Cybersecurity: Start Taking It Seriously

WEBVTT
00:00:00.000 --> 00:00:01.760
You're listening to Agency X.
00:00:01.919 --> 00:00:10.000
I'm Casey Nelson, and today I get a chance to talk to Ryan Smith, the CEO and founder of Ready State Cybersecurity.
00:00:10.240 --> 00:00:13.519
Here is one of my favorite quotes from today's episode.
00:00:13.839 --> 00:00:20.399
I find a lot of offices, not just insurance, but just people in general, are gambling with cybersecurity risk and they don't really know what they're betting.
00:00:20.719 --> 00:00:27.120
It's like you're gambling the house on something and you don't know the odds, or you didn't realize you even bet the house on it in the first place.
00:00:36.880 --> 00:00:41.759
I am super happy and excited to get to talk to my friend Ryan Smith today.
00:00:42.159 --> 00:00:54.560
Ryan and I have known each other through the conference circuit for a long time, uh going back to the days where I was in Texas at all the big eye of Texas events and then also at many, many other state association conferences.
00:00:54.799 --> 00:00:58.000
And Ryan is Ryan's my source.
00:00:58.079 --> 00:01:06.319
If I have a cybersecurity question, if I don't understand something, or if I need to know if something's real or not real, I need to go to Ryan.
00:01:06.400 --> 00:01:09.439
So I'm really, really happy and excited to bring on Ryan.
00:01:09.519 --> 00:01:12.560
And Ryan is the founder of Ready State Cybersecurity.
00:01:12.640 --> 00:01:18.879
And uh Ryan, I'm I'm stepping on your intro, uh, but thanks for making time and uh sharing your expertise with us.
00:01:19.040 --> 00:01:20.560
Yeah, yeah, I'm happy to be here.
00:01:20.879 --> 00:01:22.000
Always fun to talk with you.
00:01:22.079 --> 00:01:24.319
I you're one of the people I look for at those conferences.
00:01:24.400 --> 00:01:26.879
If if we're gonna be there, I'm pretty sure you're gonna be in the room.
00:01:26.959 --> 00:01:29.120
So, yeah, one of the people I love to go hang out with.
00:01:29.200 --> 00:01:32.400
So always happy to chat, and I think this will be really fun today.
00:01:32.640 --> 00:01:33.439
Man, I appreciate it.
00:01:33.519 --> 00:01:34.239
I feel the same way.
00:01:34.400 --> 00:01:47.359
So we'll just jump right in because cybersecurity is something that I think a lot of agents do not dedicate enough attention and focus to within their own operations, let alone their clients, potentially, especially if they write commercial insurance.
00:01:47.519 --> 00:01:50.799
So, what's the state of cybersecurity and insurance?
00:01:50.959 --> 00:01:54.480
Um, what are you seeing, and what do you think agents need to be thinking about?
00:01:54.959 --> 00:01:55.680
Yeah, awesome.
00:01:55.760 --> 00:02:00.000
And if if I can plug an event that I recently did, we I want to do this annually.
00:02:00.239 --> 00:02:09.039
What I find is a lot of agencies go into the fall, they're supposed to budget everything and have a plan for the next year and sort all that out, and you have open enrollment, end-of-year goals.
00:02:09.120 --> 00:02:10.240
Everything's going crazy.
00:02:10.400 --> 00:02:16.479
And so what I did is uh just a couple weeks ago in September, had our 2026 reality check.
00:02:16.560 --> 00:02:28.960
It's for insurance agencies, it's meant to basically kind of grab you by the shoulders and tell you what's going on out there so you can plan ahead and make sure that you're on track, you know everything that's going on, and really equip you with everything you need to make decisions going forward.
00:02:29.280 --> 00:02:31.120
We even talked about some budgeting and stuff like that.
00:02:31.280 --> 00:02:38.080
So one of the big things that I'm really focused on right now is coming down to culture and people risks.
00:02:38.319 --> 00:02:41.840
One of the things that I shared, uh there's a great report from Verizon that I look at every year.
00:02:42.000 --> 00:02:48.159
Their 2026 data breach investigation report had 62% of the breaches they investigated involved people.
00:02:48.479 --> 00:02:52.400
And there's like 20,000 breaches is a lot and a pretty strong sample size.
00:02:52.479 --> 00:02:55.360
And consistently year over year, we've seen it in that type of range.
00:02:55.680 --> 00:02:59.680
And so for me, that's one of the biggest areas I think agencies especially need to think about.
00:02:59.919 --> 00:03:07.840
And uh one, I think you and I probably have some things to say about it with that, but in addition to that side, third-party risks are huge for agencies.
