as wrong.

Right.

Now, here's the challenge with respect to using AI within physical security, or at least within security as a whole. I think it helps in regards to ensuring that the message is aligned correctly if you have a premise and you have an understanding of what you're going to say. So you can use some of that AI to help that, okay?

Right.

That gives you a— it speeds up the process of getting to the end result. So point A, that does happen in the world of security. The challenge is trying to give people the impression that with AI, we're gonna solve specific real-world challenges. I'm gonna tell you right now that that's not there yet. Because we will be able to gain knowledge of the real-world situation. Situational awareness will get more specific. Remember I said specificity is really critical. But if we're looking for the full outcome, if you were to plug the AI modeling into Charlie Kirk's event yesterday, I think there would have been a very small chance of someone shooting him. You would not have gotten that result from AI prospectively unless you said, if I put a gun in this environment, where would I put it to shoot and give the specific requirements? Maybe I could get something, but that would even be impossible.

Too many variables and too much experience and the human element on the side to perceive.

I'm just saying we have to be really cautious in what we expect out of AI.

It's still a tool.

It's still a tool. And inevitably, the man in the middle is going to be more important than the tool itself. Because we have to have a human being, human being processes information, especially one that's trained, right? That's another problem. We, when we have untrained people, is the same process of training AI. Have you heard that if you untrain, if you have an untrained AI, you have nothing but garbage.

Right.

If it's not correct, well, human beings are the same way. If you have a guard who has no training whatsoever, he's as useless as, as a, a person that's, uh, in the public just watching the event. They're not— they don't have no knowledge of how to deal or how to evaluate a certain situation because they haven't been trained. So we are in a— we're in a big, uh, problem. I mean, We have a lot of smart stuff that we created. We have a lot of smart people, but we're relying on people that aren't trained. And I'm not saying dumb because they're not, they're just not trained.

Right.

They're not positioned in the right way to be successful because frankly, a lot of people use technology as their training vehicle. So what they do is they use that to bifurcate critical thinking. and deductive reasoning. So think about you as a human being without deductive reasoning and critical thinking. You have base logic, you know, you're higher than any animal species. You have logic as you grow awareness. But from that point on, what do you, what do you rely on? Thinking, right?

Yeah.

And learning and thinking. Well, what happens is that if you use technology to bypass that, what ends up happening is you move right to emotion. And we have a society of emotional thinkers. They're no longer thinkers that use critical thinking and deductive reasoning. They're simply gone from logic to emotion. I know this sounds very psychological right now, but let's just put it this way. Most physical security or security professionals need to be psychologists.

Sure. I mean, it's a big part of hacking, right? That's tapping into that, right, tapping into it, that, that is a resource to defeat one or the other, cyber or physical. So to your point, it's a huge element. The human element sometimes is bypassed because we rely on technology or processes, right?

And even using technology, right? So how we apply technology when we design systems, we're hoping that we can automate an entire process. Oh, look at this, we've automated everything. Yeah, but what is the result of that automation, right? You have to have someone review this alert finally, right? Even if I have a decentralized SOC, right? If I put a decentralized SOC together, distributed SOC, I still have to have somebody evaluate the occurrence, right? I have to have somebody respond.

Right.

If it's an immediate issue, I have to have validation that it's worth responding to. Or you could put it all into automation and hope to God that the one time it gets it wrong, that it doesn't cost someone's life.

And it's, it's again, that cannot trust on just one line of thinking, right? All physical or cyber, or, you know, no, right? Well, let me ask you, what would you think is the critical thing that executives and you know, sitting on the board still don't get about the convergence of security and how should we, you know, communicate this better to them?

Well, I think this simple reality is how it applies to their business, right? What is that? What are the key elements that apply to their business in regards to the use of good security measures in cyber, OT, and physical security? So we've done at ESI for many years now is we've applied, of course, of course, you know, looking in— we'll just say in the regulated markets specifically— is we align the regulatory environment to the business risk using technology or security to ensure that people understand that these measures aren't just based upon security alone. They're based upon risk and liability to the organization. And by defeating or using technology to defeat potential threats, to aligning those regulatory environments. You know, what matches with what? How are we ensuring that not only are we in compliance, but are we measuring our risk tolerance and aligning with more technology that can limit our liability? Because at the end of the day, what we always say at ESI is that, look, I can always, you know, defer risk. I can always move it aside. I can pay. for eliminating risk and using insurance, maybe. But I can never, I can never defer liability. Liability is yours.

