Latest / Identity at the Center / #423 - The Middle Market Identity Security Gap with Robert Snodgrass

Transcript

#423 - The Middle Market Identity Security Gap with Robert Snodgrass · Identity at the Center

0:05
This is identity at the center. Welcome to the Identity at the
0:11
Center podcast. I'm Jeff, and that's Jim.
0:13
Hey, Jim. Hey, Jeff, how are you?
0:15
Oh, not so bad yourself. Doing great.
0:17
I guess by the time this episode drops, we will be in Berlin at
0:21
EIC. Actually, at the moment that it
0:24
drops, I think we'll be at the identity in the EIC identity
0:28
here. I love, you know, just having
0:30
those face to face, you know, casual conversations with our
0:34
colleagues from other organizations who do identity
0:39
just a fantastic time. So obviously thinking about that
0:44
it's only a couple weeks, so we'll actually be there.
0:47
Of course, like I said, when the episode drops, we will be there.
0:52
You know, beyond that, I've been thinking about the scatter
0:57
spider breach, which again, we, we kind of talked about it
1:00
earlier today, right? It's something that happened a
1:02
couple of years ago. And I keep thinking about like
1:06
every time I look at the agenda for EIC or Identiverse, we're
1:10
talking about agentic AI and protecting wallets and kind of
1:16
all this cutting edge identity stuff.
1:18
I think we'll, we tend to forget or we'll get lost in the noise.
1:22
It's this whole idea about usually the hackers login,
1:27
right? They get the credentials either
1:29
by, you know, phishing attempts or they just buy the credentials
1:34
online through the dark web and then they use them to login.
1:38
A lot of times they socially engineer, like in the case of
1:41
scatter spider, the the real popular incident they socially
1:47
engineered to help this person. So it's like it keeps boiling
1:51
back to kind of this. I I call it like the lowest
1:54
common denominator. Yeah, I mean, it's still the
1:58
most common thing that happens is getting social engineered.
2:00
There's so much going on now with yeah, look, if, if, if
2:04
you're just hearing now for the first time that, you know,
2:07
people are logging in and they're not like hacking their
2:09
way in. I feel like we're not doing a
2:11
good job messaging because this has done the same message we've
2:13
been saying for a couple years. But hey, not everyone is, you
2:17
know, a listener of the Identity Center podcast or goes to all
2:19
the identity conferences that, you know, that that we go to and
2:22
and have that messaging loud and clear.
2:23
So the more we can amplify that, the better, better identity
2:26
security is better security, period.
2:29
Like you just can't secure your organization without good
2:31
identity security. And it starts with three humans,
2:33
even though I know agentic and AI and all this other stuff is,
2:36
you know, coming hot and hot and furious, you know, through,
2:39
through the tunnels. But it still starts with humans,
2:41
and anything we can do to make the human part of the the
2:45
equation secure, you know, helps us all.
2:48
Yeah, you've probably heard it a million times.
2:49
Is like the organizations that have been breached and then the
2:54
ones that think they haven't been breached but they have, or
2:57
however you want to phrase that. But essentially it's the idea
3:01
that someone has the credentials to get into your organization.
3:05
Will you be able to identify them and lock them out when they
3:09
come through the door? I think that is where you start
3:12
to look at the technology solutions and then these other
3:16
things that we're talking about like a gentic AI and wallets.
3:19
I mean, it's real today, it's the future, and it's not to be
3:25
ignored. But neither is kind of the the
3:29
tried and true good hygiene around your accounts and making
3:33
sure that your users don't kind of cough up their credentials in
3:38
a, you know, a third party kind of man in the middle attack.
3:42
Yeah. I mean, ignoring it, put your
3:43
head in the sand. That's a strategy.
3:45
Can't say it's a good one. It certainly is a strategy.
3:50
It's 1. You can choose, yeah, but but
3:52
kind of talking about like, you know, these conferences like EIC
3:57
identifiers and being a part of ID Pro, I think the most
4:02
important part is the conversations and the sharing of
4:05
knowledge like we do on this podcast.
4:07
But I don't think you can beat in person.
4:10
We used to have much more in person interaction with
4:12
everybody going to the office. That happens a lot less these
4:16
days, but also with the conference's kind of be able to
4:19
meet people from different organizations who are solving
4:23
similar problems. I think it's great and that's
4:25
why we've kind of taken a focus and put out the discount code
4:30
for the conferences and now we have a a new discount code to
4:34
become a member of ID Pro. Yeah, if you go to
4:37
idpro.org/idac, new members get $25 off.
4:41
So we're very excited to keep that going.
4:43
Hopefully people could take advantage of it and it's a great
4:46
organization. You and I have been part of it
4:47
for several years now at this point.
4:50
We both kind of do a bunch of different things, but the SPAC
4:52
is, is worth the price of admission alone, let alone the
4:55
camaraderie or the commiseration that maybe we're feeling through
4:59
different, you know, projects. It's a great place to go and get
5:01
questions answered. Just a great organization
5:03
overall. So happy to happy that we have
5:05
their support and happy to provide them our support as
5:08
well. So that's very helpful.
5:09
And we'll have that link in our website, idacpodcast.com, so
5:13
people can check that out and kind of go right to it.
5:14
It's a form you fill out and then somebody from ID Pro will
5:17
get back to you with sort of the the details and how to get
5:20
through the next steps. So that's cool.
5:23
We had AI guess technically we still have a discount code for
5:27
EIC. If you're hearing this on the
5:29
Monday before it starts, it might be a little bit too late,
5:32
but hey, maybe if you're a last minute junior, you can go to our
5:35
website and and get that code as well.
5:37
We've got one for Ideniverse taking place in a couple weeks.
5:40
That one's 30% off. I don't think there's a better
5:42
discount than that. And I actually, I think it's
5:43
better than everything else out there.
5:45
So I hope people take advantage of that and you and I will be
5:47
out there as well. So with that out all the way,
5:51
why don't we get to our guest today?
5:52
Because I think, you know, Jim, a lot of people think you and I
5:55
do the podcast full time. That is not the truth.
5:58
That is our night and weekend job.
6:01
Our day job is with RSM. We're both identity consultants.
6:04
We've been doing that for, you know, consulting game for a
6:05
while now. And that gives us assets to a
6:07
bunch of different people. One of the things that we do at
6:10
RSM is put out this report called the MMBI, the Middle
6:13
Market Business Index report. And we're going to learn more
6:17
about what that means, what it is from one of our friends from
6:21
RSM who's actually been with us before.
6:22
His name is Robert Snodgrass. He's a principal of RSM.
6:25
Welcome back, Robert. Yeah, great to be back.
6:28
I guess I can say now. Long time listener, second time
6:31
caller. Yeah, that's accurate.
6:34
You know, I, I was shocked when we were looking.
6:35
I was like, when was the last time you were on Robert?
6:37
I was like, it was almost four years ago, back in 2022.
6:39
It was episode 158. I think this one will be episode
6:43
#423. When you joined us for the first
6:47
time, I'm going to guess we were probably doing like maybe a
6:51
couple thousand kind of listens, you know, here and there.
6:54
And we are on the verge of cracking 2,000,000 downloads
6:58
probably sometime the next couple of months, which is
7:00
absolutely nuts. So thank you for coming back.
7:03
I thank you for being part of the journey, you know, along the
7:04
way. Yeah, great to be back.
7:07
Put a little bit of pressure on me with the numbers there, but
7:09
hopefully I can rise to the occasion with your your growing
7:13
set of listeners. I have no doubt you're one of
7:15
the best we have at RSM. So that's why we have you here,
7:19
right? We're going to talk about this
7:20
report. It's one of the major things
7:22
that RSMI think puts out, you know, throughout the year.
