1
00:00:00,000 --> 00:00:09,000
Hello and welcome to another episode of Logically Speaking. This is our events edition. I'm Tatiana Harris with Logically.
2
00:00:09,000 --> 00:00:13,000
In this episode, I talk with Matt Lee from PAX 8.
3
00:00:13,000 --> 00:00:17,000
You are the Senior Director of Security and Compliance at PAX 8.
4
00:00:17,000 --> 00:00:18,000
Yes, that's correct.
5
00:00:18,000 --> 00:00:26,000
Could you tell me a little bit more about yourself and how you got into security and IT in general?
6
00:00:26,000 --> 00:00:35,000
Yeah, sure. So I actually started as a younger person doing... I was a banker. I had been a stockbroker when I was 19.
7
00:00:35,000 --> 00:00:39,000
I moved in and every three or four years I would change entire careers.
8
00:00:39,000 --> 00:00:47,000
I either get offended by something or bored by something or felt like I maybe mastered something where it wasn't like a fun thing to play with in my head anymore.
9
00:00:47,000 --> 00:00:55,000
And so I went from investments to banking and banking to mortgages, mortgages to non-numerous and numismatic gold brokerage.
10
00:00:55,000 --> 00:00:59,000
So I started trading in collectible and non-collectible gold and bullion.
11
00:00:59,000 --> 00:01:09,000
And then I traveled around and was a diamond buyer for a few years, buying and selling milli or small diamonds, 0.1 carat or less diamonds, with a couple of Armenian guys.
12
00:01:09,000 --> 00:01:15,000
And so I just have generally been always curious and always stepping into different jobs.
13
00:01:15,000 --> 00:01:23,000
The challenge is when I moved to Wichita, Kansas and started as a break-fix technician at a small MSP, I was hooked.
14
00:01:23,000 --> 00:01:27,000
Because I could never get broad enough to understand all the technology.
15
00:01:27,000 --> 00:01:32,000
I could never get deep enough to understand anything to a point where I was at an exhaustion level or couldn't learn more.
16
00:01:32,000 --> 00:01:37,000
And so it just kind of kept me into a constant sense of curiosity.
17
00:01:37,000 --> 00:01:46,000
But it also led me, just like you guys get to experience at Logically, it led me to be able to go and ask questions of hundreds of different businesses, different business types.
18
00:01:46,000 --> 00:01:52,000
How do you make money? What makes you happy? What drives your world? And be curious there too and never run out of that.
19
00:01:52,000 --> 00:02:01,000
It always kept allowing me to keep broadening my understanding of the world and then use that to help them be more successful with technology, with security.
20
00:02:01,000 --> 00:02:03,000
It's always the same.
21
00:02:03,000 --> 00:02:10,000
How did I get into security, however, was as we became a very large MSP, we got punched really hard in the face.
22
00:02:10,000 --> 00:02:19,000
And we lost a bunch of money to Soda No Kibi Ransomware Gang through an acquisition where we lost an entire million dollar acquisition from a revenue perspective.
23
00:02:19,000 --> 00:02:23,000
We lost the insurance claim from a cost perspective and we missed the opportunity.
24
00:02:23,000 --> 00:02:27,000
We could have bought another MSP that would have been better for us, that wasn't screwed like that.
25
00:02:27,000 --> 00:02:41,000
And so when that played out, the next 18 months of my life were in lawsuits or threatened lawsuits, conversations with attorneys and forensics responders and federal authorities and all of that for the next year and a half.
26
00:02:41,000 --> 00:02:52,000
Which allowed me to then focus so very heavily on security in general and driving that for that MSP for the next few years before we sold successfully and I got my first exit.
27
00:02:52,000 --> 00:02:56,000
But that's how I kind of came into cybersecurity as a practitioner.
28
00:02:56,000 --> 00:03:01,000
Now I find myself as an educator and as a subject matter.
29
00:03:01,000 --> 00:03:10,000
I won't ever say expert because you can't ever be an expert, but I would say a subject matter student perpetually and trying to drive and change subject matter where possible throughout our industry.
30
00:03:10,000 --> 00:03:14,000
So I'm lucky enough and blessed enough that Pax8 sponsors that.
31
00:03:14,000 --> 00:03:22,000
I like to say they sponsor my breakfast, lunches and dinners and help my mission to drive us all to have a better life through technology and security.
32
00:03:22,000 --> 00:03:24,000
That's kind of the background.
33
00:03:24,000 --> 00:03:28,000
I love that you don't refer to yourself as a subject matter expert.
34
00:03:28,000 --> 00:03:29,000
No.
35
00:03:29,000 --> 00:03:31,000
Like in a constantly evolving field, you can never be an expert.
36
00:03:31,000 --> 00:03:32,000
That's exactly it.
37
00:03:32,000 --> 00:03:34,000
It's too fast moving for you to be an expert.
38
00:03:34,000 --> 00:03:37,000
Now you can be very experienced in it.
39
00:03:37,000 --> 00:03:42,000
You can have a lot of losses and failures and successes that build up our life and understanding of things.
40
00:03:42,000 --> 00:03:48,000
But I just don't think experts a fair term in a non static body of knowledge is my point.
41
00:03:48,000 --> 00:03:50,000
Yes, that definitely makes sense.
42
00:03:50,000 --> 00:04:06,000
So as someone in like a security and compliance role, what do you see on a day to day basis that maybe the average person wouldn't think about or they might consider it,
43
00:04:06,000 --> 00:04:08,000
but not really to the extent that you see it every day?
44
00:04:08,000 --> 00:04:09,000
Great question.
45
00:04:09,000 --> 00:04:12,000
I don't think people realize how bad it really is.
46
00:04:12,000 --> 00:04:15,000
And I don't mean that to paint this fear and situation.
47
00:04:15,000 --> 00:04:18,000
I mean, nobody's got it figured out.
48
00:04:18,000 --> 00:04:19,000
Right.
49
00:04:19,000 --> 00:04:29,000
When it comes down to the vendors that write your software, that prepare your stuff that you consume all the way down to what you do as a service, all the way down to what your customers and consumers are doing to scare themselves.
50
00:04:29,000 --> 00:04:42,000
We're all at the state where we've defined security as tools, we've defined certain things, but we aren't really prepared for security being the very fabric of how we make decisions and what we do around around our technology.
51
00:04:42,000 --> 00:04:43,000
It's not built in.
52
00:04:43,000 --> 00:04:48,000
Like in a car, I have an airbag and it's already there and I don't have to turn it on when I get it.
53
00:04:48,000 --> 00:04:53,000
My seatbelt dings at me relentlessly if I don't buckle up and I didn't have to do anything to make that happen.
54
00:04:53,000 --> 00:05:01,000
Yet in security in our world today with technology, you're going to buy something that will be the least secure you'll ever see it and you must then improve it.
55
00:05:01,000 --> 00:05:05,000
And so it's not built in and even at the manufacturers that create this software.
56
00:05:05,000 --> 00:05:06,000
Right.
57
00:05:06,000 --> 00:05:11,000
There's a call to action from CISA right now that says secure by design, secure by default.
58
00:05:11,000 --> 00:05:15,000
Basically saying you need to make it where the airbags are turned on.
59
00:05:15,000 --> 00:05:17,000
But additionally, you need to make sure there's airbags.
60
00:05:17,000 --> 00:05:19,000
It kind of comes into that conversation.
61
00:05:19,000 --> 00:05:22,000
So we're in that stage of cybersecurity today.
62
00:05:22,000 --> 00:05:29,000
Yeah, that's a huge topic around the event today, too, like not just a I but just security by design.
63
00:05:29,000 --> 00:05:30,000
Yeah.
64
00:05:30,000 --> 00:05:36,000
Like having having everything and having that mindset set in security.
65
00:05:36,000 --> 00:05:41,000
And the only reason you can have that as a just exposition is you're from the other side of that just exposition.
66
00:05:41,000 --> 00:05:42,000
Right.
67
00:05:42,000 --> 00:05:43,000
And you're not secure by design.
68
00:05:43,000 --> 00:05:45,000
You slapped it together and said it'll be fine.
69
00:05:45,000 --> 00:05:46,000
It needs to work.
70
00:05:46,000 --> 00:05:50,000
And I've had executives say to me, Matt, a lot of money is made on shitty software.
71
00:05:50,000 --> 00:05:51,000
Right.
72
00:05:51,000 --> 00:05:52,000
And I genuinely believe that.
73
00:05:52,000 --> 00:05:53,000
And they're right.
74
00:05:53,000 --> 00:05:54,000
There's been no repercussions.
75
00:05:54,000 --> 00:05:55,000
Right.
76
00:05:55,000 --> 00:06:00,000
If you look at CISA, they released with the president the national cybersecurity strategy back in March.
77
00:06:00,000 --> 00:06:07,000
And in that, they said markets often impose upon the weakest essentially, I'm summarizing, upon the weakest of those consumers,
78
00:06:07,000 --> 00:06:11,000
the risk while the profit rides on the ones creating that risk.
79
00:06:11,000 --> 00:06:14,000
And it's this very interesting point where that's the case.
80
00:06:14,000 --> 00:06:15,000
Right.
81
00:06:15,000 --> 00:06:17,000
They've made software they know they're not investing in to make better.
82
00:06:17,000 --> 00:06:20,000
They're not going to do the things to make it cursorily more secure.
83
00:06:20,000 --> 00:06:22,000
And yet they still make the same profit.
84
00:06:22,000 --> 00:06:25,000
In fact, they're rewarded for not making it more secure.
85
00:06:25,000 --> 00:06:26,000
Right.
86
00:06:26,000 --> 00:06:27,000
Right.
87
00:06:27,000 --> 00:06:31,000
And so you're in this weird world where now the call to action is be secure by design, be secure by default, because it wasn't before.
88
00:06:31,000 --> 00:06:36,000
And so I think that's a great call to action right now and change in our world that matters a lot.
89
00:06:36,000 --> 00:06:37,000
So how do you feel?