100%. That's what translates well with the executive office, right? Where you, where you said, here is the hard cost for us not taking action, or the reduced cost if we do. Yeah, absolutely.

Well, it's also, it's also the prove it to me.

Sure.

The biggest challenge is that everybody is hoping that they can speak their way through this conversation. I call it the wall of the C-suite. That C-suite cares about one thing, right? A, they do care about the bottom line. That's the first priority. Second is, well, I want to make sure we keep our organization safe and also continue to do business.

Right.

So the reality is, and of course in that promise, we wanna make sure our people are safe, right? But the reality is that, you know, hey, I hate to say it, but it's the reality of the dollar and how it can be protected and the company can be protected. And then that carries through to virtually every type of organization, right? So with that in mind, what are you doing as, say, a manufacturer or a consultant or whoever to talk and speak to them so that they understand what that long-term challenge is or that short-term problem can be, right? So, but you have to, in fact, you know, and I always say, yes, you can try to educate the C-suite, but I prefer showing them value. and showing them why, right? You know, I always say that, yeah, you've got to show them why, because, you know, at the end of the day, yes, of course, you know, we can talk about a lot of things, but if we don't show them, they're going to give you 10 minutes at best to make it clear.

You know, to me, it's the difference between— you said it— what people, which are your— sometimes integrations are what do we need? Right? What do you want to do with it? Instead of why? Why is it important? What's the impact if we don't? Why if we invest this money?

And what is it tied to? Right?

What exactly?

What is the why? What is— okay, getting to the why is what is it tied to? Right? What are we talking about? Because if I say something about a why, but I don't tie it to the consequences, and the challenges and the problems that are existing, then all I'm saying is one statement. Well, this is why, but I'm not proving myself. I'm not giving myself room to think. You're just giving them a thought and then they have to come up with the answer. No person in the C-suite comes up with their own answers.

Right.

They're not. I'm sorry. It's just you're expecting a guy who is now, or a lady who's working on, making sure that the company is, is doing well that week or that month or that year, but you are throwing in this security thing. I get— I know we need security, that's exactly what they say, but why? Why do we need 300 cameras? Why do I need access control on these doors? Why do we need, you know, uh, sensor detection based on, you know, fence lines?

Why?

Tell me why.

And you know what, to me, going back to, you You know, my, one of my favorite writers, Stephen Covey, Dr. Stephen Covey, begin with the end. It's a good process to help someone in that position. Here's the consequence. Here is one path or here's the other. Which one makes more sense, right?

Right. Well, and that's, that goes back to the AI side too as well. Yep.

Oh, absolutely. And, you know, there's a lot of people that like the concept of implementation. It's just always, let's go to the end result that we're looking to bring in. A lot of people that watch the show are starting their careers in security, and some of them are, I'm sure, very excited about the conversation, and they're thinking, okay, what do I need to do in the next 3 years, 4 years, 5 years to be at par with the industry. So talk to them. Because we're talking about this, this organization, the CEOs, we're talking about the integration groups. What about someone coming in? What do they need to do?

Yeah, I think, I think boiling it down, right, the reason why the ADT model was so fascinating is because you— and the integrator model— to learn technology first, right? A lot of people, you know, I'm not saying that you don't learn the process of technology, the alignment of risk and what that looks like. But at the end of the day, if you're gonna be successful in security as a whole, you have to understand technology today. You can't avoid it.

Right.

