From CIA Officer to a Career in Cybersecurity With Erin Whitmore

So wow, it was quite a very interesting journey to end up where I am. You don't see a lot of former CIA case officers very entrenched in cybersecurity. There are few, but normally that's a little bit more of the traditional security side versus the cybersecurity side. Not unheard of. We'll run into former Nsaers all over the place, right? Not as many agency folks now. Not, not true on the computer operations side, but from the Directorate of Operations, there aren't too many of us that specialize in cybersecurity. And how I got there is sort of a really interesting story. It was very serendipitous.

First, first and foremost, I'm third generation service to my country. My grandfather served in World War 2 and then he went on to serve in Korea and then his last major campaign was in Vietnam. He was one of the, he was a civil engineer. He was in E8, so very senior enlisted, had made a huge career out of the military. As I said, I mean, went in to serve in World War 2 and he was Jewish. So that was really quite something at the time. Went to serve in World War 2 right out of high school. He was a civil engineer, so we had expertise and he was part of MAG Laos, which was one of the first, essentially the first Green Berets that existed at the time, right? And at that time they weren't.

They were special operations, but very much prized for their expertise. He was unfortunately killed in 1962 on an Air America flight, which is very ironic as I went on to serve in the agency and Air America's and now declassified covert operation that the agency ran with with the military. And his what he was doing at that time was as a civil engineer. He was on Air America flights to canvas the Vietcong infrastructure. Of course, 1962 is technically ahead of the declaration of war and so he is on the 1st panel of the Vietnam Wall. My father, and that was on my mother's side. My father is a retired chief foreign officer. He was a black UH-60EH60 Black Hawk pilot, served three tours in Iraq between the Gulf War and the Iraq War, served in Central and South America, Sinai, Somalia, served in Bosnia. Actually, his tour in Bosnia is what set me on my path to what I ended up doing in 1999.

He handed me, he was going to Bosnia as part of Stabilization Forces, Bosnia S4, and was doing operations to continue to keep Bosnia intact following the conflict in the former Yugoslavia, right? That's where we know about the genocide that occurred in Slobodan Milosevic and all of that. And he handed me a book called Zlata's Diary. And Zlata's Diary is the story of a young girl who lived through the surge of the siege of Sarajevo. Now, I've been to Sarajevo, Bosnia's my favorite country in the entire world, and I've been to quite a few, but I say that very one very honorably.

It's a beautiful country, and it is. It's some of the most natural beauty I've ever seen. But it has a very obviously immense history in the world, right? You can stand on the corner right by the Miliaca, the river that runs through Sarajevo, and see where Arch, you know, Archduke Franz Ferdinand was shot and a World War, World War One began, right? So Sarajevo has this very interesting play in all of world history. But my dad handed me this book and I read it and he said I was only nine years old. And he said, I want you to understand why I have to be gone so that I can go help a little girl, you know, and other little girls just like you. So I read that.

And after that, I think I was just with that family history and everything. I was fascinated by international relations and by basically just international diplomacy, you name it. So I went to college, studied political science. At the time, my dad had just completed his last tour in Iraq and retired as a pilot, retired in 2004. So he retired right as I was getting ready to go to college. So I went, studied poli sci, studied abroad in Switzerland a little bit, spent some time at the UN studying international relations and thought for sure I was going to go to law school and I was going, I wanted to get into international humanitarian law or law of armed conflict.

And that was what I wanted to do with my life. Well, at that point, you know, I didn't really have quite the same purview into intelligence operations, but I thought this is, you know, I, I think international armed, international humanitarian law will be a, a great place for me. It's international diplomacy, you name it. Sure, right. So, you know, it's kind of funny how life works out. I had the distinct pleasure of graduating in 2009 into the global reception. There were no jobs. There were zero jobs.

Like, everybody was like, cool, I'll give you an internship. It's unpaid. You work for free. You have to foot all your bills. And I was like, yeah, that's not going to work. So and then everybody who who was laid off with five to 10 years of experience went to guess what, law school to wait out the recession. So I thought, OK, well, I better get creative here. So I ended up applying to an AmeriCorps program called Public Allies where I went to go serve in Baltimore City and I worked in Baltimore City high schools. And I will tell you that that is probably the single anything I've done in my career.

I think it was the single most educating thing that I did because it exposed me to so much, right? So I was working in Baltimore City high schools in underrepresented communities and I just, I learned a lot during that time and a lot about service, right? And more so, not just military service, not just service to your country, but service to your community. And it was after, it was during my time there that I ended up being exposed to a lot of people that worked in the intelligence community, many of them at Fort Meade. Well, it was also at that time that I learned what ACI case officer was. And I thought, well, that's probably exactly what I should do as an Army brat that's moved everywhere and has done all these things.

So I thought, let me go and try to apply. Well, they were still hiring, but it was highly competitive because of the recession. So I didn't get in the first time. But, and that's, that is common. And I say this, you know, for anybody who's out there who might get rejected, if that's your dream, keep going for it because you just never know. Sometimes, you know, you've got to go. You've got to make yourself a stronger candidate and reapply. And that's what I did. So I applied first. I did not get in, but I did find my way and hustled my way into the intelligence community.

I first started supporting DIA where I took a position, just an entry level position that got my foot in the door and got me a security clearance. And after that I rolled from DIA to supporting NGA. And then I, this is obviously during the middle of sequestration at the same time. So at that time I was a contractor and contracts were getting cut left and right. So I ended up going through through three contract cuts in 2 1/2 months. So that's basically getting terminated 3 times.

And I was like all of like 2324. So I didn't. I was just rolling with like this. Real world stuff sucks. I was like, this is I'm really tired of being an elder millennial right now because we see, you know, that 2008 to 2012 time frame, just that was a rough time. So yeah, tough times. So anyway, but you know what it taught me? It taught me resilience and it taught me hustle, right? I had a little bit of that growing up the way I did, but it taught me real resilience. So I was out there hustling.

It ended up I ended up applying to a position I, Full disclosure, I probably should have got because I had no qualifications. I had no cybersecurity expertise at this time. I was just straight up. I had been supporting counterintelligence. I had been supporting NTA. I did not have any pure cybersecurity expertise, but I had the right experience at the right time and I could write right, and that tells you something. Being able to write and communicate sometimes is an invaluable skill. That's so true. Oh my God, yeah. Right. So, yeah, so I ended up, I ended up applying to this role and I was in the building and everything else. And so I got hired and it was life changing for me because I was hired into the Director of National Intelligences, National Cyber Center, the ICSCC, lots of acronyms in the government, right?

The Intelligence Community Security Coordination Center. That's the Tier 0, basically Tier 0 policy cyber Center for the ODNI that looks, that looks at protecting all national intelligence priority framework networks. So ended up getting that job. I was there for, for a few years. I supported the as part of that that cadre, I helped support the National Security Council large group for cyber at the time that was 2014 to 2016 where I had I first hand got insight into how the NSC, the National Security Council works especially and related to cyber issues.

It was a very exciting time to be there can at the same time as that I had reapplied to the agency. This time I was a very qualified candidate and this and it basically went on to be hired as a case officer where I entered duty at the agency, went to training and then graduated and then went out and served as a as a case officer. What a case officer does is a case officer looks to spot, assess, develop and recruit human beings with access to non public information to inform the United States government and policy makers of essentially the it's the collection platform of last resort. It is going where technical means can't go, where no other means can go where you have to send in a human being. It's a horrible job, right?