90
00:06:37,000 --> 00:06:46,000
I've heard someone mention, I think it might have been at ChannelCon last week, about switching the onus of security to the end user.
91
00:06:46,000 --> 00:06:52,000
And not that it has changed to the end user, but that's how it is.
92
00:06:52,000 --> 00:07:03,000
Like the security by design mindset that people are wanting to implement now, it's shifting from putting the responsibility for the end user to buy its driver software
93
00:07:03,000 --> 00:07:11,000
or do all the things that are trying to make insecure technology and systems secure like as an add-on.
94
00:07:11,000 --> 00:07:14,000
And you're saying it needs to move up the chain and move up.
95
00:07:14,000 --> 00:07:15,000
Yeah.
96
00:07:15,000 --> 00:07:16,000
Right.
97
00:07:16,000 --> 00:07:19,000
I think that's a part of just a byproduct of how this has worked.
98
00:07:19,000 --> 00:07:27,000
I mean, think about even as an MSP, five years ago serving the SMB or small mid-sized business, nobody cared about a lot of the things that are offered today.
99
00:07:27,000 --> 00:07:28,000
Right.
100
00:07:28,000 --> 00:07:29,000
They didn't want a SOC as a service.
101
00:07:29,000 --> 00:07:30,000
They didn't want EDR.
102
00:07:30,000 --> 00:07:31,000
They didn't want to do MFA.
103
00:07:31,000 --> 00:07:33,000
They didn't want to do all these things.
104
00:07:33,000 --> 00:07:40,000
And yet we then had to add costs to sell that as an a la carte thing instead of making it part of our world.
105
00:07:40,000 --> 00:07:44,000
Yet today, more and more it's becoming part of our world and you can't choose not to have it.
106
00:07:44,000 --> 00:07:46,000
And so you have this drift of it moving.
107
00:07:46,000 --> 00:07:56,000
I think the challenge with asking the consumers to make a decision on what they want to do or not is phallic in the sense that they don't understand enough to even make that decision.
108
00:07:56,000 --> 00:08:01,000
And oftentimes you're having to do stuff like this to try to teach them so they can then make a decision.
109
00:08:01,000 --> 00:08:05,000
But my attorney, my CPA, my doctor, they don't do any of that.
110
00:08:05,000 --> 00:08:10,000
They don't go, man, I really need Matt to understand methyl acillin resistant staphylococcus aurora.
111
00:08:10,000 --> 00:08:17,000
Because if you don't understand MERS and its resistance to common antibiotics, then no, they go, you need to take this pill or you're going to die.
112
00:08:17,000 --> 00:08:19,000
It's kind of that way, right?
113
00:08:19,000 --> 00:08:22,000
But yet in our world, we have to educate and they want to understand and they want.
114
00:08:22,000 --> 00:08:27,000
So I say all this to say I actually think the burden needs to shift uphill.
115
00:08:27,000 --> 00:08:33,000
And at some point, logically, is going to say I'm not taking you as a client because if you're not doing these base things, I'm not it's not worth it to me for you.
116
00:08:33,000 --> 00:08:39,000
And you've probably even seen that in your organization just from the caliber of the humans I know that work with you.
117
00:08:39,000 --> 00:08:41,000
I know that's probably part of their world.
118
00:08:41,000 --> 00:08:47,000
So I think you're seeing it go to, yes, the identity and the human matter at the end of that chain.
119
00:08:47,000 --> 00:08:53,000
But the the onus to your point is going to shift up and shift up to the service providers like logically.
120
00:08:53,000 --> 00:09:00,000
And it's going to shift up to the software manufacturers to say, why do I buy Microsoft tenants at their most insecure state?
121
00:09:00,000 --> 00:09:04,000
Why do I get my Google tenant with nothing turned on from a security perspective?
122
00:09:04,000 --> 00:09:14,000
Like at what point should that be your responsibility and it also at what point should that be part of my stack and my skew, which follows those same patterns logically at some point sold?
123
00:09:14,000 --> 00:09:17,000
I'm sure security tools separate more and more.
124
00:09:17,000 --> 00:09:18,000
Those things become part of the skew.
125
00:09:18,000 --> 00:09:20,000
And that's what we're selling. And there is no there's no dilemma.
126
00:09:20,000 --> 00:09:34,000
And I think that's a very important aspect there. Right. It's it's the whole package. And to your point, there are always going to be those people that you tell them and you educate them time and time again.
127
00:09:34,000 --> 00:09:40,000
Like, hey, enable multi factor authentication. And they're like, no, it's too much. It's inconvenient. Yeah. Yeah.
128
00:09:40,000 --> 00:09:42,000
Yeah. 100 percent. We've all heard it.
129
00:09:42,000 --> 00:09:45,000
And those same people, there's an interesting aspect of this, though, too.
130
00:09:45,000 --> 00:09:51,000
That may follow their own Darwinism in that regard. And I think you're seeing that more and more where there's such a separation.
131
00:09:51,000 --> 00:09:58,000
The people that don't do it. The cost is there. They do go out of business. They do get punched in the face. They do lose.
132
00:09:58,000 --> 00:10:04,000
And at some point, the market rewards the ones that don't and destroys the ones that do make that action.
133
00:10:04,000 --> 00:10:14,000
And I think that's what we as an industry have to be better about being OK with and saying if you don't choose to move forward at some point, somebody decided, no, that internal combustion engine is a bad egg.
134
00:10:14,000 --> 00:10:18,000
Let's stick with steam. And then they went out of business. Right.
135
00:10:18,000 --> 00:10:24,000
There's you look at, you know, blockbuster versus Netflix, even to bring it more proximal.
136
00:10:24,000 --> 00:10:31,000
They said, hey, maybe we'll stick in this normal distribution while somebody else was changing to a modern method of distribution and change the world.
137
00:10:31,000 --> 00:10:42,000
And so I think that we're in that space where those people at some point will be destroyed enough that there will be an acceptance of that standard more and more or they just won't be in business.
138
00:10:42,000 --> 00:10:48,000
The best piece and and consumers, it's an adapt or die type of situation. Yep.
139
00:10:48,000 --> 00:10:53,000
And it always kind of has been right. This is just a different front for us to focus on than before.
140
00:10:53,000 --> 00:11:00,000
I think that kind of falls in line with one of my other questions, which was AI is a huge topic.
141
00:11:00,000 --> 00:11:10,000
It has been practically all year. What do you see as some of the biggest benefits, but also maybe some of the toughest challenges that
142
00:11:10,000 --> 00:11:19,000
companies are going to face over the next few years with regard to AI, like in technology and security, like across the board?
143
00:11:19,000 --> 00:11:23,000
I think yes is a good answer. Yes. Just all of the things.
144
00:11:23,000 --> 00:11:35,000
No, genuinely, I think if you look back over history, there have always been fundamental technology shifts that that now everything changes as a result.
145
00:11:35,000 --> 00:11:45,000
Great example, cars invented in the late eighteen hundreds changed the entire landscape of the world from a city versus suburb perspective,
146
00:11:45,000 --> 00:11:52,000
especially in the United States overnight, right? Long before we ever had airbags, long before we had seat belts.
147
00:11:52,000 --> 00:12:00,000
And I say that to say we build technologies that move and change our world fundamentally first and then sort out the negative bits.
148
00:12:00,000 --> 00:12:05,000
Right. We didn't go maybe it's bad to have a shovel roll or a pinto get hit in the back end and blow up.
149
00:12:05,000 --> 00:12:11,000
Maybe it's and so then you start adding in the National Motor Vehicle Safety Act in like 1965, 1966.
150
00:12:11,000 --> 00:12:14,000
We're talking almost a decade after the invention of that technology.
151
00:12:14,000 --> 00:12:20,000
So when you think about the fundamental nature of that, it changes more than just one thing.
152
00:12:20,000 --> 00:12:26,000
It's a multifactor change. And if you look at tractors, tractors made cities.
153
00:12:26,000 --> 00:12:35,000
The mechanization of farm equipment made cities possible because I didn't have to have 17 kids to put enough taters in the ground and tend them all year so we can eat.
154
00:12:35,000 --> 00:12:41,000
Right. I could buy that in bulk and I could move to the city and create all these industries and all these things that are magical.
155
00:12:41,000 --> 00:12:46,000
And we live with every minute today fundamentally changed from some piece of technology.
156
00:12:46,000 --> 00:12:51,000
I think A.I. or machine learning or LLMs or whatever flavor you're calling it today,
157
00:12:51,000 --> 00:13:00,000
but really this understanding of more and more technical improvement of capabilities and in some ways removing human jobs, changing human jobs.
158
00:13:00,000 --> 00:13:08,000
So that's my first point. I think technologies like A.I. and machine learning LLM, which I know I'm on a stupid bandwagon saying the same stuff,
159
00:13:08,000 --> 00:13:17,000
but they will fundamentally make it where I can use better robotic process automation, better ways to automate away a role or a job.
160
00:13:17,000 --> 00:13:24,000
And so I think the advice is companies need to lean into the understanding of what this can bring and what it can do to free you up
161
00:13:24,000 --> 00:13:28,000
and can make it where you can dedicate that human to doing something way better.
162
00:13:28,000 --> 00:13:34,000
Look at what we talked about earlier about the background audio you're going to have to edit out, which if you're listening this now won't have it anymore.
163
00:13:34,000 --> 00:13:43,000
But there's more work to be done. And yet at the same time, Adobe has released a pretty awesome machine learning method that will remove the background noise.
164
00:13:43,000 --> 00:13:51,000
What if you had to do that for five hours instead of now 10 minutes? Can you focus on doing more interviews or better or putting out better quality product with your time?
165
00:13:51,000 --> 00:14:01,000
Yeah. And I think that's what businesses need to understand with these technologies is that they will be used first to make a better product and better profit for your customers.
166
00:14:01,000 --> 00:14:11,000
Now the flip side of this coin, what will it do to introduce new risks and new vulnerabilities that come into play or new vulnerabilities that can create risks?
