Yahoo's Sean Zadig on How to Raise a Hacker Safely and How Maybe AI Isn't Changing Everything

And then I kind of like dabbled a little bit with what you might call the dark side. I, I had a, this is back in the day of MP threes. I'm dating myself and I had an, I had an FTP server that was running from my home Internet connection where people could dump FTPS and you know, that sort of MP threes. And I got a letter from the RI AA saying like, we're going to sue you if you don't stop. And that was about his like sort of Black Hat as I went and said, OK, I'm going to, I'm going to go South direction.

But really I, I thought I was going to do computer programming like that. That was, it was sort of pre 2000s. And I'm like, OK, yeah, this is like the internet's really interesting and I'm going to learn JavaScript. And I, I got a job even in high school and then into college doing like cold fusion programming and, you know, very early web, like web sort of 1.5 type stuff, I guess. And I worked for a start up and the start up like I actually left school for a while so you can get to my undergrad in computer science and left school to go work at this start up and, you know, 80 hour weeks.

And we're like, you know, killing ourselves. And then the startup imploded when they all did back in, you know, 2001 or so. And, and I was like, you know, maybe I should use these, this interest and some of the skills on developing for, for good instead of instead of trying to enrich, you know, startup investors and pivoted into cybersecurity because I figured that'd be a good way to maybe help more people. It's funny, there's there's so many. Like really time specific markers from what you just said, you know, not just the MP threes and the RIAA sending out like cease and desist notices, which is like a hilarious anachronism right now considering how every piece of media ever created is basically freely available online, unfortunately. But also that sort of late 90s, early 2000s firstwave.com, you know, tech startup boom was so

it was such a specific point in time. And you you mentioned that you left college for a little while to go and do that. I knew so many people who did exactly the same thing. And I was already out of college by that time and I was working at at what was called PC Week at the time. Just like, you know, a magazine that you held in your hands that have worked on it. I was a subscriber, I think, yeah. That's really funny. Yeah. But I can clearly remember the atmosphere around when everything was starting to implode and everybody was like, maybe this is just over. Maybe like, you know, computers were kind of a specific thing and not they're not going to be everything to everybody. And obviously that was wrong.

But cybersecurity then was not a first of all, it wasn't called cybersecurity, which is called security or information security maybe, or computer security. IT security, IT security, Yeah. But there it was such a tiny, tiny little sub discipline. It was mostly people who had the background you just described, Sean, of like they were probably either BBS folks or you know, like Unix slash Linux geeks that got interest in one way or another and sort of hacking on things and seeing how they broke in interesting ways. Yeah, totally.

I mean, when I went back to college after that sort of startup failure, I got even more into like Unix and Linux and I, I ran my own domain with my own e-mail out of my closet and my, my apartment on like an old Spark 5, Sunspark 5 system that's. A. Nice. It was great. I was, I was super fun, but it actually helped me learn about, you know, DNS and Apache and how to, you know, like kind of what good looks like. And after graduation, when I pivoted into computer forensics and computer crime investigation, it was that understanding of how a system should operate that really got me to to good be good at like I'm recognizing when it went bad and how to find the sort of needle in the haystack when doing forensics.

That's interesting. When I was, I may have even asked you this on the first podcast we did. I can't recall, but your background really sort of always reminds me of Cliff Stoll's book, The Cuckoo's Egg. You know, like obviously a couple decades later, but for people that don't know you did investigative work when you were at NASA and for anybody that has not read that book, go read that. Stop listening to this. Go read that book right now. It's it's incredible.

I've read that book probably 20 times. I don't even know. But that finding a needle in the haystack was, I mean, that was kind of the original version of that, at least in the computer security slash forensics world, like somebody that was not paying for a timeshare on a specific system. And this astrophysics professor just or not even professor grad student, he's like, I'm going to go chase this down. I'm kind of bored in this observatory. Let's go find out what the Hell's happening. And that's literally just like the kind of hacker mindset of something's not right.

Let's go find out why. Yeah, and it got into it ended up, I mean, not to spoil the ending for folks, but it got into this world of cyber espionage and nation state campaigns. And yeah, it was got a guy chasing down, you know why? Why didn't the cents, the dollars and cents in this Ledger balance essentially. Yeah. That that is also the first book I recommend to people who were looking to get into the field is like, I got a list of books and that's that's the first one. Yeah, I recall reading that. My dad was a engineer and I, it was on his bookshelf. And I just remember, like, looking through the books one day when I was in probably in high school and saw that. And I was like, oh, this seems pretty interesting. You know, go check it out.

