Latest / Cybersecurity Perspectives / S1:E10 - in 3.2% of DLP policy violations, research and technical documentation was uploaded to unauthorized AI systems

Transcript

S1:E10 - in 3.2% of DLP policy violations, research and technical documentation was uploaded to unauthorized AI systems · Cybersecurity Perspectives

• 0:00
  SPEAKER_01: Cybersecurity moves fast.
• 0:02
  SPEAKER_01: Working in a space measured in minutes and seconds means we can't expect to keep pace by doing the same thing over and over.
• 0:08
  SPEAKER_01: The sharing of perspective across technologists, defenders, business, and professionals is key to unleashing internal capability.
• 0:16
  SPEAKER_01: Perspective comes from sharing experiences and ideas.
• 0:20
  SPEAKER_03: Welcome to Cybersecurity Perspectives.
• 0:24
  SPEAKER_03: Welcome back.
• 0:26
  SPEAKER_03: I'm Paul Marco, and this is another amazing episode of Cybersecurity Perspectives, the show where both the host and the guest have no idea what we're going to talk about today.
• 0:34
  SPEAKER_03: We literally have no clue.
• 0:35
  SPEAKER_03: We're going to pick it live.
• 0:36
  SPEAKER_03: We're going to figure out where we're going.
• 0:37
  SPEAKER_03: I am joined by my super talented co-host, Owen Bazidlo.
• 0:40
  SPEAKER_03: Owen, what's going on, man?
• 0:41
  SPEAKER_03: How are you?
• 0:42
  SPEAKER_02: Hey, Paul.
• 0:43
  SPEAKER_02: How's it going?
• 0:43
  SPEAKER_02: Uh, this is a new one.
• 0:45
  SPEAKER_02: Man, caught me out of right field for that intro.
• 0:48
  SPEAKER_02: Kind of like it.
• 0:50
  SPEAKER_02: It's a little bit better than the disc jockey throwback to the, what was that, the 70s?
• 0:54
  SPEAKER_02: It was jazz DJ.
• 0:56
  SPEAKER_03: I was trying to like be cool, right?
• 0:58
  SPEAKER_03: Like cool cats.
• 0:59
  SPEAKER_03: That was the whole vibe for last time.
• 1:00
  SPEAKER_02: Apologies.
• 1:01
  SPEAKER_02: You're right.
• 1:01
  SPEAKER_02: That it that is a generationally sound statement, right?
• 1:05
  SPEAKER_02: Is the cool cats.
• 1:06
  SPEAKER_02: That's not just in the 70s.
• 1:07
  SPEAKER_02: That's today in the 2020s.
• 1:09
  SPEAKER_02: So luckily.
• 1:10
  SPEAKER_03: Exactly.
• 1:10
  SPEAKER_03: Super relevant.
• 1:11
  SPEAKER_03: Exactly right.
• 1:12
  SPEAKER_03: Dude, oh, and I haven't seen you in forever.
• 1:14
  SPEAKER_03: Like I feel like we've been two ships passing the night, man.
• 1:16
  SPEAKER_03: Where have you been?
• 1:16
  SPEAKER_03: What have you been doing?
• 1:18
  SPEAKER_02: Oh no.
• 1:19
  SPEAKER_02: Yeah.
• 1:19
  SPEAKER_02: I mean, I guess just a little thing like trying to run the company, but also just working really hard for customers.
• 1:27
  SPEAKER_02: The one thing that I do want to bring up here before we hand it off to our amazing guest and doing the intro is super interesting, as much as some of the podcasts that I talk about, while AAI is the focus.
• 1:40
  SPEAKER_02: Dang it.
• 1:42
  SPEAKER_02: This one topic, AI might be the focus as well.
• 1:45
  SPEAKER_02: So the really interesting topic that I've heard is that Google Halt's open source bug bounty program amid AI spam surge.
• 1:54
  SPEAKER_02: I just felt like this movement towards bug bounty and using this again, crowdsourcing mentality was amazing, right?
• 2:02
  SPEAKER_02: 10, 15 years ago, thought it was super amazing how this came in, help organizations, really thought-provoking leaders, really intelligent people, providing good curated content to help secure organizations.
• 2:15
  SPEAKER_02: And man, doesn't AI just come in and throw a big wrench, right?
• 2:19
  SPEAKER_02: So no longer are these organizations being able to use them.
• 2:23
  SPEAKER_02: But gosh, now they're being flooded, right?
• 2:26
  SPEAKER_02: So this is like brings me back to like the grad school days of bad data in is bad data out, right?
• 2:34
  SPEAKER_02: We're now just back into the playground of the sand pits, right?
• 2:38
  SPEAKER_03: You know, I I can't really tell the future, but I have a really good feeling we're gonna circle back to this topic right before we get into our cards because I have a bunch of thoughts on that.
• 2:46
  SPEAKER_03: And with that, I do want to take a second to introduce our guest today.
• 2:50
  SPEAKER_03: Today, we have the pleasure of chatting with a gentleman hailing all the way from Haley, Idaho.
• 2:54
  SPEAKER_03: And he has a wild background, started his career in the Air Force, focused on encryption.
• 2:59
  SPEAKER_03: He's worked his way through the ranks of various MSPs, doing everything from customer support to building virtual servers in data centers.
• 3:07
  SPEAKER_03: And for the last 15 years, he's been doing something near and dear to my heart.
• 3:10
  SPEAKER_03: He's been the director of technology building something special in K-12 education.
• 3:14
  SPEAKER_03: And with that, it is our pleasure to welcome Paul Zimmerman Poe.
• 3:18
  SPEAKER_00: Welcome to the show.
• 3:19
  SPEAKER_00: Thank you.
• 3:19
  SPEAKER_00: Thank you for having me.
• 3:20
  SPEAKER_00: I uh I appreciate the opportunity to listen to what you guys are talking about and then get to talk to myself.
• 3:26
  SPEAKER_03: Yeah, well, hey, listen, this is we're gonna do some talking today, I feel like.
• 3:29
  SPEAKER_03: But Paul, before we get into it, tell the listeners a little bit about yourself.
• 3:32
  SPEAKER_03: How'd you get to where you are today?
• 3:34
  SPEAKER_00: Yeah, so the the story is is definitely colorful.
• 3:36
  SPEAKER_00: So I joined the Air Force, oh man, more years ago than I can keep track of.
• 3:41
  SPEAKER_00: And uh I actually joined in um Open General, just kind of joined with whatever, and they did some aptitude tests and said, You're pretty good at math.
• 3:48
  SPEAKER_00: Come on over here.
• 3:49
  SPEAKER_00: And so I did encryption work the whole time I was in there.
• 3:52
  SPEAKER_00: So uh anytime I'm at a veterans event with elementary kids, they ask me, Did you fly planes?
• 3:57
  SPEAKER_00: I did not.
• 3:57
  SPEAKER_00: I did math underground for four years.
