Actual PROGRESS in cybersecurity?! Are you serious? Here's the skinny!

All right, what's going on, my friends? In typical LinkedIn Restream fashion, comments aren't showing up. I'm watching comments right here on my phone, but they're not showing up here, and I don't know why. So whatevs, if it doesn't work, it doesn't work, but I'll be watching on my phone for your comments because they do matter, and there's a ton ton of you guys on here. Occasionally it does this and it's so infuriating. It's like no one's connected to the stream. I'm like, then why am I watching it here? Why is there 20+ on that have already connected? And tell me why no comments are showing up when I see them on my phone. It's so frustrating. One of these days we're gonna fix this. Matt Lee checking in, what's going on? Uh, Matthew Magica, good to see you on. Tim Schnurr, good to see you on. You guys, shout out, tell me hi if you guys are on. Um, if they're not going to show up on chat whatever reason, it's all good. We're just gonna make it through. All right, man, I hope you guys have had a great morning, great evening. Um, I had a snippet of time today that I wanted to cover some of the cool stuff happening in, um, some data that's come out. I've actually seen this come out, um, a little over a month ago and wanted to cover it. I just haven't had time, and, uh, I do now. So we're gonna, we're gonna jump into this. Um, first thing though, before I get into it, because it's related, is I want to talk just a bit about Let's see if we can get this going over here. I want to show this right here. So this is coming in from Forbes. This is just from their Forbes Technology Council. Why overcoming the cybersecurity labor shortage seems— matters to company success. Now, we know this, right? We security people get it. We're like, yeah, it matters to success for sure. It does. I don't know Justin Rinde. I've never met him. Don't know that person at all. But Some interesting things here. 52 million data breaches globally. You know, that's the stuff that when you read it, you're just like, whatevs. Like, I've seen that a million times. I'm just going to move past that. It doesn't affect us, right? That is definitely a frustrating— when we, when we use statistics like that, I guess what I'm saying is oftentimes people gloss over that. They're like, that means nothing to me. 52 million of anything means nothing, right? So Whatever, right? So as we move, move past this a little bit more, they talk about quantifying this. We need to fix it. He goes into a little bit of like some data around the Global CISO Survey, a ton of burnout, 53%, job-related stress, 60%. I'm like, welcome to the world of security, right? Like, this is, this is the world that we live in. You wouldn't want to take this job, you know, if you couldn't handle the fires in the kitchen, right? And on top of that, I'll tell you another thing as well is like I think we security people thrive on— and I want to hear from you in chat— I think we thrive on the challenge and how crazy it is. It's sort of like ER doctors and ER nurses. Like there's a little bit of the— you get something out of the stress of it all. We're just weird, aren't we? I want to hear back from you if you're the same way. Let me check back in because again, chat aren't showing up if you're just joining me. Um, let's see what else is here. Lucas Johnson checking in. What's going on? Glad to see you on here. Um, and yeah, Matt said he thinks the Restream API did some, some changes. I think Matt's right. Dom Kirby, wow, we got Dom on today. That's awesome. Good to see you on, my friend. Ross Farrington, the one and only Ross. Dude, I haven't seen you in forever. I hope you're still doing awesome. We worked together at Perch. Um, so much fun. Ross was just an unbelievable, um, SOC analyst, has moved on some to some amazing things. So good to see you on as well, Ross. Okay, so one of the things he talks about, he gets into compliance a little too much in this article. And Matt, this is probably going to trigger you as we go down. He gives like 4 things that we should start doing to start with. And the very first thing he gives is determine your level of compliance. That's companies seeking potential solutions to this cyber shortage and all this kind of stuff. He says we start with determining your current level of compliance. Agree or disagree? I'm just going to tell you, I disagree with this. But I want to hear from you guys in chat. I want to know kind of like, what are you thinking with this? Why? Why does he start this way? And is this the right way? If you're starting out and you're kind of thinking through for your company how you're going to address the labor shortage gap, how you're going to address the challenges in cyber, are you going to start with compliance? One of the things that we talk about in this industry all the time is that compliance sets the floor, never the ceiling. Compliance helps. I'm a huge fan of compliance, but compliance never takes the organization where it needs to go. Compliance is set usually at industry levels and they're set very wide. And so because of that, it's difficult for compliance. If we just say we are a compliant organization, to say that we're doing the right things, to say that we've set our unique risk