7:24
So rather than me asking you how you got into information
7:28
security identity, go back and listen to episode 158 to check
7:30
out that story. Let's dive into this MMBI
7:34
report. Who is it for?
7:36
What is it? You know what does it cover?
7:39
Wow. Coming at me with three
7:40
questions out of the gate, I thought this is I was going to
7:42
get a warm up lap here before we started.
7:45
What is the MMBI or the middle market business index?
7:48
So I'll start with what we saw as the gap.
7:50
Why did we go down this path? There's a lot of ink out there
7:54
that focuses on economic factors and cybersecurity positioning
7:58
for the Fortune one thousands of the world.
8:01
What we saw a little over a decade ago is that there was
8:04
very little that was focused on the middle third of the economy.
8:09
And we felt that there was a need to really build a composite
8:12
of the indicators, both from an economic perspective, hiring, an
8:15
outlook, but we also saw there was a need for special topics
8:19
areas that would be of interest for the board.
8:21
And starting back in 2015, we created a version of that
8:24
focused on cybersecurity. So what is it?
8:28
It is a poll that is administered by an independent
8:31
third party. Here's polls that looks at about
8:34
1600 executives across the middle market and asks them
8:38
important questions about how they're approaching
8:41
cybersecurity both from a governance and investment and
8:44
overall delivery perspective. So who is that for?
8:48
If I'm remembering your third question, it's it's really only
8:51
to anyone if interested in the middle market.
8:53
But I think traditionally the the types of readers we're
8:55
seeing are executives, board members and individuals with
8:59
leadership or business case responsibility for cybersecurity
9:03
in that middle market space. So we'll have a link in our show
9:06
notes for people to download it. It's a free report, doesn't cost
9:09
you anything, so hopefully people will check it out.
9:12
How do you define middle market? Because I think that's probably
9:15
the first question. It's like, OK, well what the
9:16
heck does middle market mean? Well, it's not entirely free.
9:20
It costs you your e-mail and your name.
9:22
We promise not to reach out to you though unless you want us
9:25
to. But we will ask for a little bit
9:27
of information before you get started there.
9:29
But the question being like what is the middle market?
9:32
And it's, it's a really good question.
9:34
And in fact, it's a question we revisited this year because what
9:38
we, what we saw is that when we started this process around what
9:41
is the middle market, we used a definition from actually 2011
9:46
that looked at organizations that were between 10 million and
9:50
1 billion in size. And what we felt is that that
9:53
wasn't really representative of the now approximately $46
9:57
trillion U.S. economy. And So what we wanted to
10:01
approach it is really to look at it and say, can we roughly break
10:04
up the US businesses into three major tranches with our focus
10:09
being that sort of middle tranche.
10:11
And what we found looking at the businesses is that that range
10:15
has really increased and it's really looking at organizations
10:20
that fall between the roughly $30 million annual revenue size
10:25
and ten billion revenue size. And so if we think about that,
10:29
like what does that look like? Well, it's a big swath of the
10:32
economy. It's 125,000 businesses, it's 50
10:36
million employees and it's roughly about 18 trillion of
10:41
that $46 trillion number I was mentioning for the US economy.
10:45
But I'd also say there's a bit of a feel to it.
10:48
It's it's art and science. I think as we like to say, which
10:51
is to say, organizations that sit in the middle market or
10:54
modern middle market as we're calling it, are those that maybe
10:57
don't have the same agility that those and the under $30 million
11:02
market have in terms of their ability to create or maybe
11:05
remove products from the portfolio or enter into new
11:07
markets. They have enterprise
11:10
requirements and enterprise scale, but maybe not at the same
11:14
size and complexity that we're seeing with those upmarket
11:18
organizations above $10 billion. You can sometimes be in an
11:22
awkward position where it's like you're a little bit too big to
11:25
do something, a little bit too small to do other things.
11:27
Is that a fair characterization? Yeah, I think and a lot of them
11:30
are going through growing pains. You know, if you look at the
11:33
size of the number of businesses that fit into that previous
11:36
middle market bucket, it was about 200,000 businesses.
11:40
We're now at 125,000 businesses. So these are organizations that
11:46
have either grown into the space, maybe have collapsed.
11:50
We solved significant consolidation, particularly in
11:53
the COVID years in this market. And so there's a lot of growing
11:56
pains for them because they don't have the same resources
12:00
perhaps available to them as as the Fortune 1000 do, but they
12:03
have a lot of the same regulatory and cyber
12:07
responsibilities that those organizations do.
12:10
And they're kind of in that pivotal, pivotal area of their
12:13
growth where, you know, the decisions they're making now
12:16
really impact whether or not they become a larger company and
12:20
to what degree they have to go back and redo them.
12:22
Some things maybe I didn't do things correctly.
12:24
So it is an interesting kind of area to be in.
12:27
I we have a bunch of stats and stuff like that that will kind
12:30
of like throughout here, but, and I want to read just to make
12:32
sure I get that right. But 96% of middle market
12:36
executives were confident that their current data safeguards
12:40
were, were, were good. But 18% of them reported a data
12:43
breach in the past year and 24% experienced A ransomware
12:47
attacker demand. So 24% of was 125,000 companies.
12:52
That's a lot of ransomware taking place.
12:56
What do you think? But they're also like, yeah,
12:57
our, our data is safeguarded. So clearly there's some
13:00
disconnect there. Like what is it that is is the
13:03
explanation for that gap in the confidence versus, you know, the
13:06
actual things that are happening in the real world?
13:08
Yeah, there was a there was a quote I pulled for this that I,
13:12
I really liked. It's from Yogi Berra, so you
13:14
know, this is going to be a good one and said in theory, there's
13:17
no difference between theory and practice.
13:20
In practice, though, there is. And I think that's really like,
13:24
that sums it up right there. Like people look at their
13:27
cybersecurity program and they think tools, right?
13:30
I've got MFA, I've got EDR, I've got my vulnerability scanner.
13:35
But what it fails to really recognize is that incidents when
13:40
they're occurring require carefully orchestrated
13:43
decisioning, understanding around roles and
13:46
responsibilities, integration with third parties.
13:50
And unless you really rehearsed and practiced that in a real
13:53
way, it's not until you're in the moment that you realize that
13:58
perhaps you were overconfident. I I think the other piece to
14:01
that as well is cybersecurity is I'm sure you 2 know and all the
14:05
listeners know is very much a beneath the surface issue.
14:09
I've been doing this for over 20 years and no one has ever walked
14:12
up to me at the end of the day and said Robert like
14:14
cybersecurity today was incredible, like great job, got
14:18
access to everything I needed, nothing I didn't need.
14:21
It's really only when those things go wrong that people
14:24
realize that they don't have the right investments in the
14:27
processes and that defense in depth that's really going to
14:30
make their program successful. You know, Robert in prepping for
14:35
the episode is kind of what got me back to thinking about the
14:38
scatter spider in that login versus hack in scenario.
14:43
I, I feel like that was kind of a major theme within the report
14:48
and I'm wondering why, you know why that is, if you have any
14:52
thoughts behind it, but what are some of the things that you
14:56
would prioritize or have middle market security leaders
15:00
prioritize from a digital identity perspective?
15:04
It's a great question and I would guess I'd say I'd boil it
15:07
down most simply. Why do people log in rather than
15:09
break in? Because it's it's the easiest,
15:12
right? I mean, that's the that's a path
15:14
of least resistance. I mean, look at all the threat
15:16
reports, the motivation of cyber threat actors is financial and
15:22
it is expensive to create 0 days.
