The Evolution of Human Risk

WEBVTT
00:00:11.199 --> 00:00:13.279
Thanks for tuning in to Simplifying Cyber.
00:00:13.359 --> 00:00:15.839
I'm Aaron Pritz and Cody Rivers.
00:00:16.160 --> 00:00:21.679
And today we're pleased to be here with Ashley Rose, the CEO and co-founder of Living Security.
00:00:21.760 --> 00:00:47.280
And I'm especially excited for this talk because I've been an advocate as well as a critic, all things security awareness and human risk back from my corporate days when I walked into a reboot of a cyber program after a FBI arrest of individual insiders and trying to get the business outside of IT to understand and do things very, very differently.
00:00:47.439 --> 00:00:48.719
So I'm excited for this.
00:00:49.039 --> 00:00:52.159
Ashley, it's been a long time in the making, looking forward to this conversation.
00:00:52.320 --> 00:00:59.759
Before we dive in, let's hear a little bit of the Ashley story and how did you find your way into cyber?
00:01:00.399 --> 00:01:13.200
Yeah, um, I think like many in cyber, I have a non-traditional background, but um, you may hear people that just kind of fall into it, whether it's like military or you know, government work or marketing and comms.
00:01:13.439 --> 00:01:16.079
I think we see a lot of, especially in the human risk phase.
00:01:16.239 --> 00:01:19.280
So um, and that's you know, really but had been my path.
00:01:19.439 --> 00:01:27.760
Um, I went to school for business marketing, uh, actually fell in love with business through a a um program called DECA.
00:01:28.079 --> 00:01:34.400
And I it's top of mine because I hosted my daughter's, uh, my senior daughter's DECA end-of-year party yesterday at the house.
00:01:34.480 --> 00:01:35.359
So that was very cool.
00:01:36.719 --> 00:01:44.079
And really like what I learned about myself through that program and then through my years in schooling is that I just love to solve problems.
00:01:44.239 --> 00:01:46.959
And so that like that's as simple as I can state it.
00:01:47.120 --> 00:01:59.200
And during, you know, first in high school and then sort of post, or I'm sorry, during college and post-college, um, I actually got my feet wet in entrepreneurship, but building an infant and ch and children's swimmer line.
00:01:59.439 --> 00:02:02.400
So yeah, that's probably surprising to people.
00:02:02.560 --> 00:02:16.960
But what was what was really great, and I look back on that experience fondly, is I had to go from customer research, problem identification, design a solution, bring it to market, deliver it to the customer, and then solve the customer problem over and over and over again.
00:02:17.120 --> 00:02:20.479
And so, like that in essence is what entrepreneurship is.
00:02:20.639 --> 00:02:26.000
And so doing that once, I learned a lot and was able to apply it to future states.
00:02:26.240 --> 00:02:30.319
So, you know, I spent some years in private company marketing.
00:02:30.479 --> 00:02:42.319
And then um I ended up actually um, you know, really kind of getting my um feet dirty, my hands dirty, my feet wet in cyber, kind of more from the audit and compliance um angle.
00:02:42.479 --> 00:02:45.759
So I ended up on a product as a product manager and a product team.
00:02:45.840 --> 00:02:47.280
This is what product people do, right?
00:02:47.360 --> 00:02:48.159
They're solving problems.
00:02:48.240 --> 00:02:49.120
So I was like, this is great.
00:02:49.199 --> 00:02:50.800
I can go solve problems with tech.
00:02:51.120 --> 00:02:56.240
And I was actually building an internal identity and access management solution at my last organization.
00:02:56.400 --> 00:02:59.680
And that's, you know, that's when I started kind of learning about the technical side of cyber.
00:02:59.840 --> 00:03:02.319
My husband, his background is more traditional.
00:03:02.479 --> 00:03:04.800
He came from a military background.
00:03:05.039 --> 00:03:11.840
He went MI military intelligence, spent a couple of years over in the with the Marine Corps doing cyber network and operations.
00:03:12.000 --> 00:03:18.879
When he came back post-deployment, he was building the cyber program at the company that I was working on, the identity solution.
00:03:19.120 --> 00:03:24.400
And I was actually able to witness firsthand the problem that he was having in the space.
00:03:24.639 --> 00:03:27.520
And I remember just like a very vivid conversation.
00:03:27.759 --> 00:03:28.960
Um, this was happening.
00:03:29.039 --> 00:03:32.319
He, you know, he'd be coming home and building games.
00:03:32.479 --> 00:03:36.240
And um at the time he was building an escape room uh for security training.
00:03:36.400 --> 00:03:38.719
And I remember asking him, like, you're a cyber guy.
00:03:38.879 --> 00:03:39.680
We're a tech guy.
00:03:39.840 --> 00:03:43.360
Why are you building cyber like games for people?
00:03:43.599 --> 00:03:54.879
And he said, Ashley, like my number one challenge is getting the people to care, getting them to engage with cybersecurity so that when they have a question, when they have a problem, that they'll come to me.
00:03:55.120 --> 00:03:58.159
Right now, everyone is like scared of the cyber team.
00:03:58.319 --> 00:04:03.759
They think they're we're gonna tell them no, we're gonna shut off access, we're gonna block them from doing their jobs.
00:04:03.919 --> 00:04:05.840
I need to start working on the culture.
00:04:06.080 --> 00:04:10.400
And then that was kind of my aha moment as a problem solver, entrepreneur.
00:04:10.560 --> 00:04:12.960
I said, okay, like this this really makes sense.
00:04:13.120 --> 00:04:20.720
Um, and then we asked ourselves, if you're having this problem, how many other security leaders are having the same challenge in their organization?
00:04:21.040 --> 00:04:35.279
Um, and so just to kind of fast forward to not quite the end of the story, but maybe the beginning, I found myself on the black hat floor with a tablet, interviewing CISOs about what was going wrong within their human risk uh cyber program.
00:04:35.439 --> 00:04:36.480
And I learned a lot.
00:04:36.560 --> 00:04:40.959
And you know, maybe the rest has been history, but I'm sure we'll we'll close the gap on that today.
00:04:41.439 --> 00:04:42.480
Well, that's awesome.
00:04:42.560 --> 00:04:46.720
And it didn't click for me when we did the prep call a couple of weeks ago.
00:04:46.879 --> 00:04:58.000
But when you think about it, marketing as well as entrepreneurship is really a lot of the problems and the basis for the workforce or the human risk factor.
00:04:58.160 --> 00:05:11.040
And like some of my on the corporate side, some of my best people that I brought into roles that ultimately went on to become besos and lead insiders threat programs were from marketing, marketing and a little bit of finance.
00:05:11.199 --> 00:05:23.199
So I do think like the cross-functional, like bringing people in that aren't traditional really helps us from a diversity of thought standpoint, but as well as like, how do we get people's attention?
00:05:23.360 --> 00:05:24.319
Well, that that's marketing.
00:05:24.399 --> 00:05:26.240
That's comms, that's we are, right?
00:05:26.720 --> 00:05:33.600
Well, let's, I mean, I know we'll get into SAT, but who built the original security awareness and training programs?
00:05:33.920 --> 00:05:35.279
IT professionals.
00:05:35.439 --> 00:05:47.839
And so, like, if we just like we take that for what it is, it's you know, people that are working mostly with computers and tech, less on the business and people side, they're trying to solve a business and people problem.