thresholds the way they ought to be. Yeah, I already got an SMH from, from Matt. Sorry to trigger you so early in the morning, my friend, but I wanted to do that. That. And then Tim says, why not a gap assessment versus CIS? Completely agree. And so he even gets— Tim, he reads your mind and he pops that in as number 3. And I think that's the right goal, the right, the right, um, the right thinking there, right? And then Matt says, I think the intention is to try to start with the business case. It's likely mid— I'm not sure what that is— focused what it is about, but we are contractually obliged to be— yeah, compliance is the bare minimum. Yep. So Anyway, just wanted to start with this. I love seeing things like this come out in Forbes magazine of all places. It's good for business owners to think, to think, oh, maybe we do have a challenge here. Maybe we have under-resourced and underutilized. And this is true. I don't know if you've seen Cyber Seek or not before, but check this out. This is a really neat website because what it does is it goes into— this is especially helpful for students. If you're watching this today, I got a bunch of students that follow me. If you're a student, really dive into this, or you're thinking about getting into cybersecurity, get into this. Take a look at what Cyber Seek is doing. They have a whole heat map. I'm going to show this to you. If we bring this up, it basically brings up the US, and I think they can, they can even go into like other areas of the country as well. But I'm sorry, other areas of the world as well. But look at some of this stuff here. You see where some of the biggest areas of job openings are? 39,000 here in my state of Florida. Tennessee, 73,000. Sorry for you Montana folks, 1,000, right? But there's still, you know, that's still a lot of openings, right? Looking at the supply to demand ratio, 68% shift towards low supply. We know this, that there are still a lot of job openings. There's 755,000 openings to 1 million currently filled in the workforce. So there's room for you. One of the things I want you to see out of this is, and I say this all the time, guys, And gals, there, there's room for you. We want you in this. Never feel like I'm not smart enough. Never feel like there's not a place for me. Never feel like, oh, I look at where everyone else is at and I'll never be there. Please don't let those thoughts terrify your mind. I'm looking at this and the data says there's room for you. We want you in this as well. Maybe not Alaska. Alaska, no, thousand. So even in Alaska, there's room for you. And I'm, I'm very excited about that. You can scroll down and you can kind of see a lot of stuff. One of the things I think is neat is looking at top certification holders and openings, job openings requesting certifications. So the top 2 that come in are CISSP and Security+. Those are 2 you can go and get. Now, the CISSP, you have to have some experience to get it, but you can still go for the provisional. The Security+, guess what? You can get started on that today. Go right over to CompTIA and begin the journey on that today. So, so I think this is really great. They even have this career pathway, which I don't fully think this is great, you know, but it's helpful to kind of start out, you know, looking for an entry-level job. What is like an incident and intrusion analyst, kind of like a SOC analyst, kind of level 1? What does that look like? Average salary, what kind of career pathways might it go into? So, so the pathway stuff, it's not perfect in how the pathways flow through, but, it is helpful to kind of look at what the job at an overall level might look like. Okay. So I think this is really cool and wanted to just share this, man. I hate that I have to keep reading comments on the phone. So annoying. Wish it was just showing up right here like I normally have them. I'm sorry if you're joining me today, for whatever reason the comments aren't working and it's frustrating, but it is what it is. Okay. So here's the thing though, about the hiring before I get into some of the data that I wanted to talk about is there's room for everybody, but how do we get in? You know, like, so if you're a tech, if you want to go the technical route, you're fortunate because you have people like Jon Hammond, who's the best. You've got people like Jon Strand, who's also the best. I guess all the Johns are the best. You've got, you've got YouTube galore. You've got universities, you've got CompTIA, you've got conferences you can go to, you've got books you can go and read. There's so much for you if you want to go the technical route. The one thing that I will say, and if I'm just going to plug it just for a second, is what about the rest of us? What about people at the MSP that simply are not in a technical role but have to speak cyber? What about you? What about someone that just got brought in and they're going in there and account manager, maybe somebody that's now a VCIO and they're doing technology alignment. They've got to speak cyber, but they don't know how. Where do I get that from? How do I find it? So I'm just plugging this quickly. If that's— if like, it's great to see there's so much opportunity, but one of the things we all have to do is how do we bring people into the fold? How