00:03:08.159 --> 00:03:16.479
You build your in your whole insurance agency around technology that you're customizing, each one of those pieces that you connect and each one of those vendors that are involved adds to your risk.
00:03:16.719 --> 00:03:19.360
And right now that's the most costly type of attack.
00:03:19.599 --> 00:03:23.599
Well, actually, the most lengthy, I should say, the costliest are phishing attacks.
00:03:23.759 --> 00:03:25.759
And then aside from that, it's just regulations.
00:03:25.919 --> 00:03:27.840
Agencies have constant changes with these things.
00:03:28.000 --> 00:03:30.719
New states are passing laws, it's a lot to keep up with.
00:03:30.800 --> 00:03:37.680
So making sure that you know what you're required to do because nobody's gonna come find you and tell you is is the other side of it that I'm educating people on.
00:03:37.919 --> 00:03:51.520
Well, I know from my experience at Catalet and the work you did with Catalet, I was not one of the 62% that was a user breach because often, whenever I sell any emails, I just assume that they are spam or that they're phishing and I don't touch them.
00:03:51.599 --> 00:03:57.919
So, with that in mind, I mean, what what should agents be telling their staff and what should they be thinking about themselves?
00:03:58.000 --> 00:04:07.360
Because I shouldn't just assume that the agency owner necessarily is well versed in cybersecurity and the cyber risks that they're getting, either experience or are experiencing right now.
00:04:07.439 --> 00:04:14.560
But like what should they be thinking about and how should they be training their teams to make sure that they're as protected so as possible so they don't fall into that 62%?
00:04:15.039 --> 00:04:29.759
Yeah, I mean it's it's a hard risk to control, and there's some interesting stuff that happens, but I mean, the first thing that you need to make sure that you're talking to your people about are what the threats are that are out there and what that does to your office if something goes wrong and how that might play out too.
00:04:30.000 --> 00:04:31.920
They need to know what really the stakes are.
00:04:32.160 --> 00:04:38.720
I find a lot of offices, not just insurance, but just people in general, are gambling with cybersecurity risk and they don't really know what they're betting.
00:04:38.800 --> 00:04:44.720
It's it's like you're gambling the house on something and you don't know the odds, or you didn't realize you even bet the house on it in the first place.
00:04:44.800 --> 00:04:47.600
And so a lot of people think, well, I'm not a target.
00:04:47.680 --> 00:04:49.839
This isn't gonna really affect us that bad if it happens.
00:04:49.920 --> 00:04:53.279
We have cyber insurance, you know, and they they kind of brush it under the rug.
00:04:53.439 --> 00:04:56.240
But the truth is people are more of a target than they realize.
00:04:56.480 --> 00:05:02.879
We need to teach people about that so they understand that they need to be d diligent, and then we also have to help them understand what really could go wrong.
00:05:03.040 --> 00:05:04.560
Like, this is something we need to avoid.
00:05:04.720 --> 00:05:08.319
It's a major costly event for any business, even with insurance.
00:05:08.480 --> 00:05:12.720
And so I think that's where the education needs to start is general awareness, really.
00:05:12.959 --> 00:05:13.279
Gotcha.
00:05:13.600 --> 00:05:28.639
And in terms of that kind of general awareness, and since you have the education background as well, like what are some strategies to educate your staff or an agency's staff that you've seen be most successful or most effective?
00:05:28.959 --> 00:05:31.040
Can I can I table that and take a step back first?
00:05:31.199 --> 00:05:31.920
Yeah, totally.
00:05:32.079 --> 00:05:32.399
Let's go.
00:05:32.639 --> 00:05:37.519
So, first, I think you need to understand what's wrong in in the equation before we can really solve it.
00:05:37.680 --> 00:05:40.480
And so I I want to just kind of explain that a little bit.
00:05:40.639 --> 00:05:46.240
What what trip troubles me with the 62% number and all the humans involved in these attacks is we are doing training.
00:05:46.399 --> 00:05:50.319
Offices are out there exercising this stuff, they're building awareness, but people still click.
00:05:50.399 --> 00:05:56.160
And I'm sure many of the people listening are probably doing phishing simulations and trainings, and they probably see that happen in their own office.
00:05:56.240 --> 00:06:00.639
They probably have you know a steady click rate, but it's normal and it's expected.
00:06:01.040 --> 00:06:06.240
The problem is that hackers are trying to put things in front of us that look like day-to-day work.
00:06:06.639 --> 00:06:11.519
And so the average user really isn't going to be able to tell some of these threats that come their way.
00:06:11.920 --> 00:06:16.000
You have AI now making it easier to write an email to where it's not broken English.
00:06:16.319 --> 00:06:23.360
They can do research really fast so they can find out information about you and make a really relevant email or message or call, whatever they're gonna use.