And it's, it's a very exciting job, but it's, it is a job with, you know, with a great amount of responsibility because of my cyber expertise and allowed me to specialize in understanding how cyber actors worked. So one of while I did a distinct, I would say array of, of types of work, my specialty was cyber adversarial, cyber actors, which is one of the reasons that I am in the position I am now, right? I was at the agency for some time.

I decided to depart service to the government after 13 years to essentially for a lot of family reasons, right, to put down roots somewhere. My grandmother, you know, not to make it too personal, but my grandmother got sick and one of my favorite mentors at the agency said to me once adventures in your 20s start to become opportunity costs in your 30s. And that really hit home for me in a lot of ways because the opportunity costs were watching my loved ones grow, you know, grow sick.

My grandmother passed away. So it and she was very, very foundational to my life. So, you know, I say this because that was there were a lot of personal reasons, but I decided I it was time. It was time to go and then I would go into private sector. And then I left the agency, took a role with Aon, the insurance broker for some time. And then most recently joined Cipher, where I'm very excited to run our Centurion group, which is a group of folks just like me with government ties and background, all at the tier one level, top levels of FBINSAJ, Sock, CIA, who have all recently separated and are positioned to know what the world's most critical adversaries, how they think, what they do.

And our leadership, the Cipher's leadership, our CEO as well as our executive chairman had Daniel Toback and Jay Hogue had the brilliant insight to understand that we needed a proactive business element that blended physical and cyber together, right. I happen to be looking for my next career move and those two things came together and here we are. And that's how I ended up leading Centaurium Group for Cipher. First of all, that's like the coolest answer to the initial question that I think anybody's given me on this podcast in like 15 years. But that's awesome.

Yeah. And there's so much there. There's like 8 different things I want to ask you about. But that sort of sense of service that you described, you know, coming down from like your your grandfather and your dad and that whole thing is a very common thing that I think we see in you mentioned that you came to cybersecurity from the outside, but we see that in the cybersecurity world quite a bit because there are quite a few, even if they're not, they weren't former military themselves.

There are a lot of people in cybersecurity who have that same sort of sense of service or helping others that you just described, Aaron, where it's like, well, this is something that I'm really good at that can make a measurable difference in a lot of people's lives. I can help protect people through doing this work, and it's something that I think a lot of people overlook. Yes, there's a lot of good paychecks to be had in cybersecurity, but there's also quite a bit of that fulfillment aspect to it where you think, OK, what I did today actually helped people.

It's not just that. Yeah, I was doing computers for. 12 hours exactly, exactly. I and I think a lot of that too comes from where we get a lot of our talent that comes to. So we get a lot of our talent from, you know, police forces, right? They're former law enforcement officers that worked on digital, you know, investigations. They're federal law enforcement from the, you know, some of my favorite people that are working in private sector and cybersecurity now or former FBI agents that did incredible digital investigations for the Bureau, right?

We're part of the Bureau of Cyber Division doing amazing things. We get a lot from the military. The military is still for people who are looking, you know, at it comes at a big cost, right? Your service to your country. You can be called up to warfare at any time, but the military still stands to be the the best place to jump social classes in the United States. They will give you an education. They will give you training. They will give you a steady paycheck. All of those things, the entitlements and the benefits that you get after, right, the GI Bill, the ability to go to school, paid, all of those things are very important. So, you know, about 15 years ago we started seeing the military, not just the Air Force and the Navy, but the Army in particular and Marines really start to bring people forward into the cyber MOS, right?

You had the whole Army cyber warrior push, all of that. So you took a lot of people who got, you know, may have just done a four year enlistment, but got incredibly advanced training and incredibly in depth technical skills that are all now serving in private sector. And they did it through career transitions and things like that. And they went and they went to college or they did this and that after. But what I'm going at with that is that you have a cadre of people that are ingrained to serve who have that, that sheepdog mentality, right?

The sheepdog mentality is I will protect the flock at all cost, right? I protect the flock. I protect the sheep from the wolves. And that mentality comes through. And in cybersecurity, you see it in real life because you see how these people, you see how like people's grandparents get milked for their savings because of online fraud, right? Well, as a, as a cybersecurity specialist, you are out there protecting those folks. Those innocent folks are protecting. Not only that, I say this all the time. People ask me, they're like, well, are you sad that you left service to your country?

And I said, well, I don't think I really left service. I think I just redefined it. And I say that because protecting the United States economy, our research and development, our private industry is just an extension of protecting the United States. Absolutely. You know, if if the United States economy, our innovation, our research and development, our industry, not just in weapons and defense, but in everything we're doing in AI and every other element, right, is, is the backbone. I mean that's one of the things that makes the United States so forceful, so powerful in the world and we have to protect that at all at all cost. And so I see that and and my many of my former colleagues who are now in private industry working in cybersecurity, etcetera, they also see it that way. It's an extension of protecting what we hold near and dear. Yeah, it's interesting because I'm a little older than you are, but like when I first got into cybersecurity in the early 2000s, it was right around 911.

So there was that whole, in the aftermath of 9/11, there was the whole mentality of cyber and physical are going to come together. There's going to be this, you know, that's when DHS started, obviously. But also in the private sector, a lot of, you know, the Beltway bandit companies or other consultants were like, we need to hire a bunch of cyber people right away because this is going to be a big thing now. And it wasn't, it wasn't in some ways like that convergence didn't quite happen the way that people thought it might. But the expertise and the mentality that both of those groups have did blend together, I think, in a really nice way. But at that point, most of the cybersecurity expertise was in the private sector.

It was not really in the military or government service yet, you know. So they were coming to the private sector and being like, hey, can you guys kind of help us out? We don't really know what to do with all these networks and stuff. Absolutely, and you know, it's funny that you bring that up. I don't don't normally, I don't normally talk about this too much because I'm not I, I keep a lot of I try to keep, you know, a lot of personal details private as by nature of my background. But a very good and and I, I want to say a huge plug to him for having the forethought in this, but a very close family tie of of of my husband's family is is is former the first secretary of Homeland defense, Tom Rich. And Tom, he had a lot of that foresight and I think it was interesting.

And I want to take a little moment to give him a shout out for this because at the time that he was given that task, right, to stand up DHS and to do exactly what you're talking about, it was a very difficult challenge. But Tom had served in the Army, right, served in Vietnam, actually in the infantry, which is amazing. Gets out, goes to law school, practices law, it becomes the governor of Pennsylvania and then eventually is tapped, right, to be the secretary of homeland defense. So first DHS secretary. And I think that that that was probably in the aftermath of 911 would have been an absolutely overwhelming task to see how working.

I mean, right, one of the things that we saw and the reason that 911 happened is because we saw gaps in intelligence sharing between the FBI, the CIA, you know, NSA, etcetera. They everything was compartmentalized. And so we, there were a lot of obviously why DHS was stood up, why DNI was stood up, all of these things was to increase intelligence sharing so that we could prevent another 911 from ever happening. And when you're looking at just that alone, let alone the whole emerging cyber threat, right, and how we were seeing terrorist networks and we were seeing this not just operating in the physical space, but in the very nascent cyber stages as well. I mean, it's hard to believe that, you know, 2001 was 24 years ago now.

It blows my mind. I mean, it feels like forever, but I think we're now on the precipice. The fact that you bring that up, I think we're now on the precipice of a new frontier just like that, and that's with AI. Oh God, yeah. We need to get to that. But one of the, one of the other things I wanted to ask you is when you, you mentioned that you joined OD and I as sort of on that in the area of like working with the private sector and in that whole thing. And one of the things that's been a constant in the, you know, 25 years that I've been doing this is that whole notion of public private partnerships, like, hey, let's share information for better, you know, threat assessment and threat intelligence across groups in cyber. It's been very difficult.