It was probably 5 or 6 years. The book itself was probably 6 or 8 years old at the time. Like, oh, this is a cool story. The more you read about it. And if you look at that story now in the context of the nation state cyber espionage campaigns that are just a fact of life for the last, you know, however many years now, it's incredible. All of the little pieces are there in what Cliff was writing about then. You know, it was like all the same kind of structures of these campaigns are literally right there in that book you.

Know, yeah, it's kind of a timeless, timeless book and so I recommend that and then I'll recommend like, you know, a sandworm or something for a much more modern one. But it's like, what are the difference between the two? Sure, technology maybe, but the the objectives are often the same. You know, that to sort of segue into the, the larger discussion we wanted to have when I was growing up and I, I think the same for you. There weren't really that many guardrails around the use of technology yet. You know, it was sort of, as you said, Sean, the way that you did it, the way that I did it, people of our generation was kind of just get your hands on it and go explore and see how things work.

You know, you, I build computers. You said you did too. You know, I think a lot of the people of our sort of generation did the exactly the same thing. And so they understood it a kind of a deep way how they worked and nobody was really telling them what to do and what not to do. And there weren't really a lot of rules and laws about them. Honestly, nobody was really looking closely at the way that people were using these things. So it was a different time, but we do not live in that time anymore. And we, we wanted to have a discussion about how exactly you go about getting kids involved in technology. And by kids, I mean just young people, you know, not, you know, from however old you want to say up through college, I would say where my kids are not, not safely in the, in the like how to use social media safely, that kind of sense, but how to raise, you know, people with a hacker

mindset, but in kind of a ethical, you know, structured way that they go about it the right way. Your kids are younger than mine. So how how are you thinking about this in terms of trying to keep your kids centered on the right path, but also having them explore things in the right way? Yeah, so it's a it's a really interesting problem because, you know, it's not just about cyber literacy like that. You can get that information in a bunch of places.

And you can also, like you said earlier, like how to be safe online, how to do social media safely, that, you know, there's resources there. But when it comes to how do you raise a kid or young person who is so interested in technology and wants to like great example, my son who is 12, very much like me as at that age and just as a hunger for technology. And in in fact, we built our first computer together last year, which was super fun. It's awesome.

And and now like literally I can go up into his room right now and there's parts of computers everywhere and, you know, taking apart laptops and stuff. And then I'm like, yeah, that's, that's my kid for sure. But he very much wants to, you know, he wants to learn how to, how to hack in a sort of Safeway and he wants to learn how to test the, the boundaries of systems. And yeah, the like, it's a different landscape now. There's, there's a lot of stuff that can happen to you legally and you know, you can, you can sort of make a decision that changes the course of your life if you go down the wrong path. For me, it was like the, the FTP and the MP3's, ha, ha, like, look at that.

But you know, you can get in some trouble nowadays. So, yeah, it's, it's a challenge. And I think, you know, we, we might have talked about this a little last time, but because it has been three years, I'll, I'll mention it again. When I was a federal agent, I often investigated young people who were hacking and were, you know, breaking into NASA or DoD or, or what have you. And there weren't a ton of opportunities back then for young people to, to hack safely. And I think there are more opportunities which, which we can get into now.

But you know, I, I felt really conflicted as, as somebody who I knew I would likely be a parent someday chasing down these, these kids and being like, man, like, I wish there was a way to have diverted them earlier so they didn't go down this kind of this bad path. Yeah, it's a familiar story that, you know, there's a there's a ton of folks I know in the security community who have stories like that, you know, had some sort of interaction with whether it was local or federal law enforcement at some point, you know, in the 80s or 90s knocking on their door and saying can't really do that.

You know, and hopefully it was it was a relatively benign interaction, but it's in some cases it wasn't. You know, there was a lot of kind of overzealousness, especially when it became, you know, clear that what could be done with computers, you know, once the authority sort of woke up to that. But yeah. It's, it's such a difficult kind of balance to strike where you want to encourage that curiosity and say, you know, here are the, the tools, go and see what you can do with them.