00:06:23.680 --> 00:06:24.720
They could even voice clump.
00:06:24.959 --> 00:06:28.480
And you could have situations where trust of the third party becomes compromised.
00:06:28.800 --> 00:06:43.839
And when you have strong security controls, if somebody you already have established trust with is manipulating, is manipulated by somebody that's in that environment and they send you a message, there's nothing your security tool is going to do to flag that unless they maybe sent a link that obviously trips something up.
00:06:44.160 --> 00:06:47.680
So to me, there's a couple of things that are happening to users that are a major issue.
00:06:47.920 --> 00:06:53.199
We're we're teaching them to watch for suspicious things that they never really triggered was suspicious in the first place.
00:06:53.439 --> 00:06:59.279
And so, what good are the tips and tricks and things that you teach them to do if they never knew to enact them in the first place?
00:06:59.839 --> 00:07:01.040
And I think that's the hard part.
00:07:01.199 --> 00:07:03.519
And so to me, there's a couple of things that need to happen.
00:07:03.680 --> 00:07:05.279
One, I think mindset is part of it.
00:07:05.759 --> 00:07:08.160
People need to understand this is a thing that can happen.
00:07:08.399 --> 00:07:18.240
Unfortunately, I I I'm I grew up in the country, man, so I'm like, I I I I don't love that I'm very skeptical when it comes to all this digital stuff, but I have to be.
00:07:18.720 --> 00:07:25.920
And I think there's a lot of agencies out there where you're just trying to help somebody, you're trying to do the right thing, you're trying to go above and beyond with your job.
00:07:26.160 --> 00:07:28.240
And these are the things that attackers take advantage of.
00:07:28.399 --> 00:07:34.079
And it it kind of sucks, frankly, that we have to give up our willingness to kind of help people and be skeptical.
00:07:34.399 --> 00:07:36.720
And this whole idea of security is trust but verify.
00:07:37.040 --> 00:07:39.839
The verification part for some people I think feels kind of icky.
00:07:40.000 --> 00:07:45.360
And I think that's one of the reasons why it's so challenging with with all of this, is it's a lot of mindset stuff, right?
00:07:45.759 --> 00:07:51.279
You you have to realize that there's threats out there, you have to be skeptical, you have to be cautious and tiptoe around everything.
00:07:51.439 --> 00:07:54.240
And so I think the first phase is kind of getting people to understand that.
00:07:54.560 --> 00:08:01.279
But then there's the second part where when you have good security, it it it blocks out the things that all of us are trained to look for.
00:08:01.680 --> 00:08:12.720
You know, the the message that came from somebody that's not really Ryan or the language and things that sound scammy, the links that are malicious, the attachments that are bad, a lot of your security tools are gonna stop those things.
00:08:12.959 --> 00:08:14.959
So to me, what's left then for the users?
00:08:15.279 --> 00:08:19.600
Well, they're gonna get the hardest stuff thrown at them because all the security tools took away all the low-hanging fruit.
00:08:19.680 --> 00:08:26.160
And so if you have to defend your office and you're that final front line, you're getting the hardest things that your security tools couldn't detect.
00:08:26.560 --> 00:08:33.039
And so I think it's just setting a lot of people up for failure because we're we're expecting them to be able to tell the difference between all that kind of stuff.
00:08:33.440 --> 00:08:35.679
So there's a big problem to unweave.
00:08:35.840 --> 00:08:37.360
One one other point, and I'll let you jump into.
00:08:37.679 --> 00:08:38.960
I I'm sure you have thoughts on this.
00:08:39.279 --> 00:08:43.200
But the other part is we're talking about digital threats, things that our brains are not wired for.
00:08:43.279 --> 00:08:45.360
I I hear this all the time about like stress, right?
00:08:45.600 --> 00:08:53.120
You you we're we can't handle the stress of like a stack of emails that never goes away because biologically we were never really wired to handle that kind of stress.
00:08:53.360 --> 00:09:00.559
The same thing goes with our threats and our ability to respond to things, is if we have a digital threat, we don't really sense it, we don't see it coming.
00:09:00.720 --> 00:09:13.600
Like if you and I were out walking, let's say we go we're at one of these conferences and we're gonna go get a drink afterwards, and we go down a dark, creepy alley, our hair is gonna be standing up, we're gonna be maybe a little cautious, maybe walk a little fast through it or go a different route.
00:09:13.759 --> 00:09:16.559
And biologically we're conditioned for those kinds of threats.
00:09:16.639 --> 00:09:22.879
We understand that stuff physiologically, but when it comes to the digital threats that we face, our brains aren't registering those things.
00:09:22.960 --> 00:09:24.080
We have to train them differently.
