Latest / You've Been Heard / EP439- Stop Reporting Activity, Report Risk Reduced w/James Dunlap

Transcript

EP439- Stop Reporting Activity, Report Risk Reduced w/James Dunlap · You've Been Heard

• 0:00
  Speaker A: For me, when I say you have to speak their language a lot of times, C Suite thinks and cores and outcomes, it often communicates in projects and jargon, as you mentioned. You can walk in there and talk about risk mitigated, you can talk about vulnerabilities managed. But the disconnect is not necessarily a capability, it's the translation. I always feel like IT leaders who really close the gap stop reporting on activity and start reporting on risk reduced and value created. And I think that's the terms that boards really care about.
• 0:45
  Speaker B: After talking with IT leaders, I've come to discover one thing. And it's the same thing, you know, it's the same thing everyone else knows what whether they want to admit it out loud or not, nothing gets done in any company without it touching it. Nothing. But here's the thing. When everything's on fire, when nothing's working, when the ransomware hits, when the whole business grinds to a halt, it is completely indispensable. You're the most valuable asset in the company. But when everything's running like a well oiled Tesla, you're a line item, a cost center on a spreadsheet. You've done the work, you've built the career, you've earned your seat at the executive roundtable. But having a seat at the table is one thing. How much nicer would it be to actually be heard? This is. You've been heard. All right, welcome everyone back. We've got James Dunlop on. You've been heard and you work at a law firm, so why don't you just give me kind of the general overview title, what you're in charge of and we'll go from there.
• 1:55
  Speaker A: Yeah, great, great to be here, Phil. Really appreciate the opportunity. Yes. Film and Thomas Battle is the premier Mid Atlantic law firm, really corporate law, energy law, and my first role in the legal vertical. So I come from healthcare banking, fintech and really was interested in the challenge certainly in the legal space. It's a lot like coming from healthcare. I've worked a lot of private practices where it's a surgeon, a lot of surgeons. So time is life or death from that perspective and from the legal standpoint, time certainly revenue, you bill every six minutes. So system downage, any interruption is. Yeah, it's really impactful to the bottom line. So my role is your typical CIO role. I oversee an internal team, diverse IT team of security help desk, enterprise systems, cloud management, and then of course the managed service provider on top of that for any data center and any subject matter expert level 3, 4. Stuff we get into with projects.
• 3:04
  Speaker B: So if you had to pick your favorite area of it, whether it be networking, data center, security, software development, which would be your favorite.
• 3:16
  Speaker A: Yeah, security is really where I dug deep. I'm not a nuts and bolts guy. Come from a completely separate background. It is something I fell into. So really I made a decision amidst it to take a deeper dive once I got a broad exposure. It was security for me and particularly grc. So that's really where I dig deep and that's where my strength lies.
• 3:39
  Speaker B: So now I know that there's a lot of people out there that may agree or not agree with this statement. That's 100% of everybody. We've got doctors and we've got lawyers. Which one is harder to convince to spend money on security?
• 3:55
  Speaker A: Oh wow.
• 3:56
  Speaker B: Because the theme my whole week was kind of offline conversations. Okay. And these offline conversations that I'm having with other CTOs and CIOs are. It goes something like this, Phil. They don't know what they need to know in order to make a decision that's in the best interest of the company. They just don't know. And we need to somehow make them know the importance of XYZ right now from a security perspective who can probably always be a little bit more secure. And I would say from the healthcare standpoint, you're probably familiar with this, that 64% of all healthcare organizations got hacked in 2025 or some sort of ransomware attack. So they're really bad. Okay. You would think that that would be enough to convince the board of doctors to care. But it might not just be something that they see. It might just be like, yeah, we, we throw some money at it or to fix the problem when it comes around it. What is it in the legal aspect or is it. I would think it might be easier to convince lawyers that you need to because you might get sued. Your CFO doesn't want 47 Internet bills. We help IT teams consolidate multi location Internet into parent child billing with coterminous contracts while still buying wholesale from the best providers. It gets control. Finance gets clarity. No disruption, no no sales pitch. Just go to you've been heard.com and answer the seven questions to simplify, streamline and save.