But it's such a sort of, you know, there's so many potholes and, and hurdles in the, in the landscape today that it's not, you know, it's not the same atmosphere. There's not a lot of that playfulness, I think is gone. That's right. Yeah. But I think there's a lot of opportunities now for providing, you know, good outlets. And so, you know, great example is back in the kind of early 2000s, bug bounty programs weren't really a thing. And, you know, shameless plug, Yahoo's got a bug bounty program and we've got one of the oldest ones around, in fact. But you know, that the ability to direct folks, young folks, like, I think for like some of the programs, you can be 16 as as sort of like your youngest and to be able to say, hey, like you can actually, you know, exercise those muscles and skills in a, in an environment

that has sanctioned for you. Here are the rules to follow. Here's what you can and can't do. And oh, by the way, if you're successful, like you can actually make some money and turn it into a career. And I, I talked to a bunch of folks on a pretty regular basis who, you know, approach me on LinkedIn or conferences or what have you. And they're like, hey, like I'm a cybersecurity researcher. I'm on this, you know, bug bounty program. How do I then turn that into a, a career? And when, you know, we've hired people at Yahoo in the paranoids who are who got their start in, in bug bounty and now they're, you know, cybersecurity analysts. Yeah, I love that kind of trajectory. I've seen those folks too.

You know, I've sat in the room at Pone to own in in Vancouver and seen, yeah, like 17 and 18 year olds walk in with like an exploit for Chrome or something like that. And you're like, Oh my God, what, How did you even, what, how does your brain work like that when you're 17? You know, that's not how my brain works ever. But that kind of talent is, you know, in demand and it's, I'm glad now that there are those sort of pathways to sort of help those folks find the legitimate ways to to use that talent in bug bounties. I mean, there are full time bug bounty hunters out there that are making quite a lot of money, you know, with two commas in it. So I think those are the exceptions, but you can do pretty well.

It's just a bug bounty hunter if you if you put your mind to it and you know, go through the right channels. But and there, there are, like you said, Yahoo has hired some of these folks. I know that Google and Microsoft and other companies like that have as well. So it's good to see that. But you know, we are still like we always hear about this talent shortage for cybersecurity and it's how difficult is it really to break in at that junior level, Sean? I mean, it's, there's a lot of openings for junior folks, but I, I feel like in a lot of cases those are pretty tough jobs too. You know they're not the highest paying things and you're going to work some pretty tough hours.

Yeah, I mean it really it. It can be hard to break in. And I've actually been fortunate enough to have been a mentor in a couple different areas where there's some programs, one of them is called Cyversity that I've that I've worked with where you're a mentor for, you know, people who are just trying to break into the industry sometimes from underrepresented backgrounds. And, you know, like it's it, it can be very tough to get that to land that interview because one of the that there are so many applicants for for jobs right now. And that included that's this is before the flood of AI, you know, assisted resumes and interviews and North Korean tech workers.

You know, it's not helping things, but it's, it is like rising above the the noise just just to get that interview is very tough. And it often, unfortunately, I think requires an inn in some way, like you have to know somebody or somebody says, Hey, look at this resume. And and that's that's, you know, it often is like it's not a meritocracy. It can be like, who do you know? Right. But I do think sometimes along with The Who do, you know, type thing, some of that practical experience that you can demonstrate the that we were just talking about, you know, if you were in some sort of bug bounty program when you were in high school or you had a little bit of success with something like that can probably go a long way. I mean, you would know better than I would in the hiring process.

But if you're able to look at something you're trying to differentiate between two potential candidates, you say, well, you know, this girl has actually done this stuff, you know, has had some hands on hacking experience and knows what's going on. It's not just theoretical for her. That could, I would think, go go quite a long way. Yeah, I think one of the things that we look for, especially at, you know, entry level junior talent is like an interest, a passion, you know, that desire to learn and take on, you know, new information. And so, yeah, exactly. You're describing the folks who have been active in clubs or they're, you know, they're active in in groups. Maybe they're going to local meetups, you know, defcon meetups or, you know, B sides or whatever. Like there are places you can go and even if you don't know much, you can feel like, Hey, I'm really interested in this. You get to know people and and then, you know, those connections really can help you, you know, quite a bit, But then it also just demonstrates that you've got that, that drive. And so the way we look at it

when we hire junior people is it's less about, you know, do you know, do you have this cert? Do you know this particular, you know, SIM stack or something? And it's more about like, are you, are you interested in this topic or did you just graduate and you're like, well, I need to find a job. So people say cyber is hot. I'll try that. That's, I think there was a lot of that, you know, probably starting about a decade ago when cybersecurity became, yeah, the new hotness. And you're like, oh, there's all these job openings. There's a lot of money being thrown around, especially in the private sector.

