Fighting Cybercrime With Global Intelligence | Will Dixon

That's AI think that's one of those things that follows you around, at least here in the US, folks that you know, worked at CIA or NSAGCHQS, you know, counterpart here. That's I think that's the same thing. Either they introduce themselves that way or other people do like, oh, have you met, you know, John? He worked at NSA like 27 years ago for 18 months. But that's the the one thing you know. Well, it's incredibly, it's now that I look back at it, it was an incredibly privileged position to be in, actually incredibly proud that, you know, I, I was able to work in such a, such an establishment, you know, really elite, hard working, dedicated professionals. And I found myself incredibly fortunate, which was I was part of the maybe younger cohorts that were really part of the frontier of kind of analysis in operations where when the government was really trying to grip, get a grip of what does the Internet mean for us from a national security perspective. And really we saw when I was

there, we saw a transformation in espionage, we saw a transformation in sabotage, we saw a transformation in online subversion. But of course, the thing that really gripped me and I enjoyed immensely working on was the the transformation that we saw in crime and in particular organised Russian and Eastern European cybercrime. And and while I was there, it went from a relatively niche topic, really specialized small team to actually being one of the most dominant threats that the government looked at. And in in part, my career was pulled up because of that and pulled through that. I think at least here in the USA, lot of people think of the anti cybercrime efforts as a law enforcement effort. But, you know, Intel agencies also focus on those groups quite a lot because in a lot of cases, especially in Russia, North Korea, they're closely aligned with government, you know, cyber espionage efforts.

So what was it like being on the Intel side of that as opposed to, you know, like law enforcement in terms of like tracking those groups and what you were trying to accomplish? Yeah. So it's a really important nuance which is in the US you're say the the equivalent of GCHQNSA actually reports into the DoD or the Department of War now. So it actually carries like a traditional defence mission. Well, actually in the UK it reported to the Foreign Office. So we were actually responsible for tracking and disrupting overseas threats.

I think for even for GCHQ, serious organised crime was a was always something that they'd done as part of their mission. But of course it, it wasn't the core part of their mission. Intelligence agencies are always much more focused on strategic threats. What I would, what I would say was the Internet and the use of Internet technologies was transforming this crime landscape so quickly. It required the intelligence agencies to help law enforcement to understand the threat and build the capabilities.

And actually what you found was what was classified or signals intelligence style capabilities actually needed to be mainstreamed into law enforcement. And, and what you found and what we still have found is many of the capabilities that were in the intelligence agencies actually transposed themselves into, into the private sector. And actually, and now there's organisations like Intel 471, but even big of cyber crimes like crowd Strike and you know, Palo Alto Networks in many ways they're large, you know, they, they are big signals intelligence organisations, huge data collections, lots of telemetry, lots of signals and you know, ingestion of large, large parts of the Internet to be able to track threat actors. So when I, when I think about cybercrime even now, and I see a crowd strike or a Palo Alto or a Microsoft, you know, they were, you know that in many ways they

are private intelligence agencies. Oh yeah. Investigations into cybercrime and I still think of it as a signal problem. Yeah. I think especially here in the US, there was a time period where those private intelligence organizations you just described were, I would say ahead of our public law enforcement agencies in terms of capabilities and just general understanding of the problem set and the threat landscape. You know, I'm probably around the time that you were in, you know, 10-15 ish years ago.

I think that's, that's changed now, you know, that our FBI and other agencies have very capable, you know, cyber intelligence units and that sort of thing, anti cybercrime units. But I don't know. I'd love to get your thoughts on like what's the cooperation level like in the UK from the private and public sector? It's it runs hot and cold here. You know, a lot of times you'll, you'll, you'll hear, you know, somebody in our government talk about the importance of this public private partnership, intelligence sharing, all that kind of thing. And then like that'll, that'll be really important for six months and then it's not important anymore. And it, and it kind of goes back and forth. What's it What's it like on your side of things? Yes.