• 5:29
  Speaker A: For me, it was definitely easier with attorneys. But I think that goes back to what you mentioned. Your peer conversations are early on the challenge was me. It was communicating with the C suite. It was speaking their language. And that's our responsibility. We can woe the challenges of. They should Know this. It's hard to convince them of XYZ. Well that's for our specialty lies of 50% of our responsibility is really communicating in the language of the C suite. And that falls on us. We can't just lament the fact that there's a gap there and they'll never understand. Well then you need to re quantify what you're doing and approach it just with problems, but with solutions, of course. And to be able to speak their language because they don't want impact on their business. They certainly don't want a reputation impact, certainly not doctors or attorneys. So it's becoming of us to make sure that communication's there, that's our responsibility. That certainly got easier for me over time. You get more comfortable. You start to understand that your job is to align their business needs with technology. And it's not just a cost department. This really drives your competitive advantage in your field. And once you identify that and you're able to use that as a selling point, really the sky's the limit on what you can move in my experience. So it's core to us to communicate that.
• 7:02
  Speaker B: I mean, I think you hit the nail on the head. Communication 1 you said, selling the other thing you said in a language that they understand that means something to them. They don't really care whatever Arctic wolf or a gdr, what that even means or Sentinel One and this and that. They just care that you're not going to bring the organization to a screeching halt and leave them with egg on their face. So you have a very non traditional or probably is traditional. What I'm finding recently is that non traditional is the traditional is the norm. Most IT leaders started out doing something else. Because you don't go to school to take IT leadership as a course. Maybe nowadays you do, but even in earlier conversations today it was you really don't go to school to become a CISO and learn anything and come into an environment and know anything about what you're doing. You've really got to kind of learn it the hard way and have hands on experience. How did you get to where you are? What was your first computer? What happened?
• 8:08
  Speaker A: What was it? Yeah, yeah. First computer was my older brother's Commodore 128. So that takes you back what just one generation after.
• 8:16
  Speaker B: So it was a hand me down. So it was a hand me down.
• 8:18
  Speaker A: It was a hand me down. It was a stand over her shoulder and watch hours of programming to get something moved from the left to the right side of the screen and Then it was a hand hand me down. It was the floppy drives, the whole experience. So as you mentioned and I've certainly listened to past guests on your show, mine was certainly the traditional windy road to this. I was introduced to it certainly in the professional space like a drug, there was a need and started off as undergrad in fine art photography really get to exercise the right and left side of my brain which has come in handy more times than I can tell you certainly to be able to use that creative background. But like all art majors we discover we want insurance and regular pay. So got a certed work in a retina specialist which is really tertiary outcare specialist retina surgeons and so was doing medical imaging for them. And this was right around the digital analog to digital change. Literally moving from the dark room to digital cameras in there at that time we're talking early 2000s. You can imagine trying to push images across NPLS Local Area Network storage. All the how expensive storage efan it was just and all of that. It was a nightmare.
• 9:38
  Speaker B: Let's just talk about how expensive storage was back then and how long it did take to something. I mean it's a simple math problem. The first Cisco startup, the company that I started, I think it was 250 megs of off site backup was $450 a month.
• 9:55
  Speaker A: That was our experience. I mean having being able to be in office X and pull up images from office y early 2000s this was just Mount Everest to conquer. So yeah the need was there. It was self evident they were just blowing a fortune on MSP solutions. Certainly Cisco Solutions, we can imagine the investment there. Synology Storage, all that stuff that comes in NAS and all that that comes in with this. So it certainly was an opportunity that was right in front of me and I pivoted too quickly, got plugged in with the IT side of imaging needs and quickly start enrolled and gained my Ms. And information systems Administration and really it just went from there and started to climb vertical and really doubled down certificate the right certifications and that's really where I fell in love with security.
• 10:48
  Speaker B: Then what was that? What happened?