00:09:24.240 --> 00:09:26.639
And so I think that's where some of the breakdown happens.
00:09:26.879 --> 00:09:34.320
Yeah, when we talked last time, you mentioned digital de-stressing or digital de-stressors, and and that was in my notes to come back to.
00:09:34.480 --> 00:09:36.639
So, how do you how do you think we combat that?
00:09:36.720 --> 00:09:39.279
I have other follow-up questions, but I want to stick with this one for now.
00:09:39.519 --> 00:09:44.399
Yeah, well, so part of it is I mean, the digital de-stressing, and that's a whole different topic.
00:09:44.480 --> 00:09:45.279
I mean, we can get into that.
00:09:45.759 --> 00:09:53.840
Oh no! But but the tuning your signal to digital threats is this is on my background here, the the cyber sense part that you need to develop.
00:09:54.000 --> 00:09:55.360
And so here's what's really interesting.
00:09:55.519 --> 00:09:56.960
I don't know if we talked about this before.
00:09:57.200 --> 00:10:04.960
In World War II, there was a big study around signal detection and people's ability to kind of calibrate their their skills with this.
00:10:05.039 --> 00:10:09.039
And so these were radar operators looking for planes coming over with bombs.
00:10:09.200 --> 00:10:13.679
And so, you know, obviously that's when, you know, this was, you know, a big deal, right?
00:10:14.000 --> 00:10:19.519
You had to be watching for these things and be able to evacuate areas or alert other Air Force and things like that to come in.
00:10:19.679 --> 00:10:29.519
And so they were measuring the accuracy of these people watching the signals and looking at certain things that would trigger a false positive, or if they'd missed something, like they were analyzing this different stuff.
00:10:29.600 --> 00:10:31.679
And a lot of it came back down to a couple things.
00:10:31.840 --> 00:10:40.159
One thing is practice, you need the repetitions, you need to basically build the neurological connections to the skill that you're you're developing.
00:10:40.879 --> 00:10:44.000
The other part of it is to be able to do that, you need immediate feedback.
00:10:44.080 --> 00:10:46.720
And this is what I think is really tricky with security awareness training.
00:10:47.039 --> 00:10:54.879
We can do this with phishing simulations, people can get an email and they can see if they find the threat and flag it or click it and find out what happens.
00:10:55.200 --> 00:11:00.159
The problem is it's not rapid enough and immediate feedback enough for our brains to really develop it.
00:11:00.320 --> 00:11:02.399
And so I don't know what the answer is for some of this.
00:11:02.480 --> 00:11:04.960
I think it's game gamification comes to mind.
00:11:05.200 --> 00:11:05.279
Yeah.
00:11:05.519 --> 00:11:11.679
Maybe doing more things where it's like you learn something and then you go through an exercise, like find a couple threats or click through things.
00:11:12.080 --> 00:11:17.279
Um my thought is one way to start to develop this is play a little game with yourself with every email.
00:11:17.679 --> 00:11:21.279
Pretend it's a phishing email and you have five seconds to find the threat.
00:11:21.360 --> 00:11:22.480
Okay, what's the red flag?
00:11:22.639 --> 00:11:30.240
And if you looked at every email and you took just a couple extra seconds, I I promise it could probably you could probably find a real threat within five seconds if it's really there.
00:11:30.480 --> 00:11:37.759
But if you started that exercise every time you looked at an email, yes, it would add up, but it would help you hone in those skills and develop those habits.
00:11:38.000 --> 00:11:39.200
Look, think about it this way.
00:11:39.360 --> 00:11:46.159
I was thinking about this because I was taking my son on a walk last night and we went across the street, and you know, I'm teaching him to look both ways for cars.
00:11:46.320 --> 00:11:48.559
And I inherently I would do that today.
00:11:48.639 --> 00:11:53.840
Like if I came up to a street and I was about to walk across it, I've done this so many times in my life that I look both ways.
00:11:54.000 --> 00:11:58.240
We need to teach ourselves those kinds of habits at that level for security awareness.
00:11:58.480 --> 00:12:08.799
Okay, so I want to ask you what are the factors or the characteristics of an email that you would look for in in compared to what you just said, like looking both ways before you cross the street, right?
00:12:08.879 --> 00:12:12.320
Like that's you're you're in your 40s, I'm in my 40s, like I know that.
00:12:12.399 --> 00:12:17.440
And when I'm with my kids or or around other people, especially little people, I'm always like, hey, are you looking?
00:12:17.519 --> 00:12:19.440
And I'm trying to see if they're looking as I look.
00:12:19.600 --> 00:12:31.440
But so going back to the email list of characteristics I look for, like if I have if if my cyber sense is tingling, then I'm looking at the sender's email address and the sender's name.