do we help people come in and learn and get all rowing in the same direction together? And so I will say that's why I started Empath Cyber. If you're not aware of Empath, you can check it out, empathcyber.com/join. Um, inside of Empath, we've got all kinds of incredible stuff, all kinds of like events that we're doing, training. We've got courses, courses galore across different things. I've got a lot of video content that matters. We've got things like Intro to the Cyber Defense Matrix, Cyber Insurance 101. We've got things like how to create a cybersecurity sales event. There's so many things that all exist inside of this. We've got things like, if I go into content, how breaches happen, how to explain this to a client in a way that makes sense to them. We've got things like cybersecurity misperceptions. How do you deal with a client who doesn't understand why cybersecurity matters? So things like, oh, I'll just deal with an attack when it happens. Come on, man, how do you deal with that objection? What would you do about that? So check us out in Empath. It's the— it— love to have you on board. $75 a month. It's the easiest decision you'll truly ever make. Um, I don't think I was sharing my screen for any of that. Wow, look, what's— man, here it is. Wow, let me just kind of quickly go back through this. Courses, you can see some of these courses I was just talking about. Intro to Cyber Defense Matrix, etc., etc., etc. Content galore. Let me go back to a couple pieces of those, um, content. Man, apparently not with any more coffee this morning. So anyway, I'd love if you're interested, empathcyber.com/join. Love to have you in there. Okay, so without any further ado, let me get into some data from Coveware. If you don't know who Coveware is, really amazing company. The reason I'm such a big fan of Bob and the team over there is they, they are— they truly are a first responder. They handle a lot of not just the ransomware payments in the correct ethical legal way, um, is at least as ethical as it can be, right? But they also do a lot around incident response, they do a lot around negotiation, Really great company. So they have a lot of great visibility into what's happening in the world around us that the rest of us, including to some degree the federal government, don't have themselves. And so I really love their blogs. And if you haven't been on their blog, just right up here, click on blog and you'll be able to see this because there's some really, really great stuff that exists. And I want to unpack some of the data that's here. And man, I just wish I could get better into the comments here. You guys are saying some amazing things here. But I'm going to try. It's on my phone. If you're joining us, I've already said it. For whatever reason, comments aren't coming in right now on, on Restream and LinkedIn. So kind of is what it is. All right. So take a look at this. Over the past 4 years, the propensity for victims of ransomware to pay ransom has fallen dramatically. Now, I would agree over the past year, but I'm like, over the past 4 years, really? Does the data support that? It does. From 85% in Q1 of 2019. Now hold the phone. 2019, 2020, 2021, 2022, and now we're in 2023. See, did you do what I did? I'm like, 2019's last year, maybe 2 years ago. We are so old. We are so freaking old. I saw that and I'm like, no, I was thinking that meant like 2016. See, to me, 2016 in my brain, that's 5, that's 4 years ago. My Goodness, we're getting old. What is happening to time? So 85% 4 years ago in 2019 to 37% today. On an annual basis, 41% of victims paid in '22, 76% in 2019. So look at this. You can actually see this if you look at the— man, that, that failed. I was hoping that zoom in would work. It's not. But you can see this right here well enough. Look at this. 85% in the days of yore, pre-pandemic. Everybody was paying ransoms. Just everybody, everybody, 85%. Because I think back then people were totally unprepared. I think we can see the data from before. These companies were just not ready. And we see into the pandemic it did go down a little bit, but not by much. So this was what we talked about over and over and over. But this alone is encouraging to me, and I want to hear what you guys think in the comments. Now we've seen a slide down in the amount of ransoms paid. We're currently sitting at last quarter from last— from the data from last year, the last quarter at 37% of ransoms paid, at least from what Covir sees. And I think it's probably fair to say that's a pretty good number. So I'm going to pull out my phone. I'm curious what you think. Like, I take that as that is progress. Look, I try to be the optimistic CISO. I try to like say, where can we find opportunities that we can go brag on ourselves? Because darn it, we need to do that. There have been so many failures that we have seen in cybersecurity. We have been— we have taken our licks. We have definitely come out with black eyes here. So any amount of progress, things like this are encouraging to me. It means a lot to me. If I was reporting to a board now, which I don't in my current role, you better be sure I would show this and say, look, this is what investments do. Not just your dollars, but your time, your attention, your support. That is progress, and I'm glad to see