• 10:52
  Speaker A: Yeah, that's my second stint as a cio, another healthcare firm and they were being acquired like all private practices by the regional healthcare conglomerate and really got to see the gap in even from mid practice to a healthcare system. The dreadful gap that as you mentioned earlier that lies with information security, cybersecurity.
• 11:19
  Speaker B: I don't believe the statistics. I still, I really don't believe them. I think it's a conspiracy theory. To sell more security services, but I know it's not. It said 2025, like something like 67% of all healthcare organizations experienced a ransomware attack of some sort.
• 11:36
  Speaker A: It's what social engineering has done to that space. In the fact that you saw so many people attesting to compliance but not holding themselves to it. That's really where I knew that obviously in the other trends outside of that industry, that security was where I wanted to go deep and not just have wide exposure. As I mentioned, not a nuts and bolts guy. Uh, I'm the first to run and get a SME for network for those type of things, a certain cloud architecture. But security is really where I wanted to hang my hat. So I wanted to help the industry, I wanted to help healthcare bridge that gap. Shortly after that I moved to banking and fintech. And of course that industry has been under attack since we first started to turn ports up. So they've had the historical need and they were so far advanced.
• 12:24
  Speaker B: Yeah, I mean they're stealing so much money from us anyway.
• 12:27
  Speaker A: They certainly can. What does JP Morgan have was one point, whatever in the millions daily of incidents or potential breach. So their threat vectors at the ceiling and banking they've been dealing with for way longer. So really I took the risk at that point to step down as a CIO in healthcare and work directly under CISO in banking. No one really, everyone was like why are you taking this chance? Really some people understood it. For me it was a great, it was the risk that was well worth the reward. Really was a humbling experience. Worked under a phenomenal ciso, really learned the foundations of GRC and got really rooted in third party risk management. All compliance, risk assessments, all your predominant in that space. So that was a great move that really propelled me forward. Then I was able to take on a role again as a CIO as a much stronger position than I was before.
• 13:25
  Speaker B: I think that's just in general good life advice is sometimes you have to take a step back to take two steps forward.
• 13:32
  Speaker A: And agreed.
• 13:34
  Speaker B: I have a lot of colleagues that were like, what do you mean you're going to do this podcast thing and you're only going to do this and that Because I come from a very aggressive industry, which is ISP and telecom and I look at it as kind of like the good old boys network. Very, very aggressive sales. And to me I saw so many problems with kind of the general landscape. I'm not saying that like the 8020 rule, like 80% of the providers and people out there selling and consulting are pretty much mediocre to very self serving. And the other 20%, you've got good quality people that know that and then you've got the top 5%. And we really wanted to take a step back and really serve the people that are using all these services, AKA you and the IT leader. And what we found after talking with hundreds of you is that many of you started out as the art major and you grew to a certain level. And then yours is interesting as you took a step back and really, really kind of. I mean it's a great story. And then we find ourselves two decades later sitting at the executive roundtable and we've had endless patches and firewall upgrades and people are going to hear this at the beginning of the intro of the show anyways. And silos that we've upgraded and as 400-400s that are still running the ERP system. What other things can we have? Ransomware attacks avoided or cleaned up or recovered from whatever it is paid for, even ransom paid for. A lot of times I've heard many people just said, yeah, we paid it. So you've got all of that. And now you're, you're sitting at the executive roundtable, you've got a seat there because you have to. Because there's not anything that doesn't get done in any company without technology touching it. But still to this day, only 7% of the people actually sitting in that seat are really authentically understood and heard. It's not an us versus them. It really is that communication piece that you said at the beginning, but you said selling and you also said really being able to reframe something in the language that they understand, not the. We evaluated all these EDRs and we did this and that and this is what we came up with. And it's really important that we do this. And they're kind of like, okay, how do you frame that? What's the best way to sell security to the C Suite in your opinion? And let's pick the hard ones, the Doctors. You've got 20 partners in a multi location practice and you've got to tell them they got to spend money on this.