15:25
It is challenging to go after really complex organizations and
15:30
a lot of the investments that they've made.
15:32
And so identity is typically the the path of least resistance for
15:37
them. The metaphor I often give is
15:38
that cyber attacks are not gone in 60 seconds.
15:42
And I'm trying to get the Shelby GT convertible.
15:45
It's really checking doors and seeing what's unlocked as you're
15:49
walking down the street. And so as I think about the
15:52
investments like where are the dollars heading, I think I'll
15:56
start glass half full because I think sometimes we tend to be a
15:59
bit negative when we're talking about the challenges.
16:01
If we look over the last three years, the trend in the data in
16:05
the middle market has been, there actually has been a good
16:07
amount of investment and identity both in terms of
16:10
centralization of identity as well as the application of MFA.
16:14
And about half of the firms that we, we surveyed out of the 1600
16:18
executive said they did have this in place.
16:21
The pieces they didn't have in place that I would recommend
16:25
they start to think about #1 is phishing resistant MFA.
16:30
And, and I think particularly in the age of AI, these sort of
16:33
adversary in the middle attacks are, are really simple to
16:35
deploy. They require very limited effort
16:39
into looking at, you know, Fido keys, platform pass phrases is
16:42
going to be going to be really important and relatively low
16:46
cost in terms of application. So 50, $100 a user is, is very
16:51
limited, especially when you focus that initially at least on
16:54
your privileged user base. I think the other thing that's
16:57
nice is we're seeing cyber insurance carriers really jump
17:01
on board with this. And why that's great is I think
17:03
we all know that it's a lot easier to say are cyber
17:06
insurance carriers requiring this or the regulator is
17:09
requiring this to get those funds than it is to try to build
17:12
the business case. Otherwise, I think you mentioned
17:16
3. So I guess probably the other
17:18
piece I would jump onto is, is identity threat detection and
17:22
response ITDR. So the tools have come a long way really just in
17:26
the last two years and we find that their solutions are picking
17:30
up attacks a lot earlier in the kill chain than your just
17:34
traditional EDR. The the third piece I would look at is going
17:38
to be just in time privileged access.
17:40
So looking at those privileged accounts, removing a lot of the
17:44
standard administrative rights and looking at tools that are
17:47
out there to to to drive things in more of an approved just in
17:50
time manner. Gosh, you said a lot of great
17:53
things there. I, you know, I took away or I
17:56
connected One of the things you said about, you know, the kind
18:02
of seeing where the easy entry points are.
18:05
I kind of thought back to something we used to say, which
18:07
was you don't need to be the fastest, you need to be not the
18:10
slowest, right? And I also think.
18:13
About outrun the Berry to outrun the the other guy.
18:16
Exactly right. And I was also thinking about
18:20
like, you know, the way a lot of car thieves work is they don't
18:25
break windows, they just walk down the street and see which
18:28
cars have an unlocked door. So it's a lot of like, you know,
18:32
the basics. One of the, the questions I
18:36
wanted to transition into was I, I think about the name of our
18:40
podcast identity at the center. We talked to a lot of
18:43
practitioners from larger organizations and they always
18:47
compliment us. Like how did you guys think of
18:49
this name seven years ago? It's like so perfect for where
18:54
we are right now. I think it's they have large IT
18:57
departments and large informational security
19:00
departments and identity guesses too.
19:03
But one of the things I saw in the report is that, you know,
19:07
the the leaders who completed the survey, only 23% of them
19:13
identified digital identity as like, the key to securing their,
19:18
their landscape, their information landscape.
19:22
And I'm wondering why is that percentage so low?
19:25
Because like, to me it seems like that should be #1 yeah.
19:29
It's, it's such a good question. And I, I also say I agree with
19:32
your point. I, I, I love the title of the
19:34
podcast and I have a really hard time not saying identity at the
19:39
centre as part of some of my responses.
19:41
Like I'm, I'm saying the title of the movie in the middle of
19:43
the movie. It is, it is very hard to kind
19:46
of not use that phrasing, but but it's, it's right on.
19:49
And I think it creates a bit of a, almost a double edged sword
19:53
where with identity being at the centre, it's everyone's job and
19:58
it's nobody's job. It crosses HRIT, cybersecurity
20:03
teams, finance, procurement and and I think that fragmentation.
20:08
You know, creates A governance challenge, particularly in
20:10
middle market organizations that perhaps only have a handful or
20:14
maybe even just one professional that's responsible for
20:18
cybersecurity to really have that executive sponsorship.
20:20
I mean, I think we're we're seeing that in the up market
20:22
where they are actually creating named dedicated identity leaders
20:27
in order to solve this challenge.
20:28
And the middle market really doesn't have that luxury.
20:32
And so governance and ownership is probably most centered around
20:37
that. I think the other piece is that
20:40
identity projects are continuous.
20:43
They don't necessarily have a definitive start and stopping
20:47
point. It's really easy to go to the
20:50
board and make an investment and say I'm going to buy a
20:53
particular tool or I'm going to remediate a particular area.
20:56
But identity is ubiquitous with operations and therefore it's a
21:01
continuous conversation. And so it becomes really hard, I
21:04
think for executives and board members to to buy into that sort
21:08
of continuous operational cycle when they're so conditioned in
21:12
the cybersecurity space to think about things as as definitive
21:15
projects. Yeah, I, I just want to you say
21:19
so many great things I wanted to queue off of, but I remember
21:23
being at one of my early identity conferences and saying
21:26
identity is a program, it's not a project.
21:29
And I almost got like a sending ovation.
21:31
I was like, people get this, but I think at the same time, it's
21:36
like executives are like, well, when are we going to be done
21:39
this project so we can move on to the next thing.
21:44
Yeah. So we talked a little bit about
21:46
smaller organizations than they're running into this
21:49
challenge. Like whether they know it or
21:51
not, identity is really a big deal.
21:54
They need to focus on it, but there are other competing
21:58
factors. So we're talking about the
22:00
middle market. I mean, what is kind of the
22:03
approach that makes sense? Is it to have a partner to help
22:07
them with operations? Is it they just need to hire
22:10
more people? Do more with less?
22:13
Like is AI the answer? What are you seeing?
22:18
It's a great question. I would say where I find the
22:21
most success is you mentioned partners is finding that partner
22:26
and the best place to start is to look at what are the major
22:30
digital or transformation related initiatives that are
22:33
occurring because identity is going to be a key enabler to
22:37
that. So rather than having identity
22:40
as its own sort of separate work stream, its identity initially
22:45
at least as an enabler to that transformation.
22:48
And so it gets a lot of initial buy in because people can start
22:51
to see that identity is not this back office siloed security
22:55
component. It is very much in line with
22:59
what the business is trying to accomplish as part of their AI
23:02
or other digital transformation initiatives.
23:05
That also deals with one of those challenges upfront that
23:08
we're seeing, which is that the first year is typically a really
23:11
significant investment and it's not always necessarily easy to
23:15
quantify the value you're getting out of year one.
23:18
It's really not until probably year two or three that you're
23:21
really seeing those returns. And so by working with the
23:24
business leader that owns one of these transformation areas, you
23:28
become more of the sub bullet underneath of, of that success,
23:32
an enabler to that success than needing to necessarily stand on
23:35
your own. And then once you get that cycle
23:38
under your belt, that's where you'll have enough of a
23:40
foundation where you've got your sort of your, your piping and
23:43
your patterns. And now it's about building the
23:46
scale out to the business. And that's a lot easier I think
23:49
to to sell to an executive audience than that first year or
23:52
two where you're making very significant investments and it's
23:56
not always necessarily clear what the business is getting out
23:59
of those. So that idea of partnership, I
24:02
think it's probably good to just clarify, right?