00:12:31.519 --> 00:12:33.120
And usually that's a dead giveaway.
00:12:33.279 --> 00:12:35.679
Well, not necessarily the name, but certainly their email address, right?
00:12:35.759 --> 00:12:46.320
Like if it said it came from Outlook or something like that, and then you look at the the after the at sign in the email address, and it's like some something that does not correspond the way you think it would, right?
00:12:46.399 --> 00:12:47.600
I also look at the links.
00:12:47.679 --> 00:12:49.600
I don't click them, but I look at them.
00:12:49.840 --> 00:12:54.480
I look at the logos if there are any, and then of course, like the language that's used.
00:12:54.639 --> 00:12:59.679
What other factors or are those the factors you look at, or are there other factors that you add to that list?
00:12:59.919 --> 00:13:01.039
Those are really good.
00:13:01.200 --> 00:13:02.799
Well, I'll say a couple things.
00:13:02.960 --> 00:13:07.039
The the sending address and email, you're right.
00:13:07.120 --> 00:13:09.840
The display name that can be whatever you want it to be.
00:13:10.000 --> 00:13:14.639
I could say anything in there, and that that's just a display like the way I'd set my name up.
00:13:14.799 --> 00:13:17.679
And so that's an easy one to confuse people with.
00:13:17.759 --> 00:13:21.759
But you're right, the email address itself is something that you would want to look at.
00:13:21.919 --> 00:13:32.159
However, there are security settings that as an employee you may or may not know exist that would allow me to replicate an email without actually having sent from it.
00:13:32.320 --> 00:13:38.320
And so if your security is not set up properly, it might not let some of those threats out and they might come through.
00:13:38.559 --> 00:13:41.679
And so even if you have security tools, this could be a factor.
00:13:42.000 --> 00:13:43.440
It depends on how you've set up these things.
00:13:43.519 --> 00:13:44.559
So there's a nuance with it.
00:13:44.720 --> 00:13:46.240
So I I don't always trust that.
00:13:46.960 --> 00:13:52.799
The other side that can happen too is you could have been emailing with me and now I had a cyber attack and you didn't know it.
00:13:53.039 --> 00:13:58.159
Somebody jumped in my email and my name and my email address match, and it's not gonna do anything for you.
00:13:58.480 --> 00:14:00.080
So, yes, it's a good one to look at.
00:14:00.159 --> 00:14:04.000
It's probably the first thing I look at, but it doesn't necessarily guarantee that it's safe.
00:14:04.159 --> 00:14:05.360
So that's where we have to be careful.
00:14:05.679 --> 00:14:12.480
Going down through the list you gave, like, yes, look at attachments, look at the language, look at links, you know, logo files, things like that.
00:14:12.639 --> 00:14:17.200
Logos can get copied, and I've with AI too, that's a really easy thing to change.
00:14:17.840 --> 00:14:20.399
The links, this is where I I think it also gets tricky.
00:14:20.720 --> 00:14:23.360
If you have strong security tools, you might have link rewriting.
00:14:23.600 --> 00:14:27.840
But the link rewriting is meant to basically protect the user in a way.
00:14:28.080 --> 00:14:33.679
When they click the link, it goes through like a test and then it t checks it out, make sure it's safe before you actually go to it.
00:14:34.000 --> 00:14:37.279
It's not always perfect, so you could still click something and end up somewhere bad.
00:14:37.600 --> 00:14:46.240
But the problem is it garbles the text and the link, and it makes it a lot harder for you and I, if we're not cybersecurity experts, to be able to look at what's going on and see where that link's gonna go.
00:14:46.639 --> 00:14:50.559
So the more security you have sometimes can make it a little harder because you get all this extra noise to filter through.
00:14:50.799 --> 00:14:58.159
And so here the way I would look at it, and one of my colleagues gave this acronym or not acronym, but like a f a f am I being fished formula for us.
00:14:58.480 --> 00:15:00.879
It it's a combination of three key elements.
00:15:01.279 --> 00:15:12.399
You have your false scenario that they're usually making up, you have some kind of call to action, something you need to do, and then you have a multiplier that adds urgency or emotion to it.
00:15:12.799 --> 00:15:14.240
But here's where it gets tough.
00:15:14.639 --> 00:15:21.120
The false scenario is almost impossible sometimes to identify as false because attackers are trying to look like a real scenario.
00:15:21.519 --> 00:15:25.200
And so you might not know it's false, it might look like a normal day-to-day thing.
00:15:25.279 --> 00:15:28.879
But the call to action also is usually gonna sound like a reasonable thing to do.
00:15:29.200 --> 00:15:31.200
The challenge is the urgency and the emotion part.