• 16:16
  Speaker A: Right? For me, when I say you have to speak their language, a lot of times C suite thinks and cores and outcomes. It often communicates in projects and jargon, as you mentioned. You can walk in there and talk about risk mitigated, you can talk about vulnerabilities managed. But the disconnect is not necessarily capability. It's the translation. I always feel like it later. Leaders who really close the gap. Stop reporting on activity and start reporting on risk reduced and value created. And I think that's the terms that boards really care about in my opinion. And that's really what I found when I started to work in the banking
• 16:57
  Speaker B: space is how do you figure that out?
• 16:59
  Speaker A: Really that was the beautiful lessons learned from taking a step back, working my way into a higher industry that has dealt with the risk institutionally. Far longer is I was able to watch peers at a higher level. The system I mentioned, I worked with the CIO was really able to watch them and how our meetings translated into the board meetings. So you're there to talk the technical jargons during our staff meetings and we're one on ones. But then you walk, you watch and you learn how that's translation translated as a board talk. That really gave me was really put the cherry on the cake for me. That topped off what I knew, but it exposed what I was lacking.
• 17:44
  Speaker B: You said talking about value created in
• 17:46
  Speaker A: one other thing, the risk reduced. Yeah, it's not our projects, our jarring that we use, but really it's in to close the gap on reporting activity and start reporting really what risk is reduced and the value created. We really have to talk in consequences. It's that once you talk for me, my experience is once you really explain what reputational harm is and they're very aware of this, obviously they've watched it in their industry. But when you put it in terms of how it's going to impact your clients, how it's going to impact, certainly the business that you've created in the years and decades of hard work that you put into it could be completely brought to its knees by an untrained user clicking on a link. That was a clear red flag. Social engineering layered with AI now is so frightening. Obviously there's great blue team tools that we're able to use. It's a double edged sword. But the fact that Mythos was able to crack just an article a few days ago, was able to crack really all NSA security by chaining together low risk vulnerabilities. And that's behind Fable, which is Vibe that just came out. So I think the progression that AI has brought to the threat, once you start to communicate that you have to be far more proactive, it's not just about meeting a standard that you've picked, a compliance standard that maybe is you're hold accountable to in your industry or one that you've just picked that best suited nist, ISO, whatever it may be. It's not just checking those boxes, it's being as proactive as you can layer, always layering that security. But when you communicate it into revenue lost and what is incapable reputational lost is where I've always got the ears start to perk and the most traction.
• 19:40
  Speaker B: So let's go through two things. Well, first of all, what not to talk about. I think what not to talk about would be a great list to go through. Don't talk about projects, don't Talk about your KPIs on the activity and the numbers of tickets that you have closed because really all you're doing is saying well I would hope so. If in other words if you're reporting on something that your executive team is going to look at you and say well I would hope you're doing that, that's your job, then that to me would be a red flag. Don't talk about stuff that you should be doing that's part of your job. Let's talk about a value. When you talk about value created, what does that mean to you? Are we talking dollar and cents or what are we talking about value created? How are we going to report on value created?
• 20:25
  Speaker A: Yeah, oftentimes for me that's a fusion of hey, this will lead to value added because it's going to minimize our spend on these. It's going to consolidate our management burden into one plane. That's kind of for me the low hanging fruit there. But once you start to understand that your job is to align your IT infrastructure to the business objectives that's laid out before you, that's when you can really start to speak the C level language. And that's what they, that's what they're wanting to hear. You hit the nail on the head when that is what you're doing. The fact that you've taken care of high vulnerabilities or you've mitigated and documented your risk assessments correctly, you've handled these incident responses correctly, that is part of the job you should be doing. Those are some appendix in the back of the report that you can point to, but that's nothing that you should be verbalizing when you have the time of the C suite level. So really you need to start giving them the understanding of here's the ROI over quarters and years. Here's how we're going to outpace our competitors. Here's what you can talk about when you're at your conference and this is what separates you from others in your industries. To me, that's the value added part that always get the most traction with you, align those with the projects that you know you need, and then it's pretty much downhill from there.