Well, I think in the UK you've got to see it in the long term, which was when I see this, when I see it on a trajectory over 10 years where it was essentially A niche secret stay, very specialised law enforcement, kind of like threat actually the public private partnerships, even though that you're right, which they can dial up and dial down actually there's been a huge transformation. There's a huge recognition that the private sector often has not only the capabilities to detect but more importantly has the capabilities to remediate the threats. I think, I think most jurisdictions have realised that in particular for cybercrime because it emanates largely from difficult to reach jurisdictions, principally Russia actually engagement with the private sector to provide the kind of like mediation and mitigation of the threat central to all our strategies.

Actually in the UK, we also, I'm a fellow at the think tank, the Royal United Services Institute, which is obviously a defence and security think tank. And we did a lot of research into what they call deputising, which is where government and law enforcement actively deputise private sector actors and entities to be able to act on their behalf. So the large scale bottleneck takedowns and even the modern ones of OP end game that you that you read about that kind of actually this like very integrated operating model and really cyber cyber's really pioneered that.

What was interesting actually seeing the cyber strategy that came out of the White House last week was that, you know, we might be seeing a even evolution of more, more private sector kind of like deputisation. And I think it asks a lot of questions about where where public private partnerships might be moving under that strategy. That is one of the most controversial, you know, questions and ideas here in the US that that thought of giving private operators the ability to go and do, you know, however you want to term it, offensive operations or that sort of thing. There's been a bunch of different proposals and iterations of that idea over, I mean, the course of my 25 years doing this, there's been a bunch of those. I think that none of them have really figured out a way to to make it workable without things going off the rails. You know, without like.

Unintended consequences. Yeah. I, I, I don't know how that would work if you're, you know, essentially not. It wouldn't be deputizing here, but it would be like authorizing, you know, like the analogy that's always used is like the letters of Mark for, you know, privateers, kids, go look that up on the Internet. But that sort of idea of like the government is granting you the limited powers to do this for a limited amount of time for specific tasks. Essentially, go do this for us.

Thank you very much. That power's now gone. Has that been like useful and effective in in your experience? It is a controversial topic, not least because America's actually been sanctioned overseas entities. So obviously America sanctioned a number of Israeli entities like NSA group that were actively compromising American technology providers to provide CNA and CNA capability.

I think, I think the broader question is, are we saying as a community that the threat and risk of cyber has now moved outside of acceptable norms of behaviour, that we now need to change our doctrine so radically? And I'm, I'm not sure I, I, I agree with that, which is I broadly think if you think in the long term, actually both the US and the UK and most technologically advanced countries have built national cyber agencies, they've built and encouraged an ecosystem to provide cyber resilience.

Yes, it's a contested space. Yes, there are incidents, but to the point where the government would give license for computer network exploitation, computer network attack against overseas adversaries, the unintended consequences and downstream risks of that, I'm not sure the kind of, I'm not sure I'm, I haven't seen the argument that we're outside that risk appetite yet. Yeah, I think that's the key point right there is the risk appetite and what, you know, what the potential blowback in unintended consequences would be. I'm sure that there are all kinds of models that have been built out in, gamified this in a million different ways at think tanks all over the Beltway and all over Europe too. But you can.

You never know until it actually goes into, you know, until you kick the ball out there and see what happens. Ultimately, certain powers, even if they're, even if the actions are carried out by private sector actors, ultimately certain capabilities, I think should remain within the state and only the state or at least supervised by the state, because how else are you going to provide the requisite governance of those capabilities? Yeah, I think about this a lot in as it relates to ransomware actors, because a lot of those, you know, private sector intelligence organizations, the folks that track, you know, specific ransomware groups, that's their entire job. They know where those guys are.

They they know their names. They know where they live, they know where they vacation. They know what cars they drive. They have pictures of all of them. And, you know, I've heard lots of discussions in, you know, bars and hallways at conferences and things like that of these guys being like, if they would just turn us loose, we would, you know, we could get these guys rounded up real quick. You know, it sounds nice, but I feel like, you know, who knows what could happen if you go down that road?

Yeah. And in international relations, obviously we as a community think that cyber is the most important thing. Actually transnational. Transnational crime is always a relatively in international relations is, is typically a secondary or a tertiary issue of international cooperation. And in essence, those discussions are about our inability to engage Russia because of the political and economic blockages that we have.