I mean, I don't, you know this as well as I do, but there's been like 40 different versions of this over the years of like, hey, let's make this group or your contact point, you know, all the Isax, all that kind of stuff. You know, Jenna Easterly tried really hard to do this while she was at SIS. From your perspective on the inside of the government, how well did that information exchange really work with with the private sector and what were kind of the hurdles that you saw?

Well, I think with private sector it is always challenging because you have to protect certain client data, certain other things, right? And you have to protect the corporate entity as well, especially depending on where you operate around the world. To sort of answer, the best public private relationships, you know, I've seen are ones where there is a mutual respect. The government can't share certain things, private company can't share certain things, but you try to find that mutual ground, right?

I think one of the best organizations that does it, and I want to give them a shout out here is NCFTA, which is the national, oh gosh, I'm going to mess up the acronym here, National Cyber. Let me hold on. I'm going to look it up because I'm telling you I don't. I want to give them good plug because I think that they do a lot of good. It's the National Cyber Forensics and Training Alliance, and they are based in Pittsburgh and they have some presence in New York too, but they do a lot in that, in that private public space.

It's run by a gentleman who's a former Secret Service agent and he is he, he, his name is Matt Levignan. It's a wonderful organization. They do a really good job of disrupting cybercrime through sharing, like IO CS, through sharing information. They work with a lot of really big institutes in order to increase that. It's a tough one because you know, there are reasons why companies can't share. There's reasons why governments want certain information, right? The FBI does victim notification all the time, right? One of the most classic examples we've seen of information sharing that disrupted cybercrime is Colonial Pipeline. There's critical national infrastructure. The Bureau did a phenomenal job that made the payment and caught it back, right?

I mean, that was top tier level work. So when it goes well, it goes well. The challenges are again, right, is like there are different competing interests between private sector and government. What I have found that works really well, and that's why I want to give NCFTA some credit here, is that you can find that kind of sweet spot, that middle ground where that information sharing overlaps just enough, right, that you can do real good in the world. And I think, you know, it's a tough one. And of course, everything changes, right? Policies change, administrations change. It really doesn't matter at the end of the day, right? If you're always working towards the greater good and you're trying to share that information, of course, there are always a lot of lawyers involved. You're still making progress.

Yeah, I think that, you know, the common complaint from the private sector, especially, I would say, you know, maybe 8 or 10 years ago was it was a one way St. like the private sector was sharing stuff with the government and the government wasn't reciprocating, which as you just described, Aaron, there's a lot of reasons for that. Like, you know, and people understand that like there's there's, you know, clearances and all that kind of stuff that that have to go into it. But I, I feel like from, you know, anecdotally and just, you know, looking at the overall landscape, I feel like it's gotten better.

Oh, yeah, OK. Look at what Cease is doing. Look at, I mean just the alerts that they put out the vote like everything that they do and Sisa has been offering and it doesn't work for every business, but for some of the smaller ones they they've been offering free table tops. Right now it's a little bit different. There's, you know, various different things that they're running through. They're not meant to be executive prep or anything like that. They're meant they're meant those those bad resource given out to various different companies is meant to just make sure that their networks are not vulnerable to.

Again, mostly we're looking at a lot of nation state actors, right? That sort of thing. It sees this priority and what they're going to share in their resources is going to be to protect critical national infrastructure. I mean, that's the mandate of the United States government. And I think sometimes, right, to your point, I mean, a lot of times in private industry, I see this too. A lot of people in private industry believe that the government should be taking action for, you know, ransomware and things like that. Except it's the United States government's interest to protect private businesses from financial crime.

It is in the United States government's interest to protect the American people. Yeah, the ransomware 1 is really difficult. I wanted to ask you about that because, you know, if you talk to folks, and I'm sure you know this as well, people in the private sector are like, listen, we know where a lot of these ransomware actors are. And we can probably tell you like, yeah, that's his yacht, that's his Lamborghini. We like, we know where they are. We just can't really go get them because they're inside of borders that we don't have friends inside of. You know, it's just, it's really difficult, especially, you know, it's North Korea, it's Russia. It's these countries that are not going to cooperate with us in a lot of ways, so.

Yeah, exactly right. And like, you know, for example, a lot of Iranian criminal hackers are really nation state hackers. They're allowed to moonlight as criminal hackers in order to offset their low salaries, right? There is, I mean, we have seen the Russian government make some notional, I would say notional movement to, to show that they're cracking down on cybercrime. But a lot of it in my opinion has been a little bit of APR stunt, right?

Because there's been no extraditions, there's been no real criminal proceedings, There's been none of that. And let's be honest, right, we're like, as of right now, especially because of Ukraine, we have, Russia is a highly sanctioned economy from the Western world. So if you know, cybercrime is bringing in hundreds of millions of dollars of illicit money into your economy, why are you going to shut off that stream? You know, and it just makes you think, right, It's and it's it's been a permissive environment and it's also a non extradition, right.

There's a reason that these criminal hackers park their assets in non extradition, non seizure countries because they know that unless they travel to a country that will offer them up or through airspace, etcetera, like they are safe. So, you know, that's that's they operate the way that they do. That's exactly right. And I mean, one of the things that we always talk about on this podcast is like, unless these people make a big mistake and go on vacation in, you know, Santorini or, you know, the Bahamas, where we can get to them, where, you know, we have a really difficult time reaching them with any sort of legal means.

You know that's that's. Why you end up with the economic sanctions and those sort of things which work to a certain extent, but they don't really work on the individual level. You know, you're, you're not harming, you're not imposing any cost on the individual actors who see cybercrime as not just like, OK, I guess I'll go do this. But like, it's a real career path. And for some of those folks, you know, like there's a lot of money to be made that they can't make in other ways. So right. How are you going to tell them not to? Do you know it's it's like a weird catch 22, Yeah. Exactly.

It is, it is, right? And it's, you know, and it gets really squishy because it's, it's crime here. But depends on what country they're sitting in. I mean in North Korea. Yeah. Context matters in North Korea. They see it as a viable way to fund the regime. They do like cryptocurrency heist are one of the largest. I mean anything that comes out of North Korea right is funded, approved by the North Korean government. So it is all nation state activity. I was having a conversation with a friend of mine who has no connection or real awareness of cybersecurity. Very intelligent person but is just not in our world. And I was explaining that whole cryptocurrency theft thing and how that all works to fund military and weapons programs in North Korea.

Absolutely astonished. Could not believe that that is how a nation is acting. That's they've been doing that for 10/12/15 years. Oh, exactly. Well, right. And it's, it doesn't matter how much we sanction them. It doesn't matter like they still keep operating on. But it's also just like the way that North Korea works. Most people, I think in the Western world, like they understand it. They understand that it's a very segmented country. Like it's very close borders. It's very controlled.

But if you do a little bit of research, right, you start to see, I mean, again, there are people in North Korea who have been told that South Korea, the rest of the world is absolutely like Armageddon. It's all on fire, it's horrid, it's all these things and that they live this wonderful life in North Korea. I mean, it is an immense, incredible study on what you can do if you control information and how you can do population control. What a perfect description. Yeah, you're, you're so right about that. And from the outside, unless you're somebody in your position, like even if you're really paying attention, you, you don't have a good picture of how those like how people are operating, you know, say inside of China or North Korea or Russia, for example.