• 21:48
  Speaker B: In my experience, one of the things that we found, again from analyzing, it's really thousands, but as far as shows that have been recorded, I guess we can say 400 somewhat shows. But I've spoken with thousands of IT leaders over the decades. It's not the say in the boardroom, it's not the presentation that you did, it's not the checkbox. It's what are people talking about after the meeting when you're not there? And it doesn't matter that your name's attached to it or not, but if they're talking about some great thing that you did at the next expo, whether your name's attached to her or not, subconsciously, they know your name's attached to it and they love their IT department. I definitely brag about our AI guy, Greg the Frenchman, because he's way ahead. So value we created, like, really start feeding people things that are like the billboards in the meeting. Risk reduced. How do you communicate reputational harm in a way that matters to people?
• 22:57
  Speaker A: Yeah, really. I think that's just. You start to describe the chain reaction. The. Okay, here's where the. Here's how easy the incident can start. And that's unfortunately, from 2025 to 2026 is changes by the day. But here's how easy it can start. Here's where our risk assessment says that we're a critical or high vulnerability. Here's the roadmap that we need, what we need in place to mitigate that. Are you going to give me the tools or not? Because if not, here's how quickly this becomes an incident to a breach. And here's how catastrophic a breach can be. It's not always as simple as just turning on your cybersecurity insurance and dealing with the incident. It is obviously the financial impact, immediate impact that you have from loss of revenue, the exposure time, turning everything back up. But when you have to start sending those letters out and when you're a law firm and you have to start sending those breach notifications out of sensitive data to clients that are Fortune 500 companies, then that's when reputational harm really starts to get everyone's attention. And that's where the institution that you've spent decades building can really be shuttered quickly because it's a small community. When you talk about being outside counsel to large organizations, and that's for me, always paints the clearest picture, there's the immediate cost. And then there's the poison that's going to take over your organization. And that's the reputational harm. It's the slow burn that's going to kill your clients, kill your contracts and all your prospective clients. So in a big part of law is acquisitions and having new talent come into your firm, acquiring top talent from other firms, folding in other firms. And so once you have that stink of stigma placed on you, then your lifeline of new talent and established talent with large portfolios to come over dies right there. So when you start to speak that language and you can tie that to a direct risk that you've exposed, the rest, as I've said a couple of times now, really starts to become downhill for me. And it's our obligation to communicate that because that really gives the whole picture to the C suite. You can speak cost savings, exposure time, all that should be quantified as much as you can. But when we're talking about information security, for me, it's reputational harm is the scariest outcome for me.
• 25:36
  Speaker B: I think that you painted a very, very beautiful, ugly picture, at least in the legal space. I think that I would find that harder in healthcare because really, ultimately, unfortunately, humans are very, very selfish. And it comes down to do they care? Does it affect them immediately? Is it affecting. And from that standpoint, from a legal standpoint, yeah, it affects my personal relationship. Especially in a firm, when you have a group of doctors in healthcare and you've got large hospitals and you've got large organizations, it's hard to kind of like to place blame. Or it would be easier for, I would say like a doctor or an MD to be like, hey, look, I'm just doing my job. I'm just saving lives, okay?
• 26:18
  Speaker A: Yeah, I'm behind this institution.
• 26:20
  Speaker B: You know what I mean?
• 26:20
  Speaker A: You can hide behind that a bit. Agreed.
• 26:22
  Speaker B: And yet they all have to be together in a room to make decisions a lot of times when they're part of this larger practice. And I just know, because I come from a family full of doctors and I know how practices work and I know kind of modern day the larger hospital businesses as well. But I've seen as of recently, some very, very smart doctors forming their own groups and investing in their own surgery centers and things like that. And you'll see like these 25 doctors have ownership in this surgery center and you'll. And they all have the same miserable IT problems. They tried to migrate to epic and you've got a bunch of nurses and cows. What do we call Those some computer on wheels or whatever sitting around with cords unplugged and you have this mess. Really. I find that industry to be really difficult for IT leadership to break that boundary. And it might be because healthcare is a very, very hierarchical, almost a feudal type of pecking order of decisions that get made with the very, very smartest people in the room with some very, very.