And we need to remember that, you know, we're supposed to be the good guys. And actually we as a we as a government and as a state say, well, actually we're not going to engage you on these other issues because we fundamentally don't believe in what you're doing on XY and Z in relation to armed conflict, etcetera. And if we as a community, as a cyber community, as some of the downstream, downstream consequences of that, we have to think more creatively about resilience. That's a balance I think you have to make as a, you know, as a society, right?

Yeah, it's, it's so difficult because you know, there, there are all of those international, you know, contingencies and and you know, sensitivities that you have to deal with. But cybercrime is such a large transnational problem, as you mentioned. Now it, you know, even 15 years ago it was an issue, but it wasn't one of the two or three largest issues on the global stage. You know, it was nowhere near the top of that list.

Now it's like terrorism and cybercrime, you know, it's right there because you the consequences like the money that cybercrime is pulling out of global economies is, you know, unknowable. But it's a huge number. And the ransomware part of it where, you know, here in the US, there are hospitals, school districts, government agencies, you know, veteran support groups, all kinds of things that you would think might be off limits that have been ransom wired six ways to Sunday so. And I think that's that's what you can see that the kind of like the Trump strategy is kind of like, is the government trying to get to grips with this, which is OK. We've tried to arrest them.

We've tried to investigate them, tried to sanction them. Actually, there's kind of like the in particular ransomware against public services and hospitals, like it's generating such an issue. What are the alternatives that we can do to try and deter that type of activity? But I don't think the debate's the same in Europe. I would say I don't think that debate, that aggressive debate is the same, not least because I think the US has a disproportionate amount of the attacks and incidents. I. Think you see that in the, in the threat metrics as well. And some of this is just actually like just a manifestation of say like your healthcare system, which is much more distributed than you get in Europe, where actually there's just one provider in the UK and like a couple of smaller private sector partners.

But, you know, in the US, you might have, you know, thousands of healthcare providers in separate hospitals, which means that the ransomware issue in particular has been has been much more aggressive. Very much so, yeah. It's yeah, the healthcare system here, I mean, it started, I would say a little before the COVID pandemic, but even during that, you know, hospitals were being hit and small healthcare providers, things like that. I mean, was I think the National Health agency in the UK was hit to some degree.

But yeah, I think you're right. The, the large portion of those attacks tend to hit the US or, you know, Western nations and they haven't been as bad in Europe and certainly not in Eastern Europe where essentially the Russian government is, you know, taking a hands off approach as long as you're not hitting Russian targets. Absolutely. We don't care, you know. And in part as well part of that is the governance of them, which is most of the large healthcare providers in certainly in the UK. The governance and the corporate governance of them is from the public sector, which means that payment of ransomware, for example, is much more a difficult issue.

So it's much more difficult for a government. Well, actually in the UK it's just not possible. I mean like the guidance is quite clear now from the UK in relation to payment of ransomware and same in Australia which has got a National Health Service. But obviously these are private sector entities in the US. So, you know, the actual ransomware that's available in the US jurisdictions exponentially larger. Yeah. I mean, the guidance here from the FBI is we'd rather you not pay the ransom, but every day there's, you know, millions and millions of dollars being paid to ransomware gangs because businesses need to keep operating and, you know, they need to get back online.

Depending on, you know, there have been many examples of businesses being completely, you know, bankrupted or taken, taken out of the market by ransomware, you know, small businesses and things like that. So, you know, it's a, it's a massive problem. I don't, I don't know what the answer to ransomware is. A lot of smarter people than me are trying to figure it out, but it's, you know, it's not one that's going to be solved by, you know, 1 country or one agency, I don't think. You do see Australia has been the first to move to for for banning payments.

Yeah, UK hasn't moved as quickly, but they're certainly wanting to register all ransomware payments. And you can see, you can see certain jurisdictions trying to at least regulate this kind of like, you know, this, this space and Intel 471. Have we seen downstream consequences that we we think we are actually, and it's one of the threat predictions that we made, which is actually in certain jurisdictions where the the regulation is moving and the governance is moving, we do see some behavioural change.

With the companies not paying ransoms and not, you know, falling victim as much and that's moving some other, you know, you definitely see chatter from the ransomware gangs about the the potential fallout and how they should how they should react to that, which is why you're seeing much more in particular, you see much more aggressive core services being integrated into their operating systems. Like, you know, a pressure tactics because there is much more of a debate and like there's much more legal guidance. And actually, some companies really are weighing up the pros and cons of paying the ransom.