24:04
We're talking like not external partners, all that certainly is
24:07
part of it. But we are referring to is
24:08
internal partners, right? How do you, you know, identity
24:12
is kind of like the Force. Sometimes you can see it,
24:15
sometimes you can't, sometimes you got a lightsaber, sometimes
24:17
you don't, which it's always there whether whether or not you
24:20
know, whether or not you're tapping into it.
24:22
And so, you know, there is an opportunity there for identity
24:25
people to tap into other parts of the organization to help
24:29
them, you know, move forward their goals and help other parts
24:32
of the business, right? I mean, it is a digital enabler
24:34
as as we say in the biz, but there's so much that you could
24:38
be doing to partner with it, you know, HR, help desk, customer
24:42
type stuff, like all of these things are touching it.
24:45
And so why not, you know, try to join forces with somebody else
24:47
who's also trying to probably get something done?
24:49
Is that fair? Yeah, I think that that
24:51
summarizes beautifully and and why I'd love the answer to every
24:54
question to be external partnership because I am
24:57
extremely biased in that regard. This this starts with internal
25:00
partnership and again showing people that identity is very
25:04
much that sort of common thread to the business and not a back
25:08
office cyber specific function. So one of the things that kind
25:12
of shows up as a theme throughout, which color me
25:15
shocked in the year 2026 is, hey, AI has made an impact both
25:19
from an offensive standpoint, but also from a defensive
25:21
standpoint. And I think we're in that era
25:24
now of offensive AI versus defensive AI and the humans kind
25:28
of in the middle trying to figure out what's left over past
25:31
that. Where is it that you see, you
25:34
know, AI most likely to really kind of impact where things are
25:38
going right and wrong? Maybe it's governance, maybe
25:40
it's shadow AI, you know, maybe it's data leaks.
25:43
You know, we have all kinds of names for it.
25:44
I'll call it just non human identities.
25:46
It's sort of like a general catch all.
25:47
Some people might call it workload identities.
25:49
In the same context, we're talking about the same thing.
25:52
It's not a human identity that's doing the thing.
25:54
It's else like where is it that you see things going wrong the
26:00
most? Yeah, I guess we have to start
26:03
with maybe the the state of the of the union as it relates to
26:06
AI. And I, I again wanted to sound
26:08
really smart here. So I pulled a quote from from a
26:10
great scientist, Dr. Ian Malcolm of Jurassic Park fame.
26:15
And he said scientists were so preoccupied with whether they
26:19
could, they didn't stop to think if they should.
26:24
By the way, I dreamed my entire childhood of being a chaotician
26:28
or chaos theory specialist until I realized that wasn't really a
26:33
thing. But it always stuck with me.
26:35
I was always very impressed with Ian Malcolm, but I think that
26:38
really summarizes the state of where AI is today.
26:42
Organizations are out there looking for value and taking on
26:46
cases that maybe they necessarily hadn't really
26:49
thought through what the risk implications are.
26:51
And so where do I see the risk coming up?
26:54
Well, the risks most immediately coming up are through shadow AI.
26:58
Why? Because there's really very
27:00
limited governance around looking at employees and the
27:03
type of data that you're putting into solutions.
27:05
You know, people can go out generally and download their own
27:08
version of cloud, take company information and put it in there
27:10
to create a PowerPoint without necessarily thinking about the
27:14
data loss associated with that. One of one of my fellows here,
27:18
Steve Kane, he talked about it as potential instant data loss,
27:23
right? Data, you know, being
27:24
exfiltrated and being used to train external models that can
27:28
then be data represented back to your competitors.
27:32
But I think the more challenging issue frankly is, is less that
27:37
and it's the non human identity piece because that's the piece I
27:40
think it's going to be extremely hard to unravel architecturally
27:44
in the future. And it reminds me a little bit
27:47
at a smaller scale of service accounts and the challenges that
27:50
we had with APIs is those initially launched
27:53
architecturally people were giving them unlimited rights.
27:57
There was very limited controls around creating these accounts
28:00
and we saw this huge permeation of service accounts across the
28:04
organizations with, with wide reaching access.
28:07
This is the same, but multiplied tenfold because it's a lot
28:11
easier. It's a lot more challenging, I
28:12
should say, to unwind those from human identities.
28:17
And so because of that, I, I think that we, we are at least
28:21
asking the question as organizations are creating non
28:24
human identities to say, can we assign at least a human owner to
28:29
net every non human identity account?
28:32
And so that does two things. One is it, it creates a bit of
28:36
accountability for someone to raise their hand and say, well,
28:38
wait a second, do we really need another non human identity
28:43
account? And then secondly, it raises the
28:45
governance question of what exactly is that person supposed
28:49
to be doing? And I think the question that I
28:51
always try to raise with organizations is they're
28:54
thinking about non human identities is take the same
28:58
thought process you're applying for a person and apply that to a
29:02
non human identity. Like would you allow for a
29:07
really smart intern to walk in on day one and give them full
29:12
production access to your customer database?
29:15
No, of course you wouldn't. So why would you do the same
29:18
thing with agentic AI non human identities?
29:21
That's a great question. People are doing it though.
29:26
Absolutely they're doing it. So a couple of things.
29:28
One, I'm, I'm glad to have the quotes coming as a, you know,
29:31
when you mentioned Jurassic Park quotes, I thought for sure you
29:33
were going to go the Jeff Goldblum life finds a way, of
29:37
course. So I'll throw that one out there
29:39
because, you know, life is finding a way.
29:42
They are finding their way into other AIS, whether it's a human
29:45
doing it, whether it's, you know, at some point non humans,
29:47
right, AIS that are going to start to find their way around
29:50
things. You started to talk there about,
29:53
you know, really how do you govern those digital workers,
29:56
right? And I think that's where we're
29:58
at now. We're seeing big bets in the
29:59
market, some from very large players that are now trying to
30:04
come up with a way to say, OK, not only is your business
30:06
comprised of humans, but also non humans.
30:09
And so you're seeing some very large organizations say, OK, we
30:13
need to treat our digital workers like more like a human
30:17
than maybe traditionally where they were more of a service
30:19
account and it was a very predictable behaviour.
30:22
Now AI and especially in the generative world, you know, can
30:25
you know, think I'll put in quotation marks.
30:27
I'm not sure if we call it that or not Process maybe, you know,
30:31
the different avenues and their behaviour is much closer to a
30:34
human identity than it is to a service account.
30:38
I'm curious, you know, does that resonate with what you were
30:41
hearing and seeing throughout this report and, and in your
30:43
travels? Yeah, I, I think it's, it's a
30:46
huge question mark. And, and I think even with some
30:48
of the initial information we're seeing on solutions like Mythos
30:51
and some of the concerns that around these autonomous
30:55
penetration testing tools, it's really hard to make the
30:58
determination as we're looking at the logs and the behavior of
31:00
a security solution that's attempting to, you know, play
31:03
defense and help you secure the environment and what a threat
31:06
actor actually might be doing in the environment.
31:08
I think the same thing applies with these agents as well.
31:11
And to really understand this, we have to, we have to think
31:13
about the scale of it, right? Cyber Ark said that your non
31:18
human identities to human identities is now 45 to 1.
31:22
Can you imagine walking into your executive audience and all
31:25
the investments you made in identity and say, hey, we've had
31:28
a great year. I've covered 2% of our user
31:31
population with all of our investments, right?