Like we don't really know how those folks live and what they're, you know, how those actors are. Are, you know, in some cases being tasked by intelligence services or the military to go and run these operations and, you know, go get money or, you know, apply for jobs in the, in the North Korean, you know, sort of fake, not fake job, but you know, illicit worker scam. That's that's going on now. Like that whole thing where they're, you know, that's the AI piece of it that you mentioned earlier, Aaron.

It is, you know, one of my favorite tests for that is, and it's a very simple test. If you suspect that you have a, one of the North Korean IT workers that is applying, ask them, basically make a disparaging comment about the North Korean government. And if they, they, they, they'll hang up, They'll freak out 'cause they can't, they can't, right? And every ounce of the Internet, every access point that you have is controlled by the government and screen. So you can't say, you can't say anything. You can't like it.

It literally it is the pest test because they'll just drop the call, 'cause they can't, right? And the consequence, I mean, my goodness, it's such an oppressive regime. The consequences are very high. Yeah, that's, you're exactly right. That's, that's clever. I like that because a lot of people, I mean, it's become a real pernicious problem inside the tech industry and other industries as well. And it's, you know, it's happened a lot of it's come like happened under the radar that people are not really understanding the the depth and breadth of it. Exactly right.

And that's true. I mean, look at the end of the day, a lot of everything and and this is where that cyber and physical convergence is. But everything that we do, right? If we're looking at cybersecurity and we're looking at physical security and then we're kind of Venn diagramming it, the center of that circle is sitting human beings, right? We have this convergence of, I would say this convergence of risk where what's happening in the digital platform, right? What's happening here.

And this is kind of, you know, as we kind of begin to talk about emerging risks, this is this will become very evident. But what we're seeing right, is, is no longer do you just have things happening behind a keyboard. What happens behind a keyboard has incredible real, real world consequences. We've seen geopolitical conflicts result in, you know, hacktivists going after like water treatment facilities for these different reasons, right? There's the famous case where the water treatment facility in the United States had Israeli parts heart basically OT on their infrastructure and a hacktivist, basically Iranian based hacktivist went after a group, I probably argue tied to the Iranian government, but that's just my conjecture.

But I you know, we we saw them go after it and try to mess with water levels. I mean, that's a very tangible real world issue. You know, we see what happens right on on cyber fraud when I was talking about, you know, people who work in cyber security protecting innocent people who aren't as technically savvy from being, you know, having their life savings stolen. You know, all of that. And again, another like incredible plug for a very valuable piece of the United States government is the FB is IC3.

If you are a victim of that kind of fraud or you have a family member that is reported, no, the Bureau cannot go probably get 500 and $1000 back. They just don't have the resources for it. But I've seen incredible work from the Bureau done because of a multitude of complaints. They build cases out of that, right? So for example, in 2018 or 2019, the Bureau arrested a whole bunch of Nigerian scammers and that was done from an aggregate of IC3 complaints, right? So when you talk about these things like these are incredible, incredible tools that will allow actual prosecution of, of criminals of these fraudsters, right? Yeah, it's it's funny to think about like the Nigerian scammers, like everybody, like that's one of the original like Internet jokes, right?

As like I sent my money, this Nigerian Prince. But like that's a that's still an ongoing problem. Like all of that stuff happens. Like that dumb movie The beekeepers, like is essentially about that like, you know, sort of organized scam as a business, you know, stealing people's lives. Like that's a real thing that it's not just individual actors. Yes, of course those people exist, but in a lot of cases they're organized or semi organized groups that act as a whole.

You know, things like lapses or Scattered spider, you know, on the higher end, but there's much lower end ones that are making plenty of money along the way too. Oh yeah. Well, and that's the other thing again, right? A lot of these scammers like the whole like your Apple TV's been hacked, those sort of things like, you know, I have a real world story, I'll scrub it out. But I had a family member who lost a little bit of money to to a scam like that. Apple TV stopped working, went to Google, Googled Apple help number, went to the first saw the phone number at the top of the the Google search bar, called it turned and and you know, here you had helpful Apple help desk saying, oh, it's been hacked.

Oh, by the way, I need you to go get me a whole bunch of like Google Play cards, like you know, you under fuck and I you know, I finally by the time I I got in involved, I got a phone call and said, Hey, can I think this is a scam? Can you help? I actually got on the phone with the scammer. That was pretty funny. He hung up on me a couple times. I. Imagine. Yeah, I kind of read him the riot act, but I, I was luckily I was able to help my family member because what it ended up happening and this is something that's very important. You have to go to the actual website, right? My family member Googled and it was a paid ad that was put at the top.

And the scammers are smart. They paid for AD placement, right? And Google will whack it down when it gets reported and stuff, but it's still there for a little bit. So they pay, they use the SEO, it gets to the top of the page and somebody calls and next thing you know, right, somebody's losing hundreds of dollars. So, you know, those sort of things are that's really the bread and butter of a lot of these scams. We see it on Facebook marketplace, you know, all the time, all the time, people selling things, There's all kinds of scams. And the problem is, is a lot of times they're using PayPal friends and family or is sales a little easier, but like Venmo, any of these cash up. And the problem is, is that these apps and the financial institutions, if you send that money, it's as good as handing somebody cash.

There's no clawing it back. There's no. And it's, so the onus is really it becomes down to the user. It comes down to the user. If you're playing with cash that way, if you're going to hand over gift cards, those sort of things. I mean, one of the things that I'm happiest to see is stores posting up those, you know, if you're being able to buy gift cards, it is a scam. Yeah. So it's crazy. Like, yeah. Any time that I've gotten a new job in say the last like 6 or 7 years, you immediately start getting the text messages from the CEO of your new company allegedly saying, oh, hey, are you busy?

I'm in a meeting, can you go do this for me? It's like the craziest, you know, they're just trolling LinkedIn and whatever else. And you know, you like, people like us are like, who is falling for this? But. Lots of people like and it only takes one or two for them to act, you know, to make it a profitable thing for them. Same thing or whatever. Exactly. Exactly. But it's even scarier now because all of a sudden that Nigerian Prince that used to have really bad spelling and is very convincing thanks to AI, right.

Large language models are changing everything. Everybody's. Yeah, right. Thanks to AII mean there is. It is it is amazing how the social engineering thread is advancing based on AI right now. You can, you can I have, I can go to chat EBT. I've been on enough media or, you know, have enough articles out there that if I ask it to write something or say something like me, it, it will. And it's scary. Oh, it's horrifying for somebody like me who's had like, yes, I've been a journalist for 30 years, so everything I've ever written is on the Internet. So like those large language models are trained on like my writing and your writing.

So they, yeah, it can just spit out, here's a 750 word article about this thing that sounds exactly like me. It's like shit. Yeah, which I think you know, and that's sort of the thing, like one of the things that we're looking at with Centaurian, with Centauri group cipher, Centaurian group is disrupting those sort of patterns, right? Looking at that different convergence, looking at those different multiple vectors, right. What you do in your real life world, not just because everything gets it's digitalized now, right, But what you do in your real life world, how you present yourself, the information you allow to be out there, just the information that I've allowed to be out there about myself in this podcast alone could be used and weaponized against me, right? So there's, it is amazing that you know what one of the things we're trying to teach people now in this advancement of the next threat, the next evolution of threats that's coming. And I am a full, full, full believer that AI is just going to fundamentally change the nature of trust and that that is the next evolution of threat.