167
00:14:11,000 --> 00:14:15,000
Just because I'm now honoring my buddy that I had a call with earlier, Norman Clatchley.
168
00:14:15,000 --> 00:14:23,000
But you're going to see this increase. People are stupid. By nature, we always take advantage of what's going to benefit us before thinking of the repercussions.
169
00:14:23,000 --> 00:14:38,000
Soon as OpenAI came out with their now easily accessible chat GBT, which isn't the first one, it's just the first one that's been made massively accessible to people in a meaningful way that was more than just novelty and had huge adoption.
170
00:14:38,000 --> 00:14:44,000
I mean, like that growth curve was like this. But those same people in that, I guess they can't see my hand motions and non-video things.
171
00:14:44,000 --> 00:14:49,000
So I'm doing a hockey stick curve. Yeah. But or asymptotes, if you will.
172
00:14:49,000 --> 00:14:55,000
But the point is, is that when that growth goes up, how many of those humans put in sensitive information that then became a leak?
173
00:14:55,000 --> 00:15:05,000
Like we've already seen class action lawsuits about that very thing of people putting in sensitive data in a shared learning environment that then can be regurgitated to another human.
174
00:15:05,000 --> 00:15:16,000
We don't think about the security first. So we will create more challenges from the vulnerabilities that we introduce that allow more threats to impact us, which means that our risk has gone up.
175
00:15:16,000 --> 00:15:22,000
But you have to imagine people are not in business to avoid risk. That's a broken thought process.
176
00:15:22,000 --> 00:15:35,000
I mean, there's still Alyssa Miller, famous CISO, she's probably here, but she spoke last year and said, we're told as InfoSec professionals that the language of business is risk, horse crap.
177
00:15:35,000 --> 00:15:43,000
The language of business is profit, raw, unadulterated profit. We take a risk. And by the time we started business, we have accepted all of those risks.
178
00:15:43,000 --> 00:15:46,000
We've done nothing to mitigate them. We took those risks to make a profit.
179
00:15:46,000 --> 00:15:59,000
Do we deal with those risks and say that one's too much and it will exceed my profit and I need to deal with that's where the risk equation gets interesting around AI is that we will often receive a better profit, a better FTE or full time employee usage.
180
00:15:59,000 --> 00:16:06,000
All of those things far before we actually understand the risk profile we've created by doing so and how we chose to do so.
181
00:16:06,000 --> 00:16:10,000
So I think we will see a John maddening it here a little bit.
182
00:16:10,000 --> 00:16:20,000
We're going to see fundamental shifts in what businesses do and how they employ humans as a result of more and more of these type of machine learning and AI type algorithms that they're out there.
183
00:16:20,000 --> 00:16:26,000
But we're also going to see at least initially a clamoring to create what what's secure enough.
184
00:16:26,000 --> 00:16:30,000
What are the baseline standards? What should we actually do to secure this?
185
00:16:30,000 --> 00:16:33,000
Most of that language hasn't even begun to exist yet.
186
00:16:33,000 --> 00:16:38,000
Yet here we find it where people are actually having it right stuff for them every day.
187
00:16:38,000 --> 00:16:42,000
Right. And so I think it's a little buzzword today.
188
00:16:42,000 --> 00:16:48,000
And even really the capabilities are somewhat that of a pretty angry teenager that might lie to you.
189
00:16:48,000 --> 00:17:06,000
Right. At the end of the day, it will continue to grow and you will continue to see more and more verticalized value out of these businesses that are just like that city being born where now there's trash people and now there's there's movies and now there's things we can go to because of that city density in the amount of delivery and demand from free time.
190
00:17:06,000 --> 00:17:09,000
We're going to see those same things play out and it will be lovely.
191
00:17:09,000 --> 00:17:14,000
I mean, it will be amazing. It's just going to come with a lot of challenges and loss probably as well.
192
00:17:14,000 --> 00:17:31,000
Yeah. And there was one talk earlier on, I guess, AI and risk management and policy and setting in certifications and new ways of holding AI and machine learning to certain standards across the board.
193
00:17:31,000 --> 00:17:51,000
And one of the important points was getting getting technical people, people that understand those areas and having them having them and their voice heard and understood so that they can actually make standards that are applicable and that can grow into what they're predicting.
194
00:17:51,000 --> 00:17:55,000
This is how the cybersecurity industry has always worked right RFCs request for comments.
195
00:17:55,000 --> 00:18:06,000
Yeah, somebody with a terrible idea puts it out there and ask others to say terrible things or good things about it until it becomes an actually accepted principle like TCP IP came from an RFC.
196
00:18:06,000 --> 00:18:11,000
We've seen these things play out forever and it's always been a practitioners consensus model.
197
00:18:11,000 --> 00:18:12,000
Right. If you will.
198
00:18:12,000 --> 00:18:14,000
But I think we've gone a long way away from that.
199
00:18:14,000 --> 00:18:16,000
I think you've let marketing teams.
200
00:18:16,000 --> 00:18:17,000
Nothing personal.
201
00:18:17,000 --> 00:18:25,000
But I think we've let marketing teams define terms and muddy the language that we've actually all gotten a little dumber in cases.
202
00:18:25,000 --> 00:18:29,000
So, yeah, yeah, I completely 100% agree.
203
00:18:29,000 --> 00:18:33,000
Marketing will make things sound snazzy, but they don't have.
204
00:18:33,000 --> 00:18:36,000
It's not a lot of benefit or value behind those words all the time.
205
00:18:36,000 --> 00:18:40,000
Sometimes. Yeah, it makes a little bit more confusing.
206
00:18:40,000 --> 00:18:47,000
I'd like to know since you've been working in in technology and security for what over a decade.
207
00:18:47,000 --> 00:18:49,000
It's been a long time. Yeah.
208
00:18:49,000 --> 00:18:51,000
My hair didn't come for free.
209
00:18:51,000 --> 00:18:54,000
And yes, since you can't see he's got a nice long beard.
210
00:18:54,000 --> 00:18:55,000
I was finding the gray ones in there.
211
00:18:55,000 --> 00:18:56,000
Each one's an incident.
212
00:18:56,000 --> 00:18:58,000
Yes.
213
00:18:58,000 --> 00:19:10,000
I'd love your perspective on how you've seen technology change and how the imperative for security has grown and changed like over the last decade.
214
00:19:10,000 --> 00:19:14,000
And I know you've kind of alluded to some of these things in some of your response earlier.
215
00:19:14,000 --> 00:19:15,000
I just wrote as well.
216
00:19:15,000 --> 00:19:16,000
Yes, exactly.
217
00:19:16,000 --> 00:19:22,000
You know, what's interesting about our world today is we are all starting to get it right.
218
00:19:22,000 --> 00:19:31,000
And I mean by that is the SAS providers or software service providers, the software manufacturers, the tools, the security, the practitioners, all of us are starting to wake up and get it.
219
00:19:31,000 --> 00:19:42,000
And at a time where we're also shifting from a very infrastructural view of the world, what I mean by that is if I start a company tomorrow, there's almost zero chance I buy a server, almost zero.
220
00:19:42,000 --> 00:19:47,000
Right. There's almost zero chance I can put a server in the cloud that I'm doing in a traditional server model, almost zero.
221
00:19:47,000 --> 00:19:49,000
I'm probably going to have an identity.
222
00:19:49,000 --> 00:19:54,000
I'm going to sign in with that identity in the cloud applications and SAS applications.
223
00:19:54,000 --> 00:19:55,000
And that's my world.
224
00:19:55,000 --> 00:20:02,000
What's interesting about that is there's such an interesting difference in what we can actually script and automate in those two.
225
00:20:02,000 --> 00:20:13,000
If I think about having that server and infrastructure world and then just the variables that have to account for to do some type of update or protect it in a certain way, I'd have to have the network type and structure delineation.
226
00:20:13,000 --> 00:20:23,000
I'd have to have the server type and what server version it is. It is server 08, 8R2, 12R2, 16, 19, 20, 22. Is it those? Is it 4th function 2003, 3R2, 8, 8R2, 16?
227
00:20:23,000 --> 00:20:32,000
Where are we? All these variables that make it where you just have a very hard time normalizing and coming up with an automation that works universally.
228
00:20:32,000 --> 00:20:36,000
But let's look at that picture I just described of an identity provider and a SAS provider.
229
00:20:36,000 --> 00:20:44,000
Like to make it easy for anybody in your audience that isn't as technical, think about signing in with Facebook for the first time into some other application.
230
00:20:44,000 --> 00:20:49,000
You wanted to play that bird game or something and you signed in with either a password or your Facebook.
231
00:20:49,000 --> 00:20:50,000
You just click Facebook.
232
00:20:50,000 --> 00:20:55,000
That's the concept of an identity provider being Facebook and a consuming entity being Angry Birds.
233
00:20:55,000 --> 00:21:02,000
Well, in our world, that becomes Microsoft as the identity provider or Okta, but probably Microsoft for most of your clients.
234
00:21:02,000 --> 00:21:06,000
And then when they consume their Salesforce, they just sign in with Microsoft.
235
00:21:06,000 --> 00:21:18,000
That type of model means that for every Salesforce and every Microsoft, I have all the variables, I have all the commands I need from an API or application programming interface perspective.
236
00:21:18,000 --> 00:21:23,000
And it's very known as it changes, it's changed known, which means I can script an experience.
237
00:21:23,000 --> 00:21:28,000
I can script security the same way for a hundred customers exactly the same way.
238
00:21:28,000 --> 00:21:32,000
And if it fails, it fails systemically and if it works, it works systemically.
239
00:21:32,000 --> 00:21:36,000
That's very different than, oh, which time did you last update your server?
240
00:21:36,000 --> 00:21:39,000
We need to buy a new OS. I can't do that in eight. I can only do it in twelve.
241
00:21:39,000 --> 00:21:45,000
Whereas in Microsoft, it just grows as it grows and everybody has the same benefit from it, the same API calls, the same everything.
242
00:21:45,000 --> 00:21:50,000
Which means back to your real core question of what's changed in security, what's changed in our world.