00:05:48.480 --> 00:05:55.439
And for all intents and purposes, the stats, you know, make the claim that has not been successful, in my opinion.
00:05:55.519 --> 00:06:03.279
And so I think like it was actually a competitive advantage for us that I came more from a business, you know, marketing perspective.
00:06:03.439 --> 00:06:08.000
And to your very point, marketing's job is to drive behavior change.
00:06:08.240 --> 00:06:25.920
The behavior that they're looking for is how can I get you to follow my path, click my link, you know, go make a purchase and become a brand advocate and ambassador in a similar way when we're building a security culture, trying to drive positive behavior and become a security advocate or a champion.
00:06:26.079 --> 00:06:27.519
We're taking a very similar approach.
00:06:27.600 --> 00:06:34.720
So, yeah, a lot of kind of the methodology, like things I learned on the marketing side, we've been able to apply to the human risk side as well.
00:06:35.040 --> 00:06:35.439
Love that.
00:06:35.519 --> 00:06:46.399
And I was in a conversation yesterday on sales automation, and I made the comment like sales automation and automating people to click things and emails.
00:06:46.639 --> 00:06:50.639
The converse of that is the the cyber criminals and the fishers, right?
00:06:50.800 --> 00:06:52.079
It's all about social engineering.
00:06:52.160 --> 00:07:01.519
There's the white hat social engineering, which is probably some benevolent thing, like, hey, come look at my product and click the link, and I want to get you into the funnel, uh, you know, that will ultimately lead to the sales.
00:07:01.600 --> 00:07:06.959
But on the flip side, like criminals, criminals are selling your entrance into their ransomware.
00:07:07.120 --> 00:07:08.560
So so many parallels.
00:07:08.639 --> 00:07:09.600
That's not a great parallel.
00:07:09.680 --> 00:07:13.600
And sorry to my sales friends that I was gonna say, Aaron, did you side to that?
00:07:13.920 --> 00:07:17.040
Did you just equate marketers to cyber criminals?
00:07:17.199 --> 00:07:18.560
Because that's kind of what's the way right now.
00:07:18.879 --> 00:07:19.279
Salespeople.
00:07:19.839 --> 00:07:21.120
Marketers are cool.
00:07:21.279 --> 00:07:24.160
Yeah, Ashley, you Braunwin, you're you're in the cool club.
00:07:24.399 --> 00:07:28.160
Salespeople, I might have just all those sales people know of you know, yeah.
00:07:28.240 --> 00:07:31.360
Uh anyway, let's move along before I dig my hole any deeper.
00:07:31.600 --> 00:07:52.879
Yeah, well, and I'll just say real fast too, actually, I think I love that that your background is not the traditional route because a lot of times I tell people with like our clients, like when you're trying to sell to people, IT and cyber, we know they kind of understand or have the foundational understanding of why this is important, but we're trying to get those who don't care about cyber, who don't think about it, you know, like my most furthest uh stakeholder from it.
00:07:52.959 --> 00:08:00.000
And I would say marketing kind of gets the picture there, they're but they're to your point helping to sell the uh the intention to sell the dream.
00:08:00.079 --> 00:08:01.360
So I I I love that.
00:08:01.680 --> 00:08:05.360
That's why I love what you're doing over there and excited to chat more here on the podcast.
00:08:05.680 --> 00:08:06.000
All right.
00:08:06.079 --> 00:08:16.240
So we've gotten through the entrepreneurial marketing background, the the babies and kids swimwear, the pivot to cyber through both your own intrigue and your husband.
00:08:16.480 --> 00:08:20.319
Now let's fast forward to early days of living security.
00:08:20.399 --> 00:08:24.240
And I remember you guys like coming out with the escape room stuff before anyone was doing it.
00:08:24.399 --> 00:08:26.560
How did all that come to fruition?
00:08:26.639 --> 00:08:36.559
And then ultimately let's pivot from SAT or security awareness and training to HRM and really get into maybe our listeners that aren't as familiar with that.
00:08:36.720 --> 00:08:42.399
It's not just another tool, but the tools have to look very different from what we've seen over the last decade.
00:08:43.039 --> 00:08:43.919
Yeah, absolutely.
00:08:44.159 --> 00:08:56.799
So um I'll actually go back to that black hat floor because the two insights that I heard just from every conversation, um, they're they're actually you know quite similar.
00:08:57.039 --> 00:08:59.600
One, there's a lack of engagement with cyber.
00:08:59.919 --> 00:09:07.279
People were not paying attention, it was not presented in an understandable and you know, an approachable way.
00:09:07.440 --> 00:09:15.919
And therefore they're zoning out, tuning out, and still doing the same things post the training, despite you know, clicking through and getting all the answers correct.
00:09:16.000 --> 00:09:18.720
Um, so there was no behavior, there's no engagement, no behavior change.
00:09:18.960 --> 00:09:28.559
The second thing that we learned was that outside of, you know, I would say kind of easily fraudulent metrics, completion, click rate, report rate, right?
00:09:28.639 --> 00:09:33.519
We can make our click rate go down if we make our fishing scenarios easier.
00:09:33.759 --> 00:09:37.919
We did not have any way to effectively measure and quantify human risk.
00:09:38.080 --> 00:09:40.879
Those were the two things that really stood out in my conversations.
00:09:41.120 --> 00:09:45.919
And so I actually remember sitting at a park, I can tell you like the exact location.
00:09:46.080 --> 00:09:52.159
And Drew and I sat on a hill and we like debated hardcore which one are we gonna go after first?
00:09:52.399 --> 00:09:54.080
Because like we couldn't do both, right?
00:09:54.159 --> 00:10:01.120
When you're when you're like a new startup, you are two people and little like a little bit of funding, you got to choose.
00:10:01.279 --> 00:10:13.360
And ultimately, to you know, maybe my dismay, because I probably would have built human risk management in Unify back in 2017 and it would have absolutely failed, fallen uh flat on its face, and nobody would have bought it.
00:10:13.519 --> 00:10:17.120
Um we opted to go, it was ahead of its time.
00:10:17.600 --> 00:10:19.600
Uh we had to go the engagement route.
00:10:19.840 --> 00:10:21.759
And so we said, fine, let's do it.
00:10:21.840 --> 00:10:24.320
And so, what was the fastest way to get product to market?
00:10:24.480 --> 00:10:30.080
It was to we Drew and I were not technical coders, although now with AI, I actually do a little coding myself.
00:10:30.320 --> 00:10:33.679
Vibe it, vibe it really goes I'm a I'm a viber, a vibe coder.
00:10:33.840 --> 00:10:38.000
So um, and yeah, so we said, well, what can we do?
00:10:38.080 --> 00:10:41.200
We can, you know, take these escape rooms that were like were really, really popular.
00:10:41.440 --> 00:10:46.480
They were just kind of hitting, you know, a big streak, just kind of like with the general public as well.
00:10:46.639 --> 00:10:49.519
And we were gonna turn those into security training.
00:10:49.759 --> 00:11:10.480
And so we were literally like, you know, going to Goodwill in the beginning, picking up props and then retrofitting them to basically like mimic security situations, packing them up in boxes, like literally luggage and suitcases, jumping on planes, and then getting on site with early customers and running these escape room experiences for their employees.
00:11:10.639 --> 00:11:15.039
And I'm talking like turn and turn, like every 30 minutes, we're getting like eight people in a room.
00:11:15.200 --> 00:11:17.600
And I'm on site for days at this point, right?