If you're, you know, going into college or thinking about a career change, that could be a good career for you. And a lot of people did that. But they, you know, some of those folks, and I've, I've certainly run into many of them, like this is not my passion. This is just a good a way that I can make a good living. And, you know, have a good career arc, but they're not always the, you know, the most successful. They get, they get to a certain point. They're like, yeah, this is what I do. You know, I work in a sock or I do this, I do DFIR and it's it's really hard, but it's a good living. The, the folks that I feel like are the most successful, at least the, the people that I know are the ones that started out with that curiosity that you described, Sean, that like, you know, they look at something, whether it's a, a computer or a network or whatever it happens to be. And they think, I want to know how that works. I want to know how people make it break, what would happen when it breaks And you know, all of

those sort of cascading effects. And they, they look at it as a problem to be solved. And they have that kind of passion. And that's not always going to be everybody. But, you know, I have a feeling that that's some of what might drive. You know, you mentioned your son really likes technology. Isn't building computers. You're not going to do that just because you're like, I don't know, I don't have anything to do on a rainy afternoon. Like you got to really want to build a computer. Yes, especially nowadays when you can get one, you know, off the shelf for very cheap and it's quite good. Yeah.

And I think again, I'm, I'm again very lucky because I've got this this kid who's got this really high interest. But it's not just technology. It really is like cybersecurity and a lot of this. I don't talk about my work that often at at home, you know, like I don't, I don't want to bore my kids if I go, this is what I did today. But there's definitely like some innate interest there in understanding and breaking systems. And so I think a lot of kids nowadays are going to school and even if they're in person school full time, they've got this like digital environment that they're in.

And whether it's like Google Classroom or it's some black blackboard or whatever, like there's a, there's a digital component to every basically you sort of middle and higher education now. And my, my son was like literally breaking the like admin portal to, to his, his school at the last one. And then he was reporting the bugs to the not to like a bug bounty program, but like to the school and saying like, Hey, I was able to, you know, change this, this argument in the URL and I was able to access this thing. And maybe you, maybe it shouldn't work that way. And I'm like, oh, that's so amazing, fantastic, like great job.

And so, you know, often times, most of our conversations are usually about games. And he plays Minecraft and, you know, loves it. But even now, like even looking at the the gaming conversations, those are often about security too, because it's about, you know, hacking and, you know, he encountered people who were cheating and, you know, wall hacking or whatever. And, you know, we have a lot of conversations about what hacking and the game, what how that translates into the real world and even like the sort of like economic digital currency aspects of it.

So yeah, I think there's a lot that I can sort of translate through the lens of gaming to my kids and teach a lot of sort of cybersecurity concepts. Yeah, I'd love that. I think that the online gaming thing is such an entry point for so many people in the, you know, the current generation and maybe one generation older where that's how they sort of got into, you know, they may not have even had a computer, might have just, you know, been an Xbox or a PlayStation when they were growing up that they used, you know, until they got a phone or whatever it was. But that's such a big entry point for folks. And it's still like a huge thing in the hacker community that that the overlap between the hacker and gaming community is like almost a concentric circle.

You know, it's just, it's crazy. Yeah, exactly like the if you think about the the skill it takes to build a like a hacking program for a modern game nowadays, like those are that's a virus. That's those are those are like malware, like, you know, exploit writers essentially who are, you know, there's a really sophisticated anti cheat systems that are, you know, kind of like EDRS basically for for games. And that's that those skills are quite good. So I think there's a ton of of parallel.

I think you're right that that overlap. And there's a whole subculture of, you know, you mentioned the cheat thing. People like literally selling cheats online. You know, that's big business for those folks just as much as in our world, the, you know, the malware as a service or phishing as a service groups are those cheat systems for, you know, whatever the the game happens to be can make tons and tons of money. It's wild. They can and actually thinking about, you know, other ways that people make money now, like there's a cryptocurrency heists and and that sort of thing.

Whenever we involve are investigating, you know, folks who might be doing that type of activity, a lot of them got their start in like Runescape or, you know, the sort of like this is like the prior generation I think of of. But yeah, I mean, there's just so much overlap. And a lot of the like, initial hacking that they were doing was to go after, you know, rare Runescape handles or, you know, taking over accounts of, of enemies and, and these online platforms. And they realized that's a skill you can monetize. So I think my interest back to our sort of original topic is trying to divert folks away from that kind of dark side into using those skills in a in a positive way. How or I, I'm positive that you've had this conversation with your kids.