One, because, you know, part of it is like people have invested in better resilience. The other part is definitely the regulation and the oversight of ransomware payments, making companies think differently about it. And you're seeing the the ransomware gangs react to that. Yeah, that's a great point. I'm glad you brought that up. I, I wanted to ask you about this. So, you know, one of the main things that you hear from law enforcement and security researchers in regards to ransomware is we need to go and mess with their money. We have to disrupt the payment infrastructure.

And you know, the Department of Justice here and other overseas agencies have been trying to do that for many years, you know, with taking down various cryptocurrency exchanges and these mixing services and all of that sort of stuff. And it, it's definitely had some effect, but I'd love to hear more about like, how are you seeing the ransomware groups actually change their tactics? The the aggressive, like, you know, follow up phone calls from there, which you know, is a funny thing to think about. But those if you, I'm sure you have, if you hear a recording of one of those calls, those things are terrifying. They're, I mean, they are the things you see in movies of, you know, threat actors calling you up, threatening your family, we know where you live, threatening your business, all of that kind of stuff.

Yeah, it's interesting. So when you've been in this like like yourself, then it's like, you know, for 2025 years, you see that often it's the same crime gangs, Constance, it's the same individuals consistently evolving their tactics with the same financial gain. So really ransomware was ransomware was a like you said, the critical thing from ransomware is it took away from banking Trojan gangs that the fact that they needed money mulling networks that were very much in the crosshairs of law enforcement investigations and were a critical risk and took large portions of their illicit gains. So you actually saw like, you know, the older, you know, dried X gangs and trick gangs, they moved into ransomware and that became lock bit and but actually they were the same individuals, you know, the evil Cork grounds, you know, obviously the the famous ones.

But broadly cryptocurrency was revolutionary to cybercrime because it it took out that vulnerable layer, which was crypt, which was the financial payments. And you're right that law enforcement have tried to have tried to crack down on that, but there's many ways to get round that. And you know, the ecosystem, cybercrime ecosystem is incredibly resilient. One of the predictions that we did make though on this is as ransom went, so one, they're more aggressive. So once they have once they have a potential ransom, they're much more aggressive. The calling services are a great example of that. But we've also seen some of the ransomware gangs move into much more traditional areas like card not payment fraud. So actually moving away from ransomware, actually going into kind of like classic cybercrime, you know, which maybe hasn't been invested in as much from a investigation or a controls perspective.

And you actually see these kind of secondary and tertiary fraud types kind of like, you know, still be relatively lucrative without the risk profile and without some of the the scrutiny of law enforcement. I've been outside of law enforcement activity until I came back to until 471. And actually I think that I think OP end game, which was the successor to OP clean Slate, you know, actually you see the the law enforcement activity is aggressive, the botnet takedowns now is aggressive. You see seizures consistently month by month. Ramp was taken down just a month ago, you know, a major cybercrime forum.

And it absolutely does have an impact on the operating model of the cybercriminals. And it does so distrust between these key gangs and these key groups. And without the ability to arrest them, you know, that's in many ways that's the game you're in. Yeah, that's the hard part as you mentioned, because there's so many of these groups operate from Russia or you know, I guess China to a lesser degree, but Russia and North Korea like those, we're not unless those people make a mistake in vacation in the wrong spot, they're not.

We're not getting them for the most part, unless, unless the Russian government has an incentive to turn those groups over, which I can't remember the name of the group they did that. I don't know. It was probably 5 or 6 years ago. There was some limited. Yeah, yeah. The meeting happened here in Geneva between Joe Biden and Vladimir Putin. They actually met in the park, and they discussed about one of the major ransomware gangs. And, you know, there was a downturn in activity after that. But of course, then, then they invaded Ukraine and you know. The ability to.

Operate on that is, you know, I felt what was interesting was certainly from a GCHQ perspective all that time ago is the use of cybercrime gangs by Russia in the Ukraine war did show that level of integration between the state and and cybercrime network. So Dana Bot's a good example of that, where they were using large DDoS services, there was exfiltration, there was an initial access given into Ukrainian networks by cybercrime gangs.