31:33
They would, they'd throw you out of the room, right?
31:36
So the same thing has to apply as we think about non human
31:40
identities. But the way that it's approached
31:43
is going to be really different. And we have to think about that
31:46
architecturally now as these solutions get stood up because
31:49
as I was mentioning before, it's going to be extremely hard to
31:52
unwind these changes later. You know, you bring up a good
31:56
point there, and I think this is not a problem.
31:58
This is not a new problem when we talk about agentic and AI,
32:02
right? These types of accounts that
32:04
existed for a long time, they've been known as service accounts,
32:06
as AP is, you know, before that there was probably a master
32:09
punch card that people would type punch into the machine to
32:12
do stuff. So this is not a new problem.
32:15
The new spin on it though is speed with which these things
32:19
are developing the scale. And when you combine both of
32:23
those, that's where you end up in a scenario where it is 45 to
32:25
1. Pretty soon it's probably going
32:26
to be 100 to one. I'm sure there's reports all
32:28
over the place that are kind of having different numbers, but
32:30
they all are basically saying the same thing.
32:32
It's that non human identities are vastly going to outnumber
32:37
human identities. Yeah.
32:39
And I, and I think that you touched on this, but the
32:41
automation behind that, because I mean, when you're hiring
32:44
someone, there's, there's an interview process, there's HR on
32:46
boarding and there's this really long lead time to bring folks
32:49
into the organization. Non human identities are being
32:52
spun up and taken down all the time.
32:55
And so the, the need to do that in an automated way, the need to
32:58
establish guardrails and to actually validate those
33:02
guardrails, the the identity federation, the science
33:04
certificates, the secret rotation like that has to work
33:07
at machine speed, not human speed to be successful.
33:11
I think there's such a balancing act here because if you lock
33:15
things down too much, then you're not going to get the
33:19
benefits that AI can bring you, right?
33:22
So you have to find that that right level where you don't say,
33:26
hey, it's a, you know, everybody has full access and that puts
33:29
your organization a tremendous risk.
33:32
But you can't also say, hey, we don't trust our employees at all
33:35
and they can't use these AI tools, and we're just going to
33:40
put our head in the sand. Yeah, I, I think that's, that's
33:43
100% right. It is, it is a balancing act.
33:45
And well before I was a cybersecurity consultant, I
33:50
worked at the Target distribution center and I was
33:54
fascinated by the orchestration that it takes to move product at
33:58
that kind of retail speed. And one of the things that I, I
34:02
often think about as I think about like secure SDLCS and
34:04
other cycles is they used to have these scanners.
34:06
So boxes would go down the line and scanners would constantly
34:09
look at them. What they were looking for was
34:11
abnormalities. They had set the guardrails and
34:13
then the scanners would identify boxes that maybe were the wrong
34:17
size or wrong shape or appear to be damaged, and they would kick
34:19
those out to the side for evaluation.
34:21
And I think that's really the expectation that we're talking
34:24
about here. It's not going back to the
34:25
Department of now, right? It's about setting the
34:28
guardrails and empowering people with the expectations to
34:31
understand what is approved and shouldn't require further
34:35
discussion. And what are those areas that
34:37
that do require further discussion.
34:39
And so much like brakes in the F1 car, they're not there
34:44
necessarily to impede your progress.
34:46
They're there to actually help you go go faster, but to do so
34:49
in a Safeway? You know, one of the things that
34:52
maybe it's just the base assumption is that companies are
34:55
spending more and more on cybersecurity.
34:59
Though I do remember being at the conference and hearing that
35:02
there's like a cybersecurity poverty line.
35:05
So there's certain organizations who spend less than the poverty
35:09
line. There are those slow ones that
35:10
the bears are going to go after. But I think that assumption that
35:15
I hold of companies are spending more and more every year was
35:19
something that I found was challenged in the report that a
35:22
lot of the middle market companies are, you know, a lot
35:25
fewer of them are seeing increases to their budgets.
35:28
And I guess number one, I asked, do you have any insights in
35:32
terms of why or what are your thoughts in terms of why?
35:35
And then what should those companies do?
35:38
If you know if you're a cybersecurity leader and you
35:42
can't, you have to just live with the budget that you're
35:45
given, what are some of the tricks that you would recommend
35:48
to them? I agree with the sentiment of
35:51
the report. I would say in the middle market
35:53
we are generally seeing that cybersecurity spend is flat or
35:57
down. The why behind that to me is
36:00
economic in nature. And I would say it really boils
36:03
down to the fact that the cost of capital is higher in the last
36:07
18 months than it's been in the preceding five years before it.
36:11
So when you could get a loan at 3%, that is a lot easier pitch
36:16
than one at 6 1/2. And so because of that, people
36:21
are looking at the investments they're making with their
36:22
capital and in a much different way.
36:26
And so some of the things that we're seeing are really
36:29
interesting. So part of it is organizations
36:31
are then looking at the return on their capital and saying how
36:34
can I look at IT and how can I look at cybersecurity as a
36:37
revenue driver. So organizations that were maybe
36:41
traditional manufacturing and made investments in IT from more
36:44
of a back office perspective are now asking those same teams to
36:48
be part of digital product creation.
36:50
How can I layer digital insights, reporting metrics as
36:55
part of my traditionally physical products?
36:58
So that's that's one way we're seeing organizations kind of
37:01
change the dynamic to create more investments in IT, but in a
37:05
way that's more top line oriented than thinking about
37:09
cyber and thinking about IT is purely a cost perspective.
37:13
But the other piece of it is, you know, really frankly
37:16
triaging the way we think about cybersecurity, you know, IA 100%
37:22
agree with the adage of defence in depth.
37:24
We cannot have single points of failure.
37:26
But what it's created, I think, is confusion in the marketplace
37:30
on which are the controls that add the most value in terms of
37:35
actually disrupting the kill chain.
37:38
And so the first filter is going to be to really look hard at the
37:41
investments you're making and saying, does this really drive
37:45
to sort of the key areas that I'm going to actually stop
37:48
cyberattacks? Policy, procedures, committees
37:53
are important, but a piece of paper has never stopped a cyber
37:57
event. So looking hard at things like
38:00
EDR, phishing, resistant MFA, patching processes, these are
38:05
the areas when we're thinking about what are the actual
38:07
attacks that are occurring. Well, they're focusing on things
38:09
like credential stuffing and vulnerability exploits is the
38:12
way to drive against those. So that that has to be the first
38:15
lens that you're looking at at this through.
38:18
I think another way that we're seeing organizations look at
38:20
this through is understanding where there's external
38:24
pressures. They're going to drive some of
38:26
that discipline. I mentioned cyber insurance
38:28
providers before, but they certainly drive, I think a lot
38:31
of the conversation because there's a definitive cost
38:34
implication of not being able to address the full underwriting
38:38
form. And so understanding what the
38:40
return on those dollars is, is important.
38:43
And then secondly, I think it's understanding, you know what's
38:45
happening in the geographic markets that you're in.
38:48
It is no surprise I think to anyone.
38:50
The EU continues to add significant regulation in the
38:54
cybersecurity, AI, data sovereignty space.
38:57
Think about the EUAI act, it's coming into full force here
39:01
shortly, Radio equipment directive that covers IoT
39:04
devices, the Cyber Resiliency Act and IS2 directive.
39:08
There's a, there's a lot of things that are happening here
39:10
that have direct implications on organizations ability to enter
39:14
and sell into those markets that it's not a matter of it's, it's
39:20
a nice to have, it's a matter of a business imperative.