243
00:21:50,000 --> 00:21:54,000
I can actually now do the nerdy bits in a script.
244
00:21:54,000 --> 00:21:57,000
I don't have to have a nerd to do them.
245
00:21:57,000 --> 00:21:59,000
I can have one nerd that does it for all of them.
246
00:21:59,000 --> 00:22:01,000
And now I can focus on your business.
247
00:22:01,000 --> 00:22:06,000
Now I can say, how do I make your decisions better, make you better for your end customers?
248
00:22:06,000 --> 00:22:14,000
And for a logically doing this with customers, it means that a lot of that commoditization of the tech goes away and you have to find new ways to add value.
249
00:22:14,000 --> 00:22:17,000
And that's through coaching them to be better than their competitor.
250
00:22:17,000 --> 00:22:21,000
That's through making their employees experience better than anybody else's.
251
00:22:21,000 --> 00:22:29,000
Think about when you started logically. How cool is it if you get that laptop and your swag bag and your new t-shirt and that new sticker that's so dope.
252
00:22:29,000 --> 00:22:33,000
And it all comes to you and you just open it up and it works and it's intuitive and you don't have to think about it.
253
00:22:33,000 --> 00:22:38,000
Compared to, we're going to take you through tech onboarding. We're going to have about the next two days of training.
254
00:22:38,000 --> 00:22:46,000
It's just you are younger than me and you grew up in an Angry Birds experience where when you fired that up on your phone, you had zero expectation of it not firing up.
255
00:22:46,000 --> 00:22:47,000
Right.
256
00:22:47,000 --> 00:22:48,000
Every time.
257
00:22:48,000 --> 00:22:49,000
No matter what.
258
00:22:49,000 --> 00:22:50,000
It's predictable.
259
00:22:50,000 --> 00:22:54,000
Yes. And that's where we're heading with technology that we weren't 10 years ago.
260
00:22:54,000 --> 00:23:01,000
We used to claim that our value statement as MSPs was, we'll give you the best white glove experience and keep your pooter working better than anybody else.
261
00:23:01,000 --> 00:23:06,000
Like that's now table stakes. How do we add value as a whole different proposition in today's world?
262
00:23:06,000 --> 00:23:07,000
Right.
263
00:23:07,000 --> 00:23:18,000
And it's much more around, I like the buzzword of security since we're here at Black Hat, but really how do I make your technology system just work under a certain level of acceptable risk load, right?
264
00:23:18,000 --> 00:23:21,000
And have escalatory capabilities to protect data that matters more.
265
00:23:21,000 --> 00:23:24,000
Like it's very, very scalable today, in my opinion.
266
00:23:24,000 --> 00:23:35,000
Definitely. What are some of the key areas that you focus on for your clients when it comes to technology? And not just technology, but also security.
267
00:23:35,000 --> 00:23:40,000
So my clients are you. So at the end of the day, at Black Hat, I'm an external resource.
268
00:23:40,000 --> 00:23:46,000
I spend most of my time educating and driving success of MSP, MSSPs, and small business in our world.
269
00:23:46,000 --> 00:23:54,000
And so I think what do I see as the biggest challenge for me and my clients?
270
00:23:54,000 --> 00:23:58,000
What do I see as that technology conversation? It's education.
271
00:23:58,000 --> 00:24:10,000
You know, it really is that you in the same way, the more you can educate your clients and get them to a position of trust and get them to a position where they're starting to win as a result of knowing you, that's where we're at, right?
272
00:24:10,000 --> 00:24:20,000
It packs a specifically knows that if I help you be better and be better at selling and be better at using and be better at protecting and be more profitable, be able to grow.
273
00:24:20,000 --> 00:24:24,000
Guess what? We grow by proxy. So win, win.
274
00:24:24,000 --> 00:24:33,000
So I do think that we are all in a state where we're shifting from this marketing hyperbolas crap to you better provide value.
275
00:24:33,000 --> 00:24:38,000
You better teach me. And if you do, I will know you're my partner and I'll buy from you.
276
00:24:38,000 --> 00:24:45,000
That's such a fundamental difference where you can't just do some snazzy webinar to showcase what you're selling.
277
00:24:45,000 --> 00:24:52,000
You must actually demonstrate an increase of what you're teaching them around that thought leadership is driving their world.
278
00:24:52,000 --> 00:24:57,000
Show them that you've got this. Show them that you understand it well enough to actually help them understand it.
279
00:24:57,000 --> 00:25:02,000
And that's just a big difference. Maybe a little self aggrandizing because that's what I do for a living.
280
00:25:02,000 --> 00:25:07,000
But I do think that's such a shift in our world that it's not just marketing hype. It's education now.
281
00:25:07,000 --> 00:25:12,000
It's actually presenting the benefits, the value that people get.
282
00:25:12,000 --> 00:25:16,000
Yeah, 100 percent. Right? Because it's not features, it's benefits. We don't care about features.
283
00:25:16,000 --> 00:25:22,000
I don't care that that car can go this fast. I don't care about how well it turns. I care about how it makes me feel and how I get somewhere.
284
00:25:22,000 --> 00:25:26,000
Right? And so there's a very difference in features versus these benefits that I actually care about.
285
00:25:26,000 --> 00:25:35,000
Yeah. I like the one of the famous analogies for Apple. It's like, oh, like five gigs of space or memory on your iPad.
286
00:25:35,000 --> 00:25:39,000
Or it's like five thousand songs in your pocket. Yeah. Right. Way different. Right.
287
00:25:39,000 --> 00:25:45,000
Speeds and feeds versus, dude, I could listen to five thousand songs. That's a long road trip.
288
00:25:45,000 --> 00:25:50,000
Yeah, exactly. Like you see it in your mind. All the value. Way different. That's a great point.
289
00:25:50,000 --> 00:25:56,000
Awesome. Well, OK, my last question, and this is however you see fit to answer.
290
00:25:56,000 --> 00:26:03,000
What is some advice that you could give to our audience, whether that's to other MSSBs or MSPs?
291
00:26:03,000 --> 00:26:09,000
Yeah. Or to individuals looking for solutions like logically?
292
00:26:09,000 --> 00:26:19,000
I think one of the things that I would say as a statement is that we can't focus on protection.
293
00:26:19,000 --> 00:26:24,000
We can't focus on this understanding that I'm going to stop all threats or that I can solve this problem.
294
00:26:24,000 --> 00:26:31,000
I think we need to focus on whether it be technology, whether it be change in general or whether it be security in this definition,
295
00:26:31,000 --> 00:26:36,000
that we always have to continue to change. There is no static point you get to.
296
00:26:36,000 --> 00:26:42,000
Even in your own business, if you're not in security or if you're not in technology and you're just making widgets,
297
00:26:42,000 --> 00:26:48,000
at some point you must keep up with market demands and changes and you have to continue to grow and change.
298
00:26:48,000 --> 00:26:54,000
So my advice is don't ever feel like you've solved security. Don't ever feel like you've solved technology.
299
00:26:54,000 --> 00:27:00,000
Always be malleable and be willing to change. One of the best compliments I got, and it wasn't given as a compliment,
300
00:27:00,000 --> 00:27:06,000
came from this Belgian engineer who's brilliant. And he often let perfect be the enemy of good,
301
00:27:06,000 --> 00:27:11,000
which is I know what the final right answer must be and until I get to that I'm not going to do anything.
302
00:27:11,000 --> 00:27:15,000
I'm going to go do this. No, start where you are and iterate.
303
00:27:15,000 --> 00:27:21,000
And what he said to me one day is, Matt, you hold extremely loosely to passionate beliefs.
304
00:27:21,000 --> 00:27:26,000
And he's right. While I believe something, I'm going to go scream it and drive it and do it wholeheartedly.
305
00:27:26,000 --> 00:27:31,000
But I'm always looking for data that says I'm wrong. I'm always looking for data that says I need to change what I'm saying.
306
00:27:31,000 --> 00:27:36,000
And for anybody out there thinking about where they are in security, if you put those two concepts together of,
307
00:27:36,000 --> 00:27:41,000
don't let perfect be the enemy of good and start where you are, right? I right now can only do this.
308
00:27:41,000 --> 00:27:47,000
But then also understand I need to grow and change, then you'll iterate to where you need to be from a security perspective,
309
00:27:47,000 --> 00:27:54,000
from a technology perspective, from any perspective. I gave this as a talk at ChannelCon and I started with a two-minute rocket video.
310
00:27:54,000 --> 00:28:00,000
And this was just a video of SpaceX every time they blew up a rocket trying to land it and failed, right?
311
00:28:00,000 --> 00:28:06,000
And they showed it over and over again, all the failures they made. And at the end of it, they finally succeeded.
312
00:28:06,000 --> 00:28:10,000
Did they win because of the success or did they win because of the failures?
313
00:28:10,000 --> 00:28:16,000
And the argument is they won because of the failures. The company that can fail the fastest for the cheapest amount of money
314
00:28:16,000 --> 00:28:22,000
and with the highest ability of tenacity and persistence to continue doing it, wins at the end of the day.
315
00:28:22,000 --> 00:28:26,000
And so it's really about leaning into those failures, leaning into those gaps.
316
00:28:26,000 --> 00:28:30,000
And for anybody trying to choose a service with somebody like Logically, can they give me an assessment
317
00:28:30,000 --> 00:28:34,000
of where I am and where I really want to be, at least on today's standards?
318
00:28:34,000 --> 00:28:37,000
And do I have confidence that they'll take me to where tomorrow's standards go?
319
00:28:37,000 --> 00:28:42,000
That's what I would be looking for if I was trying to hire a company in that way.
320
00:28:42,000 --> 00:28:44,000
Well said, very well said. Thank you.
321
00:28:44,000 --> 00:28:46,000
I get one a day, you know?
322
00:28:46,000 --> 00:28:48,000
Well, thank you so much for your time, Matt.
323
00:28:48,000 --> 00:28:52,000
Absolutely. Thanks for having me.