And that's what we're trying to teach clients about every single day, disrupting those patterns, reframing your expectation of trust. Like trust used to be, you could believe what your eyes and your ears showed you. But AI is making that. I mean, unless you get one of those creepy pictures where like the fingers are like, you know, there's like 18 fingers on one hand and like a leg coming out over here, which happens. But it's getting better and it's going to get to the point that it's going. I've even seen some AI videos that I'm like, is that is that real? Are some real so many?

Yeah, and they're just done by people I know that are like video producers. They're just like, here, look what I made. I put you in Hawaii or something. Like what the what how is this? What is happening? And how is it like in your job now? I'm, I'm guessing that your backgrounds, you know, in the intelligence community where you're taught to like a lot of it is people, as you described earlier, Aaron, like you, you know, as a case officer, which is what, you know, everybody thinks you're out doing spy game type stuff and Jason Bourne type stuff.

But mostly what you're doing, I would imagine is a lot of research, a lot of sort of getting to know people, a lot of human interaction. And now we live in a world where, like, you have to trust people in that job, in that position, but you also have to have like, a healthy, not distrust, but like, yeah, skepticism of like, OK, until you show me that you're giving me information that I can trust, I can't really trust. It's like a weird thing. Hall of Mirrors. But we have a say.

We have a say. Trust but verify. Yeah, exactly. That's very live in the cybersecurity world too, but in the AI driven world now like how are you explaining this to your clients in in giving them a threat assessment, in trying to help them understand this? The threat landscape is wild. Exactly. And it's going to change so much, I think in a lot of ways. One on the physical side, right, just being aware of your presence, being aware of what data and aggregate is out there about you. For example, a lot of high net worth individuals fly by private jet, right?

Well, those records are very public, right? There are whole accounts that track, I won't name those individuals, but they're pretty high profile, those individuals in their private jet movement, right? There's all kinds of information that can be gathered about you, right? Most people don't realize just how much open source information can be found. Just you know, I mean, think about it, you go to those, any of those websites, those data aggregator websites like Spokeo or Clear, any of those, right? It is wild what a few bucks can get you on a person, right? So when you're thinking about those things, when people, you know, getting people to think, especially some of our high profile clients to think about what your kids are posting on their social media and how that can aggregate back to you, right?

I look, I am a big believer. I am adamant about this. My child is not on social media. My child is not. There are no pictures of my child. There are. I do not post anything with my child in it because one my child can't give consent 2 my child is the is is the basically her mom is a fairly high profile former intelligence officer. I shouldn't say high profile.

That's probably too you get to. I don't mean it that way, but like I'm enough out there that I mean it says CIA on my LinkedIn like that makes that would make my my child a target. My husband is a former government official as well. And so you know, those sort of things like I don't want that. I don't want pictures of my child being distorted by AI, and those are things that are happening. So, you know, trying to teach people like be very cautious. Your digital persona is not private, no matter how locked down you think it is, right? Just using common sense, but also with AI emerging, right, we're seeing ingestion of data, data that's out there about you, right?

Every single time, I'm painfully aware that every single time I give an interview or I talk about something that's personal, like my background at the start of this, it's a very, it's, it's an engaging story. So of course I tell it. But every piece of that information can be ingested to build a profile about me. And that's a really important thing. So you have to start thinking offensively in nature. What am I putting out there that can be used to either personify me, to make, you know, to make me a target? And so we're teaching people to think differently. And see, here's the problem.

Because in the next 5 years, I think that the cybersecurity threat landscape is going to shift. I, you know, I talk about trust, but I don't think it's going to be necessarily different, like crazy attacks and different technology throwing at different attacks. I actually think that the next round of the biggest risk that we're going to have is data poisoning. It's going to come in manipulating data in AI models to manipulate outputs. That could change the trajectory of research. It could change the trajectory of a company, like where, how a company's going, their financial structure, all of that, right? Because if you're relying too much on AI models, like AI models should be increasing our proficiency, our speed, our productivity, but they should not be trusted as a verified output.

Human beings still have to look. It's that trust but verify. We still have to look at what is the outcome. You can't blindly trust it, right? See that a lot because what I see coming down the pipeline, and this is some of the things we're talking about as Cipher and it's Centurion is what are you doing to protect your data? What are you doing to protect your data integrity? What are you putting out there that is can be manipulated and fed back in? Because every company is moving to AI in some way, shape or form, right? So again, I think the next five years is going, it's not necessarily going to be about the volume of attacks.

It's going to be how AI changes the nature of trust and how we look at data integrity and protection. And AI's output is only as good as the data that is it's ingesting. Yeah, and that's such a great point because I think in the cybersecurity world, a lot of people are thinking about AI from two different points of view, the offense and the defense. You know, defense, what can we do with a genetic AI to help automate, you know, sort of mindless or repetitive tasks, you know, say in the sock or something like that In the offensive side. A lot of what we've thought about so far is how is this allowing attackers to automate things or become more efficient or, you know, spread their attacks farther in, you know, and we've seen some of that.

But what you just described, Aaron, is the thing that I really worry about. And I know a lot of other people that think about this in a deep way that not to put myself in that in that class, but you are worried about is that kind of data poisoning? And because I don't think that the general public certainly understands that LLMS are just prediction models. They're taking input and looking at what they've been trained on and trying to predict what a logical output from that would be.

They're not sentient. They're not, you know, we have to let people, you know, we have to get people to understand that. And even with my kids who are in college, like, OK, you can use ChatGPT and these other tools to help you, you know, summarize really difficult scholarly articles or things like that. But you also have to get an understanding of it yourself. You can't just take that as gospel, you know? It's. It's. Human beings are inherently, we are inherently lazy, right? So if we can do or if we can do something faster, if we can make it, you know, make that shortcut, we're going to the problem becomes it's training us to not think critically about what what it's giving back to us. So if we treat it like gospel, then we're we're losing the checks and balances.

We're losing the veracity, everything right, authenticity and veracity in anything that you're looking at, the ability to look at it critically and say, is this accurate? And what I fear, right, is it's no longer going to be a ransomware that's going to take a company down, right? It's going to be, it's going to be an adversarial like competitor, let's just say in an adversarial country, I'll leave names out of it, but right, who is going toe to toe not unlike what we're doing in the race and AI right now, right?

It's going to be in an industry like semiconductors, something like that, where you've got companies that are located in competing geopolitical regions that are going, you know, that are, that are in a race. And what's going to happen is, is if you can taint the data going in, you can literally derail an entire company. I I think no longer will it be ransomware taking down a company because they can't afford to pay it and they've lost all, you know, all their data is encrypted. I think it's going to be we trusted our models and our models were wrong and now we're wrong and we're wrong in the market and we're done.

We're covered. Yeah, the models part of it is the most worrisome part to me because we're putting all of our faith and trust in these black boxes that we, you know, that are controlled by a small handful of companies that own the models. We don't have any insight into how they train them for the most part. Like, you know, we really have no concept of what their training data is. So how can you trust what's coming out if you don't know what's going in?

Exactly. And not only that, but as companies move to their own proprietary like backbone models that they're paying for and they're, you know, they're doing all of that again, what happens if you have a malicious insider that feeds it erroneous, you know, data, right? What happens like say you're racing in research and development to develop a very proprietary technical tool in healthcare. I'm just going to make up something here in healthcare and you're doing your research, you're doing your task that you're doing all these things and you're using AI to help that research and modeling go faster.