00:11:17.679 --> 00:11:19.840
Because we're trying to get like mass audience through.
00:11:20.080 --> 00:11:31.360
So, what I what was really unique about that opportunity is I got to sit next to these program owners, the CISOs, the leadership team that they wanted to bring through.
00:11:31.440 --> 00:11:38.879
And I got to hear firsthand for hours at a time, days at a time, weeks at a time, what was going on within their human risk and cyber program.
00:11:39.200 --> 00:11:48.960
So, like unify, like the human risk management concept was actually like birthed on the ground floor in security escape rooms, like alongside of the customers.
00:11:49.120 --> 00:11:52.720
And so that's truly like how this concept really developed.
00:11:52.879 --> 00:11:57.519
Like we knew we needed to be able to quantify risk, but we didn't really know how or like what it would look like.
00:11:57.679 --> 00:12:03.039
But we actually really got to materialize that while we were on site with the customers doing the escape rooms.
00:12:03.120 --> 00:12:05.519
And so there was a really like natural progression there.
00:12:05.679 --> 00:12:07.679
I'll say, you know, to kind of quicken that.
00:12:07.840 --> 00:12:11.279
So the escape rooms were very popular, customers loved them.
00:12:11.440 --> 00:12:27.360
One of the things that it truly did that I think you do have a hard time doing sort of with like mass scale online training, is like the security team was in the room and they got to see like the benefit and value of the program that they were providing firsthand.
00:12:27.759 --> 00:12:38.799
Because the aha moment would like it would pop up and you'd almost see this person, like the light bulb go off when they learned something like unique, or they would ask a question or say, I saw this thing on my phone come through.
00:12:38.879 --> 00:12:41.600
Like it was so visible, the ROI.
00:12:41.840 --> 00:12:44.159
Still hard to quantify, but very visible.
00:12:44.399 --> 00:12:49.600
And so that really motivated the customers to keep like wanting to do that more and more.
00:12:49.759 --> 00:12:58.559
Um, it actually probably wouldn't have been for like out you know, outside of COVID, that I don't know that it would have been really hard to shut it down because it was so beloved.
00:12:58.720 --> 00:13:02.080
Like we still have people today come back and say, Do you have these escape rooms?
00:13:02.399 --> 00:13:08.720
Um, but anyway, COVID obviously accelerated, you know, accelerated the need to be online and to achieve scale.
00:13:08.879 --> 00:13:14.639
And so it was through 2020 and then some capital raising that we went after problem two, right?
00:13:14.799 --> 00:13:17.279
Which is how do we how do we get visibility?
00:13:17.440 --> 00:13:18.720
How do we quantify risk?
00:13:18.879 --> 00:13:21.039
How do we deploy interventions at scale?
00:13:21.200 --> 00:13:23.679
And how do we drive an ROI from our programs?
00:13:23.840 --> 00:13:32.320
And so that was really like the accelerant for us was through, you know, like many businesses, like the COVID pandemic, you have to pivot and go with where the market's going.
00:13:32.399 --> 00:13:34.480
And it's been a great journey from there.
00:13:34.960 --> 00:13:35.360
Love it.
00:13:35.519 --> 00:13:41.840
So, Ashley, talk about because I think when HRM was kind of relabeled, Forrester declared it.
00:13:41.919 --> 00:13:48.320
I know you mentioned to me in the prep that Gartner just asked if uh if we could do another, if it needs to be renamed again.
00:13:48.399 --> 00:13:51.120
And I think both of our reactions were very similar.
00:13:51.440 --> 00:14:05.440
But talk to me about, I think there was a misperception early on that risk quantification was going to be on the human risk signals that were available today, like phishing, like we're we're doing metrics better.
00:14:05.600 --> 00:14:19.840
But talk to me about like the broader signals that you know an evolving HRM prop uh program should be pulling in and really how it starts to look very different from what SAT was able to measure and metric over the past.
00:14:20.639 --> 00:14:21.440
Yeah, absolutely.
00:14:21.679 --> 00:14:26.559
So we started very intentionally, and the naming convention was also very intentional.
00:14:26.639 --> 00:14:29.279
We called it risk management because I believe that is our job.
00:14:29.679 --> 00:14:36.799
You know, we are human risk managers, we're not human risk eliminators, and risk management is a business security function.
00:14:36.960 --> 00:14:38.399
They have to work hand in hand, right?
00:14:38.639 --> 00:14:46.080
So um and I do believe, I said this on the prep, that I think risk is not inherently good or bad.
00:14:46.240 --> 00:14:52.720
I think there is acceptable risk, and sometimes you know, you have to take risk to drive competitive advantage.
00:14:52.879 --> 00:15:09.440
So when you have CIOs and CEOs saying, hey, everybody in your organization needs to be using AI tools, and there's like not a lot of you know, security governance and restriction, the question is at that point, how do we like, how do we manage the risk around this?
00:15:09.600 --> 00:15:20.559
And ultimately you're weighing out the the upside, right, the potential benefit of letting people do that with the downside risk that could come with a security incident, a breach, right, yeah, privacy, all that.
00:15:20.639 --> 00:15:23.600
And so, um, and we know where that's landed, I think generally.
00:15:23.759 --> 00:15:31.279
Many most companies that I've you know have talked to, like they want their teams interacting with AI and they're gonna go figure it out after the fact.
00:15:31.440 --> 00:15:46.240
Now we have, you know, maybe more compliance oriented or uh people that have, you know, maybe not quite that risk tolerance that are blocking, restricting, I would beg that, you know, I would say there's probably a lot of like shadow AI in those environments, but we'll we'll talk about that later.
00:15:46.399 --> 00:15:47.679
Um, but back to your question.
00:15:47.840 --> 00:15:52.960
So started out with okay, this is truly like a risk management function.
00:15:53.200 --> 00:15:54.960
How do we quantify risk today?
00:15:56.080 --> 00:15:57.519
Likelihood and impact, right?
00:15:57.679 --> 00:16:03.519
And so how then can we quantify human risk in the form of likelihood and impact?
00:16:03.679 --> 00:16:06.720
And so with that was that was really like the basis of where we started.
00:16:06.799 --> 00:16:10.720
And so we said, well, what are we learning from our metrics today?
00:16:10.960 --> 00:16:15.919
Well, how what's the propensity of somebody to click on a phishing email potentially?
00:16:16.000 --> 00:16:20.240
Because you know, these are also simulations, they're not real, but like it's giving us some signal.
00:16:20.480 --> 00:16:24.399
And then are they taking their training and are they compliant?
00:16:24.720 --> 00:16:27.200
And like that's really not a lot of depth, right?
00:16:27.279 --> 00:16:29.519
When we're thinking about risk quantification.
00:16:29.600 --> 00:16:31.279
And so it had to be more.
00:16:31.600 --> 00:16:36.960
And so then the next question was like, well, where can we get some of these risk signals from?
00:16:37.200 --> 00:16:44.159
And so we realized that like a lot of this signal aggregation was already happening in the security teams, right?
00:16:44.240 --> 00:17:03.440
We had Sims and SOARs like gathering and collecting data across your entire infrastructure and security tech stack, but they were like feeding it back into a solution that was um really optimized to manage your network, your assets, your devices, like it wasn't tailored for user risk.
00:17:03.679 --> 00:17:16.079
And so, in a similar way that the SIM was collecting the data, we realized we could actually start getting a lot of behavioral data about users, not it through simulations, but just how they were interacting with their in their environment.