it. All right, let me see what you guys all think here. Oh yeah, always more coffee. That's exactly right. What's the URL? The URL for— I'm not sure which one you were talking about, Kevin, but Cyberseek was one of the ones I was talking about. This one here is Coveware. It's just C-O-V-E-W-A-R-E if you want to get into this one. Dom says, I'm pretty sure the clock just broke in 2020. We're almost a quarter into 2023. I'm still not writing down the correct year. Yeah, brother, I'm the same way. Oh, Ernest checking in as student— no, as an MSP currently. Cyber insurance has allowed us to secure our clients further, but the amount of breaches via email are on the rise, plus skirting— oh man, see, this is why this— yeah, I can't even read— oh, plus skirting MFA. Yeah, Ernest, you're exactly right. So, so cyber insurance has been a huge boon in the sense of it's forcing better minimums goes back to the compliance discussion that we just opened livestream up with. Right. And it is helpful. And if you need help with that, check us out at fifthwallsolutions.com. We have an education pathway completely free, true, no strings attached. Jump into it. We'll start you in a Cyber 101 and then we'll pull you through an entire masterclass pathway, which is really awesome stuff. So check that out if you want to see if anyone else has chatted in here. The time lapse is the lingering effect of the pandemic lockdown. All of us have experienced it to some degree. Yes, Scott, that's exactly right, man. It's like we've all been locked away in our homes. So give me some comments. There's probably a lag on the video feed to me asking, to me seeing the comments. So I'll come back to that. But yeah, we're seeing that's progress right there is what we're seeing. So they get into some factors on this that they believe are present. So key factor one. Enterprises are investing substantially more in security and IR. A heightened appreciation for the exponential risk of ransomware attack has substantially increased funding to enterprise security and IR teams. So in other words, they're basically saying, look, from our point of view, we are seeing progress because companies are investing more and more in security tools and controls, more in actually maturing their incident response. And that's going a long way. We also understand the risk of ransomware. This is now a board-level discussion topic. We hear it in the news. We want to hear about it. We want to know what does this look like? We've been impacted and affected by some of these bigger attacks. So we care about this, right? High-profile attacks at Colonial Pipeline were very effective in kicking off a fresh wave of investment in security because here's the thing that boards care about. They don't want to be lapped in with everyone else in the sense of what would happen if we were the next one. It's fine for like I'm putting my board hat on for a minute, like my non-technical hat. I'm going to put— this is my board hat today. Okay. My, my Slagle CNWR hat. This is my board hat today. All right. So I put that hat on and I'm thinking, oh, so Colonial got hit. I guess they get a pass because no one else in our industry got hit by it. But what would it look like if I'm Colonial part 2, I would look even worse as a board member because I didn't take action on something that happened to a fellow victim. See how they think like that? And so that's where that's like, okay, we're going to put some more investment in, we're going to put some more dollars into this because it's a big deal, right? I think that's not a bad thing, right? This clearly personified a major bump in keyword search volume and frequency for terms such as immutable backups, but so is cyber insurance because they've been asking for the same thing. Do you have immutable backups? People are like, I don't know what the heck does that mean? What does the word immutable even mean? And they go and check that out, right? So we see this, right? An increase, just that they just use that as one example. But yeah, so we're seeing that companies are certainly doing more. They're certainly investing more. They're certainly practicing incident response as they show here more. This is good. And so, so first of all, I guess I should say there have been key drivers that have forced us to invest more, commit more time and resources and care more. And that's been part of the additional reason we've seen a slide down in the number of ransoms that have not been paid. This blue level increasing, the more blue we have here, the better off we are. We're not paying ransoms. Okay, so let me come back to comments and see. Sariah, thanks for joining us today. It's encouraging to hear and see progress in our community. Agree, Sariah, and thank you for joining. And absolutely, that's how I see it too. Like we should be— there's room for improvement for sure. But really good stuff to see. Colonial Pipeline was the key incident to our clients finally taking operational technology security seriously. Scott, thank you for those comments. I would see those are the things, those are the comments I live by because I'm not in your industry. And so I don't see it the way you see it, your boots on the ground. And so those kind of comments are really exciting and I'm glad to hear that. I'd