Well, what happens if you have a malicious insider that is placed seated into your company to to disrupt that, right? And they feed one little bit of erroneous data and now possibly years of development, etcetera, like whatever your final output is, is fundamentally doesn't work. You could, and that's like the end result. But what happens if somebody is there just wasting resources, slowly halting and stunting development because they're slowly seeping in erroneous data into a model, right.

And the worst part is if that person is even caught, right, Let's just say you've enough evidence. All they have to say is, Oh well, I didn't know. Right. Or yeah, it was a mistake. My bad. Yeah. Like. Yeah, it's that erosion of trust in it could happen really quickly or it could happen over time. You know, the wild analogy could be, you know, something like the the Tylenol health scare in the 80s, which you probably don't remember, but I.

Remember it? Yeah, I remember. Yeah. I mean, it did not take, you know, it took like two or three people getting sick and dying from poison or, you know, tainted Tylenol. That was one person was doing, had nothing to do with the factory or anything like that. All of a sudden trust is gone in that product. And, you know, we're not talking about those kind of consequences, but the financial and cultural consequences of what you just described could be, you know, pretty massive. Absolutely.

And so again, you know, we have to train people to think differently, right? If you get a phone call, even if it looks like your boss, right, take that extra step. Hey, hey, hey, boss, I'm just I'm calling you. You did just call. That was you, right? Like I know I heard you that seemed like you, but I just want to verify, right. And again, we had, you know what wasn't it the was it the Hong Kong case, the Hong Kong employee that transferred like 20 some $1,000,000 because of the we call where a was all a deep fake again, right?

Like we're going to see adversaries. They're going to mimic employees, executives, vendors and entire departments. I mean, all we're going to see is the same old playbook, the Nigerian scammer on hyper drive. Right. Perfected. Like. Perfected. Honed and yeah, without grammatical errors and, you know, at scale, they don't need a giant call center anymore. You know they have agent, you know literal agents to do it for them. Right. And the sad thing is when we're seeing this around the world and you said call center, I didn't finish a thought earlier.

A lot of these call centers that we see some of them in India, Southeast Asia and places like that, right? I mean, one, a lot of those employees are not there willfully. They're, they're then two, right, which is a horrid thing. Two, we're seeing a lot of reports, at least on open source from, you know, I'm not, I, I don't ever give anything up for my government time, but like, you know, reading just open source law enforcement stuff and indictments and everything else. We're seeing organized crime get into cybercrime because it's so profitable, right?

We've seen there was a podcast, I, I want to say maybe it was the daily did a really interesting story on the cartels, the Mexican cartels getting into like timeshare, basically extortion, like milking people out of their savings based out of Mexico to like get out of timeshare. I don't know. It's why it's insane. Somebody's got a Fact Check of me. I'm sure I got something wrong there because I'm recalling like a podcast from like 2 or plus years. But anyway, I mean, it's just wild.

What it's just wild what we're seeing organized. I mean, again, organized crime also, they see themselves as a lucrative business that they're always going where the new hot target is. And with digital currency and with everything being done digitally, you know, we're we're seeing this scams, we're seeing these call centers, we're seeing all. And so, so when you see the old playbook, Mary, with new technology and AI and poisoning data, but also just deep fakes and you can't trust your eyes and your ears anymore. You have to start to retrain people to think about that second layer, which is that trust but verify. OK, cool, boss.

Yeah, I'll, you know, or CFO. I'll, I'll initiate that transfer. Hang up phone, go directly to the number, you know, is the CF OS number and call them and say you did just do this, right? Yeah. And you know what? It's one extra step. But it's again, like we're going to see CF OS go, no, I, I did not. And we're going to see those sort of scams start to get, you know, basically disrupted. How much do the clients that you're working with understand all of this already before you get in there?

I mean, I'm sure it varies from, you know, organization to organization, but how much of what you're doing initially is sort of that education that you just described? I think a lot. I mean, obviously they're very savvy folks and they're very good. But one thing that I have started to really understand as I have left government, you know, I spent to some degree my entire life kind of sort of steeped in force protection, if you will. I mean, I can remember being 3 or 4 years old in Germany going through the gates during Desert Storm and the bomb dogs sniffing every car.

So again, very early formative memories. So you can drop security and just a little bit differently. And then you go in and you know, everything that I did in the government and everything else, it gives you a different lens on the world and you start to realize, like how you perceive the world is fundamentally different than how most people do. So they're very aware of it. I think the deep fake scam for the 20, some $1,000,000 that unfortunately happened was a big awakening because you know, there's always the notional threat. But I think when you start to see real world examples, it gets people really understanding. One of the things that I do and spend a lot of time is talking to clients and about these threats, but giving them real life case studies, real life examples of times that companies or individuals fell victim to these things and you put it into a story.

So I think many of them are thinking about it, they understand it, but they're not, not everybody's connecting all the dots because it's a lot of lots to connect, especially when we talk about physical, especially when we start to talk about cyber, we're seeing this, right? I mean, how many acts of violence have we seen come from online radicalization in the last five years, right? We're seeing and, and I use that not just in the traditional like the traditional like terrorist methodology that we've thought about post 911 for so long. I'm talking about online radicalization of anything. And so we see this, we're seeing it in various different area areas.

So getting people to understand that what is what is digital is also physical and physical is also digital. It's a really big thing. So we start to look at them and basically at the beginning of it, we start to look at them and say all we're trying to do is teach you to fundamentally disrupt the patterns that put you at risk. Do not be predictable, right? Do not be this. Do not be that. Don't. Don't make it easy for them. You know, don't be just. That, yeah. Yes, we see this, you know, all the time because you know you can do you can have a massive budget and you can lock down your network.

You can do everything, but all you need is one person, like to piggyback in or you need one person to pick up a thumb drive in the parking lot and like that, like you just need one person to get duped, you know, by the help desk calling. It happens all the time, you know, and there's various different like industries that are are, you know, that are that are looked at for and targeted for various means like biotech industry, obviously because the massively lucrative industry.

So you're trying to steal the, the IP there. We see scientists and researchers gone after, if you're talking about private equity, right, going after various different portfolio companies is a great vector. And it's a very scary one in law firms when you know, I, I speak to to lawyers quite frequently and I say you're a target because of who you represent. And that could be a target of nation state, criminal. It doesn't matter, you know, and we've seen a lot of that. No longer is the world separated. We see with the way that the Internet works and interconnectivity, right?

A geopolitical conflict halfway around the world can absolutely end up in your backyard. Yeah. And it's, it's sometimes difficult. I mean, we've been dealing with this in cyber security for a long time, trying to convince people that they are actually targets, you know, especially when you get in like the small, medium business world. They're like, well, we don't really have anything that an attacker would want. You know what, what would they want with us? We're not a, you know, we're not making microprocessors, We're not a pharmaceutical company, We're not Microsoft or whatever.

But you could be a target of opportunity. If they see a soft, you know, potential target, they're gonna come after you, you know. Oh, yeah. And if you, if you're, if you make things difficult for them, they'll move on. You know, that's a big part of it is just not being the easiest target. Than third party vendor, third party vendor verification is incredibly important. You know, one of the examples, I think it's long enough ago now, you know, I think it was nine years ago. But Target, excuse me, Target spend millions of dollars on its network security, correct?