00:17:16.319 --> 00:17:17.839
Was their endpoint compliant?
00:17:18.000 --> 00:17:19.920
Are they clicking at real phishing email?
00:17:20.079 --> 00:17:21.359
How are they handling data?
00:17:21.519 --> 00:17:23.200
What websites are they browsing?
00:17:23.359 --> 00:17:24.720
Are they using MFA?
00:17:24.880 --> 00:17:26.400
Are they setting strong passwords?
00:17:26.480 --> 00:17:29.039
Like the list goes on, but a lot of behavioral signals.
00:17:29.119 --> 00:17:29.920
So that was great.
00:17:30.079 --> 00:17:31.359
That was a great signal start.
00:17:31.759 --> 00:17:34.480
I would say there's some companies out there that will stop there.
00:17:34.640 --> 00:17:37.759
We said, well, that's not really true, livelihood and impact either.
00:17:37.839 --> 00:17:39.759
And so how do we how do we move beyond?
00:17:39.920 --> 00:17:42.240
So we need we need a threat vector.
00:17:42.559 --> 00:17:45.839
We want to know, like, is this person getting targeted?
00:17:46.160 --> 00:17:46.400
Right?
00:17:46.480 --> 00:17:50.960
Well, there are signals, contextual signals outside of the behavior that really matter here too.
00:17:51.039 --> 00:17:52.400
So maybe we can get some of those.
00:17:52.720 --> 00:17:54.000
Three threat and tell platforms.
00:17:54.160 --> 00:17:58.079
Can we see people who have breached credentials, for instance, that were found in the dark web?
00:17:58.480 --> 00:17:59.279
Um, absolutely.
00:17:59.599 --> 00:18:03.440
And so then the next piece was all right, now let's think about the impact.
00:18:03.680 --> 00:18:05.200
Where can we get that signal from?
00:18:05.359 --> 00:18:09.359
Well, we we can tell who has admin privileges, right?
00:18:09.519 --> 00:18:12.960
Who has privilege escalation if their account's compromised?
00:18:13.119 --> 00:18:16.240
You know, what's the blast radius for this individual?
00:18:16.400 --> 00:18:20.400
And so we wanted to go after the sort of inherent risk signals, the identity signals.
00:18:20.559 --> 00:18:37.359
And we really we believe that if we could marry these two, these three areas, the behavior, the threat, and the identity, we could give you a really, really solid um risk quantification engine or an HRI score and really give you the opportunity to start prioritizing where you spend your time.
00:18:37.519 --> 00:18:43.119
How do you get to that 10% of individuals that are driving 73% of the risk?
00:18:43.200 --> 00:18:46.160
And that's a backable claim by a study we did last year.
00:18:46.319 --> 00:18:50.640
So um, I think that answered your question, but like it really was that simple.
00:18:50.799 --> 00:18:53.599
It was just what do we need to get, what do we need to accomplish?
00:18:53.759 --> 00:18:54.720
Where is the data?
00:18:54.960 --> 00:18:55.920
Can we connect it?
00:18:56.079 --> 00:18:57.519
Does this make logical sense?
00:18:57.599 --> 00:18:58.960
And then let's go after it.
00:18:59.279 --> 00:19:01.920
Well, and one follow-up on the can we connect it?
00:19:02.000 --> 00:19:23.519
For those of us that went through like UEBA, you know, probably five, 10 years ago, UEBA implementations and lots of actually one of the managing directors on our team, when we he was first getting introduced to HRM, he was like, oh man, I went down this with UEBA and all the connectors and trying to get everything, and it always sounds great from the vendor perspective, but then nothing connects right.
00:19:23.680 --> 00:19:25.039
But that was 10 years ago.
00:19:25.279 --> 00:19:28.480
APIs are different, the world is more interconnected.
00:19:28.559 --> 00:19:35.039
What does that look for you guys and the kind of promise of the great things you can do if you connect everything to actually connecting it?
00:19:35.359 --> 00:19:36.720
What does that take?
00:19:37.039 --> 00:19:38.400
Yeah, that's a great question.
00:19:38.559 --> 00:19:42.079
So certainly we have stumbled quite a bit.
00:19:42.480 --> 00:19:47.519
I have all the bumps, the bruises, and the scars to prove it is what I tell people when I'm especially when I'm speaking to the enterprise.
00:19:47.599 --> 00:19:48.799
I'm like, we've seen it all.
00:19:49.119 --> 00:19:51.440
Like we work with the biggest companies in the world.
00:19:51.599 --> 00:19:56.000
There's a lot of messy identity, you know, out there, like a lot of messy identity systems.
00:19:56.160 --> 00:20:16.640
And so one of the first things that we did was realize like we needed to create our own entity resolution and identity graph in this solution because we're gonna like see Ashley and her, you know, and at on the endpoint and in the web application firewall and like in the email security tool, and like Ashley's gonna look different in all of these systems.
00:20:16.799 --> 00:20:21.519
And we needed a way to bring it all together and see like who Ashley was, what she was doing, right?
00:20:21.599 --> 00:20:22.319
All of those things.
00:20:22.400 --> 00:20:24.079
And so that was the first thing we did.
00:20:24.160 --> 00:20:27.279
And so then it didn't like we like a source of truth, right?
00:20:27.359 --> 00:20:36.079
Typically that's coming through like an HR system, a workday, maybe it's coming from your Okta or your sale point, like an identity solution, but we could then orient everything else around it.
00:20:36.160 --> 00:20:40.160
And we're really kind of like cleaning up the identity mess in a lot of these organizations.
00:20:40.319 --> 00:20:41.839
Um, so that was the first piece.
00:20:42.079 --> 00:20:51.920
The second thing was when you go out to these APIs and you're bringing in signal, we knew we did not want to be like an alerting and noise platform.
00:20:52.000 --> 00:21:04.319
Um and actually, something I think is worth noting that you said, right, when you did UABA, like oftentimes the complaint was like this was very noisy, there was a lot of alerts, like you couldn't really find the needle in the haystack that you were looking for.
00:21:04.480 --> 00:21:07.039
And it was also like very reactive in its approach.
00:21:07.200 --> 00:21:09.920
It was meant to be more of a detection response system.
00:21:10.160 --> 00:21:25.039
Um, HRM, our focus was on how do we shift left and how do we go to predict and prevent so that we're finding the signals and the sequencing that could lead to an incident and getting in front of it before the incident and the breach occurs.
00:21:25.200 --> 00:21:27.200
And so it was a very different like mindset and approach.
00:21:27.279 --> 00:21:29.279
And so the data model had to support that as well.
00:21:29.440 --> 00:21:32.880
And so we said we don't want all the data, we want the meaningful data.
00:21:33.039 --> 00:21:39.279
And so we got really specific about like what parts, what feeds, what signals and streams we're gonna be pulling in.
00:21:39.440 --> 00:21:42.240
It had to add context and value to our model.
00:21:42.319 --> 00:21:46.000
And the output needed to not be noise or junk either.
00:21:46.160 --> 00:21:47.839
We wanted the output to be actionable.
00:21:48.000 --> 00:21:53.519
And so when we started building like the signal library and all that, like it was with the mindset of how do we make this actionable.
00:21:53.839 --> 00:21:56.799
I'll say, like, maybe this last third thing to answer your question.