• 3:59
  SPEAKER_00: That's all I did the whole time.
• 4:00
  SPEAKER_00: And then they stopped talking to me.
• 4:02
  SPEAKER_00: So um did that and then got out, and the MSP route was kind of a natural progression from the Air Force right into the technology field.
• 4:11
  SPEAKER_00: And that was a good learning experience because the enterprise environment uh outside of government control is much different.
• 4:18
  SPEAKER_00: So it was a great contrast for me to see.
• 4:20
  SPEAKER_00: Uh, and then moved to Haley and um was a manager of a landscaping place for a little while.
• 4:26
  SPEAKER_00: Then I went on and started teaching technology classes at a library.
• 4:30
  SPEAKER_00: And from there, I moved into the school district as technology innovator briefly and then director of technology the rest of the way and getting these great opportunities to uh work with Google and Nintendo and all these different kinds of things to um take risks.
• 4:46
  SPEAKER_00: And it's unusual in education to have the flexibility to take risks, but luckily this organization lets me, you know, explore and experiment, you know, safely and and you know, intelligently, but I get to try new things and it's been a really great experience up to this point.
• 5:00
  SPEAKER_03: That's amazing.
• 5:01
  SPEAKER_03: That's amazing.
• 5:01
  SPEAKER_03: You know, listen, I I I love hearing about people's stories just because like you have no idea where life is gonna take you, right?
• 5:08
  SPEAKER_03: Like it's so random in terms of like where you thought you were gonna go and what you thought you were gonna do, and like kind of where you end different parts of the country, but focus on the very same problems, the very same things.
• 5:20
  SPEAKER_00: And it's so neat to listen to the the stories because every story is a brushstroke on this tapestry you have of your life.
• 5:26
  SPEAKER_00: And without understanding all of the brushstrokes, you don't have that full picture.
• 5:29
  SPEAKER_00: So it's I'm the same.
• 5:31
  SPEAKER_00: I love hearing stories and listening to where the how they got to this point.
• 5:34
  SPEAKER_00: No story is uninteresting because everything is unique for everyone.
• 5:37
  SPEAKER_00: And I I love that.
• 5:38
  SPEAKER_00: I can't, I can never learn less.
• 5:39
  SPEAKER_00: And I love hearing those things.
• 5:41
  SPEAKER_03: I love, I love the the thing you talked about with the Air Force and like the kids being like, oh, do you fly planes?
• 5:46
  SPEAKER_03: It's like from the mouths of babes, right?
• 5:48
  SPEAKER_03: Like I do, we, we Talos participates in this career, uh, this career day for one of our customers.
• 5:54
  SPEAKER_03: We go down and we talk about cybersecurity.
• 5:56
  SPEAKER_03: And of course, I say cybersecurity, all the kids are like, oh, do you hack computers?
• 6:00
  SPEAKER_03: I'm like, oh great, no, no, no.
• 6:02
  SPEAKER_03: And then of course they were disappointed because like that's what they wanted to hear about.
• 6:05
  SPEAKER_03: And then I have to explain about like, you know, governance and risk, you know, boring things that people don't want to do, right?
• 6:11
  SPEAKER_03: And they're just like, okay, cool.
• 6:12
  SPEAKER_03: I'm gonna go talk to the fireman.
• 6:13
  SPEAKER_03: Uh uh, goodbye.
• 6:14
  SPEAKER_03: Thank you.
• 6:15
  SPEAKER_03: Right.
• 6:15
  SPEAKER_00: Yeah, I gotta go.
• 6:16
  SPEAKER_00: Yeah, I get the same thing.
• 6:17
  SPEAKER_00: I I will do this, and the kids will, you know, stop talking.
• 6:19
  SPEAKER_00: And I think in one of the events I was in, I said that I did math for four years and it was radio silence.
• 6:25
  SPEAKER_00: But I think you had one teacher start clapping.
• 6:26
  SPEAKER_00: A math teacher in the back somewhere in high school with the man, you're the one.
• 6:31
  SPEAKER_03: Those are the people that have been through it.
• 6:32
  SPEAKER_03: Those are the people that understand, you know?
• 6:34
  SPEAKER_00: Yeah.
• 6:34
  SPEAKER_03: They know.
• 6:36
  SPEAKER_03: Well, look, again, thank you so much for taking the time.
• 6:38
  SPEAKER_03: But honestly, like the thing he brought up is something I've been thinking about for a while.
• 6:42
  SPEAKER_03: And it's like all of these companies that had these bug bounty programs, right?
• 6:47
  SPEAKER_03: You know, like they they were trying to do the right thing.
• 6:49
  SPEAKER_03: And this is what he was alluding to is like, okay, I want to be able to pay people to responsibly disclose bugs to our systems.
• 6:56
  SPEAKER_03: Like if they find something, we'll we'll give you, you know, in the bug bounty programs vary wildly, right?
• 7:01
  SPEAKER_03: You have some programs that'll pay out a ton of money.
• 7:03
  SPEAKER_03: Like they'll pay you$10,000 for a bug or more.
• 7:05
  SPEAKER_03: And then there are some that are like, hey, can I send you a hat, right?
• 7:08
  SPEAKER_03: Like, so there's like there's the whole spectrum.
• 7:10
  SPEAKER_03: Right.
• 7:10
  SPEAKER_03: But they're like in this case, like I never thought about how like AI and especially some of these frontier models, like Mythos, right, and and the others, like are gonna turn that on their head, right?
• 7:21
  SPEAKER_03: Because now finding zero days is cake, right?
• 7:23
  SPEAKER_03: We've we've done a bunch of episodes where we've talked about like the statistics of how many vulnerabilities are emerging and the velocity which they're emerging.
• 7:29
  SPEAKER_03: It makes perfect sense that these bug bounding programs are gonna be suspended.
• 7:32
  SPEAKER_00: Yeah.
• 7:32
  SPEAKER_00: And I think what happens is typical, I don't want to say typical AI, but I I hearing this tells me that it's another space that was built in a certain way and now has to evolve because of emerging technologies.
• 7:46
  SPEAKER_00: Because before you had humans that were on it on a Saturday or they were doing their thing, poking at bugs and trying to find these, these, you know, all these things for the bounties.
• 7:53
  SPEAKER_00: Now those same people can use AI to do it instantly, just like with bive coding.
• 7:58
  SPEAKER_00: So now, like instead of before the experts were doing it, now I mean a random someone can just, you know, get an AI to help them find a bug somewhere and they get paid for it.
• 8:06
  SPEAKER_00: And it's just such a strange landscape shift from expertise in one area to utilizing a tool in a different area.
• 8:13
  SPEAKER_00: It's just such a strange slide.
• 8:16
  SPEAKER_03: Yeah.
• 8:16
  SPEAKER_03: And look, like I Owen was making a joke before how like we talk about AI every time.
• 8:21
  SPEAKER_03: And I think it's true.