I mean, they had top notch, top notch security on everything. Like they're not a small retailer, retailer, they know what they're doing. But yet when they were compromised circa 2014 by Russian criminal hackers, they were, they were literally compromised through a mom and pop HVAC vendor, right? This and this is a widely publicized story. So I don't feel bad. I'm not trying to name and change Target by any means, but it's one of the best lessons learned because what those Russian criminal actors saw was a, a port being opened consistently on Target's network.

And they said, huh, what's that? So then they swam downstream, realized that it was a local HVAC vendor going into stores, plugging in the computer to do the diagnostics. That mom and pop HVAC vendor that serves a local area or local store is not going to have the cybersecurity, you know, infrastructure, the cybersecurity budget that Target does. So, you know, they waited for that port to open and then boom, they were in and caused the largest point of sale breach at that point in history. So at the cost Target how many millions of dollars so.

Yeah, very famous example and the consequences of that, I mean I remember covering that in every quarter for years afterwards you would look and it would still be a material impact on their on their financials, you know on. Their financials. Yeah, one of the most famous examples. It still shows up in like presentations at conferences. Now as a, you can be a mature security organization and do everything right as far as you know and something like this happens, you know, and there's other examples too, not of necessarily the third party risk, but mature security teams like the Operation Aurora attacks that targeted Google and other technology companies in 2010 or 11, whatever year it was huge wake up call for the cybersecurity industry itself to be like, oh shit, if they can get to Google, then they can probably get to us because we don't have Google's budget or their talent.

Midnight Blizzard and Microsoft. Totally. Yes, Midnight Blizzard being attributed to the Russian SBR, which the SBR is the Russian version of the CIA, the most incredibly capable element, right? Never to be underestimated. And essentially, you know, look what they did with Microsoft and that's that there is a point to that, right, which is never be never have hubris, never think one, never assume you're not a target because one, you don't know what the adversary is targeting. And I use adversary and that's a very loaded term, but it's true.

Whether they be criminal or nation state, you just don't know what their interests are, right? It's the same reason that we see a lot of Chinese APT activity on on data theft and IP theft, right? You don't know what the priorities of of the Chinese government are. You also don't know if you're a third or fourth removed downstream vendor for, you know, some classified government contract. You just you don't know you could be so Daisy chained down. You have no idea. I've seen this like I'll scrub out all the all the relevant details, but you know, I remember watching the FBI do a victim notification on a mom and pop company that was like 3 times removed from a very interesting piece of defense equipment.

And they were manufacturing one tiny piece, one tiny element and a nation state hacker went after them because they were trying to swim upstream. So again, you know, we see these sort of things. One never assumed 2 hackers they don't look at I mean, some of them may maybe they're like, we want to go after this big fish and we're going to try right? And you know, there's a lot of reason for that, but most of the time it's you and I both know it's scanning for vulnerabilities, it's scanning for credentials, it's buying things off the dark web and then it's access Everything comes down to access. It doesn't matter how they're going to get it, but they want to get it.

So you need to be preparing yourself again, that's what we're talking about understanding, understanding your entire security posture, right? Think about it like, you know, we think about physical access, badge access. Don't piggyback this and that, but if your badge system is interconnected and you can pop the badge system, then you can walk somebody in the front door without access. Yep. Yeah, there's, there's, yeah. It's all connected. Like it's, you know, it sounds like a line from, you know, sneakers or war games or something. But it's all true now. You know, it's there is no analog anything unfortunately anymore.

Everything. Is, I mean think about it, there are refrigerators that are connected to the Internet like you're so many and your IT team, your smart TV is all of this like is your IT team cataloging that as part of your defense project? Like are they looking at it? No, they're they're not right. There's in the, in the grand scheme of the Internet of Things, like there's so many interconnected devices that it's just going to be very, you know, it's, it's, it's scary. I mean, think about it even down to the base level of like the hackers getting onto baby monitors, how terrifying that is.

I know. But we're doing that for a really long time. Yeah, it's, yeah, it is. Everything is kind of, I feel like it's one of those things if you sit back and think about it too much, you kind of get paralyzed and you're like, everything's terrible. Like I imagine that was a risk in your former jobs too, where if you like look at the world as a whole, you're like, well, everything's on fire. Is anything I'm doing making any sort of difference? Like you have to just like I would assume, pick something and go do that one thing and then, you know, sort of keep. Going all overwhelming, yes, it can. And that's, that's one of the things that we really focus our clients on, right when especially with our, with Centurion, with Centaurian group, we Centaurian itself is a whole bunch of people like me who have been very trained to look at the entirety of the risk, we'll say landscape. One of the things that's really important, one of the things that I try to really teach people about is backwards planning.

You can get so overwhelmed if you're sitting at the start and you're looking at the risk landscape in front of you and you're going, Oh my God, everything's on fire. What am I going to do, right? You've got to work from your endpoint goal and then you work backwards and that's what's Centauri Group. That's one of the, I think the market differentiators for us is because it's a whole bunch of operators trained to think like that. We're going to take you from your security goal of where you want to be, and then we're going to walk it backwards and we're going to find every pitfall along the way you backwards plan because it allows you to see the things that you cannot predict if you're forward-looking only. This is, yeah, that mentality is so I mean, it's it's not anathema to a lot of people, but it's hard to sort of switch your brain to be like, OK, this is the outcome that I'm looking for.

How do I get from where I am now to that outcome? You know, in especially when you're dealing with something as complex as cybersecurity or you know, even physical security or just threat assessments in general, what is your end goal in OK, how are we going to work back from there to get you there? And then what are we going to uncover along the way? Because when we're backwards planning, we're seeing things we wouldn't see otherwise. That is, that is something I think that especially as we look at this new emerging, you know, the next five years of, of essentially veracity, I would say an authenticity being the, the core crux of every, everything in, in, in the cybersecurity landscape, right? As we see AI Morphis, we see data poisoning, all these things start to happen and deepfakes and everything else. I think getting people to understand that right, getting them to start thinking that way, start thinking offensively. I love, there's a few phrases I

love, right? Like you don't, for example, you know, I tell customers or clients all the time. I say, hey, you know, you don't, you don't go to Super Bowl without practicing. You need, you don't, you need a tabletop where you don't just sit there and you don't just talk about what you're, you know, you're going to do. You need to go like have real tests, have a red team come in and break some things, right? Yeah. How everybody's going to act when it's real. Have a physical, have a physical element to it, right?

What are you going to do when you find somebody who has access to your building that's not supposed to be there? Like, how are you going to act? How is your leadership going to act? How are you going to do crisis communications? One of my favorite things when you talk about reputational damage, right? Things that can occur during a breach, one of the really critical things is making sure you practice like you play, Making sure that your exact team knows exactly who's going to say what, when, where, how, who has what. Authorities learn what's going to happen under pressure. One of the critical things that happens, right? Let's say a big company gets hacked. They haven't disclosed it yet. They're in the 1st 30 minutes, first hour. All of a sudden a reporter calls up. Hey, I got a tip that you guys have just been breached. Do you care?

Comment. How do you know that you just tacitly confirmed? Yeah. How right are you prepared for that? What is going to be the first steps you take in that first hour of the worst day that your company is going through is going to prevent reputational damage. It's going to prevent financial loss. It's going to you know, and then don't even get started on the regulatory aspect, right? What is material? What is not like make sure you have a a good breach council. Make sure you know your crisis vendors like you. Make sure you know your your digital forensic sensitive response from right. I mean, obviously I'm going to shamelessly plug cipher because we're awesome.