00:21:57.039 --> 00:21:59.839
There are a lot of systems out there, I would say pre AI.
00:22:00.480 --> 00:22:05.119
It was very like time consuming and costly to build out a lot of APIs direct to these systems.
00:22:05.200 --> 00:22:09.839
And we found like enterprises would have, I have this homegrown system or something you've never heard of.
00:22:09.920 --> 00:22:13.599
And so our team spent a lot of time like building out custom connectors.
00:22:13.759 --> 00:22:27.119
And we had, you know, sort of an internal, like secure, you know, sales engineering position where we would have to go out, we'd build this custom connector, we'd work kind of directly hand in hand with the customer, and making sure that there was trust in the data that was coming in.
00:22:27.279 --> 00:22:28.880
That was absolutely critical.
00:22:29.039 --> 00:22:43.680
Um, is actually why one of the first reasons we started outreaching to partners like Reveal Risk, right, and others is because we said, hey, there's there's really a need for services in the upfront like implementation of this for these enterprise customers that have complex environments.
00:22:43.759 --> 00:22:47.200
And um, so yeah, I'm not gonna like say that it was really easy.
00:22:47.279 --> 00:22:48.000
We learned a lot.
00:22:48.160 --> 00:22:49.440
I think we've gotten very good at this.
00:22:49.599 --> 00:22:52.720
It's like one of the things that is standoutish about our company.
00:22:52.880 --> 00:23:06.319
And then certainly with AI, um, we're we're doing some really cool things where you know, now deploying like AI against an API, you can actually do things like best guess matching and then surfacing up, you know, signals that you haven't seen before.
00:23:06.480 --> 00:23:08.880
Like the AI can kind of like map that to the data models.
00:23:08.960 --> 00:23:11.839
And so there's some really cool advancements which we which we can get into.
00:23:11.920 --> 00:23:15.119
But um, but yeah, complex environments takes a lot of work.
00:23:15.200 --> 00:23:17.200
Um, and we spent the years to figure it out.
00:23:17.440 --> 00:23:17.680
Love it.
00:23:17.839 --> 00:23:19.920
Ashley, do you have a dog in the office?
00:23:20.480 --> 00:23:20.880
I do.
00:23:20.960 --> 00:23:30.160
Did she no, no, it was it was perfectly it was perfectly timed because when you were talking about signals, all I saw was a little tail wagging right below your name.
00:23:30.240 --> 00:23:32.000
And I'm like, perfectly timed.
00:23:32.079 --> 00:23:33.039
It was on cue.
00:23:33.119 --> 00:23:33.440
Love it.
00:23:33.599 --> 00:23:39.920
Yeah, so she was supposed to be with uh I have a a child from school in the back of the room who's supposed to be keeping the dogs quiet.
00:23:40.000 --> 00:23:46.319
So we we we applaud when when office office uh canine workers make an appearance.
00:23:46.400 --> 00:23:47.599
So that's welcome on this show.
00:23:48.000 --> 00:23:48.799
All right, good, good.
00:23:48.960 --> 00:23:54.079
Well, she may jump up in my lap if we let if you know we we keep saying what a great opportunity that is for her.
00:23:54.160 --> 00:23:56.240
But Ashley, you've done a lot of cool things.
00:23:56.319 --> 00:24:00.960
And I want to talk about kind of like the the action out of what what you're we're gathering the data.
00:24:01.039 --> 00:24:06.559
And I think is that a prep call or was on an interview I think I read that you did recently, but you said something that stuck with me.
00:24:06.720 --> 00:24:10.880
And it was like, make the secure path the easiest one to follow.
00:24:11.039 --> 00:24:14.400
So kind of give us what that looks like in practice.
00:24:15.200 --> 00:24:15.759
Absolutely.
00:24:15.920 --> 00:24:25.200
So, first and foremost, CISO security leaders, like they need to know where to spend their time actually learning about which pathways are broken.
00:24:25.359 --> 00:24:43.759
Because I think a lot of times we actually don't know because we're trying to like combat the thing that's like on fire in front of us, and we're maybe missing out on some like really big opportunities to, you know, enable faster work streams, drive business efficiency, and like enable the business to drive operational results in a secure way.
00:24:44.000 --> 00:24:55.680
And so the first pass of that, the first requirement of that is can we go figure out is there like an unknown unknown in our environment, like an area of risk that's just like we haven't quite figured out?
00:24:55.839 --> 00:25:04.079
And we've seen that in a couple of our customer environments where it's like, okay, this group of people continues to do this same thing over and over and over again.
00:25:04.240 --> 00:25:09.839
And in the past, I think we would have said, oh, those, you know, stupid users, like they don't care about security.
00:25:09.920 --> 00:25:10.880
Why are they doing that?
00:25:11.200 --> 00:25:13.359
Reality is that guess what?
00:25:13.519 --> 00:25:15.680
We're putting a lot of friction in their job.
00:25:15.920 --> 00:25:17.359
They need to go get something done.
00:25:17.519 --> 00:25:19.359
They have a goal and out and outcome, right?
00:25:19.440 --> 00:25:21.119
These people were hired, they're smart people, right?
00:25:21.200 --> 00:25:28.319
They were there in an interview process, they were given a mission, and so they're trying to get their job done most of the time, and something's in their way.
00:25:28.559 --> 00:25:43.839
So, you know, an example I gave, uh, maybe it was in the prep call was, you know, we were working with a healthcare system, and they were like, hey, these, you know, nurse practitioners and doctors, they keep like sharing their password, and you know, they're not, you know, they're bypassing MFA and all these things.
00:25:44.079 --> 00:25:53.279
And it took actually like going and having a conversation with that business and even like maybe getting on the ground floor, like going to the hospital system and saying, like, what is happening?
00:25:53.440 --> 00:25:54.799
Why are we behaving like this?
00:25:54.960 --> 00:26:00.319
To realize these healthcare workers, like their number one job is to save patients' lives.
00:26:00.480 --> 00:26:13.039
So they're on the floor, they're trying to get their job done, and like this system's logging out pretty consistently, and like they're moving carts around, and it's just taking so long to get, you know, to the patient record and and whatever else.
00:26:13.200 --> 00:26:17.200
And so, you know, that's a risk, a risk decision for the business.
00:26:17.359 --> 00:26:23.279
Like, do we do we want to keep this type of you know, log out time on the on the system?
00:26:23.440 --> 00:26:25.039
Maybe we want to we want to extend it.
00:26:25.200 --> 00:26:30.400
Is there like a different type of tool that can make it easier for these you know doctors and nurses to log in?
00:26:30.559 --> 00:26:36.960
You know, there's there's something here that it's not what we're doing now because the behavior that we want that is not happening, right?
00:26:37.119 --> 00:26:39.839
The behavior we don't want is happening, so that's not secure.
00:26:39.920 --> 00:26:43.759
And on the flip side, we have frustrated clinical staff.
00:26:43.839 --> 00:26:50.559
And so that's just an example, but like it required the data to be surfaced to start and like ask the question like, why is this happening?
00:26:50.799 --> 00:26:56.400
Go investigate, go spend time with feet on the ground, or go have a conversation with if you have a viso, right?
00:26:56.480 --> 00:27:07.920
Your your business owner over there, and then really co-author and work together to strategize what's gonna work for our business, what's our risk tolerance, and let the business make the decision, right?
00:27:08.079 --> 00:27:09.680
Is this acceptable risk or not?