• 8:22
  SPEAKER_03: Like every card we've pulled for almost every episode except for two have been some like AI dramatic statistic.
• 8:28
  SPEAKER_03: And, you know, the thing is like it makes sense though, because of how much it's changing our world, right?
• 8:33
  SPEAKER_03: Like everything from bug bounties to operationalizing technology to, you know, doing things like reporting or assessments or even risk management.
• 8:41
  SPEAKER_03: Like it's it's truly permeated every aspect of cybersecurity.
• 8:45
  SPEAKER_03: So of course it's gonna change things.
• 8:46
  SPEAKER_03: Of course, we're gonna talk about it, right?
• 8:48
  SPEAKER_00: And I think the thing that that happens though is often it's the doom and gloom approach.
• 8:53
  SPEAKER_00: Everyone talks about it in the way things are gonna be terrible or how this is happening and it's not gonna be good and all this kind of stuff.
• 8:58
  SPEAKER_00: And the thing I always think about and I share with others is when the internet came around, everyone was sure libraries would go away.
• 9:05
  SPEAKER_00: And they didn't.
• 9:06
  SPEAKER_00: They evolved.
• 9:07
  SPEAKER_00: And so AI is around.
• 9:08
  SPEAKER_00: So things that are directly affected, similarly to internet and library, the things that are directly affected will evolve.
• 9:14
  SPEAKER_00: And that's fine.
• 9:15
  SPEAKER_00: That's part of the human experience.
• 9:17
  SPEAKER_00: But the the constant, you know, doom and gloom and it's gonna ruin everything, I I'm challenged because as soon as you have that mindset, you're not open to what are the opportunities?
• 9:25
  SPEAKER_00: What are the either opportunities for it to improve or the opportunities it creates with its evolution of things around it?
• 9:32
  SPEAKER_00: Those are things that get overlooked, and I I always try to circle people back to that.
• 9:36
  SPEAKER_03: 100%.
• 9:37
  SPEAKER_03: I uh I I love that perspective.
• 9:39
  SPEAKER_03: Our industry, cybersecurity in general, is very negative, right?
• 9:43
  SPEAKER_03: It's all very fear-mongering, it's all very like the most worst thing on the planet is gonna happen to you.
• 9:48
  SPEAKER_03: I mean, I've always been a positive guy, and I feel like that's just uh a default when your name is Paul now, right?
• 9:53
  SPEAKER_03: You're a positive guy, I'm a positive guy.
• 9:55
  SPEAKER_03: This is the only thing that's right.
• 9:56
  SPEAKER_03: Like we it is our job to change like how this industry thinks, and we have to move it to a positive, positive space.
• 10:03
  SPEAKER_00: We're a couple of hug machines.
• 10:04
  SPEAKER_00: That's how it's gonna go.
• 10:05
  SPEAKER_00: I love it.
• 10:06
  SPEAKER_03: This is already an incredible episode.
• 10:08
  SPEAKER_03: We can end it here and I'd be happy.
• 10:09
  SPEAKER_03: But as you know, Paul, that is not where things end.
• 10:12
  SPEAKER_03: This is where things get interesting.
• 10:14
  SPEAKER_03: When I started our intro, I said we have no idea what we're talking about, and that is true.
• 10:17
  SPEAKER_03: We have no idea what the topic is going to be.
• 10:19
  SPEAKER_03: Um, I have to be careful with that because I could see people misinterpreting this as we have no idea what we're talking about, not no idea what the topic is.
• 10:28
  SPEAKER_00: This is amazing.
• 10:30
  SPEAKER_00: I my superpower is I am at my very best when I have no idea what I'm doing.
• 10:33
  SPEAKER_03: So there it is, and that's where we're at.
• 10:35
  SPEAKER_03: So, as you know, there are three cards that are in front of us here.
• 10:37
  SPEAKER_03: You can see them pile A, pile B, and pile C.
• 10:40
  SPEAKER_03: And this is where you get to select the card.
• 10:42
  SPEAKER_03: We pick it, we read it live, and that's the topic for the show.
• 10:45
  SPEAKER_03: Okay.
• 10:46
  SPEAKER_03: So am I looking at picking one right now?
• 10:48
  SPEAKER_03: You're you're gonna tell me, A, B, or C.
• 10:50
  SPEAKER_03: And I love the rationalization.
• 10:51
  SPEAKER_03: Where are we going?
• 10:52
  SPEAKER_03: We're doing A, B, C.
• 10:53
  SPEAKER_03: What do you think?
• 10:54
  SPEAKER_00: Let's go with the uh C.
• 10:56
  SPEAKER_00: And that's the one I could see.
• 10:58
  SPEAKER_03: See the end of the list.
• 10:59
  SPEAKER_03: Okay.
• 10:59
  SPEAKER_00: Only because it's curled up slightly and the other two are not.
• 11:02
  SPEAKER_03: Huh.
• 11:03
  SPEAKER_03: Okay.
• 11:03
  SPEAKER_03: Well, let's see here.
• 11:04
  SPEAKER_03: This this one's a lot.
• 11:05
  SPEAKER_03: Okay, so the title of this one is AI Defense, Governance, and Shadow I and Shadow AI.
• 11:12
  SPEAKER_03: And this actually comes from the 2026 Verizon Breach Investigations Report.
• 11:17
  SPEAKER_03: And here is the actual statistic.
• 11:19
  SPEAKER_03: In 3.2% of DLP policy violations, research and technical documentation was uploaded to unauthorized AI systems, creating direct intellectual property risk exposure.
• 11:33
  SPEAKER_03: I'm gonna read it again.
• 11:35
  SPEAKER_03: In 3.2% of DLP policy violations, research and technical documentation was uploaded to unauthorized AI systems, creating direct intellectual property exposure risk.
• 11:49
  SPEAKER_03: Now, this comes from 2026 Verizon Data Breach Report.
• 11:52
  SPEAKER_03: So this is a very, very relevant statistic.
• 11:56
  SPEAKER_03: And here's this is one of those ones where 3.2% doesn't sound like a lot, but I also have some opinions on DLP, and I bel I bet this number is way, way higher than it's being represented.
• 12:07
  SPEAKER_00: And it's 3.2% of some number, so it scales up based on the quantity.
• 12:13
  SPEAKER_00: Exactly right.
• 12:14
  SPEAKER_00: My first my first initial thought when I hear this is it just proves the point that in cybersecurity or in technology in general, the users are your greatest risk.
• 12:23
  SPEAKER_00: 100%.
• 12:24
  SPEAKER_00: One no three point two percent.
• 12:26
  SPEAKER_00: But yes, 100%.
• 12:27
  SPEAKER_03: Well, 3.2%.
• 12:28
  SPEAKER_03: And so I think I think this is where it's important, I think, to to really kind of temper this statistic.
• 12:35
  SPEAKER_03: And actually, I think we're gonna temper it in the other way, right?