So I always say, if somebody is entering the world today, try to get real-world knowledge through integrators, get a job in an integrator. If you're gonna do consulting as an engineer, Well, as you're getting, you know, your classes, get to, you know, be a part of a security organization, be it a consulting firm, or be an integrator, be— have— get your hands into this, learn about it, understand it. Because I'm telling you right now, there's a lot of design engineers right now that come into the security space that don't understand one thing about how technology works. They understand what the premise is and what the reality is, Division 8 to Vision 28, they'll get that part. But at the end of the day, how do you deal with the outcomes? And I think that understanding the industries they're doing business in, people need to understand what are the challenges that organizations have in regards to security. When it comes to cybersecurity or IT security, my, my, my desire for everyone is to have an opportunity not only to learn the basics of what we're talking about, but advance your knowledge as much as possible in certain areas of cybersecurity. Don't try to eat the elephant. I would say one bite at a time is much better. I think a lot of people, because they get, they get frustrated, they want to get all this done so they can get a high-paying job. And I go, hey, listen, and this is to our, you know, 20-year-olds in the industry today. You know what, time will make that happen. You're not going to get what you want all the time. But you, if you just a little bit of patience, you know, get another job if you have to get 2 jobs to get to where you want to go. Don't expect miracles. You're not going to get what you want right away. And those who have the patience and have the desire to learn and keep minded and don't think that you're going to get it all from this phone, practical knowledge, learning, seeing, and evaluating and doing. that type of work is much better than just learning it online and thinking that they got the answer. Because I'm telling you right now, you'll get a piece of it.

Yeah.

But you're not going to get all of it. So it's, it's, it's, it's, it's roll up your sleeves, hard work mentality that's going to get you success in the security industry. And then you want to be recognized, you want to be a thought leader. Please don't enter that thought leadership position when you don't know your ass from your forehead. You've got to learn first, be understanding of what the technology, the world, of the world we live in, and then you can start speaking about it. I don't mind podcasts and all that cool stuff that people do, but just be careful what you say and how you say it. Opinions matter, words matter. People learn from people who say things. I would be prepared to remember one thing. The security profession is unique, very unique. We have a responsibility because if we screw up and we do things wrong, people could die. I always try to be sobering at this because I think we just, you know, if you're working for a manufacturer, you're just thinking, okay, I'm going to sell, sell, sell. If I'm selling or I'm making or innovating or this and that. But at the end of the day, what we're doing actually matters. So, you know, people rely on it and it fails. or we say something that isn't quite right, or we talk about things, or we do things that just really don't matter, then what are you really doing for our industry? So, you know, I'm not gonna be judgmental about everyone because I myself am not perfect. I've made a lot of mistakes myself as a person in a thought leader position, trust me. But I've learned from some of those mistakes. Some of them I still haven't. all— you're— we're human, by the way. So I would say that that's the key also, is be humble as much as you can, which is hard for a guy like me because I do go overboard on it. But the reality is I do know it's important. Uh, I understand the importance of being humble. I also understand the importance of really knowing what you say and sticking with it. And I try to, you know, bring down the tone of the language of, of knowledge to try to make it so it's attainable. But at the same time, I'm not going to obfuscate the fact that I need people to get and elevate the tide as well.

Because at the end of the day, it's only going to make those conversations between professionals frictionless. I've seen, by the way, for the record, I've seen Pierre sit down with not one but many people that approach him in events or corporate events and whatnot and sit down and have a conversation. similar conversation about, look, critical thinking is essential. Your ability to communicate is important. But more than anything, be resilient on learning, never stop.

Yeah. Communication is really key. You're right. I mean, at the end of the day, we have to learn to communicate. We can't speak to our phones and hope that we're going to get the answer. People listen different ways. I've learned that better over time, because I just you know, would just go off and because I was frustrated. And the reality is you can't get frustrated. Humans learn at different paces, but you will have to give them as much as possible. And being a servant to the, to the security world as much as you can will help our world.

Truly, I appreciate that. And this is so true. But Pierre, thank you for returning to Executive Checkpoint and helping us launch this path, at least in my professional career. Really, thank you from the bottom of my heart. I believe that we're doing a good thing in this podcast to bring knowledge to the professional side and make sure that we bring not only the best, but the cream of the cream.

Tino, I'm proud of you, my friend. You've, you've done so well in the last many years that I've known you. And And I'm happy that whatever I could do to help has done well for you, and you're going to do the same. I could tell you're passing it along. I hear it. I see it. Congratulations on all the efforts, and this is a great show, and I wish you luck.

Thanks so much. And, you know, this only continues, and we'll continue this conversation. I'm sure we'll do this again, Pierre. You're always a welcome guest to the show. And with that said, You know, I'll see you at the next event. I know we're going somewhere, right?

Yes, actually.

For the rest of the viewers, thank you so much. Thank you. Appreciate you for all your support and your kind words and this milestone for Executive Checkpoint. Until the next time, stay informed, stay secure, and we'll see you at the next checkpoint.