00:15:31.440 --> 00:15:38.159
For me, and this is maybe something to do in that little five-second overview you give an email, is just do a quick emotion check for yourself.
00:15:38.559 --> 00:15:39.200
Are you worked up?
00:15:39.279 --> 00:15:39.840
Are you excited?
00:15:39.919 --> 00:15:40.399
Are you confused?
00:15:40.559 --> 00:15:41.120
You scared?
00:15:41.200 --> 00:15:43.519
Are you having serious feelings about this email?
00:15:43.759 --> 00:15:46.879
Especially that doesn't maybe jive with like what you'd expect, right?
00:15:47.200 --> 00:15:51.679
And so to me, like the false scenario is really hard to tell, but you might be able to tell if it's not expected.
00:15:52.159 --> 00:15:56.799
You can probably ask with the call to action, is this ask yourself, is this a high-risk call to action?
00:15:56.879 --> 00:15:59.200
Am I gonna click into something and log into someplace?
00:15:59.360 --> 00:16:02.080
Or am I gonna share information that's sensitive?
00:16:02.240 --> 00:16:05.600
Like, am I doing something high risk here where I maybe need to slow down?
00:16:05.759 --> 00:16:10.639
But I think to me it's it's more kind of being in check of it's like a mindfulness kind of exercise.
00:16:10.720 --> 00:16:12.240
Like, why am I so mad?
00:16:12.320 --> 00:16:15.759
Or why am I freaking out, or you know, why is the hair on my arm standing up?
00:16:15.919 --> 00:16:17.600
And I think that's kind of an awareness thing.
00:16:17.759 --> 00:16:23.200
Yeah, I wrote down urgency as you were talking before you said it because I do think that's a huge factor, right?
00:16:23.279 --> 00:16:34.480
Like, I actually got an email, clearly a phishing email not that long ago, that was that I had been invited to a Zoom meeting that I was late and and I hadn't joined the call yet.
00:16:34.639 --> 00:16:36.799
And so it did all of those things.
00:16:37.039 --> 00:16:47.360
And I mean, I didn't recognize the sender and I didn't have any calls in my calendar, and I wasn't expecting anything, so I didn't click it, but it certainly did set my like heart going.
00:16:47.440 --> 00:16:50.639
And I thought, shit, like who do who did I drop the ball for?
00:16:50.799 --> 00:16:52.159
Like, what did I forget to do?
00:16:52.320 --> 00:16:56.799
And then I thought to myself, I was like, I'm not expecting this, I don't have any calls in my calendar.
00:16:56.960 --> 00:17:01.600
And I think that if something's truly urgent, somebody's gonna call you, right?
00:17:01.679 --> 00:17:08.720
Like, I mean, and if they don't, if if if anybody listening to this needs me urgently, an email is not the way to do it.
00:17:08.799 --> 00:17:12.559
That is like the worst possible way to get in touch with me if you need something urgently.
00:17:12.720 --> 00:17:19.440
So that's that's at least my defense mechanism against you know the urgency factor of of these kind of scam situations.
00:17:19.759 --> 00:17:24.240
But sometimes this happen in offices where that is normal practice, and they they just get lucky, you know.
00:17:24.559 --> 00:17:35.599
This is uh these are crimes of opportunity, and so this is something I think for agencies to understand is you don't necessarily have to be a target today to become one, it's clicking on that link that draws you in.
00:17:35.759 --> 00:17:44.079
And so they could be sending that Zoom link out to hundreds and hundreds of people at scale automatically, and you're just one person that didn't click on it.
00:17:44.160 --> 00:17:45.759
But I guarantee you there were people who did.
00:17:45.839 --> 00:17:50.880
And so for them, they might just send out thousands of emails and they're gonna get a good percentage of that click.
00:17:51.359 --> 00:18:01.920
And so they here's the thing attackers they get a million uh like unlimited tries, your your people have to defend every single one of them, or one failure means an attack.
00:18:02.079 --> 00:18:04.640
Like, so you're constantly getting bombarded with these things.
00:18:05.039 --> 00:18:08.160
And that's and that goes back to like the whole point of like the security awareness thing.
00:18:08.240 --> 00:18:12.240
I think that people need to really hit home is like how prevalent all of this stuff is.
00:18:12.400 --> 00:18:14.160
This is something that we we need to understand.
00:18:14.319 --> 00:18:19.920
We're playing in this digital arena where there are real threats that are constantly just kind of floating around looking for people.
00:18:20.160 --> 00:18:20.400
Yeah.
00:18:20.640 --> 00:18:27.680
I do have one other follow-up question when you were talking about like you know, verification, and you called it the ick, I think you said.
00:18:28.960 --> 00:18:34.079
So is that are you referring to and and I'm I do this and I I don't feel any ick about it.