• 12:37
  SPEAKER_03: Like we're gonna, I I think this number is actually low, a low representation.
• 12:42
  SPEAKER_03: And you know, over the course of my my career, I've run multiple DLP programs.
• 12:46
  SPEAKER_03: I've helped design multiple DLP programs.
• 12:48
  SPEAKER_03: And the reality is DLP is by far and away one of those services that organizations offer where the volume is truly untenable.
• 12:56
  SPEAKER_03: Like you cannot keep up with the number of alerts that are firing.
• 13:00
  SPEAKER_03: It's very hard to understand like what data is and is not leaving.
• 13:03
  SPEAKER_03: And here's the other thing: let's not forget that these AI models and systems that people are interacting with, especially the web-based one, are all brand new.
• 13:11
  SPEAKER_03: So there's not even a ton of techno technological controls out there that organizations can even implement to know when data is being uploaded into these unauthorized AI systems.
• 13:21
  SPEAKER_03: So I think we can we can work with this percentage, but I would guess that that that if I had to, if I had to venture a completely wild and also listener, completely unproven guess, this is Paul's opinion, please don't shoot me.
• 13:32
  SPEAKER_03: I think that we'd probably be closer to like 15 to 20%.
• 13:36
  SPEAKER_03: Like if I had to truly like put my money on a number, I would guess this number is significantly higher.
• 13:42
  SPEAKER_03: This is just the number that represents what visibility we have into before we even talk about the impact.
• 13:47
  SPEAKER_00: That's the key, is the 3.2% is based on what I can see.
• 13:51
  SPEAKER_00: And what I can't see is the real danger because then I have no governance of it, no accountability, and no way to retract or mitigate that situation.
• 13:59
  SPEAKER_00: And or I have no opportunity to help the users in that situation be trained or whatever the situation warrants to do better next time.
• 14:08
  SPEAKER_00: I lose all of that because it's not in an authorized way that I have visibility into.
• 14:14
  SPEAKER_03: I agree.
• 14:15
  SPEAKER_03: So let's dig into this one.
• 14:16
  SPEAKER_03: This one is interesting.
• 14:17
  SPEAKER_03: I think it's gonna take us down a bunch of different rabbit holes.
• 14:20
  SPEAKER_03: And I think the the interesting thing about this one is we talk about like, okay, this 3.2% of DLP events that have been recorded per this industry report, they're effectively things where someone uploaded a document that had some intellectual property in it, right?
• 14:34
  SPEAKER_03: And that represented that risk, right?
• 14:36
  SPEAKER_03: Because as everyone knows, if you're uploading things into AI, untenctioned AI systems, they always say, well, they're gonna train on the data and you lose control of that data, you lose control of that information.
• 14:46
  SPEAKER_03: And I get all that, but I think, I think the perspectives here are gonna be a little different because like, what are we talking about?
• 14:52
  SPEAKER_03: Like when we talk about intellectual property, like the that when I think of that word, I think of things like, you know, unfiled patents, I think about things like non-public information or like financial information.
• 15:03
  SPEAKER_03: But like there's a full gamut of data that we as cyber professionals have to protect.
• 15:07
  SPEAKER_03: And it's all subject to this very same thing, right?
• 15:10
  SPEAKER_00: Like it is, yeah.
• 15:11
  SPEAKER_00: Like I think this and I hear uh for me, FERPA compliance is my whole life.
• 15:15
  SPEAKER_00: So I have FERPA is the number one rule I live by for data compliance, and in the medical fields, it's HIPAA.
• 15:20
  SPEAKER_00: And using the same example, it would be akin to a teacher uploading student data into a non-sanctioned or unauthorized AI.
• 15:28
  SPEAKER_00: So now all of that private data that is federally protected is now in a thing that's going to use it to train its models and off it goes.
• 15:34
  SPEAKER_00: And we, it is a reality.
• 15:36
  SPEAKER_00: So our percentage is probably higher in the reality in the world.
• 15:40
  SPEAKER_00: I like, you know, we do we do our best to train and we have all these tools in place, but um, you know, users are the greatest risk and they have workflows and they have habits and they have patterns that they follow, and it's hard to get them to change.
• 15:52
  SPEAKER_00: And so when I hear these things, it's often, yes, it is an AI issue, it is a security issue, but it is also a user awareness and training issue.
• 15:59
  SPEAKER_00: It's kind of a trifecta of things that create these situations.
• 16:04
  SPEAKER_03: You know, the more I think about this, the the more interested I get.
• 16:07
  SPEAKER_03: Like when I first read this statistic, I'm like, ah, this one, this one's gonna be kind of easy, it's pretty straightforward.
• 16:13
  SPEAKER_03: But the thing is, it's not.
• 16:14
  SPEAKER_03: This thing has a ton of nuance, right?
• 16:16
  SPEAKER_03: Because like here we are, like if we're thinking about what this threat model looks like, right?
• 16:20
  SPEAKER_03: If we're really mapping this out in terms of what like folks like you, myself, Owen, whoever have to like, what's our goal to protect?
• 16:28
  SPEAKER_03: Our goal, like we're thinking about the threat model as there's an individual with an individual file that puts that file into some free version of an AI system, and then that free version spits out some result, but because of because it's the free version, the terms and conditions say, hey, I'm allowed to train on this data, that data now becomes a part of their model.
• 16:47
  SPEAKER_03: Okay.
• 16:49
  SPEAKER_03: The problem with that threat model is a couple of things.
• 16:51
  SPEAKER_03: And there's, I think, like if I'm thinking through this live with everyone, there's pros and there's cons.
• 16:55
  SPEAKER_03: The pro is, well, look, yeah, maybe, maybe the document I had, but the one paragraph that was highly, highly specific and like very protected in in some data set.
• 17:05
  SPEAKER_03: And I think we can, at this point for our con our conversation, we can move past like research or intellectual property.
• 17:10
  SPEAKER_03: Like we can talk about just protected data sets.
• 17:12
  SPEAKER_03: The reality is we're still talking about these frontier models that are using billions and billions and billions of tokens, right?
• 17:18
  SPEAKER_03: Like these are not like, you know, all right, there's a hundred different tokens in here and I just uploaded four.
• 17:23
  SPEAKER_03: Now all of a sudden I now 4% of the models, now my data that I'm protecting.
• 17:27
  SPEAKER_03: Now we're like, you know, there's like the the percentage of the data that's potentially going to train the model is unbelievably low.
• 17:34
  SPEAKER_03: Like if I put my social security number into the free version of OpenAI, I wouldn't expect someone would say, tell me about social security numbers.
• 17:41
  SPEAKER_03: And they'd be like, well, Paul Marco's social security number is one, two, three, four, five, six, seven.
• 17:45
  SPEAKER_03: Right.
• 17:45
  SPEAKER_03: Like, I don't think that's gonna happen, even though it's still a data risk.