00:27:09.839 --> 00:27:14.640
Do we want to pay to mitigate it, to transfer it, to reduce it, whatever that is?
00:27:14.720 --> 00:27:18.559
And so that would be like one, you know, kind of on the ground example.
00:27:18.640 --> 00:27:22.240
There's plenty of others, but like sometimes it's a systems issue.
00:27:22.400 --> 00:27:26.079
It may not be the bad users that keep doing something wrong.
00:27:26.240 --> 00:27:29.920
I mean, maybe it's a problem, but we're not gonna train that away, right?
00:27:30.079 --> 00:27:32.400
Like, and we if we could have, we would have by now.
00:27:32.640 --> 00:27:37.839
Yeah, I actually I'd like to double down on like the business process issue piece.
00:27:38.000 --> 00:27:51.039
Cause so when I was on the corporate side and had the FBI arrest and the insider threat, you know, the you know, no lack of executive support to fix it, which not a lot of cyber leaders get, you don't want to get that level of support.
00:27:51.200 --> 00:27:57.119
But when you've got you get it, you can do a lot of things that you maybe couldn't if they're still kind of doubtful that it'll happen to them.
00:27:57.359 --> 00:28:08.160
But on broken business processes, right after this, obviously we really amped up the data loss prevention capabilities because data loss, data going out the door, exfiltration, that is insider threat.
00:28:08.319 --> 00:28:15.200
And when we were first turning it on in the high-risk countries as well as the high-risk business areas, all sorts of alerts.
00:28:15.279 --> 00:28:20.160
And some of it was white noise, but a lot of it was in that case, like insider threat.
00:28:20.319 --> 00:28:22.880
HR is doing interviews and you're doing investigations.
00:28:22.960 --> 00:28:29.839
And if it's, you know, not a false positive, then like, you know, potentially some someone is doing something bad.
00:28:30.079 --> 00:28:43.519
But what we realized early on is there's so many broken business processes, and people have done things a certain way, you know, emailing to vendors in clear text, very, very sensitive files, or pick whatever bad behavior it was.
00:28:43.599 --> 00:28:49.920
And it wasn't anything, any security awareness training once a year, quarterly, bite size, it wasn't gonna fix it.
00:28:50.000 --> 00:28:53.920
Like somebody needed to go re-engineer that business process.
00:28:54.079 --> 00:29:16.400
And then the second thing on Cody's question, like making it easier, hey, if you're gonna, you know, if you have the signals from a quality tool, HRM, DLP, wherever you're identifying the gap, and you're gonna go in and fix the business process to make it secure while in there, why would a cyber person not want to take some credit for like getting rid of unnecessary steps and making it go very much quicker?
00:29:16.559 --> 00:29:21.119
We had a bunch of success when we used Six Sigma black belts to kind of parachute in.
00:29:21.200 --> 00:29:31.839
And again, it's hard to ask a business process owner to be like, hey, here's a here's a um HRM report and your business process is broken.
00:29:31.920 --> 00:29:35.920
On top of everything else you're doing, go fix this on your own without direction.
00:29:36.079 --> 00:29:36.640
That won't work.
00:29:36.799 --> 00:29:42.079
So I'm a big advocate for our industry and CISOs have understaffed SAT.
00:29:42.160 --> 00:29:45.039
It's usually a lot of companies we see is like a half of a person.
00:29:45.519 --> 00:30:10.240
If we want to get HRM right, we can't expect, even with the greatest tools, if you don't have the human capital around them to enact the positive change, there'll be a lot of good signals and tools that and we can block stuff, but like let's let's put some effort and resources behind this and and do all the things that CISOs wish with wish the human side of cyber could help.
00:30:10.480 --> 00:30:11.920
Uh so I get a little passionate about that.
00:30:12.000 --> 00:30:15.519
But what are your thoughts on the let's how do we go fix it?
00:30:16.400 --> 00:30:21.519
Yeah, there was like so much goodness there in the story that you just told.
00:30:21.680 --> 00:30:24.240
Um, so a couple of things really stand out to me.
00:30:24.480 --> 00:30:35.599
First and foremost, it's not just about adding capacity, but it's also empowering, enabling, and like actually elevating that particular individual.
00:30:35.759 --> 00:30:57.519
So I remember like one of the first um or individuals, because one of the first decks that we built around human risk management, and again, in partnership with the customer, it was like there was like a table, and you know, SecOps was there and like insider threat and TRC and like the network security team, and like you know, we could keep the list goes on.
00:30:57.680 --> 00:31:10.559
And it, you know, they're at like the table and they're like enjoying a conversation, and then there was like the kid table over to the side, and the security awareness person was like sitting at the kid table, and like this analogy came from our customers.
00:31:10.880 --> 00:31:15.680
They were like, We are invited to the conversations, like we don't have a seat at the table.
00:31:16.160 --> 00:31:22.319
And so, how do you expect them to go help solve like your number one risk is your people?
00:31:22.799 --> 00:31:32.799
Like, stats are clear, and like you put a person on that that is great, like they are they are motivated, but they do not have the tooling, right?
00:31:32.960 --> 00:31:38.400
They do not have the access, they oftentimes do not have the executive support, and they don't have the budget.
00:31:38.640 --> 00:31:41.599
And so that is like a really hard position to be in.
00:31:41.839 --> 00:31:50.799
And so when we talk to this type of individual, they are like, they're always telling me they're like, I want to do more for my company.
00:31:50.960 --> 00:31:57.039
I want to be able to prove out that the work that I'm doing, like I know it's doing good, like I can feel it, like right.
00:31:57.119 --> 00:32:01.839
I can see it, like I can see the light bulb moments, but like I have no proof of my effort.
00:32:01.920 --> 00:32:05.839
And so it's hard for me to communicate to that around that, and I can't get budget, right?
00:32:05.920 --> 00:32:11.359
So that is like still very much, I'd say, the state of the industry, which we need to do more work there.
00:32:11.599 --> 00:32:25.680
Um, so yes, we need to give them a seat at the table, and we need the cyber teams and we need CISOs to recognize that this is like a critical attack service, and you need to manage that well and you need to staff it well.
00:32:25.839 --> 00:32:28.559
And you need to be breaking down the silos in your security team.
00:32:28.720 --> 00:32:30.640
And so then moving to the tool, right?
00:32:30.720 --> 00:32:31.519
How do we do that?
00:32:31.680 --> 00:32:39.759
We we always say like human risk management tools, when implemented and operationalized effectively, are breaking down the silos.
00:32:39.920 --> 00:32:43.359
So, first and foremost, we can't do anything without the security data.
00:32:43.519 --> 00:32:50.559
So we need sec ops at the table, we need the tool owners, we need to be pulling in and ingesting the data, but that should not stop there.
00:32:50.880 --> 00:33:08.160
When we are able to categorize and derive really important insights and prioritization of risk, there's so much value for these tool owners and context that we can provide them can actually enhance the value of the tools they've already invested in and that they're spending their time.
00:33:08.319 --> 00:33:09.759
So let me give an example.
00:33:10.000 --> 00:33:18.079
The DLP uh issues that you were talking about, you probably like weren't gonna go block every type of you know DLP alert that came through.
00:33:18.240 --> 00:33:24.799
Actually, many times, like the DLP UEBA solutions when they're first put into practice are in like read-only.
00:33:25.039 --> 00:33:26.640
There's like not a lot of right happening.