I would be remiss if I didn't say that. And that's the core of our business. We're there for incident response, but also to help get you back online. One of the core things that we do right is that we, we do, we get you when everything's down. We don't just, we don't, don't just do the, the investigation, give you the digital forensics. Of course we want, we do that. We tell you how, we tell you what happened. We give you all the facts. But we, we're really focused on also on restoration. That's our bread and butter. So we get companies back online as fast as possible because you can't afford to be down. And then you know where my group comes into play. And This is why it's so critical, right? Is Centaurian.

Then we make sure it doesn't happen to you again. But again, the best, the best offense is a good defense, right? The best, the best, the best thing that you can do is get out there, be proactive, lock down, make sure you know where your lowest hanging fruit is and mitigate it right. Do proactive services. It doesn't just help you like yes, it is a cost it you're as a as a company, you're going to spend on your security budget to do proactive, to do proactive security, doing things like threat hunts, finding out what's in your, you know, in your environment, doing things like tabletop, like real world table tops, doing a red teaming engagement at whatever level is necessary for you, doing a physical assessment, right, looking at your travel patterns of your top executives, those sort of things. But here's where it pays off.

It pays off because you've mitigated the lowest hanging fruit of the rest, right? You, you know where the things are. You've done your third party vendor assessments. You've done those sort of things. There's a lot of packages. There's no one cookie cutter size that fits all. You need to look at what fits your business, your budget and your model the best, right your footprint in this digital ecosystem. But where that helps you, right is it helps you when you need to go get insurance placement. It helps you when you're when somebody's looking and saying, am I going to cover your risk right now?

I'm not a broker, you know, I'm not an insurance broker, but a lot of companies are out there. There's a whole bunch of brokers that will help get you, your, your physical security insurance, right to protect your balance sheet and cover your risk. So you want to make sure that you have these things, you have these companies, because if you're sitting there and your employees log on and all of a sudden the screens go ransom, you know, and there's a note up on your screen, who are you going to call? What are you going to do? And in your first hour like those, the steps that you take are going to be critical to the survival of your company. It's so true and it sounds dramatic the way that you described it, but it that's how it is. I know you've been on the inside of those and I've been the reporter making that call and being like, Hey, I heard that you guys got owned.

You want to tell me what happened? And they're like, how do you know that? Literally what you just said Aaron, I've gotten that response and you're like half the time I'm like, oh man, dude, you don't. You have APR person who told you to say that like what's wrong with you, but I'm not. Right. Yeah. And you need to have a security comms team internally or if you don't have that budget, an external security comms agency that knows what they're doing. And that's not the same as crisis comms do different things. And you need to make that call to your counsel right away.

Your lawyers need to know probably before anybody else, like before your CEO. Call the lawyer and then start getting things going. Yeah, and it's so important because not only you're going to have there, you could be dealing with a regulatory issue, could be depending, right. So your lawyers are there to protect you for that. They're also there to make sure that one, if you actually do have insurance that you could start to get that process going and get yourself covered, Make sure that you're not going to be out of pocket for the cost to get back online. They're going to get the, you know, companies just like Cipher, whoever your approved vendor is or whoever it is that you have a relationship with. Maybe you have have a retainer.

If you don't, you know, give us a call. But there are other companies that do retainers too. There's a lot of firms out there. You want to make sure you have that. If you're a large company, you should have more than one retainer because what happens if you call and like one of these ransomware groups is on a big campaign and everybody's staffed out, right, putting out fires, right. So you want to make sure like have relationships with all of the best DFIR firms, right? Have know who you're going to call, but your breach council is going to help you through that. And then of course, of course, there's the other thing, and I talk about this a lot too, which is you don't know what's going to happen during an investigation or what you could find on your network that is inadvertently there that can cause you all kinds of other problems.

I will say I've seen more than once where we have seen illegal materials end up on a company's network inadvertently because some, you know, some employee or somebody decided to put them there, right? That's where your counsel is going to help because you just don't know. People do things. There are people who are not good people and they're not, you know, bad people. Criminals don't just wear big neon signs to say I'm a criminal, right? So you just, you don't know, you know, and not to talk, you know, not to, to, you know, bring this up in such a bad way. But you know, a lot of times during DFIR investigations, they'll find C Sam child sexual assault material, right? All of that.

You want to make sure you have your counsel in place. It's a horrible thing. But if that's found, guess what? Now you have a criminal proceeding in law enforcement that has to come in. Your counsel is going to make sure that they're working with all those elements to protect you. Yeah, it's, yeah. Everything is interconnected, as you said, Aaron, and it's all like it's really difficult. I don't envy the work that that you're that you're having to do with these companies. But yeah, it sounds fascinating, honestly. It's interesting. Well, you know, and I wanted to say this earlier, we were talking about the deep fakes and AI and everything else. One of my colleagues, in conjunction with a couple other partners did a phenomenal presentation at Net Diligence Philly where they actually did video and they put all three of them on screen and they changed their faces in real time as we were talking.

And I mean, everybody, it was such a hit. It was probably one of the best presentations because people were blown away. Like watching, I mean, it was hysterical because like you're watching faces change and like, but the mannerisms don't. But it shows you the the rapidity that this technology is taking and the risk aperture that's coming out. So again, right, we're not throwing out the old playbook. We're not changing like the tactic. What's tried and true is always going to be tried and true. Social engineering and the human element is always going to be the easiest way in, right?

It is it just, it's, however the technology and the way that it's applied is going to evolve so fast because of AI and, and everything that we talked about today that you have we're, we have to train people to no longer just think reactively, but to start thinking proactively and start thinking about that trust and veracity, authenticity and trust, but verify. Yeah. And that honestly, the scariest part is that we're really at like the very start of the whole AI, you know, revolution or whatever word you want to use. I mean, the availability of these public LLMS is like 3 years old at the most, like 4 years in some cases. Like we're at the very, very beginning of this. And these tools that are being developed now are just the first, maybe second generation of the stuff we're gonna see in the next 5 or 10 years.

Oh yeah, I think, look, I think we're entering a moment where cybersecurity is going to become a trust discipline, right? Organizations that invest in authenticity, intelligence and decision speed will be the ones that adapt the fastest. And that, you know, tools do matter, but it's going to be foresight and human judgement that will determine resilience going forward. It's funny, I see us kind of doing a waxing and waning, right? A little bit of a yin and Yang. We are going from humans where the detectors and everything to technology is the detector and then now. We're going to go back to where like we're going to go to an era and we're going to pay some painful consequences of over reliance on dependability and trust in technology only to come full cycle where humans will be becoming again the overlords of technology to verify the output.

And we're going to do this arc and there's going to be some painful stories in the middle, not unlike, you know, the target example that we talked about with third party vendor verification. We're going to see that it's just going to be this next evolution, not unlike what we talked about in the post 911 years of, of sharing between private and public sector, increasing sharing among intelligence in in, in government elements. What we're going to see is, is we're going to go through this next cycle. We're going to get some really scary case story case studies out of it and then we're going to face the brave new world after that where we're going to realize that human independence and autonomy is is is absolutely critical to to cybersecurity and physical resilience.

Yeah, I couldn't agree more. That's probably a great place to end up. Aaron, this is a delight. Thank you so much for giving me so much time. This is great. I really, really enjoyed it. Hopefully, hopefully I, I, I suspect this might be one of your longer podcasts, so hopefully that everybody found it really interesting or will find it very interesting. That's totally fine. I would have stayed here for another hour, but I know you have things to do. So thanks again, Aaron, it was great talking to you. Thank. You pleasure.