00:00:00,000 --> 00:00:09,000
Hello and welcome to another episode of Logically Speaking. This is our events edition. I'm Tatiana Harris with Logically.
2
00:00:09,000 --> 00:00:13,000
In this episode, I talk with Matt Lee from PAX 8.
3
00:00:13,000 --> 00:00:17,000
You are the Senior Director of Security and Compliance at PAX 8.
4
00:00:17,000 --> 00:00:18,000
Yes, that's correct.
5
00:00:18,000 --> 00:00:26,000
Could you tell me a little bit more about yourself and how you got into security and IT in general?
6
00:00:26,000 --> 00:00:35,000
Yeah, sure. So I actually started as a younger person doing... I was a banker. I had been a stockbroker when I was 19.
7
00:00:35,000 --> 00:00:39,000
I moved in and every three or four years I would change entire careers.
8
00:00:39,000 --> 00:00:47,000
I either get offended by something or bored by something or felt like I maybe mastered something where it wasn't like a fun thing to play with in my head anymore.
9
00:00:47,000 --> 00:00:55,000
And so I went from investments to banking and banking to mortgages, mortgages to non-numerous and numismatic gold brokerage.
10
00:00:55,000 --> 00:00:59,000
So I started trading in collectible and non-collectible gold and bullion.
11
00:00:59,000 --> 00:01:09,000
And then I traveled around and was a diamond buyer for a few years, buying and selling milli or small diamonds, 0.1 carat or less diamonds, with a couple of Armenian guys.
12
00:01:09,000 --> 00:01:15,000
And so I just have generally been always curious and always stepping into different jobs.
13
00:01:15,000 --> 00:01:23,000
The challenge is when I moved to Wichita, Kansas and started as a break-fix technician at a small MSP, I was hooked.
14
00:01:23,000 --> 00:01:27,000
Because I could never get broad enough to understand all the technology.
15
00:01:27,000 --> 00:01:32,000
I could never get deep enough to understand anything to a point where I was at an exhaustion level or couldn't learn more.
16
00:01:32,000 --> 00:01:37,000
And so it just kind of kept me into a constant sense of curiosity.
17
00:01:37,000 --> 00:01:46,000
But it also led me, just like you guys get to experience at Logically, it led me to be able to go and ask questions of hundreds of different businesses, different business types.
18
00:01:46,000 --> 00:01:52,000
How do you make money? What makes you happy? What drives your world? And be curious there too and never run out of that.
19
00:01:52,000 --> 00:02:01,000
It always kept allowing me to keep broadening my understanding of the world and then use that to help them be more successful with technology, with security.
20
00:02:01,000 --> 00:02:03,000
It's always the same.
21
00:02:03,000 --> 00:02:10,000
How did I get into security, however, was as we became a very large MSP, we got punched really hard in the face.
22
00:02:10,000 --> 00:02:19,000
And we lost a bunch of money to Soda No Kibi Ransomware Gang through an acquisition where we lost an entire million dollar acquisition from a revenue perspective.
23
00:02:19,000 --> 00:02:23,000
We lost the insurance claim from a cost perspective and we missed the opportunity.
24
00:02:23,000 --> 00:02:27,000
We could have bought another MSP that would have been better for us, that wasn't screwed like that.
25
00:02:27,000 --> 00:02:41,000
And so when that played out, the next 18 months of my life were in lawsuits or threatened lawsuits, conversations with attorneys and forensics responders and federal authorities and all of that for the next year and a half.
26
00:02:41,000 --> 00:02:52,000
Which allowed me to then focus so very heavily on security in general and driving that for that MSP for the next few years before we sold successfully and I got my first exit.
27
00:02:52,000 --> 00:02:56,000
But that's how I kind of came into cybersecurity as a practitioner.
28
00:02:56,000 --> 00:03:01,000
Now I find myself as an educator and as a subject matter.
29
00:03:01,000 --> 00:03:10,000
I won't ever say expert because you can't ever be an expert, but I would say a subject matter student perpetually and trying to drive and change subject matter where possible throughout our industry.
30
00:03:10,000 --> 00:03:14,000
So I'm lucky enough and blessed enough that Pax8 sponsors that.
31
00:03:14,000 --> 00:03:22,000
I like to say they sponsor my breakfast, lunches and dinners and help my mission to drive us all to have a better life through technology and security.
32
00:03:22,000 --> 00:03:24,000
That's kind of the background.
33
00:03:24,000 --> 00:03:28,000
I love that you don't refer to yourself as a subject matter expert.
34
00:03:28,000 --> 00:03:29,000
No.
35
00:03:29,000 --> 00:03:31,000
Like in a constantly evolving field, you can never be an expert.
36
00:03:31,000 --> 00:03:32,000
That's exactly it.
37
00:03:32,000 --> 00:03:34,000
It's too fast moving for you to be an expert.
38
00:03:34,000 --> 00:03:37,000
Now you can be very experienced in it.
39
00:03:37,000 --> 00:03:42,000
You can have a lot of losses and failures and successes that build up our life and understanding of things.
40
00:03:42,000 --> 00:03:48,000
But I just don't think experts a fair term in a non static body of knowledge is my point.
41
00:03:48,000 --> 00:03:50,000
Yes, that definitely makes sense.
42
00:03:50,000 --> 00:04:06,000
So as someone in like a security and compliance role, what do you see on a day to day basis that maybe the average person wouldn't think about or they might consider it,
43
00:04:06,000 --> 00:04:08,000
but not really to the extent that you see it every day?
44
00:04:08,000 --> 00:04:09,000
Great question.
45
00:04:09,000 --> 00:04:12,000
I don't think people realize how bad it really is.
46
00:04:12,000 --> 00:04:15,000
And I don't mean that to paint this fear and situation.
47
00:04:15,000 --> 00:04:18,000
I mean, nobody's got it figured out.
48
00:04:18,000 --> 00:04:19,000
Right.
49
00:04:19,000 --> 00:04:29,000
When it comes down to the vendors that write your software, that prepare your stuff that you consume all the way down to what you do as a service, all the way down to what your customers and consumers are doing to scare themselves.
50
00:04:29,000 --> 00:04:42,000
We're all at the state where we've defined security as tools, we've defined certain things, but we aren't really prepared for security being the very fabric of how we make decisions and what we do around around our technology.
51
00:04:42,000 --> 00:04:43,000
It's not built in.
52
00:04:43,000 --> 00:04:48,000
Like in a car, I have an airbag and it's already there and I don't have to turn it on when I get it.
53
00:04:48,000 --> 00:04:53,000
My seatbelt dings at me relentlessly if I don't buckle up and I didn't have to do anything to make that happen.
54
00:04:53,000 --> 00:05:01,000
Yet in security in our world today with technology, you're going to buy something that will be the least secure you'll ever see it and you must then improve it.
55
00:05:01,000 --> 00:05:05,000
And so it's not built in and even at the manufacturers that create this software.
56
00:05:05,000 --> 00:05:06,000
Right.
57
00:05:06,000 --> 00:05:11,000
There's a call to action from CISA right now that says secure by design, secure by default.
58
00:05:11,000 --> 00:05:15,000
Basically saying you need to make it where the airbags are turned on.
59
00:05:15,000 --> 00:05:17,000
But additionally, you need to make sure there's airbags.
60
00:05:17,000 --> 00:05:19,000
It kind of comes into that conversation.
61
00:05:19,000 --> 00:05:22,000
So we're in that stage of cybersecurity today.
62
00:05:22,000 --> 00:05:29,000
Yeah, that's a huge topic around the event today, too, like not just a I but just security by design.
63
00:05:29,000 --> 00:05:30,000
Yeah.
64
00:05:30,000 --> 00:05:36,000
Like having having everything and having that mindset set in security.
65
00:05:36,000 --> 00:05:41,000
And the only reason you can have that as a just exposition is you're from the other side of that just exposition.
66
00:05:41,000 --> 00:05:42,000
Right.
67
00:05:42,000 --> 00:05:43,000
And you're not secure by design.
68
00:05:43,000 --> 00:05:45,000
You slapped it together and said it'll be fine.
69
00:05:45,000 --> 00:05:46,000
It needs to work.
70
00:05:46,000 --> 00:05:50,000
And I've had executives say to me, Matt, a lot of money is made on shitty software.
71
00:05:50,000 --> 00:05:51,000
Right.
72
00:05:51,000 --> 00:05:52,000
And I genuinely believe that.
73
00:05:52,000 --> 00:05:53,000
And they're right.
74
00:05:53,000 --> 00:05:54,000
There's been no repercussions.
75
00:05:54,000 --> 00:05:55,000
Right.
76
00:05:55,000 --> 00:06:00,000
If you look at CISA, they released with the president the national cybersecurity strategy back in March.
77
00:06:00,000 --> 00:06:07,000
And in that, they said markets often impose upon the weakest essentially, I'm summarizing, upon the weakest of those consumers,
78
00:06:07,000 --> 00:06:11,000
the risk while the profit rides on the ones creating that risk.
79
00:06:11,000 --> 00:06:14,000
And it's this very interesting point where that's the case.
80
00:06:14,000 --> 00:06:15,000
Right.
81
00:06:15,000 --> 00:06:17,000
They've made software they know they're not investing in to make better.
82
00:06:17,000 --> 00:06:20,000
They're not going to do the things to make it cursorily more secure.
83
00:06:20,000 --> 00:06:22,000
And yet they still make the same profit.
84
00:06:22,000 --> 00:06:25,000
In fact, they're rewarded for not making it more secure.
85
00:06:25,000 --> 00:06:26,000
Right.
86
00:06:26,000 --> 00:06:27,000
Right.
87
00:06:27,000 --> 00:06:31,000
And so you're in this weird world where now the call to action is be secure by design, be secure by default, because it wasn't before.
88
00:06:31,000 --> 00:06:36,000
And so I think that's a great call to action right now and change in our world that matters a lot.
89
00:06:36,000 --> 00:06:37,000
So how do you feel?