• 17:49
  SPEAKER_03: Oh, I like this.
• 17:50
  SPEAKER_03: I like this contention, Paul.
• 17:51
  SPEAKER_03: Hit me with it.
• 17:51
  SPEAKER_03: What do you got?
• 17:52
  SPEAKER_00: I I I guess, but you're you're in a slippery slope where you're saying that because I'm a small part of a larger whole, it's okay.
• 18:00
  SPEAKER_00: When the laws, rules, or basic or ethics in some cases state that it's all or nothing.
• 18:07
  SPEAKER_00: Like if I'm doing that one tiny bit of info, then all of the info should be fine.
• 18:11
  SPEAKER_00: Because technically, my entire organization's data set is smaller than the billions and billions of tokens like you mentioned.
• 18:17
  SPEAKER_00: Technically, that's a true statement.
• 18:18
  SPEAKER_00: But is that the right statement?
• 18:20
  SPEAKER_00: Is that the ethical statement?
• 18:21
  SPEAKER_00: Is that the one that follows the law or the rule or the policy that you have that organizes that?
• 18:26
  SPEAKER_00: You can't set the precedent for, ah, this little bit is okay.
• 18:30
  SPEAKER_00: You have to hold the line with your data privacy 100% of the time.
• 18:35
  SPEAKER_03: You're you're 100% right.
• 18:37
  SPEAKER_03: And what I'll clarify is I'm I don't think it's okay.
• 18:40
  SPEAKER_03: Right.
• 18:41
  SPEAKER_03: Like I agree.
• 18:41
  SPEAKER_03: Like, yeah, no, I didn't mean like that.
• 18:45
  SPEAKER_03: But here's where I here's where I do want to push a little back is this is not in my mind about black or white, although I truly appreciate your your position on the slippery slope and like if this is okay, then that's okay.
• 18:56
  SPEAKER_03: That actually makes a ton of sense to me.
• 18:57
  SPEAKER_03: What I'm trying to do here is quantify risk.
• 18:59
  SPEAKER_03: Right.
• 19:00
  SPEAKER_03: At the end of the day, this is a risk conversation, right?
• 19:02
  SPEAKER_03: And like, you know, if if someone were like, hey, I'm gonna put I I put this data in this in this model and you know, it was unsanctioned, like if I'm thinking through things like incident response processes and reporting, like are are we reporting that?
• 19:15
  SPEAKER_03: Are you gonna report that to your, you know, whatever your regulatory body is?
• 19:18
  SPEAKER_03: Like, like I'm thinking about this like from if I'm quantifying the risk, I agree with you.
• 19:22
  SPEAKER_03: If we're thinking about this like right or wrong, if we're thinking about ethics, if we're thinking about the rule of law, no, it's wrong.
• 19:27
  SPEAKER_03: It's bad, don't do it.
• 19:28
  SPEAKER_03: But like when it does happen, what is what's the actual follow-on risk from that actually happening?
• 19:34
  SPEAKER_00: So it it it I think it depends on your organization and the policies you have.
• 19:38
  SPEAKER_00: For me, for example, if uh with FERPO road laws, if we find out that student social security numbers, for example, are uploaded into a wide open data model, it's no different than a data breach.
• 19:50
  SPEAKER_00: It is now outside of my purview, outside of my control, and I have to report it to the parents.
• 19:55
  SPEAKER_00: I there's we have a whole procedure for data breaches, and this would apply to that.
• 19:59
  SPEAKER_00: But I think the other thing that I run into, and you bring up something I'm thinking about, is as these models come along, the frontier models, everything's brand new.
• 20:07
  SPEAKER_00: In certain um, what is it, organizations or industries like education, for example, our policies and our governance is well behind the rules.
• 20:18
  SPEAKER_00: The rules are well behind what technology is doing.
• 20:21
  SPEAKER_00: And so we are not as malleable or as quick to change as maybe a private industry would say, Oh, frontier models are out, let's rewrite the policy, so we are good.
• 20:28
  SPEAKER_00: We're way behind.
• 20:29
  SPEAKER_00: So some of my um rules and regulations are kind of dated.
• 20:34
  SPEAKER_00: So it's hard to interpret them.
• 20:36
  SPEAKER_00: We have to think thoughtfully about this is how I would do it in this situation because this real life scenario is happening.
• 20:42
  SPEAKER_00: It doesn't apply to any of our policies, but we have to put it somewhere.
• 20:45
  SPEAKER_00: So we do run into that.
• 20:48
  SPEAKER_00: Interesting.
• 20:49
  SPEAKER_03: Yeah, and look again, I I wanna I want to be clear.
• 20:51
  SPEAKER_03: I agree with you.
• 20:52
  SPEAKER_03: But again, like uh the what what took me down this path is actually the second thing I want to talk about, which I think is more interesting, is like that was the threat model.
• 20:58
  SPEAKER_03: Right?
• 20:59
  SPEAKER_03: This threat model was this individual that uploaded this one document or this one piece of information into the free version of it of an A.
• 21:05
  SPEAKER_03: That's how we think about it.
• 21:06
  SPEAKER_03: But here's the thing that I wanna I want to talk through because I think this actually also completely compounds this particular this particular statistic, is that every platform on the planet now is integrating AI.
• 21:18
  SPEAKER_03: Right.
• 21:18
  SPEAKER_03: And like each of those platforms now have terms and conditions that in some way or shape or form require that you accept the terms and conditions of their data processor, which may require you to accept the terms and conditions of their data processor, right?
• 21:33
  SPEAKER_03: So, like even in the scenario where like our threat model is one person, one direct access to a frontier model, pick your poison, could be Gemini, could be OpenAI, could be throughout, it doesn't matter, right?
• 21:43
  SPEAKER_03: They're interacting with that directly.
• 21:45
  SPEAKER_03: And in that case, it's a very clean threat model, right?
• 21:47
  SPEAKER_03: The risk is very clear.
• 21:48
  SPEAKER_03: But like, what if the user is putting something into a sanctioned platform that is using a data processor that uses a data processor that uses a data processor, right?
• 21:57
  SPEAKER_03: You now still have that same exact risk, even though the user didn't What they were supposed to do.
• 22:01
  SPEAKER_03: They used an approved platform.
• 22:02
  SPEAKER_03: They put data in this platform.
• 22:03
  SPEAKER_03: And now that data has been processed by these subprocessors at the third, fourth, and in some case fifth parties.
• 22:09
  SPEAKER_03: It's the same risk, right?
• 22:11
  SPEAKER_03: Like, like this is where I start to, I like I really start to think through this.
• 22:14
  SPEAKER_03: And like I get it.
• 22:15
  SPEAKER_03: Like we have to protect data.
• 22:16
  SPEAKER_03: We live and die by our data.
• 22:18
  SPEAKER_03: That is our goal, right?
• 22:19
  SPEAKER_03: Like that's the thing that we care about the most.