00:18:34.160 --> 00:18:36.799
Maybe it's just because I don't know, it's me or I'm used to it.
00:18:36.880 --> 00:18:52.319
But if I get an email and I would and I would, I'd get emails all the time from well, I won't say what industry, but I I work in insurance, so insurance it's an insurance adjacent industry where I'd get these emails and there'd be an attachment as they would try to create the urgency and there's this attachment.
00:18:52.559 --> 00:18:55.279
I'm like, I'm not expecting an email from this person.
00:18:55.440 --> 00:19:02.400
I've never gotten an email from this person, and I would search my inbox if I thought that there was any reason I needed to double check, and then I call them.
00:19:02.480 --> 00:19:08.480
I'll just call them and be like, hey, I got an email from so-and-so at your office, and they're like, Yeah, yeah, we got hacked.
00:19:08.559 --> 00:19:11.839
Like it's it's a scam or it's a whatever, if they answer the phone.
00:19:12.000 --> 00:19:13.839
But I mean, is that the kind of ick you're talking about?
00:19:13.920 --> 00:19:17.440
Is people don't want to go through that extra step, or what what's the ick that you mentioned?
00:19:17.680 --> 00:19:23.359
It's it's it's the accepting the fact that you have to be skeptical with everything.
00:19:23.519 --> 00:19:32.880
I just I the reason why I say that is it would be nice to live in this world where you know we we can have nice things and trust everybody, but that's unfortunately not the case.
00:19:33.039 --> 00:19:43.839
And what we did when we basically made everything more accessible through the internet and technology is we've allowed you know all all people to have access to it, you know, and and to have access to us and our business.
00:19:44.000 --> 00:19:49.839
And so there are bad guys out there that that want to find us and they're out there actively looking for us, unfortunately.
00:19:50.000 --> 00:20:11.759
And so I think that's the icky part to me is realizing that and having to admit like I need to be skeptical now, and and then especially if you are like think about like a customer service role, you know, or any any of that kind of side of business where you're engaging with clients, you're trying to make a good client experience, and then now you have to like verify every little thing because you're afraid.
00:20:12.000 --> 00:20:13.599
I mean, that's that's it's tough.
00:20:13.759 --> 00:20:17.440
But you know, security and efficiency operate on opposite sides of a scale.
00:20:17.759 --> 00:20:24.480
All the things that you do to become more secure slow you down and make you take more time and be less efficient.
00:20:24.720 --> 00:20:33.920
On the other side of that, if you start to um become more efficient, you you know make things easier, faster, more connected, you're taking away from efficient uh from security.
00:20:34.079 --> 00:20:46.079
So we have this tricky balance to play, and I think it really the icky side of it, I think, is is realizing that when you look at it in the customer service part where you want to trust your customers, their partners, and things like that, and you kind of have to be a little bit careful.
00:20:46.240 --> 00:20:47.359
Yeah, for sure.
00:20:47.599 --> 00:20:59.039
Okay, so I want to ask you what an agency should do if they have not taken any precautions or at least not enough precautions, and they do experience an attack or a breach.
00:20:59.200 --> 00:21:04.559
What in that moment of shit, what do they do to either verify that there actually was a breach?
00:21:04.720 --> 00:21:06.000
Like, like what do they need to do?
00:21:06.079 --> 00:21:11.200
If there's a if there's like a five-step process or a 25-step process, whatever it is, what do they need to do?
00:21:11.359 --> 00:21:16.799
Yeah, so I'll give you some immediate things to do, but I will say there needs to be foresight with this.
00:21:16.960 --> 00:21:20.880
This is something that everybody really is required to do by different laws.
00:21:21.039 --> 00:21:24.960
In all 50 states, there are breach notification laws that protect consumers.
00:21:25.039 --> 00:21:38.319
So anybody in your book of business has a law under the attorney general that basically is protecting them, saying under those laws that you will have a plan and do your due diligence to investigate something and report it to the attorney general depending on what happened.
00:21:38.559 --> 00:21:42.960
There's timelines involved, there's specifics they want and a whole process for this.
00:21:43.279 --> 00:21:46.880
With insurance, you have that plus insurance data security laws.
00:21:47.200 --> 00:21:48.160
They're in 28 states.
00:21:48.319 --> 00:21:50.000
New York's probably the more famous one.
00:21:50.559 --> 00:21:54.079
They those laws pull in the insurance commissioner for them to get reported to.
00:21:54.160 --> 00:21:56.480
And they also have deadlines and specific steps to take.
00:21:56.880 --> 00:21:59.680
Then you add in things like HIPAA, where there's even more specific.
00:22:00.160 --> 00:22:03.119
Specific things that you have to do in a different government body to report to.