90
00:06:37,000 --> 00:06:46,000
I've heard someone mention, I think it might have been at ChannelCon last week, about switching the onus of security to the end user.
91
00:06:46,000 --> 00:06:52,000
And not that it has changed to the end user, but that's how it is.
92
00:06:52,000 --> 00:07:03,000
Like the security by design mindset that people are wanting to implement now, it's shifting from putting the responsibility for the end user to buy its driver software
93
00:07:03,000 --> 00:07:11,000
or do all the things that are trying to make insecure technology and systems secure like as an add-on.
94
00:07:11,000 --> 00:07:14,000
And you're saying it needs to move up the chain and move up.
95
00:07:14,000 --> 00:07:15,000
Yeah.
96
00:07:15,000 --> 00:07:16,000
Right.
97
00:07:16,000 --> 00:07:19,000
I think that's a part of just a byproduct of how this has worked.
98
00:07:19,000 --> 00:07:27,000
I mean, think about even as an MSP, five years ago serving the SMB or small mid-sized business, nobody cared about a lot of the things that are offered today.
99
00:07:27,000 --> 00:07:28,000
Right.
100
00:07:28,000 --> 00:07:29,000
They didn't want a SOC as a service.
101
00:07:29,000 --> 00:07:30,000
They didn't want EDR.
102
00:07:30,000 --> 00:07:31,000
They didn't want to do MFA.
103
00:07:31,000 --> 00:07:33,000
They didn't want to do all these things.
104
00:07:33,000 --> 00:07:40,000
And yet we then had to add costs to sell that as an a la carte thing instead of making it part of our world.
105
00:07:40,000 --> 00:07:44,000
Yet today, more and more it's becoming part of our world and you can't choose not to have it.
106
00:07:44,000 --> 00:07:46,000
And so you have this drift of it moving.
107
00:07:46,000 --> 00:07:56,000
I think the challenge with asking the consumers to make a decision on what they want to do or not is phallic in the sense that they don't understand enough to even make that decision.
108
00:07:56,000 --> 00:08:01,000
And oftentimes you're having to do stuff like this to try to teach them so they can then make a decision.
109
00:08:01,000 --> 00:08:05,000
But my attorney, my CPA, my doctor, they don't do any of that.
110
00:08:05,000 --> 00:08:10,000
They don't go, man, I really need Matt to understand methyl acillin resistant staphylococcus aurora.
111
00:08:10,000 --> 00:08:17,000
Because if you don't understand MERS and its resistance to common antibiotics, then no, they go, you need to take this pill or you're going to die.
112
00:08:17,000 --> 00:08:19,000
It's kind of that way, right?
113
00:08:19,000 --> 00:08:22,000
But yet in our world, we have to educate and they want to understand and they want.
114
00:08:22,000 --> 00:08:27,000
So I say all this to say I actually think the burden needs to shift uphill.
115
00:08:27,000 --> 00:08:33,000
And at some point, logically, is going to say I'm not taking you as a client because if you're not doing these base things, I'm not it's not worth it to me for you.
116
00:08:33,000 --> 00:08:39,000
And you've probably even seen that in your organization just from the caliber of the humans I know that work with you.
117
00:08:39,000 --> 00:08:41,000
I know that's probably part of their world.
118
00:08:41,000 --> 00:08:47,000
So I think you're seeing it go to, yes, the identity and the human matter at the end of that chain.
119
00:08:47,000 --> 00:08:53,000
But the the onus to your point is going to shift up and shift up to the service providers like logically.
120
00:08:53,000 --> 00:09:00,000
And it's going to shift up to the software manufacturers to say, why do I buy Microsoft tenants at their most insecure state?
121
00:09:00,000 --> 00:09:04,000
Why do I get my Google tenant with nothing turned on from a security perspective?
122
00:09:04,000 --> 00:09:14,000
Like at what point should that be your responsibility and it also at what point should that be part of my stack and my skew, which follows those same patterns logically at some point sold?
123
00:09:14,000 --> 00:09:17,000
I'm sure security tools separate more and more.
124
00:09:17,000 --> 00:09:18,000
Those things become part of the skew.
125
00:09:18,000 --> 00:09:20,000
And that's what we're selling. And there is no there's no dilemma.
126
00:09:20,000 --> 00:09:34,000
And I think that's a very important aspect there. Right. It's it's the whole package. And to your point, there are always going to be those people that you tell them and you educate them time and time again.
127
00:09:34,000 --> 00:09:40,000
Like, hey, enable multi factor authentication. And they're like, no, it's too much. It's inconvenient. Yeah. Yeah.
128
00:09:40,000 --> 00:09:42,000
Yeah. 100 percent. We've all heard it.
129
00:09:42,000 --> 00:09:45,000
And those same people, there's an interesting aspect of this, though, too.
130
00:09:45,000 --> 00:09:51,000
That may follow their own Darwinism in that regard. And I think you're seeing that more and more where there's such a separation.
131
00:09:51,000 --> 00:09:58,000
The people that don't do it. The cost is there. They do go out of business. They do get punched in the face. They do lose.
132
00:09:58,000 --> 00:10:04,000
And at some point, the market rewards the ones that don't and destroys the ones that do make that action.
133
00:10:04,000 --> 00:10:14,000
And I think that's what we as an industry have to be better about being OK with and saying if you don't choose to move forward at some point, somebody decided, no, that internal combustion engine is a bad egg.
134
00:10:14,000 --> 00:10:18,000
Let's stick with steam. And then they went out of business. Right.
135
00:10:18,000 --> 00:10:24,000
There's you look at, you know, blockbuster versus Netflix, even to bring it more proximal.
136
00:10:24,000 --> 00:10:31,000
They said, hey, maybe we'll stick in this normal distribution while somebody else was changing to a modern method of distribution and change the world.
137
00:10:31,000 --> 00:10:42,000
And so I think that we're in that space where those people at some point will be destroyed enough that there will be an acceptance of that standard more and more or they just won't be in business.
138
00:10:42,000 --> 00:10:48,000
The best piece and and consumers, it's an adapt or die type of situation. Yep.
139
00:10:48,000 --> 00:10:53,000
And it always kind of has been right. This is just a different front for us to focus on than before.
140
00:10:53,000 --> 00:11:00,000
I think that kind of falls in line with one of my other questions, which was AI is a huge topic.
141
00:11:00,000 --> 00:11:10,000
It has been practically all year. What do you see as some of the biggest benefits, but also maybe some of the toughest challenges that
142
00:11:10,000 --> 00:11:19,000
companies are going to face over the next few years with regard to AI, like in technology and security, like across the board?
143
00:11:19,000 --> 00:11:23,000
I think yes is a good answer. Yes. Just all of the things.
144
00:11:23,000 --> 00:11:35,000
No, genuinely, I think if you look back over history, there have always been fundamental technology shifts that that now everything changes as a result.
145
00:11:35,000 --> 00:11:45,000
Great example, cars invented in the late eighteen hundreds changed the entire landscape of the world from a city versus suburb perspective,
146
00:11:45,000 --> 00:11:52,000
especially in the United States overnight, right? Long before we ever had airbags, long before we had seat belts.
147
00:11:52,000 --> 00:12:00,000
And I say that to say we build technologies that move and change our world fundamentally first and then sort out the negative bits.
148
00:12:00,000 --> 00:12:05,000
Right. We didn't go maybe it's bad to have a shovel roll or a pinto get hit in the back end and blow up.
149
00:12:05,000 --> 00:12:11,000
Maybe it's and so then you start adding in the National Motor Vehicle Safety Act in like 1965, 1966.
150
00:12:11,000 --> 00:12:14,000
We're talking almost a decade after the invention of that technology.
151
00:12:14,000 --> 00:12:20,000
So when you think about the fundamental nature of that, it changes more than just one thing.
152
00:12:20,000 --> 00:12:26,000
It's a multifactor change. And if you look at tractors, tractors made cities.
153
00:12:26,000 --> 00:12:35,000
The mechanization of farm equipment made cities possible because I didn't have to have 17 kids to put enough taters in the ground and tend them all year so we can eat.
154
00:12:35,000 --> 00:12:41,000
Right. I could buy that in bulk and I could move to the city and create all these industries and all these things that are magical.
155
00:12:41,000 --> 00:12:46,000
And we live with every minute today fundamentally changed from some piece of technology.
156
00:12:46,000 --> 00:12:51,000
I think A.I. or machine learning or LLMs or whatever flavor you're calling it today,
157
00:12:51,000 --> 00:13:00,000
but really this understanding of more and more technical improvement of capabilities and in some ways removing human jobs, changing human jobs.
158
00:13:00,000 --> 00:13:08,000
So that's my first point. I think technologies like A.I. and machine learning LLM, which I know I'm on a stupid bandwagon saying the same stuff,
159
00:13:08,000 --> 00:13:17,000
but they will fundamentally make it where I can use better robotic process automation, better ways to automate away a role or a job.
160
00:13:17,000 --> 00:13:24,000
And so I think the advice is companies need to lean into the understanding of what this can bring and what it can do to free you up
161
00:13:24,000 --> 00:13:28,000
and can make it where you can dedicate that human to doing something way better.
162
00:13:28,000 --> 00:13:34,000
Look at what we talked about earlier about the background audio you're going to have to edit out, which if you're listening this now won't have it anymore.
163
00:13:34,000 --> 00:13:43,000
But there's more work to be done. And yet at the same time, Adobe has released a pretty awesome machine learning method that will remove the background noise.
164
00:13:43,000 --> 00:13:51,000
What if you had to do that for five hours instead of now 10 minutes? Can you focus on doing more interviews or better or putting out better quality product with your time?
165
00:13:51,000 --> 00:14:01,000
Yeah. And I think that's what businesses need to understand with these technologies is that they will be used first to make a better product and better profit for your customers.
166
00:14:01,000 --> 00:14:11,000
Now the flip side of this coin, what will it do to introduce new risks and new vulnerabilities that come into play or new vulnerabilities that can create risks?