It it shows a level of cooperation that I don't think we quite understood before the war. Yeah. And and I think that, you know, I know some of the folks that have been focused on Ukrainian cybersecurity for quite a long time. And when that invasion happened, the first thing they said was we're about to see some really seamless cooperation between these cybercrime groups and the Russian government because those cybercrime groups are pre positioned in the Ukrainian networks and can just hand off that initial access to their, you know, partners in the government.

And, you know, we saw blackouts. We've seen all kinds of stuff in, you know, in the course of that war and, you know, to bring it to current events. We're seeing some of that right now with the Iranian US conflicts. There was a medical device company here in the US that was hit, yeah, very badly this this week as we're speaking there. There's been, you know, limited other things, but it I'd love to hear your perspective, what, you know, what you would expect to see. We haven't seen it as much as honestly, I thought we might at this point.

But we know very well here in the US that Iranian threat actors are pre positioned in the US networks as well. They've had more than enough time to get ready for something like this. Yeah. So when I was in government and when like at Bruce, one of the, one of the big strategic questions we always asked was how does cyber play into conflict And kind of like conflict. And what we've seen is I'm going to make a big prediction, big statement, I think on the podcast, which is largely the West is winning that cyber war, which is yes, there is activity. Yes, it's important.

And yes, for companies like Stryker, it's devastating, but it's strategically not significant, you know, So from a strategic perspective, the cyber activity that we see is nuisance. It's not decisive like kinetic strikes. Actually that's, that's not to downplay that this is a contested battle space. But what from where we were 10-15 years ago, where we fought, we used to talk about actually the CIA director put out very famous paper which was, you know, called Cyber Pearl Harbour, which is when Cyber first emerged.

We really thought it was going to be a devastating kind of like weapon which was able to produce strategically decisive effects. We haven't seen that in Ukraine and Russia. We've seen things that are largely integrated into kind of like espionage intelligence gathering to help frontline forces. We have seen APT activity from an espionage perspective. That's obviously important. But we we've not seen this kind of like integrated effect disrupting CNI. Now I know STRIKE is an important company, but what we haven't seen from the Iranians is their ability to say transpose that capability, say into a government department. You know, it'd be much more meaningful if they were, you know, doing wiper attacks against say the FBI networks or the of war networks, etcetera.

So Iran's quite an interesting case study because I'd like to contrast it with Venezuela. Now when America went into Venezuela to pick up Maduro, there was quite a lot of reports that actually Cybercom had been quite tactically useful in being able to impact the air defence systems and the electric network associated with defending Caracas. So if you compare and contrast, actually America is showing defy decisive cyber power from a kinetic perspective.

And the Iranians, yes, we are seeing hacktivism. We are seeing attacks like we do with Striker. The Russians are incredibly aggressive as well from a hacktivist in A and we see a lot of evolving it there. But arguably, I might say that if you were telling me who's winning the cyber war from a strategic perspective, actually America takes some beating, I would say. I would, you know, the, the Venezuela example I think is a good one because from the outside those are the kind of operations that I would expect from US offensive cyber assets preparing the, you know, the battle space for lack of a better term. We're going to disable certain specific strategic assets in that area to make life easier for the guys that are going in. Yes, I'm sure there's stuff like that going on in this current conflict as well.

But I wonder how much of, I don't know, restraint isn't the right word, but how much of like the lack of big operations we've seen so far is the understanding that both of both of our, you know, our, the US and Iran and I guess Israel as well. Everyone understands that we all have these capabilities. And if one of us really pulls the trigger on, you know, say turns the lights out or does something really out of hand, the other, the other team can do the same thing.

Yeah, I think I think that's fair. And the thing that most people in this kind of like discussion don't understand and you know, if you've come from government is the question of assurance. So actually, I that's which is if you're integrating this into kinetic effects as a military commander, when you say you're going to do something that commander wants you to, wants to know that it's going to do exactly what you said it's going to do, right? And it's not going to switch back on.