• 22:21
  SPEAKER_03: But in this more and more interconnected world, I'm wondering how impossible that's become.
• 22:25
  SPEAKER_00: I think transparency is what makes what you're describing feasible.
• 22:30
  SPEAKER_00: So you're right, there's layers upon layers.
• 22:32
  SPEAKER_00: I've subcontracted this out to this process or however it's going.
• 22:36
  SPEAKER_00: Um and in these cases, I think it's important for people that are in the cybersecurity industry or leadership roles to ask for transparency.
• 22:44
  SPEAKER_00: And you have to understand what the data flow looks like.
• 22:46
  SPEAKER_00: I have my in my information in your model.
• 22:49
  SPEAKER_00: Okay, vendor, is there anything going on in the background?
• 22:52
  SPEAKER_00: If there is, you need to transparently explain to me.
• 22:54
  SPEAKER_00: Let me see your privacy policy.
• 22:55
  SPEAKER_00: Let me make sure that it has wording that accounts for if we go to a subcontractor, we continue this on, or click here to see theirs, or whatever the situation is.
• 23:03
  SPEAKER_00: So I think transparency is important.
• 23:06
  SPEAKER_00: But I think the the challenge, as I push back on myself, is it happens so fast.
• 23:11
  SPEAKER_00: Things are changing and evolving so quickly.
• 23:14
  SPEAKER_00: Um, I feel like they're uh it reminds me of Jeff Goldblum in Jurassic Park, where they're jumping in and they're like, they're not thinking about whether they could, or you know, they should, but they could, or whatever his phrase was about making the dinosaurs.
• 23:24
  SPEAKER_00: It's they're just charging ahead as fast as they can, and it makes it where some of these thoughts after the fact are either too late or it's harder to clean it up going forward.
• 23:34
  SPEAKER_03: A hundred percent.
• 23:36
  SPEAKER_03: This is this one definitely is throwing me for a loop here, right?
• 23:38
  SPEAKER_03: Because there's a ton here.
• 23:39
  SPEAKER_03: And the other thing too, this reminds me of is like this reminds me of the same outrage people experienced when Google first IPO'd.
• 23:46
  SPEAKER_03: Right.
• 23:47
  SPEAKER_03: Like I remember I was on the trading floor, right?
• 23:49
  SPEAKER_03: So doing doing tech support for an organization and like it was the day Google was coming out.
• 23:54
  SPEAKER_03: And I remember you had all the you know, the the big like you know, financial news screens on on the wall and stuff.
• 23:59
  SPEAKER_03: And I'm standing there watching this.
• 24:01
  SPEAKER_03: But you're standing there in in person?
• 24:03
  SPEAKER_03: I was in person, yeah.
• 24:03
  SPEAKER_03: I was on.
• 24:04
  SPEAKER_00: I want to hear your story.
• 24:05
  SPEAKER_00: Why'd you have me share mine?
• 24:06
  SPEAKER_00: That's really interesting.
• 24:07
  SPEAKER_00: We missed that.
• 24:08
  SPEAKER_03: This was this is early, early in my career.
• 24:10
  SPEAKER_03: And let me be clear.
• 24:11
  SPEAKER_03: Like like there's no glory here.
• 24:12
  SPEAKER_03: I was crawling under desk fighting dust bunnies, swapping like clamshell things.
• 24:17
  SPEAKER_03: Like, this is not like I just happened to be on a trading floor, like in, you know, and while while Google was happy while Google was IPI.
• 24:23
  SPEAKER_03: And like I remember watching this thing, some trader comes over.
• 24:26
  SPEAKER_03: It was it was a surreal moment because like at the time you didn't know, and Google was this thing, it was like getting huge.
• 24:31
  SPEAKER_03: It wasn't the behemoth that it was today.
• 24:32
  SPEAKER_03: It was still doing like you know very cool things, but it just it was just sitting in that IPO.
• 24:36
  SPEAKER_03: And I remember like the trader being like, this company's gonna fold.
• 24:41
  SPEAKER_03: I'm like, well, why?
• 24:42
  SPEAKER_03: He's like, they're stealing everyone's data.
• 24:44
  SPEAKER_03: Every time you put information in that thing, they're saving it, they're keeping it.
• 24:48
  SPEAKER_03: And the, you know, like like they're they're doing all this crazy stuff with that information and indexing, and they have it.
• 24:53
  SPEAKER_03: And like at the time, it was a real outrage.
• 24:55
  SPEAKER_03: And I remember companies being like, yeah, don't use Google, block it.
• 24:58
  SPEAKER_03: Like you can't put information there because they're stealing our information, they're taking our data.
• 25:02
  SPEAKER_03: And that was a problem 24 years ago or 22 years ago, or however long ago it was.
• 25:08
  SPEAKER_03: Um, you know, like I think this is fundamentally different in terms of the technology and how it consumes data, but that outrage, like, it it triggered one of those long-standing memories in my brain, like kind of one of those core, those core memories.
• 25:20
  SPEAKER_03: Interesting.
• 25:21
  SPEAKER_00: And I'm thinking about, because I haven't I don't really think back to like when Google started and they really kind of, you know, doing data the way they do it and all that kind of stuff.
• 25:29
  SPEAKER_00: But when I think about it in a big picture, I think about Google did their IPO and that got that guy's comment of taking all your data and storing it.
• 25:37
  SPEAKER_00: But what did that really do in the industry from that point forward?
• 25:41
  SPEAKER_00: Data for everyone became a valuable thing that they used.
• 25:46
  SPEAKER_00: So the opportunity it turned from Google's, you know, stealing data.
• 25:49
  SPEAKER_00: Sure, I I understand and I know that to be true.
• 25:52
  SPEAKER_00: However, it also showed the society that data can be used as a tool to help inform, educate, understand, which it wasn't nearly as leveraged before that.
• 26:02
  SPEAKER_00: And using that same logic, I feel like AI could be similar.
• 26:06
  SPEAKER_00: So, because we're hearing the same thing.
• 26:07
  SPEAKER_00: Oh, they're harvesting all your data.
• 26:08
  SPEAKER_00: It's the same conversations.
• 26:09
  SPEAKER_00: You're right.
• 26:10
  SPEAKER_00: However, what opportunities is this going to create for us using the data in a different way?
• 26:16
  SPEAKER_00: Just like when Google started, it transformed everyone.
• 26:18
  SPEAKER_00: Is this going to be a similar transformation?
• 26:20
  SPEAKER_00: And welcome to Paul Zimmerman's positivity focus to everything in life.
• 26:24
  SPEAKER_00: Now you know.
• 26:25
  SPEAKER_03: Well, the thing is, I think fundamentally it is, right?
• 26:28
  SPEAKER_03: I think this is why we keep talking about AI and why it keeps becoming like this topic of like huge interest and like it's not the same conversation over and over again because the reality is the more this thing trains, the better it's going to get.