39:23
So bringing those pieces forward and being, you know maybe a bit
39:26
more of that sort of triage position plus understanding
39:30
where you were being a top line driver like those are really
39:34
coming together we're seeing to drive these business cases for
39:37
continued investment. I love it when Robert gets
39:40
passionate because he starts on the table and he's clearly on
39:42
the soapbox and he's like, stand back, you know, hold this, I
39:45
have something to say, which is awesome.
39:48
I want to ask you a side question.
39:49
It really wasn't kind of one of the things that we were
39:51
originally going to talk about, but we started talking about
39:53
budget. And one of the questions that,
39:56
you know, people always ask consultants, and I get this a
39:59
lot too, is. How much should I be spending on
40:02
X, right? What percentage of my revenue or
40:05
budget or whatever should be allocated to like IT versus I am
40:09
or security at large? I don't want to put you in a
40:11
spot because I don't want to get the consultant.
40:13
It depends answer, but I do want to read something in the report
40:17
and just see if you've got a comment on it.
40:19
And so I'm going to read this, the share of companies
40:21
allocating 16 to 20% of their IT budgets to cybersecurity more
40:26
than tripled from the prior year, rising from 4% to 13%,
40:31
while those allocating more than 20% doubled from 2% to 4%.
40:35
So that's telling me that IT budgets are growing, but at the
40:38
same time, I'm reading again, the percentage of organizations
40:42
spending less than 2% on cybersecurity fell sharply from
40:45
4% to 11%. So budgets are growing, but it
40:48
doesn't seem like the cybersecurity budget is growing
40:50
in proportion to the rest of the spend.
40:53
Yeah, it's, it's the tale of two very different stories.
40:55
And I and I think the dimension that's missing there is the size
40:59
of those organizations. And So what we're seeing is
41:02
those that have a mission that's been a bit more traditionally
41:05
aligned with cyber regulations, those that have more significant
41:10
digital products and those that are on the upper end of that 30
41:15
million to 10 billion, which is a wide range, right, we're
41:17
seeing them spend more. Why to my point from earlier, it
41:21
has to do with the fact that they see IT and cybersecurity as
41:24
a revenue generator. It is a top line driver, not a
41:28
cost center. On the flip side, organizations
41:32
that are the opposite of that, right, less digital dependency,
41:35
less traditionally regulated, lower end of that sort of 30
41:41
million to $10 billion range. They're taking a really hard
41:45
look at their spend and cyber is an easy cut because it has no at
41:51
least initial impact as they think about their PNL.
41:55
It certainly has beneath the surface tech debt assigned to
41:58
it, but that is hard to quantify and typically not on the board
42:02
agenda. I feel like there is a piece of
42:06
good news in this report which was around the adoption of like
42:11
formal risk management frameworks.
42:14
And I'm assuming that's something that organizations are
42:18
using to assess the the progress they're making in terms of
42:23
wiping away or or reducing risk as a result of cybersecurity.
42:27
So NIS, for example, doing a NIS CSF assessment, cybersecurity
42:32
framework, what do you attribute that to?
42:39
I think there's a variety of reasons for that.
42:41
I think as we think about governance being a, a key
42:46
driver, you know, the, the boardroom is trying to get more
42:48
engaged around cybersecurity, both required for regulations
42:51
like the SEC cyber disclosure rule, as well as I think we're
42:54
seeing younger board members with more of an IT, data cyber
42:58
background beginning to enter into these middle market
43:01
organizations. You know, they're asking good
43:03
questions around cyber and where frameworks are extremely helpful
43:08
as they provide a, a scaffolding, a, a common
43:10
vocabulary to really talk about cyber risks.
43:15
NIST is probably the most common.
43:16
Why? Because I think it's really easy
43:18
to talk about the six functions that govern and identify,
43:21
protect, detect, respond, recover.
43:23
Like people can very easily understand and gravitate to what
43:27
those mean. I think the challenge with
43:30
frameworks is that people see them as a as a destination and
43:35
not a way to drive the conversation.
43:38
Going back to my point from before with, you know, identity
43:41
being more of an operation than a program, cybersecurity is an
43:44
operation and not a program. And so the challenge with these
43:47
frameworks is it can often be seen as well, I want to hit this
43:51
number, I want to get this grade and that means I'm good.
43:54
From a benchmarking perspective, I don't think that's right way
43:58
to apply it, but where I think it is extremely helpful is that
44:01
it helps people to really take very technical topics, translate
44:06
them into more outcomes that they're trying to achieve, and
44:09
then set a qualitative threshold to really gauge that progress.
44:14
Again, it's a beneath the surface issue that's sometimes
44:17
challenging to quantify. So having a score to say I moved
44:21
from A2 to a 2.2 for govern is easy for people to understand
44:27
and reflect and see where that value is coming from, from these
44:30
often big cyber investments. And I think it's also helpful
44:34
too, when you use frameworks is, is you're getting a little bit
44:36
away from subjectivity and moving to something that's a
44:39
little more, you know, math based for lack of another term,
44:42
right? A little more objective doesn't
44:43
mean that you remove all the subjectivity from it because
44:46
there are obviously various Shades of Grey.
44:48
And, you know, I can make any answer be a yes if I think hard
44:51
enough that I'm doing something. It also helps too, that, you
44:54
know, recently, like NIST has gone through some updates.
44:56
So there are some newer and more modern things that are in NIST.
45:00
And it, you know, it takes a while for these frameworks to
45:01
get updated. So I think, you know, we're in a
45:03
cycle now. It's like, OK, NIST is somewhat
45:05
fresh in certain areas. You know, let's maybe take a
45:07
look at those areas that have kind of caught up maybe with
45:09
where the reality of the world is, you know, to those kinds of
45:12
programs. Yeah, 100%.
45:15
I mean, I think you look at the changes in in two point O, you
45:18
know, the the focus on 3rd party risk, what that means for
45:20
organization, the creation of of the govern function, focus on
45:24
metrics and continuous improvement.
45:25
I think that's all reflective of the community coming back to
45:27
them and saying like here's where we're seeing the
45:30
challenges in the organizations. But you're right, I mean, is it
45:35
comprehensive in terms of talking about cloud specific
45:37
risks or generative AI risks? It's not.
45:40
And I always look at these as a starting point, but not
45:43
necessarily going to tell the full story.
45:47
So let's wrap up talking about incident response because no
45:52
matter what happens, I feel like they're, you know, this is an
45:54
old saying in IT security is, you know, there's two types of
45:56
companies, those that have been breached and those who don't
45:57
know it yet. So, you know, I feel like it's a
46:00
matter of time when some organization is going to have to
46:03
deal with something, you know, that has happened.
46:06
You know, there's a lot of talk around, you know, testing and
46:09
running through your, you know, Dr. plans, right?
46:11
And, and all that stuff. And I'm a big fan of testing
46:14
things before their problem, even if it's just, you know, a
46:17
tabletop or walkthrough. OK, well, what happens if
46:20
something happens, right? You don't want to be figuring
46:23
that out at the same time you're going through an incident.
46:25
So what are some of the findings that you saw or, or tips you've
46:28
got there for the people listening and say, OK, yeah, we
46:30
know something's going to happen.
46:32
How can we best be prepared for that?
46:34
Yeah, I, I think when you think about incident response plans,
46:38
the vast majority are form over substance.
46:41
And in my experience and the way I always try to equate it from a
46:44
metaphor perspective is think about your your two-minute drill
46:49
as a quarterback. Like if you don't have those
46:51
plays called, if you, if people don't know their role and you're
46:54
trying to explain it to them in the moment, you're going to run
46:57
out of time. And I worked with an
47:00
organization and we identified relatively early on that there
47:04
was an active ransomware event and we were trying to make a
47:08
decision on who had the authority to actually turn off
47:11
the originating web application server which was responsible for
47:15
hosting the primary customer facing website.