love to hear more from you on some comments and just some anecdotes on like what that's meant. For you and for your clients. Because yeah, the reality is sometimes we just have to see this happen to somebody else before we take action. It's unfortunate, but this, this happens, right? So yeah, glad to hear that. All right, so key factor number 2, and I don't have time to dive into this a lot, but Coveware believes, and I happen to agree, that law enforcement agencies like the FBI have subtly but effectively shifted strategy from pursuing just arrests to putting a focus on helping victims and imposing costs, the economic levers that make cybercrime so profitable. That's a really, really interesting one. If they give this little link right here, I'm going to show this to you. So this comes from the FBI right here, FBI.gov, oversight of the FBI Cyber Division. This was given March 29th of last year. And so you can, you can scroll through this. I'm going to get through past the data, the value proposition right here. If you ever want to read this on your own, I don't have time to go into it in today's livestream, but here is the FBI cyber strategy of what they're focusing on. What they're moving towards, moving into truly helping victims, to working with the private sector, to producing more information that helps, to, yes, still doing arrests. They mention right here, one of the most notable examples of recent success is our disruption of Sodanokibi, REvil. I actually covered that on my YouTube channel. If you search for the rise and fall of REvil, you'll see my documentary that I covered on this, on the shutdown of of REvil, same guys that went after JBS and in my own industry, Kaseya. They even mentioned Yaroslav Yezhinsky. So if you don't know Yaroslav, hopefully you don't, right? If you do, we need to have a conversation. He's actually sitting in North Texas. And last week in Rite of Boom, Robert Chiaffi mentioned who was an MSP that was impacted by the REvil, the Kaseya REvil attack, was mentioning he is like 10 minutes from where we're at this hotel right now. Boy, I'd love to be in a room with him alone for 10 minutes. I, you know, New York style. At least joking about the violence. Maybe not, uh, if you know Robert, but, uh, but probably not. Uh, but who knows? Robert's a bit of a loose cannon, right? But anyway, he's just talking about this. There he is. That's progress, right? So you can read through this and see kind of the shift in strategy. I don't have time to go into that. I guess I could do another livestream on it if you cared and wanted to see it. So that's factor 2. And they believe— we hope the agency continues to lean into this strategy in 2023 and beyond, as it's clearly working. Yes, disrupt the bad guys. Help the victims. Help us all mature and do more. Get more involved. Don't just be, you know, going after the bad guys only and trying to put them in prison. We all applaud that. We want to see more of that. But, but also do some work on the defensive side as well. Okay. Factor number 3. Now, this is where it gets interesting. All right. So if you've just been sort of like listening but not watching the screen, here's where you want to kind of put in a little mental energy with me because some really amazing stuff happening here. By the way, if you're joining us, I don't have comments coming up today because it's just not working. Talking. So I have them on my phone, I'm trying to reach down and look at those as well. All right, so look at this. Factor number 3: when unit economics of a profit— they're just talking economics in general here, all right— when unit economics of a profitable industry shrink, the contraction tends to compound on itself, causing exponential decline versus linear decline. In other words, when a company grows, we can just linearly grow by doing the right things. We're growing, we're growing, we're growing. But In a lot of economies, when we have a profitable industry and it's growing quickly, and then all of a sudden it goes down, it's not just a, a linear decline downward, it's a compounding. One problem leads to another. When we've had good fast growth and things are going well and something goes down, it tends to go down way quicker. It compounds in on itself and it topples much quicker. This is not just in ransomware, this is in all business. Businesses that are growing quickly, they have to be very careful to protect that. Sometimes it's even as valuable just to level things off because sometimes when you hit decline, it compounds. As the absolute dollar amount of ransoms proceeds produced by the cyber extortion economy shrinks. Look at this. The operating costs to carry out an attack increase. In other words, okay, look, in the days of yore, 2019, 4 years ago. It's crazy. And it's going up and it's blowing up, right? All of a sudden, when the reduction in ransoms are occurring and we're seeing that go downward now, it's much more expensive for bad guys. It's not as easy. As less victims pay, the profitability to the criminal shrinks. And this is true. Like, we don't think about this often. They have costs. They actually talk and act as if they're running a business. By the way, if you don't know that, they will call their victims clients and customers. So that's how they act. That's what's