167
00:14:11,000 --> 00:14:15,000
Just because I'm now honoring my buddy that I had a call with earlier, Norman Clatchley.
168
00:14:15,000 --> 00:14:23,000
But you're going to see this increase. People are stupid. By nature, we always take advantage of what's going to benefit us before thinking of the repercussions.
169
00:14:23,000 --> 00:14:38,000
Soon as OpenAI came out with their now easily accessible chat GBT, which isn't the first one, it's just the first one that's been made massively accessible to people in a meaningful way that was more than just novelty and had huge adoption.
170
00:14:38,000 --> 00:14:44,000
I mean, like that growth curve was like this. But those same people in that, I guess they can't see my hand motions and non-video things.
171
00:14:44,000 --> 00:14:49,000
So I'm doing a hockey stick curve. Yeah. But or asymptotes, if you will.
172
00:14:49,000 --> 00:14:55,000
But the point is, is that when that growth goes up, how many of those humans put in sensitive information that then became a leak?
173
00:14:55,000 --> 00:15:05,000
Like we've already seen class action lawsuits about that very thing of people putting in sensitive data in a shared learning environment that then can be regurgitated to another human.
174
00:15:05,000 --> 00:15:16,000
We don't think about the security first. So we will create more challenges from the vulnerabilities that we introduce that allow more threats to impact us, which means that our risk has gone up.
175
00:15:16,000 --> 00:15:22,000
But you have to imagine people are not in business to avoid risk. That's a broken thought process.
176
00:15:22,000 --> 00:15:35,000
I mean, there's still Alyssa Miller, famous CISO, she's probably here, but she spoke last year and said, we're told as InfoSec professionals that the language of business is risk, horse crap.
177
00:15:35,000 --> 00:15:43,000
The language of business is profit, raw, unadulterated profit. We take a risk. And by the time we started business, we have accepted all of those risks.
178
00:15:43,000 --> 00:15:46,000
We've done nothing to mitigate them. We took those risks to make a profit.
179
00:15:46,000 --> 00:15:59,000
Do we deal with those risks and say that one's too much and it will exceed my profit and I need to deal with that's where the risk equation gets interesting around AI is that we will often receive a better profit, a better FTE or full time employee usage.
180
00:15:59,000 --> 00:16:06,000
All of those things far before we actually understand the risk profile we've created by doing so and how we chose to do so.
181
00:16:06,000 --> 00:16:10,000
So I think we will see a John maddening it here a little bit.
182
00:16:10,000 --> 00:16:20,000
We're going to see fundamental shifts in what businesses do and how they employ humans as a result of more and more of these type of machine learning and AI type algorithms that they're out there.
183
00:16:20,000 --> 00:16:26,000
But we're also going to see at least initially a clamoring to create what what's secure enough.
184
00:16:26,000 --> 00:16:30,000
What are the baseline standards? What should we actually do to secure this?
185
00:16:30,000 --> 00:16:33,000
Most of that language hasn't even begun to exist yet.
186
00:16:33,000 --> 00:16:38,000
Yet here we find it where people are actually having it right stuff for them every day.
187
00:16:38,000 --> 00:16:42,000
Right. And so I think it's a little buzzword today.
188
00:16:42,000 --> 00:16:48,000
And even really the capabilities are somewhat that of a pretty angry teenager that might lie to you.
189
00:16:48,000 --> 00:17:06,000
Right. At the end of the day, it will continue to grow and you will continue to see more and more verticalized value out of these businesses that are just like that city being born where now there's trash people and now there's there's movies and now there's things we can go to because of that city density in the amount of delivery and demand from free time.
190
00:17:06,000 --> 00:17:09,000
We're going to see those same things play out and it will be lovely.
191
00:17:09,000 --> 00:17:14,000
I mean, it will be amazing. It's just going to come with a lot of challenges and loss probably as well.
192
00:17:14,000 --> 00:17:31,000
Yeah. And there was one talk earlier on, I guess, AI and risk management and policy and setting in certifications and new ways of holding AI and machine learning to certain standards across the board.
193
00:17:31,000 --> 00:17:51,000
And one of the important points was getting getting technical people, people that understand those areas and having them having them and their voice heard and understood so that they can actually make standards that are applicable and that can grow into what they're predicting.
194
00:17:51,000 --> 00:17:55,000
This is how the cybersecurity industry has always worked right RFCs request for comments.
195
00:17:55,000 --> 00:18:06,000
Yeah, somebody with a terrible idea puts it out there and ask others to say terrible things or good things about it until it becomes an actually accepted principle like TCP IP came from an RFC.
196
00:18:06,000 --> 00:18:11,000
We've seen these things play out forever and it's always been a practitioners consensus model.
197
00:18:11,000 --> 00:18:12,000
Right. If you will.
198
00:18:12,000 --> 00:18:14,000
But I think we've gone a long way away from that.
199
00:18:14,000 --> 00:18:16,000
I think you've let marketing teams.
200
00:18:16,000 --> 00:18:17,000
Nothing personal.
201
00:18:17,000 --> 00:18:25,000
But I think we've let marketing teams define terms and muddy the language that we've actually all gotten a little dumber in cases.
202
00:18:25,000 --> 00:18:29,000
So, yeah, yeah, I completely 100% agree.
203
00:18:29,000 --> 00:18:33,000
Marketing will make things sound snazzy, but they don't have.
204
00:18:33,000 --> 00:18:36,000
It's not a lot of benefit or value behind those words all the time.
205
00:18:36,000 --> 00:18:40,000
Sometimes. Yeah, it makes a little bit more confusing.
206
00:18:40,000 --> 00:18:47,000
I'd like to know since you've been working in in technology and security for what over a decade.
207
00:18:47,000 --> 00:18:49,000
It's been a long time. Yeah.
208
00:18:49,000 --> 00:18:51,000
My hair didn't come for free.
209
00:18:51,000 --> 00:18:54,000
And yes, since you can't see he's got a nice long beard.
210
00:18:54,000 --> 00:18:55,000
I was finding the gray ones in there.
211
00:18:55,000 --> 00:18:56,000
Each one's an incident.
212
00:18:56,000 --> 00:18:58,000
Yes.
213
00:18:58,000 --> 00:19:10,000
I'd love your perspective on how you've seen technology change and how the imperative for security has grown and changed like over the last decade.
214
00:19:10,000 --> 00:19:14,000
And I know you've kind of alluded to some of these things in some of your response earlier.
215
00:19:14,000 --> 00:19:15,000
I just wrote as well.
216
00:19:15,000 --> 00:19:16,000
Yes, exactly.
217
00:19:16,000 --> 00:19:22,000
You know, what's interesting about our world today is we are all starting to get it right.
218
00:19:22,000 --> 00:19:31,000
And I mean by that is the SAS providers or software service providers, the software manufacturers, the tools, the security, the practitioners, all of us are starting to wake up and get it.
219
00:19:31,000 --> 00:19:42,000
And at a time where we're also shifting from a very infrastructural view of the world, what I mean by that is if I start a company tomorrow, there's almost zero chance I buy a server, almost zero.
220
00:19:42,000 --> 00:19:47,000
Right. There's almost zero chance I can put a server in the cloud that I'm doing in a traditional server model, almost zero.
221
00:19:47,000 --> 00:19:49,000
I'm probably going to have an identity.
222
00:19:49,000 --> 00:19:54,000
I'm going to sign in with that identity in the cloud applications and SAS applications.
223
00:19:54,000 --> 00:19:55,000
And that's my world.
224
00:19:55,000 --> 00:20:02,000
What's interesting about that is there's such an interesting difference in what we can actually script and automate in those two.
225
00:20:02,000 --> 00:20:13,000
If I think about having that server and infrastructure world and then just the variables that have to account for to do some type of update or protect it in a certain way, I'd have to have the network type and structure delineation.
226
00:20:13,000 --> 00:20:23,000
I'd have to have the server type and what server version it is. It is server 08, 8R2, 12R2, 16, 19, 20, 22. Is it those? Is it 4th function 2003, 3R2, 8, 8R2, 16?
227
00:20:23,000 --> 00:20:32,000
Where are we? All these variables that make it where you just have a very hard time normalizing and coming up with an automation that works universally.
228
00:20:32,000 --> 00:20:36,000
But let's look at that picture I just described of an identity provider and a SAS provider.
229
00:20:36,000 --> 00:20:44,000
Like to make it easy for anybody in your audience that isn't as technical, think about signing in with Facebook for the first time into some other application.
230
00:20:44,000 --> 00:20:49,000
You wanted to play that bird game or something and you signed in with either a password or your Facebook.
231
00:20:49,000 --> 00:20:50,000
You just click Facebook.
232
00:20:50,000 --> 00:20:55,000
That's the concept of an identity provider being Facebook and a consuming entity being Angry Birds.
233
00:20:55,000 --> 00:21:02,000
Well, in our world, that becomes Microsoft as the identity provider or Okta, but probably Microsoft for most of your clients.
234
00:21:02,000 --> 00:21:06,000
And then when they consume their Salesforce, they just sign in with Microsoft.
235
00:21:06,000 --> 00:21:18,000
That type of model means that for every Salesforce and every Microsoft, I have all the variables, I have all the commands I need from an API or application programming interface perspective.
236
00:21:18,000 --> 00:21:23,000
And it's very known as it changes, it's changed known, which means I can script an experience.
237
00:21:23,000 --> 00:21:28,000
I can script security the same way for a hundred customers exactly the same way.
238
00:21:28,000 --> 00:21:32,000
And if it fails, it fails systemically and if it works, it works systemically.
239
00:21:32,000 --> 00:21:36,000
That's very different than, oh, which time did you last update your server?
240
00:21:36,000 --> 00:21:39,000
We need to buy a new OS. I can't do that in eight. I can only do it in twelve.
241
00:21:39,000 --> 00:21:45,000
Whereas in Microsoft, it just grows as it grows and everybody has the same benefit from it, the same API calls, the same everything.
242
00:21:45,000 --> 00:21:50,000
Which means back to your real core question of what's changed in security, what's changed in our world.