At what point did you have the conversation of sort of the dual use nature of not just technology, but also, you know, the term hacker or things like that hacking and like it might mean one thing to me and you, Sean, but to, you know, a federal agent knocking on your door. It has a very different. Meaning, yeah, totally dual use is a great term. I I've definitely talked about how there are like sort of in the older group of of cybersecurity enthusiasts like hacker was like a term of respect for sure. And, you know, like their experience, the kids, kids nowadays, I, I say as an old man, I think their, their view of the term is like, it's a, it's either a negative thing or somebody who, you know, is you have to watch out for online. But like it's also it's somebody who wants to understand and to question and to, you know, take things apart perhaps. And that's, so I, I am trying to

sort of say, Hey, not all hackers are bad. There's a, there's a legitimate hacking, you know, opportunity and career path. And I've talked about, you know, red team operators and people who get paid to hack. And it's so funny because everybody, most people who start out in cybersecurity want to be a red teamer. They want to be a pen tester. And it's like, no, no, no. There are so many different avenues and ways to go as in your career. But for folks really who have that attitude, like, heck yeah. Like, you know, there's a there's a way to to, to be really successful there.

Yeah, part of that probably comes back to the fact that, you know, the media and movies and TV and whatever else it is sort of glorifies the offensive side of it. You know, the especially now. But even way back in things like war games or sneakers or or things like that where it's always like the folks trying to get in and break something, where the other heroes or anti heroes, you know, they were the the folks you were kind of rooting for the defenders.

You're always like, Boo, don't stop them. They're they're the the Goonies doing the cool shit. Right. Like there's not all that much glory in defense. You don't. You get blamed for everything, but you don't always get the credit for just doing your job every day. Yeah. And the defenders, like, they always sort of looked corporate with the suits or whatever. Totally, Yeah. Exactly, But you know, as coming from a lifetime of defense, I and and looking at the sort of really diverse folks in the paranoids, you know, like folks of all different backgrounds and experiences and you know, a lot of folks with like funny colored hair and tattoos and just, you know, it's it is definitely defense is really, actually quite interesting. Like I love being a defender because of the the challenge of it and having to think like an attacker. In fact, is is.

It's what keeps it super interesting. Yeah, to me, that sort of psychological aspect of it and having to put yourself in the shoes of the person on the other side of the screen or fence or whatever metaphor you want to use is the really interesting part for me. It's sort of not an outsider, but somebody looking at it from both sides. You have to understand if you're a defender, as you said, Sean, you have to understand the hackers mentality. You have to know their motivations or or be able to sort of divine their motivations. Are they interested in our IP trade secrets? Are they trying to use our platform to make money illicitly?

What are they trying to do and how can we stop them or divert them or whatever it happens to be? And on the offensive side, they're trying to figure out your, you know, the same thing. What your how would they defend against this? You know, it's everybody uses the chess game or cat and mouse, but it's not that binary that it's a, there's a lot more like branches and sort of, you know, roads you can go down. It's not just one thing or the other. Yeah, the way you're describing it is actually very much how we've organized our, our program here at Yahoo in the paranoids the like a lot of teams and I think a lot of cybersecurity professionals, they don't necessarily think of the person behind the keyboard.

They're like, OK, I'm going to, I'm going to block this attack. I'm going to, you know, set up this defense or this control. But really, you do have to think about what's the motivation of that person behind the keyboard? Why are they doing it? What are they after? What part of their campaign are we seeing? Is it the whole thing? Is it just a little portion of it? And then, you know, how do you, how do you dissuade them? How do you deter them from from doing the thing they're trying to do? Some, you know, there are some opportunistic hackers who, yeah, like you put up a, a higher fence than their ladder and they'll go find a lower fence.

But there are others who they have a objective and, and you're it. And it doesn't matter how how high you make that fence, they're going to bring that higher ladder. And So what else can you do? And you know, there's a lot of talk about imposing cost on, on attackers and adversaries. And I think that's that's a big part of our strategy as well. How does a, how does a platform operator like Yahoo impose that cost? I mean, I, I understand how say governments and law enforcement might do that, but but how do you guys think about that?

Yeah, I think there's a there's a variety of strategies. I think it's part of it really comes back to understanding what their motivation is. And so if it's, if it's a financially motivated adversary, you know, really making it harder and more expensive to do their attacks, it is often enough to dissuade them to go find another platform that is, that is maybe less defended or, you know, doing more to educate our user base. So they don't like, they've got more 2FA, you know, in place. For example, sometimes, you know, we, our legal team will, will, will sue.

We've sued attackers. We've, you know, in some cases gone to law enforcement and said, Hey, this is the thing that you, we think you should look at send this legal process and, and we can tell you about it. It that the law enforcement stuff is always very difficult and challenging because the privacy aspects of our users super important to us, but also in some cases you can't get these folks to stop unless, you know, they're, they're sort of taken off the board in a, in a legal way. So it's a, it's a lot of complexity.