in their brain. It's a business. But they do— they're not a business, but they do have costs. All right. And the cycle repeats in a compounding manner. So as, as you decide to not pay as a victim, you are directly harming the bad guy because they put time, attention, resources into you. And when they get nothing out of that, their losses compound significantly because they put in a lot of time into this. The end result is a smaller number of cybercriminal actors that can make a living distributing ransomware. So if we can reduce the supply coming back to them, then the demand goes down. And if the demand goes down, then we see less and less of these outfits. If we see less and less of these outfits, we see less sophistication, we see less innovation, and they tend to shift their eyes elsewhere to wherever they can go and make money. Maybe I— maybe they go into like making money in an ethical way. They're going to go for whatever is easiest. That's just the mantra and idea these people have. So it makes a difference. You paying a ransom makes a difference, but it's not as simple as that. There are some unfortunate downsides. And I'm going to cover those. All right. As we've long discussed, attacking the economics of cybercrime is the most effective way to counter the threat of ransomware. I wholeheartedly agree with this. If you want to counter it, don't just go after and arrest them. Do arrest them. Hear me. But understand, if you really want to eradicate it, make it to where there's no value in it. If they can't make money out of it, then why are they going to do it? They might— you might still see some doing it for, you know, the whole like cyber, you know, like, like setting a message like WikiLeaks. You're going to see that kind of stuff, but you're not going to see big sophisticated outfits that are in this to make millions and millions of dollars. So I totally agree with this. But here's what's interesting. If that's true, look at this data. If that's true, then why have we seen from quarter 3 to quarter 4, so just 3 months later, a 58% increase in the average ransom payment. Why? Why is that? Why do we go from $225,000 for the average ransom payment in Q3 of '22 to now $408,000? If what I said is true, why is it now way more expensive? Doesn't that seem counterintuitive? That should be the thought. Same with the median ransom payment. That's gone up 342%. That's crazy. So now the median is $185K. So we've seen a huge increase in the average ransom payment. When you think about that a little bit more, you're like, wait a second, doesn't that make sense? If there's fewer people paying ransoms, then I need— as a bad guy, I need to increase how much I'm going to get out of it because I got fewer paying clients, right? If there's a lot less out there for less opportunity out there for me, then I got to raise my price. Less supply, more demand. That's kind of what's going on here. You look at the payments, they've actually— they've blown up of late. They've just blown up. Now, we've also covered some of this as well, that there is the Ukrainian conflict has a lot to do with this as well, just because some of these threat actors— I covered this in a couple of livestreams ago. If you want to peek into like what modern cyber warfare would look like attached to a kinetic war between two superpowers, you're going to see— you look at what's happening in Ukraine. A lot of these bad guys are now focused on disruption in Ukraine. So I think there's also something to be said for that as well. So if you didn't attend that livestream, go back and watch it. DM me, I'll get you a copy of it. But the high level is this: we've seen about a 300% increase in the attacks against Ukrainian infrastructure. Like never before, all from Russia. So a lot of those people that are going after financial crime have now switched, put on the bad guy— now this was my board badge, now it's my bad guy badge— they put on their, their nation-state, uh, hat, and now they go after, um, you— they're working for the Russian government, they're going after Ukrainian assets, but instead of ransoming them, what are they doing? They're literally just disrupting them. They're literally just deleting everything, just smash and grab and destruction. That's part of what we'd see in cyberwar. Okay, so costs are going up and they mention this. Why are the average costs and median costs going up if fewer companies are paying? As expected, the profitability of a given ransomware attack decline— the attack declines for cybercriminals. They've decided to compensate by adjusting their own tactics. First, the medium victim size in the quarter— during the quarter, 275 employees plus 10%. So first of all, They've gone up the stack. So they've said, okay, if not few people are paying, we got to make more. So if we're going to make more, then we have to go after companies a little bit bigger so that we can, we can make the numbers up and we can make this a profitable business. Right. I say that with the airiest of air quotes. That's what's happening here. Threat actors are moving slightly up the market to try and justify their larger initial demands in the hopes that they result in large ransom payments. So this goes back to the age-old, what we call big game hunting. That is a term that