Well, actually in cyber, that's incredibly difficult, right? You know, like it's, it's not the same level of assurance that you get, say, from a kinetic strike. Right. Bombs do what bombs do you know? Yeah. Well, it's still a kind of like in many ways like as a capability for those kind of very high end effects. It's actually a level of assurance and maybe a level of interdependency that it's still, you know, like a developing field. I'd also say the difference probably between Venezuela and Iran was Venezuela was clearly AUS LED operation, very long term planning, which meant that it was only the USI think obviously the partnership integration, the Israel kind of like, you know, it does feel like Israel may be acted and kind of like forced America to act maybe kind of quicker than he was expected might have meant that maybe some of the cyber impact and the offensive cyber operations maybe couldn't have been deployed like they were in Venezuela allegedly.

Obviously we've never had too many reports and they've come out except the the, the some statements about Venezuela. But when I think about Iran and I think about my old job, I think about it in this strategic macro context, which is, yes, we see important things happening. Yes, it's a evolving and difficult threat landscape. And you know, there is hack to this activity. There are things like striker, but really from where we thought we might be in defending our cyberspace when originally this emerged as a capability.

Actually, arguably, companies are quite. Resilient. Yeah, it's funny, you know, if you if you look at some of the like movies and TV shows from, you know, 2025 years ago that were like, you know, wars are not going to be fought on the battlefield anymore. They're just going to be fought on computer networks and all that kind of thing. All these, you know, goofy plot lines. And that just, you know, that hasn't come to pass for a variety of reasons. But the assurance part of it that you mentioned I think is really important will because like, yeah, I mean, the US and the UK and Israel are really good at these cyber operations.

But if you think about something like Stuxnet, which was allegedly AUS Israel cooperative effort, that took years and years and years of planning. Specific effects as well. Right, Yes. And, you know, had somebody patched a machine somewhere along the way, it wouldn't have worked. You know, there were a million contingencies. So yeah, computers do weird shit all the time, and you never know what's going to happen. So, like, assurance is not assured. Yeah. Yeah. So I think this is a great doing something is possible.

And what you're seeing from the Iranians is can we do something against like American networks and they are doing something which is, you know, for Striker, it's devastating. That is a major attack. You know, like it's the like the virus that's essentially shut down that that company. We're doing something as opposed to do something with very high assurance to an integrated military operation. I think it's a very different set of capabilities. And of course, what we haven't said in is that actually the Iranians were so capable from a cyber perspective, one of the very earliest strikes in the war was actually the Israeli cyber command was of course blown up and kind of like was struck multiple times. And so actually there's been a kinetic impact against their kind of ability to command and control given the the large casualties actually that that have been reported from their cyber HQ.

What we have seen as well, which is very interesting is we do see coordination which with the Russian groups that we know are affiliated with the state as well. So Iran, Russian, we call it muddy water, you know, like this kind of like combination of these two threat actors coming together is a very, very interesting development, I think in the in the landscape. Yeah, I do too. I was having a conversation yesterday with one of my friends who is following the conflict very closely but doesn't, you know, isn't as like, deep into the cyber security world as I am. And he was surprised by Iran's capabilities. He was like, I didn't know that they were, you know, on this level.

And. Yeah, Yeah, unfortunately, yes, they are. They're, you know, in that sort of top tier of. Yep, Yeah. And not, not don't have a lot of discretion in who they hit, you know, with the those operations, so. Exactly like they've, they've clearly been shown, which is like the, I think the striker, the striker case is an example where their mission and their objective is so distrust.

So kind of like harm the US, harm their kind of infrastructure, harm their businesses. It's kind of like if you're an American company or an allied company now, like it's a, it's a serious risk and threat, which is it's opportunistic. Yeah. Is the is the way to think about it, which is you've got a very capable threat actor who's been given a wide target set with a broad objective and can be quite opportunistic in their targeting. No question. I mean the yeah, there's plenty of other, you know, economic targets in the US that that can be taken down.

And, you know, unfortunately I think those that's the way things are going, at least so far from what we've seen. And, you know, you would know better than I would, but that that's the kind of thing that I have expected to see is those kind of targeted opportunistic, economic, you know, attacks like that. And I think we're, you know, for, for the fret landscape, I think broadly, I think broadly most people agree that there's going to be no short term ceasefire and no short term agreements. I think we need to anticipate that these types of attacks and types of targeting might go on for, you know, months.