And that's one of the things that I really actually love the most about this role in this work is, is navigating that complexity and educating our partners in the company, in the business about how attacks happen and, and how you can get them to stop and what different ways and, and really how to design systems and products that are more resilient against attacks. OK. That was another thing I was going to ask you is how does your, you know, experience in just your team in general, How do you interact with the product side and inform the way that they think about designing the platforms for for the users?

Yeah, there's, I'm, I'm sure you've heard many people talk about shift left right. Like that's like of course. So, you know, without saying shift left, I think it's a, it's a lot of different ways at Yahoo that we engage with our business partners and the design teams and the product teams. You know, that's, there's, we have a really dedicated and robust application security team that in some cases are embedded in the squads that are building these, these things.

And so we're looking at really early architecture designs and we're looking at, you know, how they want to set up their infrastructure before they even write any code. And we're there providing advice. We have a BISO or a business information security officer program where we've got folks who are actually at the on the business side embedded into product teams, embedded talking to our leaders in the across the company and providing like strategic advice about, you know, different decisions and lines of business to even get into.

I report to our CEO and so I've got a lot of Direct Line of communication to him and then also to our board about what the sort of strategic, you know, risks and opportunities are in certain areas, certain parts of the world. And, and then once something launches that we've got, we've got a lot of teams who are looking at what's the consumer experience like? Is there any abuse on there? You know, all that sort of thing. So I really think it's at every point in that life cycle, we are engaged and we're trying to be we have a, we have a culture and a phrase we use that's called yes.

And like, if you come from a, a improv background, you probably heard that. But one thing we've seen is that if you are the department of no as a security team, then you're, your partners will be like, well, we don't want to engage with you because you're just going to say no or they'll wait to engage because they're, they're like, that's going to be so painful. So they'll actually get months down the wrong path before they come to us. And then we're like, well, I know you want to launch tomorrow, but actually you got to go back a couple of weeks. So we try to be very, you know, understanding and empathetic as a security team to say, Oh, this is what you want to accomplish.

Well, why don't we try this other way instead of the way that you thought that would be the best way because there's other ways a lot safer, but we're going to accomplish the same goal. And by being collaborative. I think that is the, that's the way to approach a, a team that, you know, security is important at Yahoo, but it's also if you're a, a product owner or, you know, a salesperson or whatever, like you are trying to, you know, do your day job and, and do it in a secure way. And we're there to say, OK, here's the most secure way. Let's let's help you and be your partner. The I love it, that collaboration that you just described, which I think every company aspires to and they talk a lot about, but I've seen a million different versions of that over the years and they're not always true. You know, there can be a lot of people out, excuse me, out front talking about collaboration with, you know, from the security team to the product teams and management, etcetera, etcetera.

And you can often tell the organizations where it actually happens because they don't end up putting out products or services where security was an afterthought or where they have to roll something back two hours after they put it out because they didn't think about a specific use case or something like that. Unfortunately, I, I still think it's relatively rare depending on which portion of the technology industry we're talking about, but. It's. I don't think it's the the rule honestly. And I think one of the ways that we've tackled that is we as a security team, we don't own the risk for the business. Like the business owns the business team owns that risk. And so if we're there really to advise and to provide guidance, but if the business wants to do something that is risky, that is it's up to them, but they have to own that and own the consequence of it.

And so, you know, we'd like to say we use an, or I use an analogy of, of like a race car. The business is like a race car going around the track and we want, everybody wants the car to win. We want to to be, we don't want to go so fast it flies off the track. But at the same time, like you can't, you can't win the race if you don't take a few risks. And so we're there to help advise on what's a reasonable risk and what's the amount of cumulative risk. A, a, a business or a company should be owning. And it's so funny when I was coming up in, in cybersecurity, coming from that, like investigations and forensics background, like if you start talking to me about risk, I would fall asleep and, and now I'm like, Oh, I get it. It's really important.

And you know, now I'm, I talk a lot more about risk than I used to, but it actually, it actually matters. Yeah, that's, I laughed because I have so many friends that are in that risk portion of the security world who, you know, came up like you did and just went off on that path for one reason or another. And I would always have those. I'm like, you guys, this is the most boring shit I've ever heard in my life. Like there's there's no there, there's no excitement there. And they're like, well, there is. You just don't really see it. This is like we're the ones that are actually stopping, you know, really bad things from happening in a lot of cases.