47:19
We spent about two hours having that conversation at which point
47:22
the decision was made for us because the environment suffered
47:25
almost a complete ransomware event.
47:27
So having that predefined set of decision authority and rights is
47:34
probably first and foremost people have to know their role,
47:36
people have to know the decisions they can make and they
47:38
have to going back to our point before be thinking at machine
47:41
speed and not typical bureaucracy.
47:45
Another element to that is this is not most people's day job,
47:50
but it is some people's day job. And so having firms on call that
47:54
specialize in this that can advise you in the moment and
47:59
having a pre built retainer that you've worked with procurement
48:02
to go through is extremely important.
48:04
You're not going to be able to put this out to RFP in the
48:07
moment. You've got to be ready to
48:08
respond again at that machine speed, you know, think less than
48:12
24 hours, not 24 weeks. A a couple of other things that
48:17
I often run into with these plans is they make a lot of
48:20
assumptions around what people know around the asset inventory,
48:24
like what's important, what's not, what can talk to what and
48:26
what's not. And I think the, the first
48:28
question I must always run into in these incidents is what does
48:31
this mean? Like, how bad is it?
48:34
It's like, well, I don't know what the asset does.
48:35
I don't know what the asset has. I don't know what the asset can
48:38
talk to. And so being able to answer that
48:40
question without having to call 10 people is, is going to be
48:44
really important. And then the last piece I'll
48:47
mention is, you know, most, most frameworks and NIST is 1 CIS is
48:53
others have table tops in there. And I think most organizations
48:56
perform table tops. My experience is that they're
49:00
way too easy their mechanism to get people in the room.
49:05
Everyone passed himself on the back at the end and go, oh that
49:08
was a really nice exercise. If you're not at least somewhat
49:12
emotionally upset by the end of the tabletop exercise after
49:16
you've done one or two of these, you didn't do it right.
49:18
Because the reality of real incidents is every decision you
49:22
make is imperfect, at least based on imperfect information,
49:26
and requires real trade-offs. So going back to my example from
49:30
before, I can choose operational shutdown and save the network,
49:35
but at the flip side, I lose customer trust, I lose revenue.
49:39
If you're not having those kinds of questions, you're not running
49:42
a real tabletop and so challenging yourself to ask
49:45
really good injects. So questions, evolving
49:49
situations is is really important, I think to improve
49:52
these, these kinds of tabletop exercises.
49:55
And those have to be safe places to ask the what if questions,
49:57
right? You can't go in and just say,
49:59
well, why are you trying to poke a hole in this and make this not
50:01
work? That's the whole point of doing
50:04
those things. You should be rewarding that
50:05
behaviour. You know, this idea of having a
50:08
retainer I think is really important because I think a lot
50:10
of people, you know, they, they see retainer and they think, Oh
50:13
my gosh, that's very expensive. And in my experience, it's not
50:16
sometimes it's even like a $0.00 retainer.
50:18
It's just, you have that contract, that paperwork already
50:22
in place before. The problem is, Can you imagine
50:25
if your house was on fire and you're like, oh, hold on.
50:28
I got to fill out an RFP and I got to send this out to six
50:30
different fire departments and see which one's going to provide
50:32
me the best deal to, you know, to, you know, to put out the,
50:35
put out the fire. Like that's kind of like the
50:37
same thing you're doing if you don't have something in place
50:39
already. So I would, I, I, I think that's
50:41
great. You know, advice to to take a
50:43
look at who you've got on call because chances are you will
50:46
need help and you do not want to be searching the phone book for,
50:50
you know, a a incident response company and your mileage may
50:54
vary with how good they are. Yeah.
50:57
You know, with the Sanders spider story, I was, you know,
51:00
rehashing all the details today and one of the companies that
51:05
was affected by it not going to get into it, even though it's
51:08
all Wikipedia. They paid 50% of what the
51:13
hackers originally asked for in crypto, right?
51:15
So give us 30 million. They wound up paying 15,000,000.
51:18
So they had a negotiator on whether or not you feel like
51:22
they got a good deal. They paid less than half or
51:25
about or exactly half what was originally demanded.
51:28
So I'm not saying they got a bargain, but and.
51:32
You definitely want to say, well, it paid for itself.
51:34
Like that's not the way to look at it, but having having experts
51:38
in your corner ready to go when something happens, it just saves
51:42
time. And that's that's of the essence
51:43
when you're in that scenario. So it's a great report, Robert.
51:46
Congratulations to you and us and everyone else at our time
51:49
for putting this out. Looking forward to getting in
51:51
the hands of people again. We'll have a link in our show
51:53
notes for people will be able to check it out.
51:55
I said it was free. Yes, there will be an e-mail
51:57
involved, but we promise not to bug people.
52:01
You won't start getting the text like, hey, this is Rob, what are
52:05
you doing tonight? I'm curious with vendors.
52:12
Nothing. What are you up to?
52:13
Let's do something. All right.
52:17
Well, you know what? We ended on a later note today
52:19
and you know, Jim, you kind of see the idea here that later
52:24
this week, May 22nd into what's known as Bitcoin Pizza Day.
52:28
And for people who aren't familiar, this is the day that
52:30
happened in, I'm going to read it here.
52:32
May 22nd, 2010, a programmer, I won't put his name out there,
52:37
used 10,000 Bitcoin, which is about $41.00 at the time for 2P
52:43
John's pizzas. It was, you know, the first kind
52:47
of usage of Bitcoin and I guess in the kind of a commercial
52:49
sense, obviously here we are, you know, 16 years later and
52:54
it's like, are you nuts? You spent 10,000 Bitcoin on a
52:58
pizza And you know, you can say what you want, whether Papa
53:02
John's quality, whatever it may be, right?
53:04
It's fine. I don't discriminate.
53:05
I'll eat any pizza put in front of me.
53:07
But 10,000 bitcoins today, That's about a billion dollars
53:12
worth of pizza. Yeah, it's $800 million worth of
53:17
pizza. I mean, in the guy's defense,
53:19
you got 2 pizzas. So it's only a pizza better.
53:23
$400 million per pizza it's. A value.
53:27
Total value I just. Probably have like an IR, you
53:30
know, pizza negotiator and only paid half that, Yeah.
53:33
Exactly. It explains the mystery of why I
53:36
see a Papa John's everywhere, despite the aforementioned
53:39
quality issues. Now if we could just solve the
53:42
Mattress Firm mystery, we'd really be making progress.
53:45
I think we should all be happy that this person kind of was a
53:50
sacrificial lamb and kind of the butt of many jokes now that he
53:54
made this first transaction on the Bitcoin blockchain.
53:57
I mean, Bitcoin is kind of the OG of crypto and you can't
54:01
escape crypto nowadays. And I'm a big Bitcoin fan.
54:04
I'm not, you know, an investment advisor or anything like that.
54:08
But I mean, essentially crypto is digital money.
54:12
And as you see everything in societies moving to digital like
54:17
the Internet, at one point people were, there were a lot of
54:20
people who thought I don't need the Internet, I'm not going to
54:22
shop on the Internet. Not everybody shops on the
54:25
Internet. I think in the future
54:27
transactions are much more tokenized money.
54:33
And I think that's, that's really it like to, you know, to
54:38
me, like what other case do you need other than the last thing
54:42
I'll say is, you know, when you look at currency from
54:46
governments, they can continue to print more money.
54:49
This is why like the US government will never default.