243
00:21:50,000 --> 00:21:54,000
I can actually now do the nerdy bits in a script.
244
00:21:54,000 --> 00:21:57,000
I don't have to have a nerd to do them.
245
00:21:57,000 --> 00:21:59,000
I can have one nerd that does it for all of them.
246
00:21:59,000 --> 00:22:01,000
And now I can focus on your business.
247
00:22:01,000 --> 00:22:06,000
Now I can say, how do I make your decisions better, make you better for your end customers?
248
00:22:06,000 --> 00:22:14,000
And for a logically doing this with customers, it means that a lot of that commoditization of the tech goes away and you have to find new ways to add value.
249
00:22:14,000 --> 00:22:17,000
And that's through coaching them to be better than their competitor.
250
00:22:17,000 --> 00:22:21,000
That's through making their employees experience better than anybody else's.
251
00:22:21,000 --> 00:22:29,000
Think about when you started logically. How cool is it if you get that laptop and your swag bag and your new t-shirt and that new sticker that's so dope.
252
00:22:29,000 --> 00:22:33,000
And it all comes to you and you just open it up and it works and it's intuitive and you don't have to think about it.
253
00:22:33,000 --> 00:22:38,000
Compared to, we're going to take you through tech onboarding. We're going to have about the next two days of training.
254
00:22:38,000 --> 00:22:46,000
It's just you are younger than me and you grew up in an Angry Birds experience where when you fired that up on your phone, you had zero expectation of it not firing up.
255
00:22:46,000 --> 00:22:47,000
Right.
256
00:22:47,000 --> 00:22:48,000
Every time.
257
00:22:48,000 --> 00:22:49,000
No matter what.
258
00:22:49,000 --> 00:22:50,000
It's predictable.
259
00:22:50,000 --> 00:22:54,000
Yes. And that's where we're heading with technology that we weren't 10 years ago.
260
00:22:54,000 --> 00:23:01,000
We used to claim that our value statement as MSPs was, we'll give you the best white glove experience and keep your pooter working better than anybody else.
261
00:23:01,000 --> 00:23:06,000
Like that's now table stakes. How do we add value as a whole different proposition in today's world?
262
00:23:06,000 --> 00:23:07,000
Right.
263
00:23:07,000 --> 00:23:18,000
And it's much more around, I like the buzzword of security since we're here at Black Hat, but really how do I make your technology system just work under a certain level of acceptable risk load, right?
264
00:23:18,000 --> 00:23:21,000
And have escalatory capabilities to protect data that matters more.
265
00:23:21,000 --> 00:23:24,000
Like it's very, very scalable today, in my opinion.
266
00:23:24,000 --> 00:23:35,000
Definitely. What are some of the key areas that you focus on for your clients when it comes to technology? And not just technology, but also security.
267
00:23:35,000 --> 00:23:40,000
So my clients are you. So at the end of the day, at Black Hat, I'm an external resource.
268
00:23:40,000 --> 00:23:46,000
I spend most of my time educating and driving success of MSP, MSSPs, and small business in our world.
269
00:23:46,000 --> 00:23:54,000
And so I think what do I see as the biggest challenge for me and my clients?
270
00:23:54,000 --> 00:23:58,000
What do I see as that technology conversation? It's education.
271
00:23:58,000 --> 00:24:10,000
You know, it really is that you in the same way, the more you can educate your clients and get them to a position of trust and get them to a position where they're starting to win as a result of knowing you, that's where we're at, right?
272
00:24:10,000 --> 00:24:20,000
It packs a specifically knows that if I help you be better and be better at selling and be better at using and be better at protecting and be more profitable, be able to grow.
273
00:24:20,000 --> 00:24:24,000
Guess what? We grow by proxy. So win, win.
274
00:24:24,000 --> 00:24:33,000
So I do think that we are all in a state where we're shifting from this marketing hyperbolas crap to you better provide value.
275
00:24:33,000 --> 00:24:38,000
You better teach me. And if you do, I will know you're my partner and I'll buy from you.
276
00:24:38,000 --> 00:24:45,000
That's such a fundamental difference where you can't just do some snazzy webinar to showcase what you're selling.
277
00:24:45,000 --> 00:24:52,000
You must actually demonstrate an increase of what you're teaching them around that thought leadership is driving their world.
278
00:24:52,000 --> 00:24:57,000
Show them that you've got this. Show them that you understand it well enough to actually help them understand it.
279
00:24:57,000 --> 00:25:02,000
And that's just a big difference. Maybe a little self aggrandizing because that's what I do for a living.
280
00:25:02,000 --> 00:25:07,000
But I do think that's such a shift in our world that it's not just marketing hype. It's education now.
281
00:25:07,000 --> 00:25:12,000
It's actually presenting the benefits, the value that people get.
282
00:25:12,000 --> 00:25:16,000
Yeah, 100 percent. Right? Because it's not features, it's benefits. We don't care about features.
283
00:25:16,000 --> 00:25:22,000
I don't care that that car can go this fast. I don't care about how well it turns. I care about how it makes me feel and how I get somewhere.
284
00:25:22,000 --> 00:25:26,000
Right? And so there's a very difference in features versus these benefits that I actually care about.
285
00:25:26,000 --> 00:25:35,000
Yeah. I like the one of the famous analogies for Apple. It's like, oh, like five gigs of space or memory on your iPad.
286
00:25:35,000 --> 00:25:39,000
Or it's like five thousand songs in your pocket. Yeah. Right. Way different. Right.
287
00:25:39,000 --> 00:25:45,000
Speeds and feeds versus, dude, I could listen to five thousand songs. That's a long road trip.
288
00:25:45,000 --> 00:25:50,000
Yeah, exactly. Like you see it in your mind. All the value. Way different. That's a great point.
289
00:25:50,000 --> 00:25:56,000
Awesome. Well, OK, my last question, and this is however you see fit to answer.
290
00:25:56,000 --> 00:26:03,000
What is some advice that you could give to our audience, whether that's to other MSSBs or MSPs?
291
00:26:03,000 --> 00:26:09,000
Yeah. Or to individuals looking for solutions like logically?
292
00:26:09,000 --> 00:26:19,000
I think one of the things that I would say as a statement is that we can't focus on protection.
293
00:26:19,000 --> 00:26:24,000
We can't focus on this understanding that I'm going to stop all threats or that I can solve this problem.
294
00:26:24,000 --> 00:26:31,000
I think we need to focus on whether it be technology, whether it be change in general or whether it be security in this definition,
295
00:26:31,000 --> 00:26:36,000
that we always have to continue to change. There is no static point you get to.
296
00:26:36,000 --> 00:26:42,000
Even in your own business, if you're not in security or if you're not in technology and you're just making widgets,
297
00:26:42,000 --> 00:26:48,000
at some point you must keep up with market demands and changes and you have to continue to grow and change.
298
00:26:48,000 --> 00:26:54,000
So my advice is don't ever feel like you've solved security. Don't ever feel like you've solved technology.
299
00:26:54,000 --> 00:27:00,000
Always be malleable and be willing to change. One of the best compliments I got, and it wasn't given as a compliment,
300
00:27:00,000 --> 00:27:06,000
came from this Belgian engineer who's brilliant. And he often let perfect be the enemy of good,
301
00:27:06,000 --> 00:27:11,000
which is I know what the final right answer must be and until I get to that I'm not going to do anything.
302
00:27:11,000 --> 00:27:15,000
I'm going to go do this. No, start where you are and iterate.
303
00:27:15,000 --> 00:27:21,000
And what he said to me one day is, Matt, you hold extremely loosely to passionate beliefs.
304
00:27:21,000 --> 00:27:26,000
And he's right. While I believe something, I'm going to go scream it and drive it and do it wholeheartedly.
305
00:27:26,000 --> 00:27:31,000
But I'm always looking for data that says I'm wrong. I'm always looking for data that says I need to change what I'm saying.
306
00:27:31,000 --> 00:27:36,000
And for anybody out there thinking about where they are in security, if you put those two concepts together of,
307
00:27:36,000 --> 00:27:41,000
don't let perfect be the enemy of good and start where you are, right? I right now can only do this.
308
00:27:41,000 --> 00:27:47,000
But then also understand I need to grow and change, then you'll iterate to where you need to be from a security perspective,
309
00:27:47,000 --> 00:27:54,000
from a technology perspective, from any perspective. I gave this as a talk at ChannelCon and I started with a two-minute rocket video.
310
00:27:54,000 --> 00:28:00,000
And this was just a video of SpaceX every time they blew up a rocket trying to land it and failed, right?
311
00:28:00,000 --> 00:28:06,000
And they showed it over and over again, all the failures they made. And at the end of it, they finally succeeded.
312
00:28:06,000 --> 00:28:10,000
Did they win because of the success or did they win because of the failures?
313
00:28:10,000 --> 00:28:16,000
And the argument is they won because of the failures. The company that can fail the fastest for the cheapest amount of money
314
00:28:16,000 --> 00:28:22,000
and with the highest ability of tenacity and persistence to continue doing it, wins at the end of the day.
315
00:28:22,000 --> 00:28:26,000
And so it's really about leaning into those failures, leaning into those gaps.
316
00:28:26,000 --> 00:28:30,000
And for anybody trying to choose a service with somebody like Logically, can they give me an assessment
317
00:28:30,000 --> 00:28:34,000
of where I am and where I really want to be, at least on today's standards?
318
00:28:34,000 --> 00:28:37,000
And do I have confidence that they'll take me to where tomorrow's standards go?
319
00:28:37,000 --> 00:28:42,000
That's what I would be looking for if I was trying to hire a company in that way.
320
00:28:42,000 --> 00:28:44,000
Well said, very well said. Thank you.
321
00:28:44,000 --> 00:28:46,000
I get one a day, you know?
322
00:28:46,000 --> 00:28:48,000
Well, thank you so much for your time, Matt.
323
00:28:48,000 --> 00:28:52,000
Absolutely. Thanks for having me.