• 27:37
  Speaker A: Absolutely. You're dealing. Doctors, lawyers, you're dealing with are brightest people in the community. Certainly that's the reputation they carry. Some don't live up to it, a lot of them do. But yes, there's the complexity with healthcare really stands out because here's a $3,000 or, sorry, $3 million imaging machine that you've invested in that. Now the operating system is out of date and, and no longer patchable, but the system works as intended. It could work another 15 years this way, but now you're stuck with an unpatchable operating system that the vendor may not be offering an upgrade to because they can talk you into the next generation of imaging system. So you're stuck with so many legacy systems in healthcare and trying to tie those all together, keep those secure, keep the network segmented as best you can in those systems away from other systems. There's a really unique challenge there. And as you mentioned, you start to fold in the fact that you can start to maybe hide behind an institution if you're not a private practice. But for me, I would correlate that medical malpractice at the physician level is akin to governance malpractice at a legal level or at your fintech or banking level. I would say those things that would really get the attention of the physician is not adhering to best practices, certainly being out of compliance with your contracts, not mitigate, not identifying your risk and giving it the proper risk treatment is akin to a malpractice in its own way. And thankfully there's been such a crackdown over the last couple of years, especially at the federal level, where now there's really some steep and severe penalties. And there's been some large cases of that come about, as you mentioned, for large private practices that have their own surgical centers. They're not even doing their annual HIPAA risk assessment. So there's been some really stiff penalties handed down. And that's really have gotten the attention in the last that I've seen talking to my peers that are still in the industry over the last three to five years. That's helped push that along.
• 29:43
  Speaker B: Just another statistic, I think, like the HIPAA penalties and from 2025 just to 2026 are up 300 in like it's 300%.
• 29:51
  Speaker A: Yes. But the director has been very vocal about the push that we're really coming after this. And if you can't present an annual assessment, then the penalties are going to be severe.
• 30:02
  Speaker B: Here's an idea. Let's be like a really, really secure law firm that can brag about how secure they are and then go after the healthcare industry for all their violations.
• 30:12
  Speaker A: That's right. We know how to hold youth standard because we're keeping that standard here at our own institution. Yes, absolutely. It's frightening when you're dealing with sensitive records like that.
• 30:24
  Speaker B: You know, do you have like a hero story where you came in, everything was absolutely terrible. You got ransomware attacks, something really, really bad. It doesn't have to be that. It could be anything where you came in and was like, if it wasn't here, we'd be done. We would be in that metaphorical spot where we were brought to our knees and we'd be sending out letters. Do you have any stories like that that you have come in and save the day from?
• 30:46
  Speaker A: One that pops in mind. And it's not necessarily information security driven as much as it was change adoption. And one of the most painful change adoptions I've experienced in most of my space I've experienced is the implementation of electronic medical health records. Going from the paper chart, as you mentioned, the ethics discerners out there, or at the medium, the small business level, which is giant space. But that's really where I lived out a large hero moment and really went from imposter syndrome to I can do this was the complicated and challenging transition from decades of paper charts into an EHR system. And really that went from concept selecting vendors, comparison charts. This was really all laid in my hands and I wasn't even a CIO yet, really, that was just department director, say head of help desk, so to speak. So big problem laid up my lap. We need to move into this space and we need to do it within a year. And really I had great executive buy in. But you can imagine dealing with, as I mentioned, tertiary level surgeons. It was quite a challenge to convince them that what they've been doing has worked for them for decades, needs to be changed. And well, why can't this be like the way I use it? And why can't I just write this here? Why do I have to change my practice around a piece of software? So that really was my first introduction of talking to C Suite Cost savings, exposure time, making the compromises, finding the right vendor, holding them accountable to their SLAs, holding myself accountable to communication outcomes dates. And we went practice wide in the same day. And this was a medium sized level practice for West Virginia. Seven surgeons, seven locations across the state. We went fully live over three days and it was amazing. Went from charts to iPads in charting to the scribes and techs were happy, the nurses were happy, the doctors were accepting and growing. So that was really my first really full hero moment. We picked the right platform, we picked the right implementation team and it was really where, as I mentioned, it really went from me being that imposter syndrome to believing in myself and knowing I belonged at a leadership table.