54:54
The the, what they say is the way it will default is by
54:57
printing more money, right? They'll just inflate the money
55:00
supply and they've inflated the money supply every year by like
55:05
on average 7%. So the question then becomes
55:09
like, what is real money? And so that's Jeff.
55:15
You just sent me a message. I'm going to call you out.
55:17
You said I was getting political.
55:18
This is not political. This is not political.
55:21
I don't think it's. Political, but you know, it's
55:24
look, Bitcoin is an interesting option.
55:27
Any sort of cryptocurrency definitely has, you know, some
55:29
ways to go. I think there's concerns around
55:31
how it's used. I'm not a, you know, tinfoil hat
55:34
person. I think eventually we end up
55:36
there. I don't know how soon that is,
55:38
but I also don't want to turn this into a financial advice
55:40
show because really, you know, you hit one of the last
55:43
statements you made was like we've, you know, we're using
55:45
this as a currency. We also used to use gold beads,
55:49
you know, rocks, you know, shiny things and whatever it may be.
55:52
So you know, is this just the next former that maybe maybe
55:55
not, but this is not where I wanted to take a lighter note.
56:00
I wanted to ask more a a lighter question around you've got
56:04
10,000 Bitcoin. You're buying a pizza.
56:07
What is on your pizza for today, a 10,000 Bitcoin pizza?
56:12
What are the toppings? Jim, I'll start with you because
56:14
you're clearly very passionate about this.
56:15
And I I thought, it seems to me like you've already figured out
56:18
what you're going to do with your 10,000 Bitcoin.
56:21
Pizza. I mean, look, I mean, there's
56:25
really nothing that you can put on the pizza that's going to
56:27
make it worth $800 million. So I'm going to say what I would
56:31
put on a pizza. I would get a Hawaiian pizza
56:35
because, Jeff, I know that's going to just absolutely, like,
56:39
ruin the show for you. You probably won't even publish
56:42
this episode. And we've got audio and video
56:46
gold from Robert Stockgrass coming on the show and giving,
56:49
you know, hundreds of dollars worth of, you know, advice.
56:54
And you're going to ruin it just because I said Hawaiian pizza's
56:58
the best. I'm just going to use AI to make
57:00
you say something you know better than Hawaiian pizza.
57:03
I mean, if it if it so for people who aren't watching this
57:06
and they probably won't see it like when Jim said Hawaiian
57:09
pizza at the almost exact same time, Robert and I both shook
57:13
our heads like dude, no, come on, Hawaiian pizza 10,000
57:16
Bitcoin. Like now if you had said Hawaii,
57:21
you know, actually the islands on top of a pizza.
57:23
OK, now we're talking like that's where my head is going.
57:27
It's like, OK, well, how do you make a 10,000 Bitcoin pizza, put
57:31
11,000 bitcoins on top of it? Not now.
57:33
You're making some money on that pizza.
57:36
There you go. I thought this wasn't a
57:38
financial advice show. It feels like that's the trend
57:40
we're heading. What's on your pizza, Robert?
57:43
10,000 bitcoins. You got a billion dollars.
57:46
What are you going to put on it? Oh man.
57:48
You know what, just to cancel out Jim's horrible Hawaiian
57:52
pizza comment, I feel like I have to put real toppings on my
57:55
pizza because that. I feel like you're honestly
57:58
trolling us with that comment, Jim.
58:01
And I'm worried about your now 2,000,000 downloads, like if
58:05
your streaming service is going to actually reduce those just
58:09
based purely on that comment. I love pizza.
58:13
And so I would say I would first start by adding the home of
58:16
pizza, which is Italy, which is just one of the most fantastic
58:21
countries to travel to for the most amazing, I would say
58:25
Neapolitan pizza. So heading out to Napoli and my
58:30
great Italian accent there, you can hopefully change that out
58:33
with AI. And then from a topping
58:35
perspective, you know, you got to go light red sauce, little
58:40
bit of Pecorino mozzarella, maybe some, I'd say sausage on
58:47
there. And if you go white sauce, got
58:49
to go pursuit. So you're you're kind of at
58:52
where I was thinking. I was thinking, you know, the
58:54
ultimate meat lover's pizza, like, you know, prime you, you
58:58
know, you know, prime aged something or other, you know,
59:01
whatever. Maybe like all of the finest,
59:04
you know, I'm not sure what the best bacon is.
59:06
Maybe some pancetta, right? Maybe all of it.
59:08
Maybe each individual slice of the pizza is a different theme
59:13
or style along the science of so I can get more toppings on there
59:17
without, you know, what I don't want to do is blow away the
59:19
taste profile and be like, well, this is just meat, right?
59:22
And you can't taste the differences.
59:23
So maybe that is the key is each individual slice has its own
59:28
sort of, you know, mix. And as a former Chicagoans, I'm
59:32
still a Chicagoan, right? I'm thinking deep dish, maybe
59:35
thin and maybe my pizza has a bunch of different, you know,
59:38
layers when it comes to, you know, how much dough is on
59:41
there. But I'm I'm a definitely a light
59:42
red sauce person. I'm not much heavier.
59:44
Give me more of the cheese and the meat and all the other
59:47
unhealthy things instead. Well, if Robert did get me, I
59:50
did. I was trolling you guys, even
59:52
though I'm not against a little pineapple on a pizza for a
59:56
treat. But I will be in Naples in two
1:00:00
weeks and I'm going to get the pizza, Margarita, like I'm just
1:00:04
going to eat that for every meal.
1:00:07
I don't see any faults at all in that strategy, Robert.
1:00:09
I mean as as the two consultants here advising Jim on his pizza
1:00:12
eating, I, I see nothing but five out of five, you know, from
1:00:16
a CMMI scale from an assessment standpoint.
1:00:19
What about? You.
1:00:19
Yeah, 100%. I would also say shout out to
1:00:21
Chicago Tavern style pizza, which is definitely the ultimate
1:00:26
Chicago pizza rather than deep dish.
1:00:29
Yeah, well, now we're getting political.
1:00:31
We're talking about different styles of pizza.
1:00:33
The New York crowd is going to be chatting here.
1:00:35
And, you know, pretty soon it's going to be, you know, Italy and
1:00:37
Detroit. Look, we don't discriminate.
1:00:39
We like all the pizzas. We like all the currencies.
1:00:41
Let's all just be friends. Let's go ahead and wrap it up
1:00:45
for this week. Robert, it's always a pleasure
1:00:47
to have you on. Let's not wait four years for
1:00:49
the next visit. This report is excellent.
1:00:53
It will be LinkedIn, our show notes.
1:00:54
I'm sure you'll see it on LinkedIn as well, so people can
1:00:57
check it out. We'll go ahead and leave it
1:00:59
there for this week. I'll put a link in connection
1:01:02
information for you, Robert, so people can reach out, you know,
1:01:05
with their thoughts, you know, or maybe you know, there are
1:01:08
10,000 Bitcoin pizza toppings, you know, put that in wherever
1:01:12
you want to put it, YouTube comments, LinkedIn or whatever
1:01:14
it may be. Find us on the web, IDC
1:01:16
podcast.com. Happy EIC week and we'll see
1:01:20
folks in Ideniverse in a few weeks as well.
1:01:22
So thanks everyone for watching and or listening and we'll talk
1:01:26
with you all in the next one. You've been listening to
1:01:30
Identity at the Center. We hope you've enjoyed the show.
1:01:34
Make sure to like, rate and review, and we'll be back soon.
1:01:39
But in the meantime, hit the website at
1:01:41
identity@thecenter.com. See you next time on Identity at
1:01:47
the Center.