Yeah, exactly. You know, depending on the organization, another part of the collaboration concept I wanted to ask you about, Sean, is how much does your team collaborate with other internal teams, you know, at other large platform owners or providers or you know, we can think about Microsoft, Google, Meta, whoever you want to talk about. But when there's large scale investigations or if you want to get outside eyes on something that you guys are seeing, how much of that happens? I would say a pretty fair amount. You know, I, I think the way that I like to look at the whole problem space is that there's not a lot of competition in cybersecurity and especially against defending, you know, our collective platforms against adversaries. And so, you know, the, the sort of metaphor of the rising tide lifting all the boats.

Like we actually do a lot of participation in industry forums. You know, we go to conferences, we speak in enclosed, you know, sort of invite only sessions really with the intention of information sharing and in some cases like helping helping teams who might be less mature. You know, Yahoo has been around for 30 years. The paranoids have been around as a cybersecurity kind of brand for over 20. And you know, we're we. The thing that that really gets a lot of folks excited, myself included, is helping some teams kind of like jump, you know, leapfrog ahead of of. Of the sort of natural order of, of growth. And so if we can say, hey, like we've tried this, this is what didn't work, this is what did work and catch them up a lot faster than that's great because then then they're an ally and we can work together to defend against some kind of common adversaries.

So yeah, I would say there's a, there's quite a bit of of sharing and collaboration even among companies that you think would be competitors. Yeah, I think the the rising tide lifts all boats metaphor, even though, you know, it's a yeah, it's a cliche for a reason, especially in security, because you know, if if you find something that works and you can share that across platforms and help make y'all have the same users, everybody. You know, I'm a Yahoo user, I'm a Google, you know, whatever it is, if you can make everybody just a little bit safer each, you know, every day or whatever, whatever the metric you want to use is it, it benefits everyone.

Yeah. I mean, the, the global cost of cybercrime is, you know, in the trillions, right. And if we can do, if we can make that more expensive for the adversaries and, and really, you know, if we can eliminate entire classes of attacks, then I think, you know, we're all better as, as consumers, as, you know, global citizens, as, you know, employees at companies like this is Nope. Everybody wins when there's a lot of, you know, partnership and collaboration to fight cybercrime and and abuse.

Yeah, and I mean even I'll use the word simple. It's not easy, but it's simple or excuse me, effective. Implementing something like 2 FA across, you know, accounts say on Yahoo was a relatively early adopter of that. I remember, you know, getting the the e-mail saying you can now do this on your Yahoo account. I was like rad, good, let's do this. That's still not the norm. Like one of the banks that I use still doesn't have, you know, mandatory 2FA, which is completely bananas to me for in 2025.

But these are steps that you can take. I know they're not easy to implement on the back end on the platform end, but they're known effective things that can make user safer. You know, immediately as soon as they're rolled out. Yeah. And it's been very exciting to see industry as a whole take on things like pass keys and like, I mean, you know, it, it used to be hard, like providers had to kind of roll their own. And then you you'd see the Fido Alliance come together and start to look at common approaches. Yet pass keys come out that are now being adopted with common language across platforms.

So, you know, consumers can say, oh, I have a pass key here on my, you know, on my Target app and now I have one of my, on my Yahoo app and I know what that means. That's finally things are kind of converging. But it's also, it's tough because, you know, you have to sort of meet the user where they're at and sometimes the user isn't ready to go on that journey with you. And so, you know, I feel really good about, I won't name names, but I feel really good about our, our 2FA adoption rates and our consumer base. We're, we're doing really well and you know, ahead of a lot of folks in industry.

But you know, we've talked we should we turn on for everybody. And it's like, well, you can't do that because not everybody is is going to be able to. They're not there yet. Right. Yeah. I mean, there are plenty of people that, I mean, as crazy as this is to say in 20 people that just don't have smartphones or just don't, you know, don't have a backup e-mail account or don't have a way to implement 2FA. They wouldn't know how to use a hardware security key or what that, you know, what that would look like for them. So yeah, you can't just unfortunately flip the switch and be like, hey everybody, tomorrow morning we're using 2FA.

And if you can't, then thanks for coming. We'll see you later. Right, exactly. It's, it's, it's interesting for, you know, a platform like Yahoo, a lot of people think, oh, Yahoo. And when in reality, you know, half of our users are, you know, Gen. Z or millennials. But like, I think a lot of people sort of tend to think that it's an older, you know, kind of user base when in reality it's not. But you know, you have to sort of you have to be able to support all types of users and whether it's, you know, my grandmother who would I think struggle with turning on multi factor authentication or whether it's somebody who is, you know, a digital native, I mean, it's you just designed for everybody. Yeah, alright, before I let you go, I think I'm obligated to ask you about AI just.