• 26:41
  SPEAKER_03: And the thing that's interesting about AI is like the more we train it, it helps every industry, right?
• 26:47
  SPEAKER_03: We're not innovating for like one thing.
• 26:48
  SPEAKER_03: It's not just like oil and gas or medicine or chemistry or cybersecurity or whatever.
• 26:54
  SPEAKER_03: Like every industry benefits from AI becoming this thing that that gets better and supports research across the board for every single industry.
• 27:03
  SPEAKER_03: So to your point, like I do think there is a benefit.
• 27:05
  SPEAKER_03: In fact, this I remember I was having a conversation with super talented CISO, probably about a year ago.
• 27:10
  SPEAKER_03: We were talking about this stuff.
• 27:12
  SPEAKER_03: And he he said, he's like, you know, forgive my language, I'll paraphrase what he said, but he's like, I don't give a shit if they train my because if my data helps some doctor solve a disease for my kids, I'm gonna call my friends and tell them to give them their data too.
• 27:27
  SPEAKER_03: Right.
• 27:27
  SPEAKER_03: And like this is that benefit of like helping humanity.
• 27:30
  SPEAKER_03: And again, like I think this is that positive outlook of like, all right, in this case, yes.
• 27:35
  SPEAKER_03: I I think from a research perspective, bring it back to the statistic.
• 27:39
  SPEAKER_03: If you have intellectual property research you've been working on, we've even seen articles of like people outraged that that their research showed up in in some model, right?
• 27:48
  SPEAKER_03: Or they believe it was stolen or whatever else.
• 27:50
  SPEAKER_03: But again, like if we're gonna think about the flip side of this and and your positive angle, like what's the cost of helping humanity?
• 27:56
  SPEAKER_03: What's the cost of solving diseases or or lowering the cost of energy or or you know, innovating in some space that helps some subspect of the population?
• 28:05
  SPEAKER_00: And I think some of that stuff will be revealed as it evolves.
• 28:08
  SPEAKER_00: So I I think about, I use analogies often, and I think about when cars were first invented, we had no rules.
• 28:13
  SPEAKER_00: There was no precedent for a metal box with seatbelts included to go forward faster than we could run.
• 28:20
  SPEAKER_00: That was just that didn't exist in society ever before it.
• 28:23
  SPEAKER_00: So we had to build the rules going forward, like build the plane as you flew it, that kind of thing.
• 28:28
  SPEAKER_00: Um, which and it worked out fine.
• 28:30
  SPEAKER_00: Like we got seatbelts and you know, uh regulations and a million other things.
• 28:34
  SPEAKER_00: This AI evolution, this explosion reminds me of the exact same thing.
• 28:39
  SPEAKER_00: It is an incredibly powerful tool.
• 28:41
  SPEAKER_00: We just have to make the rules as we go, just like we did with cars and human beings did just fine.
• 28:47
  SPEAKER_00: And I think it'll be a very similar thing where the, you know, the risk factors, training, users, all of these different factors and ideas and thoughts end up coalescing into X number of years from now.
• 28:58
  SPEAKER_00: This is the way it goes and it's safe and it's usable.
• 29:00
  SPEAKER_00: People will do it irresponsibly.
• 29:02
  SPEAKER_00: They always do, like when you drive poorly and don't use your turn signal and whatever.
• 29:06
  SPEAKER_00: It'll that'll all be the same, but that's a human function.
• 29:08
  SPEAKER_00: That is not a function of the tool.
• 29:10
  SPEAKER_00: And so humans will continue to abuse things because they always will.
• 29:13
  SPEAKER_00: But there also are humans that are going to do wonderful things that I can't even imagine right now.
• 29:18
  SPEAKER_00: I mean, you can set a land speed record in a car in the salt flats in Salt Lake.
• 29:22
  SPEAKER_00: That is not something they thought of when they originally made cars.
• 29:24
  SPEAKER_00: Right.
• 29:24
  SPEAKER_03: When the Model T came out, that wasn't that wasn't the goal, right?
• 29:27
  SPEAKER_03: Yeah.
• 29:28
  SPEAKER_03: Exactly.
• 29:28
  SPEAKER_00: Same idea.
• 29:30
  SPEAKER_03: Yeah.
• 29:31
  SPEAKER_03: No, I I I agree.
• 29:32
  SPEAKER_03: And and like this thing is definitely evolving very, very quickly.
• 29:36
  SPEAKER_03: I'm I'm afraid it's evolving faster than I think we'll be able to keep up with those guardrails.
• 29:41
  SPEAKER_03: And that actually brings us to a to another topic I wanted to cover here.
• 29:45
  SPEAKER_03: It's like really it's on us.
• 29:46
  SPEAKER_03: It's on our individual, in our in our individual purview to put the guardrails in place, at least at an organizational level right now, to prevent the things from happening, right?
• 29:55
  SPEAKER_03: So that you don't have a uh a FERPA issue and and people don't lose intellectual property or they want to maintain like things that are truly privileged.
• 30:03
  SPEAKER_03: I'm I'm still a very private person.
• 30:05
  SPEAKER_03: I still have blinds on my windows.
• 30:06
  SPEAKER_03: Like, you know, like even though I'm not doing anything wrong in my house, I still like to close the curtains and be like, this is my private time, right?
• 30:13
  SPEAKER_03: And like there is an element of privacy that I think still exists, although more and more people are willing to trade their privacy for for benefit.
• 30:20
  SPEAKER_03: And we can talk about that in a completely different episode when you come back, Paul, because it's been amazing.
• 30:24
  SPEAKER_03: Um But like in this case, let me ask you, Paul, like, all right, our listeners just heard talked heard us talk about a ton of different things, all stems from this concept of DLP as related to this brand new threat vector of AI.
• 30:38
  SPEAKER_03: Like, what are the things we can do about it?
• 30:40
  SPEAKER_03: Like if people are solving for their organization, like what are some of the guardrails you could think about?
• 30:46
  SPEAKER_03: I have a couple ideas as well, like that'll help to prevent this type of a data leakage and allow you to control your network to make sure that you understand where your data is is flowing.
• 30:56
  SPEAKER_00: I think um two things, I think it's a twofold approach.
• 31:00
  SPEAKER_00: One is policy, whatever that looks like in different organizations.
• 31:03
  SPEAKER_00: We have school policy that mandates and dictates what AI usage looks like.
• 31:07
  SPEAKER_00: And we deliberately wrote it vague enough to adjust as AI does, but it's very clear on this is how it works.
• 31:13
  SPEAKER_00: We have um, and then functionally, we have filters in place to eliminate access to any AIs that uh we don't authorize, except the two that we authorize.
• 31:24
  SPEAKER_00: So, but that's only on the network when they're away from the network.
• 31:27
  SPEAKER_00: Every organization's a little different, so controls would change when they leave the network.
• 31:31
  SPEAKER_00: But on the network, we have policy in place to protect us legally and functionality in place to basically get them away from their habits at home to fo make them focus on this is the enterprise habits that we have.