• 33:23
  Speaker B: Man, you basically had all of the top three major problems that every IT leader ever has expressed or the top four. So one is training end users, one of the top four. Two, taking decision direction in the top four. Three, upgrading antiquated silos. Right. I think the fourth one is like selling to the C suite or convincing the C suite. I mean, so like you literally had all of the major problems in one project because everyone's got to learn how to use the new emr, right? You've got to change from the old way. So you've got a bunch of end users that you've got to train. People sitting at the front desk that were used to sticking color stickers on manila envelopes and filing them away. And Sally and Jane in the back. I'm not trying to be stereotypical here, but Sally and Jane in the back that are taking the doctor's old tapes and typing them up, typewriter or whatever it was. I mean, I remember that growing up as a kid, paper files, doctors recording into a device and like people literally typing up it into a file. That's where we've come from in the last 30 years. It's pretty wild.
• 34:37
  Speaker A: It is. Those are always the most substantial projects and they leave an indelible mark on your professional life.
• 34:44
  Speaker B: All right, final two questions. Eighteen months from now, what are people going to be talking about? That is going to surprise everyone.
• 34:52
  Speaker A: I think for me, we've started that conversation now a bit. I think it's only going to grow. And that's probably governance of AI agents and the data they touch for me is an alarming topic. I think right now most leaders are kind of excited about what the tools can do and almost nobody's really asking who authorized the agent, what can it access, where the liability sits when it acts on its own. And I think the capability conversation there is loud and I think the accountability conversation has barely started for that, but it's coming fast.
• 35:29
  Speaker B: I think we have to do pen testing and we've got so many places that people can attack us. Right. We don't know which one they're going to choose. All right, where it's kind of like the reverse side. Like, it's easy for the hackers, he just has to find one way, whereas, like the CISO has to know all of the ways. So maybe through agents and magentic AI and stuff, we can have better outbound prevention and honey pots and attack vectors or something kind of from the reverse standpoint, I don't know.
• 35:59
  Speaker A: I feel like there should be this understanding that once you've hit my honeypot, all bets are off, I can come after you. And so if I'm going to sit that out there and you're going to breach it, I feel like almost we should be obligated or at least have the legal leeway to start to go on the offensive there. But I dream, of course, that you're. You hit the nail on the head really is we have to be prepared for everything. And we're not aware of a lot of it, unfortunately, especially when it comes to ransomware as a service, all this social engineering as a service, all this being. You don't have to be. You can be the script kitty, you can go out there and buy the service. And now with AI being able to chain low to medium grade vulnerabilities together for an attack, that's really changed for me. What I see no longer. Can you just say, I'm going to hit the critical and high vulnerabilities and maybe cherry pick some of the mediums. I think we're moving into a situation where we're going to have to really drill down into the medium and lows and hopefully AI is going to be our big solution there.
• 37:05
  Speaker B: Maybe with, if quantum computing is real, maybe with that mixed with AI and the thousands of drones everywhere and breaking the blockchain somehow, I don't know, maybe like we can send like a swarm of drones to the hacker's house within minutes of something like that.
• 37:21
  Speaker A: Yeah, you and I know there's another 18 months. You don't hear a lot of conversation, Phil, about the convergence of AI in quantum computing. You almost hear them as they're in their own silos. But when those two converge, I don't know what kind of world we live
• 37:38
  Speaker B: in then I think it's going to be. I'm kind of like I heard Alex Hormozi say something the other day about it and he has kind of like a positive outlook on it. He was like, look for all the bad things that can happen with AI, there's always going to be the outliers. Right? He's just like, use it. But he was saying almost like. And I kind of. Maybe I took it, maybe I'm understanding what he said wrong. But this is my thought or my idea on it. We might get so advanced as a human species, not terminator 2. From a positive standard, we're making it so advanced that money really isn't a thing anymore. Meaning it's like things have become so streamlined from crops and food and like just everything. It's going to be just like, well, what do we do now?