CrowdStrike kind of personified when we saw that 2017-18 shift in attack tactics where bad guys were beginning to congregate together, build affiliate programs, and work together in force. And now they're going after really big companies. And so instead of ransomware payments being $10K, $50K, now they're like $1 million, $2 million. So then we saw them come back downmarket as they realized, oh, the big companies are doing a better job securing themselves. And downmarket is like, you know, stealing candy from babies. And so we saw that huge increase. And now as we see the small market doing better, thank you, MSPs, we're seeing less ransoms being paid. They're like, maybe we got to go back upmarket. So this whole like upmarket, downmarket is really interesting. You can actually see this right here. Look at this shift in attack This is, this is the number, the size, the median size of companies impacted by ransomware. Notice vast shifts in the 2018 era. Only small businesses because bad guys themselves were not highly sophisticated. They hadn't really got like GandCrab was just coming out in 2018. One of the most, the first, I would say, like prolific, large, focused, financially driven outfit. There was a lot of other like really advanced nation-state outfits that were out there, bad guys. But GandCrab is one of like the first sophisticated, well-oiled machine. And so that's when you see that slide go up because they realize they can make a lot more money. We kind of hit that peak in 2021 as the pandemic is kind of coming into full force. And then we see this slide downward and we see it slide downward because those small businesses were not ready and because there was a lot more opportunity. So here's the deal. Threat actors are like water. They will go wherever the opportunity is easiest. They will go wherever the least resistance path takes them. And so right now, as small businesses are doing better, as we're paying fewer ransoms, that means they can't make their money on the low volumes, you know, the ton— I'm sorry, the high volume but low payment. Now they're saying, well, all these like small businesses not paying are hurting me. So now they're not as lucrative is maybe I should focus my attention on bigger companies and go after bigger ransoms. You see this shift, this up and down shift? This will continue to happen. So two things that shine to me very seriously out of this is one, progress. That's progress. That is, to me, definitive progress. But two, because this goes up and down, this is not mission accomplished. Please do not hear me and listen to no one in security that says, look at that data, mission accomplished, we've done our job, we got it. That's not how security works. Security is not a project that I start, I invest in, and then I see results and I finish and stop. Nope. Not how this works. Not how any of this works. Security is something that is a process that is cyclical. So we report this back and we say, hey, board, We want you to know you've poured money into this, or business owner for an MSP, you've poured money into this. It's working. Your resources matter. We've used them wisely and look what we have done. And then just objectively at the macro view, look what we're seeing. Look at this data. We are doing better. We're not— no one's saying we're winning the war, but we are doing better. Things are getting better here. That's a good thing for us. Okay. So it's great to see that in place. But if we just stop here, it's going to come back. This is not something that we just give up and say, mission accomplished, we got it. Please don't see that. Okay. So last thing I'm going to show here is right here, ransomware impacted by company size. So if you look here, we're still under attack. Small business, 11 to 100, 29% of the makeup, and then just slightly above 100 to 1000, which I know is a big number here, but 40% of the makeup of attacks. Right. So then get down into like the threat actors and those that are doing some nasty things like double extortions, things like that. Also, I might note that most commonly observed ransomware variant last quarter was Hive. Hive just got shut down. I did a livestream on that shutdown as well. So really glad to see that. So we'll see some others. BlackCat, that was the subject of Rite of Boom. We kind of use them as in our threat brief. So there they are. But basically I'm going to stop here and flip over to comments. Man, I wish the comments were showing up here. But that's the story here is we can define it. In my opinion, we can definitively, objectively say progress is being made. There are really a lot of inputs to it. The Ukrainian conflict, better investments, more maturity and incident response, understanding how dangerous paying ransoms are, pushing pain back to bad guys by not paying those ransoms. That's now forcing them to go to larger businesses as a whole. But you better believe me, they'll come back to you the second you become easier. So this is an ebb and flow. We haven't stopped the bad guys. The job is not done, but we are seeing progress. So progress means you're wisely investing your resources. Let's continue to do that. It's not necessarily more money. It's more time, more resource, more support is what it means. All right. Let me flip over to comments