• 31:43
  SPEAKER_00: And we we try to do user training, but the hardest part is for users to have the bandwidth to absorb new training and new ideas.
• 31:51
  SPEAKER_00: It's it's very challenging and we want to be sympathetic to everyone has a lot going on.
• 31:56
  SPEAKER_00: So policy and guardrails is how we do it in this organization, and it's been pretty effective so far.
• 32:01
  SPEAKER_00: We haven't had any data breaches, but back to your 3.2% that we know about.
• 32:06
  SPEAKER_03: Right, right.
• 32:07
  SPEAKER_03: Yeah.
• 32:08
  SPEAKER_03: And it's a risk.
• 32:10
  SPEAKER_03: I I wish I wish I could like right now show how smart I am and be like, well, here's the other things, but honestly, you nailed it.
• 32:16
  SPEAKER_03: Like the same exact things that you said are the things I would have said.
• 32:19
  SPEAKER_03: I would have talked about policy, I would have talked about training and people controls, I would have talked about technical controls.
• 32:23
  SPEAKER_03: Um, I think that's the key.
• 32:24
  SPEAKER_03: I think the only other thing I would add here is like people are clamoring for this, right?
• 32:29
  SPEAKER_03: And like I think organizations have to figure out a way that they can adopt these AI tools safely so you don't have to worry about people going to the rogue sites, right?
• 32:38
  SPEAKER_03: If you give people the tools they need and you can give them those tools in a controlled environment, well, now I don't have to go to Hugging Faced and download and access a model indirectly, or I don't have to go to AI router and start to access models through APIs that you that you don't know about.
• 32:53
  SPEAKER_03: Like I can I can use the tools that have been given to me in order to innovate, in order to make sure that I'm doing my stuff properly by doing my work properly.
• 33:01
  SPEAKER_03: Um, and I think that that really is it.
• 33:03
  SPEAKER_03: Like if we do that along with the stuff you talked about, blocking the things that are not approved, ensuring that you have proper coverage from an enforcement perspective and place from a policy perspective, training your people to make sure they're doing the right thing, ensuring that the standards support those policies.
• 33:16
  SPEAKER_03: Like I think in that case, like we have a well-rounded control and we can start to build those guardrails, at least at the organization level, until the rest of society catches up.
• 33:26
  SPEAKER_00: Well, I think you bring up a good point about the users are going to want to do it anyway.
• 33:29
  SPEAKER_00: And so it's a phrase that I use often.
• 33:30
  SPEAKER_00: I actually have it on my dry race board, you can't quite see it, is freedom in a box.
• 33:34
  SPEAKER_00: So as a person in a leadership role or a director role or whatever your organization is, you build the box.
• 33:40
  SPEAKER_00: Let them have freedom within it, but you know that the box keeps them safe, data safe, whatever the case is.
• 33:45
  SPEAKER_00: But I call it freedom in a box.
• 33:47
  SPEAKER_00: I build the box, do what you want in the box, go nuts.
• 33:51
  SPEAKER_03: Amazing.
• 33:52
  SPEAKER_03: Well, Paul, this has been an incredible episode.
• 33:55
  SPEAKER_03: I'd like to just wrap it with like, what's what's the last thing?
• 33:57
  SPEAKER_03: Like, what's your last kind of thought?
• 33:59
  SPEAKER_03: Like, what are you taking away from this episode?
• 34:01
  SPEAKER_03: Like, is there a new perspective you're leaving with, or is there something you want people that are listening to leave with?
• 34:06
  SPEAKER_00: I think what I'm taking away from this is that I'm not the only one with a positive perspective on the potential with this.
• 34:13
  SPEAKER_00: That I I I appreciate that, you know, you and I'm sure some of the listeners, there are positive aspects to this.
• 34:19
  SPEAKER_00: And, you know, the the vibe of the industry is very, very negative and doom and gloom, especially in cybersecurity, but there's enormous potential.
• 34:28
  SPEAKER_00: And it's okay that we don't know what the potential is.
• 34:31
  SPEAKER_00: We just know that it's there.
• 34:32
  SPEAKER_00: And that's really amazing.
• 34:34
  SPEAKER_03: I agree.
• 34:35
  SPEAKER_03: I've I've come away with the fact that anyone named Paul is gonna have a positive outlook and that's it.
• 34:40
  SPEAKER_03: Started with you though.
• 34:41
  SPEAKER_03: You're the OG, starting with you.
• 34:44
  SPEAKER_03: I think, I think it's that.
• 34:45
  SPEAKER_03: I think the other thing that like really hit me, like my my real perspective here from this episode is like we love to look at like percentages.
• 34:55
  SPEAKER_03: We love to look at these statistics.
• 34:56
  SPEAKER_03: I mean, heck, our entire show is is literally built around like perspectives around these different statistics.
• 35:03
  SPEAKER_03: But the thing is, like, these statistics can be dangerous and they can be misleading.
• 35:07
  SPEAKER_03: Like, I truly think that from a visibility perspective, this number is significantly higher, but this is just what happened to be reported, right?
• 35:15
  SPEAKER_03: And I think that like what what my perspective here is like these are great.
• 35:19
  SPEAKER_03: Information is uh is incredible to help you understand what the risks are, what the threats are.
• 35:23
  SPEAKER_03: Like, how do you how do you kind of wrap your head around what you need to control and how you protect it?
• 35:28
  SPEAKER_03: But it's always about independent verification.
• 35:31
  SPEAKER_03: You can have an organization that might have 1% of this, and you might have another one that'll have 72% because I just don't have good enough controls, and it's gonna vary wildly organization to organization.
• 35:40
  SPEAKER_03: But at the end of the day, it's about making sure that we are cutting the data at our individual organizations so we truly understand what our threats are.
• 35:48
  SPEAKER_00: I agree.
• 35:48
  SPEAKER_00: I agree with that.
• 35:49
  SPEAKER_00: All that was really well said.
• 35:51
  SPEAKER_03: Well done.
• 35:51
  SPEAKER_03: Well, there you go.
• 35:52
  SPEAKER_03: Well, listen, Paul, thank you so much.
• 35:54
  SPEAKER_03: I really appreciate the time.
• 35:56
  SPEAKER_03: This half hour has flown by.
• 35:58
  SPEAKER_03: I feel like we can probably do another three or four hours long for him.
• 36:00
  SPEAKER_00: But I was hoping for more cards.
• 36:02
  SPEAKER_00: I was hoping.
• 36:03
  SPEAKER_03: We'll save that for next time.
• 36:05
  SPEAKER_03: Um, listen, appreciate the time, listeners.
• 36:08
  SPEAKER_03: Thank you so much.
• 36:09
  SPEAKER_03: Really appreciate it.
• 36:10
  SPEAKER_03: Be well, stay safe, and we'll talk to y'all soon.