Because it wouldn't be a podcast if we didn't talk about it. It's literally in the the Constitution for podcasters. Yeah. I just wanted to add like in general, is there anything that's that's exciting you on the defensive side that ways that you've seen people implementing AI or anything like that? I've I've heard some interesting things but honestly a lot of what I've seen so far is kind of AI wrapper type stuff and nothing super exciting honestly. I think in the product space it's still early yeah and I, you know, there's there's always a little bit behind the curve when it comes to building security products, but I, I think the the actual technology itself is really exciting and there's I'm I'm unlike a lot of ceases.

I know I'm I'm pretty like bullish on AI as a as a concept. We're starting to adapt it a lot within my team and we're looking at, you know, ways to make, if you look at our, our SIM and like our, our, our security operations center, our SoC folks, you know what, how can we help those analysts, you know, get, get more context quickly and, you know, take actions that would otherwise take them 5 minutes. Maybe we can condense it down to, you know, 10 seconds.

I, I think the, the great thing about AI is that it reduces toil, you know, the, the balance is not, it's not about using AI to get rid of jobs or to eliminate expertise, but instead it's about making the most out of folks and, and their skills and their, and you, you free them up to, to sort of like use your imagination. And if you can automate away the things that would take them that aren't great uses of their minds so they can spend more time with their creative part of their mind. Like that's that's I think the for security and really for a lot of industry is, is the benefit of AI. Yeah, that's the most, I guess, logical and effective way that I've seen people using it on the defensive side is, is the automation in a in a sock or things like that, You know, automating those, as you said, sort of mind numbing, repetitive, Yes, this has to be done. But is there a way that we can use AI to do this, so that we can free up the humans to, yeah,

actually do some creative and critical thinking? But there is also really cool stuff happening in application security space and it's, it's like it's sort of catching vulnerabilities as they're entered into code, you know, raising PRS and, you know, and, and maybe even committing fixes immediately and then using that to sort of like do just in time education for developers. Like a lot of that stuff is super exciting. And there are places within Yahoo we're, we're starting to roll that out as well.

And you know, it's not just like we're fixing things for people behind the scenes. You want to make sure folks are understanding, hey, this is the problem that we fixed it for you and here's how to avoid it next time. That kind of stuff is is really, really cool. That to me, that what you just said is a key part of it is we're not just going to fix it and keep going. We have to tell you what the mistake was and how we fixed it. Otherwise, you're going to keep making that mistake. Yeah. We can't just gloss over and be like AI fixed it. Right, one, one challenge, I know we're, we're coming up on time, but one challenge I think is that I've been having with other folks, other Cisos is how do you in the age of AI, how do you get folks like the risk is that you might automate away a lot of those really junior entry level roles. And then how do you build that talent pool? How do you build that pipeline so you can, you know, hire a, a mid or a senior person if you've automated away all the junior roles?

And so, you know, I think the way that I try to approach it with my team is we're not automating your job away, but we are, you know, we're helping you grow faster and do more interesting things, I guess. But yeah, like with this, that's a problem we haven't solved industry wide yet. No, but that's a good way of putting it. You know, helping you get there faster and you know, we're not going to take your job and just turn it over to the entity or something. And back to actually, you know, our discussions about kids. I, I introduced my two older kids who are 14 and 12 to the Matrix two weeks ago.

And and they watching them watch it through the eyes of their interaction and growing up with AI now has been really interesting. And they're like, oh, we're reading about this, you know, like, what if AI takes over the world and, you know, does all this stuff? And it's like, yeah, here's here's the sort of formative thinking on that from a cultural perspective at least. Super. Interesting that's I need to go and rewind. I haven't seen that movie all the way through in probably 10 or 12 years or something like, you know, long before this current wave of AII wondered how well how how did it hold up? Like, what did you think of kind of the, well, this isn't exactly how things, you know, turned out. I mean, it was, yeah, sure, there are parts that are kind of like cringe worthy now, but on the whole it holds up well. And this was actually on the heels of of my son talent talking to me about the study that was published around all the different AIS that would that would lie to you and would sort of cheat if if you threaten to like turn it off or something.

And sort of like the self preservation that's that you are seeing emerge super fascinating, but it's it was nice to see that it held up because not not everything from that, you know, that long ago does. No, no, absolutely not. No, that's cool. Well, I think that's a great place to end. Sean, Thanks so, so much for coming on and thanks for giving me so much your time. This is great. Yeah, then this is super fun and I will do it again sometime. All right. Talk to you soon. Thanks. Awesome.