and see if we've got anything here. Anyone know from Tim? Anyone know if other forms of these attacks are being monetized outside of ransomware, maybe data sales on the dark web? So, Tim, that's an interesting one. I can't speak to that with all authority, but we are seeing that, right? Leaks are becoming an important thing and leaks are monetized. This even goes back to the pre-ransomware era when the biggest thing that we saw were like these dark web markets and people buying and selling, you know, personal information, things like that. Scott is saying also, although compliance is still way behind on the questions that are there asking, they aren't as far behind as liability, cyber liability insurance questionnaires. Yeah, that's, that's very accurate, right? Someone in the insurance industry will tell you The carriers are still years behind in where they need to be and what they're asking and how they're asking for it. So that's exactly right. Yet they have generated an action on the part of our clients. And therefore, even though they still aren't asking the right questions, they can be leveraged to get clients to get a good minimum level of cybersecurity. It's not— compliance is not security, but the starting line. Exactly right. Completely, 1,000% agree with you, Scott. That's exactly right. Leverage cybersecurity because it is pushing the needle. Clients care about it because they have to get it, but it's not, it's not perfect, right? Um, exactly right. Uh, Brian said, I would worry more, more about, uh, day, uh, day one or day zero financial redirects impacted economy. Threat actors haven't paired the financial redirect method with the ransom event yet. Um, yeah, yeah, yeah. Uh, Dom, um, checking in, I imagine if we got to the point where it's more profitable to be an ethical hacker, right? Yeah, maybe that was the whole idea of like bug bounties and all these kinds of things, right? For sure. Um, yeah, so anyway, really good stuff here. Um, bunch of other comments. I probably won't get to all of it, but really good. Maybe I'll pull out Ross because, man, I just— I miss— I miss you, Ross. You're awesome, dude. It's always nice to see improvements in a company after an engagement. I get to see the improvements firsthand one company at a time. A lot of work to do, uh, for many still though, you know. And I think I'll close with that comment from Ross, is that why do we do this? Why do so many of us cyber nerds do what we do? I'll tell you why. We do it because we want to make the world a better place, don't we? We do this because we feel like this is how I can contribute. I love technology and I want to help businesses succeed. I want to help our nation. And there's an altruism to why we do what we do. And it feels good, doesn't it, Ross, to get out of an engagement and be like, man, that was helpful. That really helped us go take our business for the better. I love that, and that's why we do this. When I was a kid, I live in Florida, we were driving down those old country roads in Florida, and I would see those big stands that go up in the middle of the woods. I'd be like, "Mom, what is that?" She'd be like, "Oh, that's a fire stand. That's like what firemen will climb, or firefighters will climb when there's a fire." And in my mind, I thought, "That's awesome. There's probably people up there all the time." And I remember telling her, I'm like, "I want to be a watchtower man when I grow up. I'm going to climb up those watchtowers. I'm going to look out for fires. I thought that was like somebody's full-time job. I didn't realize they only climbed in when a fire might be happening or whatever, they're trying to spot it and understand. I just thought there's people up there all the time. And you know, lo and behold, that's kind of what we do in security, isn't it? We're climbing those watchtowers, we're looking out overhead for our businesses, we're looking for the threats, we're looking for what's concerning. We want to go put out those fires early before something bad like a true huge forest fire happens. That's what we are, that's what we do. So it's just my encouragement back to you on why we do what we do. I'm gonna rock on some kicking music again. This has been a lot of fun. I am really sorry that, uh, couldn't get comments showing up on screen. Just proof to you right here, they don't show up. They're not there even though you guys— yep, even— whoops, something went wrong. Whatever, it doesn't work unfortunately. But man, it's been so good to have you on today. I gotta jump to my next meeting. Wanted to cover this data. One thing you could do, uh, if you want, is share this out, hit the like button, let someone know, tag someone if you think that this live stream would be helpful and useful for them. Also, as always, if you're interested in joining Empath Cyber as a community of people that are doing security better and focused on the rest of us in security, those that, you know, really need to grow in that journey but aren't technical by nature, check it out. Right there is— there somewhere is the QR code. You're welcome to join that. You can trust me, scan that guy or just go to empathcyber.com/join and I would love to see you there. All right, my friends, signing off for now. Until next time, talk to you later. Thanks.