00:33:26.720 --> 00:33:30.960
And we've seen that and like people have you know negative connotations about like the first pass of this.
00:33:31.119 --> 00:33:42.559
But like the real reason was because it is it is noisy and like there was a lot of risk if you blocked somebody from getting their job done, and especially when it was like maybe not a malicious insider, right?
00:33:42.640 --> 00:33:44.079
There's a lot of false positives in there.
00:33:44.319 --> 00:33:47.279
But what if we could start prioritizing those alerts for you?
00:33:47.440 --> 00:33:54.880
What if we could marry high-risk individuals across numerous systems, across their identity system, across their email system?
00:33:54.960 --> 00:33:57.839
Like, you know, what are they doing within phishing and all of that?
00:33:57.920 --> 00:34:08.400
So on their endpoint, their endpoint out of compliance, what if we could see very clearly that this person holistically is very high risk, and now we're also seeing a lot of DLP alerts.
00:34:08.800 --> 00:34:12.719
Maybe we would turn on a block for that individual, right?
00:34:12.880 --> 00:34:16.960
Um, you know, and then people that are more vigilant in nature, right?
00:34:17.039 --> 00:34:23.039
They're reporting phishing emails, they're taking their training and they're doing their they're setting strong passwords or using MFA.
00:34:23.280 --> 00:34:26.800
You start seeing that, like maybe you're gonna not block it right off the bat.
00:34:26.880 --> 00:34:32.639
Maybe you're gonna send them a training, you're gonna send them a nudge and like redirect them to the appropriate business process.
00:34:32.800 --> 00:34:43.199
So you can start providing contextualized and adaptive controls and policies when you have the context of that individual from a risk perspective.
00:34:43.360 --> 00:34:47.119
So I think there's a lot of value for security teams in doing that.
00:34:47.360 --> 00:34:50.559
And then I think there's two other points I wanted to make from what you said.
00:34:51.519 --> 00:34:53.039
Efficiency is key.
00:34:53.760 --> 00:34:56.239
Uh we have small teams across all of security.
00:34:56.400 --> 00:34:59.360
We are we are understaffed, not just in the human risk side of things.
00:34:59.519 --> 00:35:05.280
And so it was really important for the platform to be able to enable a lot of efficiency and workflows.
00:35:05.440 --> 00:35:09.039
And so there's a lot of business, like broken security business practices.
00:35:09.199 --> 00:35:12.079
Like if you want to just like clean up your own house first, you know?
00:35:12.239 --> 00:35:25.760
And so, for instance, for instance, like I had a customer tell me, okay, well, when when there's like an exception policy that's requested, you know, the the the plan is, the path is that they need to go and they need to take their training.
00:35:25.920 --> 00:35:28.159
Once they take their training, we can give them the exception.
00:35:28.239 --> 00:35:33.760
And then, you know, if they don't have it, after so many days, we need to go like revoke that access or exception.
00:35:33.920 --> 00:35:35.760
And that this was all happening manually.
00:35:35.920 --> 00:35:44.719
Like it's tickets going into like ITSM and ServiceNow, and then somebody's like getting a list and they're like sending a training, and then they have to go track and see if that person took their training.
00:35:44.800 --> 00:35:48.639
And then maybe like if they go check on it, you know, they're gonna go check on it later.
00:35:48.800 --> 00:35:51.199
Maybe they didn't take it, so we have to go send like another ticket back.
00:35:51.360 --> 00:35:54.239
We're gonna revoke their access, and then that user is like pissed.
00:35:54.400 --> 00:35:56.079
They're like, I can't get my job done.
00:35:56.320 --> 00:35:58.880
Like, what if that whole thing could be automated, right?
00:35:59.039 --> 00:36:01.119
Through a platform, like an HRM platform.
00:36:01.199 --> 00:36:05.840
And so this is where like workflows and automation can be really helpful in achieving scale.
00:36:06.079 --> 00:36:24.880
If you can clean up some of like the operational burden and friction of just like the management of these programs, you can actually like take those resources and like reposition them and pivot their focus to something that is more strategic and they can get more done, you know, get more done, you get more, you know, bang for your buck with your security budget, if you will.
00:36:24.960 --> 00:36:28.559
Um, and then the last thing I think you said was around ROI and measurement.
00:36:28.639 --> 00:36:47.199
Um, that's critical because um if you can't, you know, especially today, like if you can't provide business justification and some sort of ROI story, it could be as simple as hey, instead of requiring everybody in my organization to take 30 minutes of training a month, I'm only gonna target risk-based training to the people that need it.
00:36:47.360 --> 00:36:49.360
And that's probably about 10% of my staff.
00:36:49.440 --> 00:36:52.639
And so the 90% that equates to 10,000 people.
00:36:52.800 --> 00:36:54.639
We're saving 30 minutes a month.
00:36:54.880 --> 00:36:58.800
Average, you know, cost per hour of wages for our people are this.
00:36:59.039 --> 00:37:06.719
This is like the potential cost savings for the business by going into more of a risk-based approach versus requiring training for everybody all year long.
00:37:06.960 --> 00:37:10.800
Like that was just one example, but um, it is very more concrete, right?
00:37:10.880 --> 00:37:13.920
It's black and white than trying to say, like, okay, what is like the risk avoidance?
00:37:14.000 --> 00:37:15.039
Like, how do we quantify that?
00:37:15.199 --> 00:37:16.880
Certainly we're working on those things as well.
00:37:17.039 --> 00:37:28.400
But I think we need to get more creative and like that financial oriented mind that you said earlier, that's sometimes really great to be a part of the security team, like they can be helpful in those, you know, business calculations.
00:37:29.280 --> 00:37:29.760
Love it.
00:37:29.920 --> 00:37:30.239
Yeah.
00:37:31.039 --> 00:37:35.119
And thinking too, like, we've been, you know, years in the game now in security awareness training.
00:37:35.199 --> 00:37:38.639
I think HRM now is kind of catching, catching some of some of the fire.
00:37:38.719 --> 00:37:41.039
And I think we're getting some of the grounds well.
00:37:41.440 --> 00:37:43.039
Do we get to critical mass?
00:37:43.119 --> 00:37:44.559
Does the name change again?
00:37:44.719 --> 00:37:45.920
I mean, what are your thoughts there?
00:37:46.079 --> 00:37:51.360
How do we start to get this in the limelight, or does the narrative shift again on the name of what we're trying to accomplish?
00:37:51.599 --> 00:37:52.400
Yeah, great question.
00:37:52.559 --> 00:37:57.679
So if you look at like analyst coverage today, they'd probably say that we're still at about 15%.
00:37:58.159 --> 00:38:02.639
And I would say that's growing and it's accelerating adoption of true human risk management.
00:38:02.719 --> 00:38:15.039
Um, I again, I do believe like the last, I would say the last maybe three, four quarters to almost a year, like we've actually seen a huge uptick and we track things like number of RFPs that are coming in, and we can see like customers and all that stuff.
00:38:15.199 --> 00:38:21.440
So that's really good news for all of us because as you know, like third-party risk and supply chain is a big thing.
00:38:21.519 --> 00:38:24.880
So if we're all safer, if we're all more secure, like everybody benefits, right?
00:38:25.039 --> 00:38:26.960
Um, so we should all be advocating for this.
00:38:27.199 --> 00:38:33.840
Look, I think um naming convention, I feel pretty strongly like this is a risk management function.