• 38:24
  Speaker A: We're so aware of this change. More than pre industrial revolution, more than pre Internet. We're so aware of what this change is coming. It was hard for us pre Internet, pre assembly line to know how revolutionary these things were going to be. It was certainly underthought and perhaps under communicated. Never done a lot of research there in that. But I think that we're having so much conversation on the front end of this technology, more than we've had with any revolutionary technology before, that it really lends itself to this. Is this Armageddon or is this utopia? And I really try to lean on the utopia side, but it may be a little Armageddon to get the utopia.
• 39:12
  Speaker B: Yes, exactly. The boundary is going to be power with all this stuff. The boundary is power. When you mentioned tokens and stuff. We can't just have people doing stupid stuff. There's going to have to be some kind of again, serious streamlining of how we use these tools because otherwise it's going to be a lot of wasted tokens.
• 39:31
  Speaker A: Yeah. The prediction is really asking who authorized these agents, what can they access, where is the liability sits Certainly when they start acting on their own or start to in. A big concern in law is the injection of hallucinations within AI. We've got a strong AI deployment with some choice vendors, but the ramifications of AI in the legal industry are just staggering. Right now where you have both parties submitting unverified certainly cases. There's a case I just read where the counsel and opposing counsel both had wrong case sources cited and they both were fine, they were both disbarred. I mean the judges are not putting up with this. So thankfully we have a great oversight. Certainly this is not going to get rid of the paralegals. Everything still has to be double checked and verified. But it speeds up production. Yes, but yes, it introduces a whole new level of risk.
• 40:34
  Speaker B: Yeah, that's crazy. And last question. If you could go back in time and give a piece of advice to yourself 20, 30 years ago, whenever you got started, what would that piece of advice be?
• 40:46
  Speaker A: I think for me it really was. And this gets tossed around a lot, but imposter syndrome is healthy. You should feel that way. That's part of growth. You should be always challenging yourself and putting yourself in uncomfortable situations. If you don't want to, that's fine. If you want to stay where you're at, you're happy, more power to you. But anyone that's reached the level of your audience, cio, ciso, we've invested so much time and education certifications into this. We're people that push ourselves and love to test ourselves and we love growth. So being riding that edge of imposter syndrome is healthy. It isn't that you don't belong at the table, you've earned your way to that table. But it's a healthy dose of knowing that you're where you should be. You should feel challenged, you should feel humble amongst your peers. There's a lot to learn from them and you're certainly not the smartest person at the table. If you find out that you are, that's great. That's a rare accomplishment for me at least. But stay humble. I always felt that I did. But for me, it was so crippling at first. Climbing the ladder and dealing with imposter syndrome, not coming from it, not growing up, not ripping apart computers, segmenting networks, coming from fine art. But I've learned over the years that it's healthy. It comes with the role. It comes with being challenged and growth. That's definitely something I'd love to communicate to myself in the 20s. It's healthy.
• 42:19
  Speaker B: Yeah, you gotta do the work, you gotta put in the at bats, you've gotta kind of fail forward. All those things I'm a big fan of, get comfortable being uncomfortable. And every level of success is surrounded by pain and tribulations and hard work. There is no shortcut to that. There isn't.
• 42:40
  Speaker A: Your credibility is built on quiet, boring follow through. It really is ability to consistently do. Yeah, like yes, the opposite. The road to incident response. It's not that a lot of people can look good in a crisis, but it's the leaders who actually trust are the ones really, for me, that do the unglamorous work. Consistently tell the truth every day. Yes.
• 43:07
  Speaker B: Training, doing the same thing over and over again, like day after day. Yeah.
• 43:12
  Speaker A: And when the time comes, like, just like we mentioned and talked about the EHR project, where I got to fill the hero, your. Your time will come where you can draw on that experience and. And. And can shine.
• 43:25
  Speaker B: Mr. Dunlop, you've been heard.
• 43:27
  Speaker A: Yeah, this was great. We appreciate it.