I wonder from, you know, given your background, do you have you seen or would you expect to see any ripple effects outside of, you know, the US, Iran, Israeli sort of threat landscape, other threat actors taking advantage of what's going on, kind of the chaos of, you know, of the current situation? So I think always in this space is the Russian, the Russian groups and the Russian activist groups. What we find is with the Russian groups highly capable.

I'd say one of the key things that we've seen in the threat landscape is what used to be a broadly disparate group of hacktivists that were clearly civilian. They're clearly controlled now by the state. And what you find is that they're often, they're often probing in Europe, they're very aggressive in Europe. And while, and while certain jurisdictions will be very focused on Iranian activity, actually we've seen a lot of the hacktivist groups, the Russian hacktivist groups known in 57 for example, they've become very adept at trying to target OT and SCADA and ICS systems. So that's that's another major kind of like threat development that we've been seeing this crossover between hacktivist slash nation state activity.

Yeah. And the the OT and skater part of it is I think a very concerning part because those networks are really fragile. You know they a lot of times the infrastructure is pretty old and can't really be updated and needs like hands on support like literal somebody. You know. Like going out into a gas field and like programming some stuff like, yeah, like PLC, yeah. It's, I, I have a lot of sympathy and empathy for the, for the security teams and the, and the, you know, chief technology officers, chief security officers of, of the major, kind of like ICS users for sure.

Yeah, that that does not seem like a fun job at all. No. And then if you were thinking about it, when I mean, we talked about like my background, say at Barclays, you know, like, you know, think about I was at Barclays 10 years ago at the fallout with JP Morgan, which was one of the very, very first big breaches, you know, the financial services industry, which was the primary target of cyber crime gangs, you know, 10 years ago. They put huge investment into kind of like cyber resilience. They spend hundreds of millions of dollars, if not billions in, you know, some of the systemically important banks and actually the cybercrime actors did move down into that other tier. And actually, you know, the manufacturing and the engineering companies, the oil, the gas, that lower tier of less protected, more complex networks became much more wide open. You know, I remember when I was at Barclays it, you know, it would have taken a lot to compromise. But you know, like you know some of the big financial services banks compared to targeting some

of these other kind of less defended spaces. Yeah, you once those bigger fish get their defenses in order, then you they have to move back down the supply chain, you know, maybe one of their software suppliers or yeah, manufacturer that they do business with or, you know, one of their business partners or things like that. But yeah, banks are where the money are, but money is. But there's lots of other ways to get to that money before it gets to the bank. You don't have to. You don't have to mess with the bank itself. You know, they've got all the money in the world to defend themselves.

So yeah, you're better off with the smaller fish it seems like. Yeah, for sure. Yeah, that's true. But yeah, it's a very fascinating landscape. And I, I think in particular what we're finding is that geopolitics, you know, geopolitics is really driving a lot of the decision making in the front landscape. It's, and I think in, I think for cyber, for cyber professionals, don't just think of it from a threat landscape perspective. I think a couple of key things, which is the geopolitical environment that you're seeing now is actually driving a lot of economic decision making.

Inflation's on the rise, Interest rates may stay high. That has a massive downstream impact on cyber budgets because, you know, when interest rates go high because of geopolitical conflict and there's trade wars, ultimately cyber budgets are seen as discretionary spend. We get impacted, you know, if you're ever going to ask a see, so who's the biggest decision maker on their cyber program is inevitably their chief financial officer. So we might see downstream impact as we see, you know, oil going up to $100 a barrel.

As we start seeing the Straits of Hormuz close, the downstream economic impact of these things inevitably has an impact on cyber practitioners because we are not immune to these big macro trends. Yeah, I think we love to think of ourselves as just like focused on this one area and we do our thing and, you know, go home at night. But, yeah, there's a much broader world out there that does have downstream effects on on the work that everybody in this industry does. Yeah, Yeah.

Yeah. All right. Well, well, thanks so much for your time, man. I really appreciate this. This is a lot of fun. And it was, it was really informative. So, you know, hopefully we'll get a chance to talk again soon. Thank you very much, Dennis. Really appreciate it. Thank you for having me. You're more than welcome. Take care.