00:38:33.920 --> 00:38:34.880
So I think that's great.
00:38:35.119 --> 00:38:37.039
Human risk management, who knows, right?
00:38:37.119 --> 00:38:39.199
Because the workforce is changing.
00:38:39.440 --> 00:38:46.400
And that's really where we're spending some time is really understanding that the workforce is now hybrid human and AI agent.
00:38:46.559 --> 00:38:51.679
And so then, therefore, like the workforce attack surface is changing before our eyes.
00:38:51.920 --> 00:38:57.440
We know that humans and agents are interconnected because we're delegating access and we're creating them.
00:38:57.519 --> 00:39:00.159
We have agents working on behalf of humans.
00:39:00.320 --> 00:39:06.000
And so we need to get our arms wrapped around the broader workforce challenge and equation right now.
00:39:06.159 --> 00:39:11.679
And so, does that turn into something like unified workforce risk management?
00:39:12.320 --> 00:39:17.199
I think there is probably over the next decade some sort of change that's going to occur.
00:39:17.360 --> 00:39:31.599
But for right now, as we're maturing this category, you know, we talk about this as like, hey, it's, you know, we're a human risk management vendor, we operate in this category, and we're not thinking about the hybrid workforce, which is inclusive of our AI agents.
00:39:31.920 --> 00:39:33.360
Yeah, no, that's a great point.
00:39:33.599 --> 00:39:37.199
What I do know is I don't want it to follow the path of GRC.
00:39:37.360 --> 00:39:46.079
You know, similar Gartner Forrester renamed GRC Integrated Risk Management or IRM, and now it's back to GRC, or there's confusion.
00:39:46.239 --> 00:39:46.719
Are we back?
00:39:46.800 --> 00:39:47.360
Are we not?
00:39:47.519 --> 00:39:51.519
And what didn't happen was the tech the technology didn't shift material.
00:39:51.679 --> 00:39:59.760
And if analysts are calling for name change because the technology category is not showing value, that's not a naming problem.
00:39:59.920 --> 00:40:06.719
That's a adoption, people process technology, making it all work together, and a technology capability problem.
00:40:06.880 --> 00:40:24.880
So I've already seen a more substantive change in HRM from SAT than there would, I think the GRC to IRM was more hype and surface label or lipstick on a pig than it really was materially changing what we're focused on from a practitioner standpoint.
00:40:25.280 --> 00:40:26.400
That that's right, Aaron.
00:40:26.639 --> 00:40:37.280
So I will say there's still, you know, and this always happens, but you always have like those vendors that are saying, oh, well, like I need to jump on the hype wagon, I'm gonna call myself human risk management.
00:40:37.440 --> 00:40:49.679
But if you like peel back the covers, it's really like fishing and training with a you know stop light, you know, like numerical system on top of it, red, yellow, green, zero to a hundred, whatever you want to say.
00:40:49.760 --> 00:40:52.079
Um, and they're saying, oh, we're doing human risk management too.
00:40:52.159 --> 00:40:56.400
We can give you risk scores, but like it's really like the same old metrics, like in a different way.
00:40:56.559 --> 00:40:59.760
So look, I think that's up to the market, right?
00:40:59.840 --> 00:41:02.480
When they're going through RFPs and they're putting out criteria.
00:41:02.639 --> 00:41:15.440
It's why like we win our POVs 90% 90 plus percent of the time, because truly like the the um the value and the proof is in you know in in the delivery, but we cannot be be remiss.
00:41:15.760 --> 00:41:18.800
We have to recognize that human rights management is a strategy.
00:41:19.199 --> 00:41:24.559
And you can't like deploy a tool and expect you know results overnight.
00:41:24.719 --> 00:41:39.760
Um, it does require business conversations, it requires breaking down silos, it requires strategic alignment, it requires executive sponsor, like the the companies that are doing the best are the ones that their CISO are on the QBRs.
00:41:39.920 --> 00:41:47.840
Their CISO is at, they're at, they're trying to figure out what's going on in my in this, you know, in this human attack service, like how what's this platform showing me?
00:41:48.000 --> 00:41:56.880
And they're helping to drive business change and they're you know bringing teams together around that and they're saying, oh, I can use this data over here as well.
00:41:56.960 --> 00:42:01.119
And so I think executive, um, executive alignment is absolutely key.
00:42:01.280 --> 00:42:04.320
And then, you know, partners like reveal risk as well.
00:42:04.480 --> 00:42:28.719
They're not, you guys are not paying me to say this, but like it's I'm a true believer that if you can find like a really strategic partner to come in um and that understands like the ins and outs of security organizations, like friction and all that, like that can help you navigate, you know, deriving, getting all the right stakeholders there, and then like implementing, executing, and managing a program, like that can be an unlock for a lot of companies, especially if they don't have the resources internally.
00:42:28.960 --> 00:42:33.280
So um I think you know, we're we got a match made in heaven in front of us.
00:42:33.599 --> 00:42:34.480
Agreed.
00:42:35.039 --> 00:42:37.119
Um, thank you, Ashley, again.
00:42:37.280 --> 00:42:41.679
We always have one question for our guest, and this is this is because it's a VIP experience.
00:42:41.840 --> 00:42:47.679
But for those who who wouldn't know Ashley Rose or you know, or personally, give us give our crowd like a fun fact.
00:42:47.760 --> 00:42:50.480
What's into that, you know, that maybe no one knows.
00:42:50.719 --> 00:42:52.400
It could be brand new or it could be something that you've been.
00:42:52.639 --> 00:42:54.719
Well, you know I found it a swimmer line.
00:42:54.800 --> 00:42:56.400
I think that's a pretty fun fact.
00:42:56.639 --> 00:43:02.480
Um so I so one of my one of my goals in life is to get my pilot's license.
00:43:02.800 --> 00:43:08.320
And so I've taken a couple, I've taken a couple flights, uh, but I still have a lot of ways to go.
00:43:08.400 --> 00:43:12.960
I think that's a pretty fun fact um about myself and I will get there.
00:43:13.039 --> 00:43:17.760
I don't know if my husband will ever let me fly my children around, but I'll be up there.
00:43:17.840 --> 00:43:19.440
I'll be up there in the in the sky.
00:43:19.599 --> 00:43:25.440
So yeah, I would say that's like an you know an unmet dream um that I'm pretty excited about.
00:43:25.599 --> 00:43:28.719
So I'm sure there's more, but hopefully that one's good enough.
00:43:29.039 --> 00:43:30.000
No, that that's great.
00:43:30.239 --> 00:43:34.400
I'm sure at some point when we see in the future, I could share a story he had when he was doing his pilot's license.
00:43:34.480 --> 00:43:40.559
But I don't want to scare Ashley away from the uh pilot experience that I had in high school as I was I was prepping.
00:43:40.639 --> 00:43:43.199
But that's that's a story for part two of this podcast.
00:43:43.440 --> 00:43:50.960
Ashley, thanks so much for joining us and looking forward to seeing you in Boston, where I think we're both gonna be at HealthSec and and hosting a dinner.
00:43:51.119 --> 00:43:59.760
So uh would love to meet uh uh mutual fans of both companies as well as great uh cyber practitioners doing great things when uh if anybody's out in Boston.
00:44:00.639 --> 00:44:02.400
Amazing, yep, see you there.
00:44:02.719 --> 00:44:03.360
Thanks so much.
00:44:03.519 --> 00:44:04.960
Have a good day.