00:22:03.359 --> 00:22:10.960
And so first, I'll just just to circle that there are requirements to have an incident response plan and make sure you know exactly what to do.
00:22:11.279 --> 00:22:18.799
So I would tell every agency if they don't have that, talk to their cyber liability provider or reach out to consultants like us and we'll help get that kind of stuff set up.
00:22:19.200 --> 00:22:23.759
But you need to know exactly what that is, and you're required by law to have that plan figured out ahead of time.
00:22:24.000 --> 00:22:24.880
So that's the first thing.
00:22:25.200 --> 00:22:31.839
That aside, the fact that you got a breach, compliance away from that, there are a handful of things that you need to know to do, and that's kind of where that plan really helps.
00:22:32.240 --> 00:22:34.160
But the first thing, it depends on the breach.
00:22:34.319 --> 00:22:40.880
I would say just based on what I was saying at the beginning of this, chances are it's probably a phishing email compromise or a social engineering compromise.
00:22:41.200 --> 00:22:47.519
You probably had a user give up their credentials to some account, but most likely their email is usually how it's gonna look.
00:22:47.680 --> 00:22:53.839
But when that happens, one of the first immediate things that you need to do is reset their password and revoke access.
00:22:54.240 --> 00:22:57.759
I see so many offices where I talk to them and they've reset the password, which is great.
00:22:58.079 --> 00:23:02.960
The bad guy now has to use a new password, but without revoking access, they're probably still in there.
00:23:03.359 --> 00:23:04.559
So that kind of flushes them out.
00:23:05.039 --> 00:23:08.000
That can hopefully give you some confidence that they're not still in there.
00:23:08.480 --> 00:23:13.759
But one of the things as attackers, what what they try to do is keep their hooks in and keep back doors.
00:23:14.079 --> 00:23:17.680
So some things they might do um depends on the level of access they got.
00:23:17.759 --> 00:23:22.640
They could create another account, they could create an email forwarding rule, there's all kinds of things.
00:23:22.720 --> 00:23:23.599
It just really depends.
00:23:23.839 --> 00:23:29.200
And so that's where the next part of this is really important is to start preserving evidence and investigate what happened.
00:23:29.440 --> 00:23:40.880
One of the things that I've seen a lot of businesses mess uh mess up here, and agencies as well, is they'll have a business email compromise, they'll reset the password, revoke access, and they think that they've got it done, and they move on.
00:23:41.200 --> 00:23:45.279
When somebody's in your email, they've gotten access to all of the emails that are in there.
00:23:45.680 --> 00:23:53.759
They could have theoretically gotten confidential information, so you do have a data breach, they could have communicated with other people, and you don't necessarily know how long they've been in there.
00:23:54.160 --> 00:23:57.680
To give you a quick stat, I mentioned Verizon's report earlier.
00:23:57.759 --> 00:24:00.400
The other one that I really like is IBM's cost of data breach report.
00:24:00.559 --> 00:24:00.640
Okay.
00:24:00.799 --> 00:24:04.640
Their 2026 data showed that it was around 185 days.
00:24:04.799 --> 00:24:10.799
I don't remember the specific, it's over 180 days before a person detected a phishing email comp or a business email compromise.
00:24:11.200 --> 00:24:17.359
So it's about on most attacks, around 183 days, I think was the overall average, and then 64 days to contain it.
00:24:17.680 --> 00:24:23.119
And so it's six months uh yeah, six months to be able to c detect the fact that somebody was actually there.
00:24:23.359 --> 00:24:31.920
So when people tell me they had an email compromise and it started last Friday, I'm a little skeptical because I know statistically it's probably gone on for months and they just found out about it.
00:24:32.480 --> 00:24:36.640
And again, attackers come in, they want to stay hidden, so they're they're gonna try not to make a lot of noise.
00:24:36.720 --> 00:24:37.599
But that's not always the case.
00:24:37.759 --> 00:24:39.200
Sometimes they'll get caught on early.
00:24:39.440 --> 00:24:40.880
But um, I'll give you a quick example.
00:24:40.960 --> 00:24:43.440
We had one, it was a construction company we got called into.
00:24:43.599 --> 00:24:53.039
They had a business email compromise, and somebody was jumping in on invoices, and they said it was like a week ago that they saw the initial activity, and that's pretty when they were pretty sure this happened.
00:24:53.279 --> 00:24:59.759
We found out that it actually started a month prior, and we were able to give a list of emails and things that this person was reading and getting into.
00:25:00.000 --> 00:25:02.400
And so we gave them a list of invoices to go chase down.
00:25:02.720 --> 00:25:07.119
And so, again, one of the values of having an investigation and actually doing your due diligence there.
00:25:07.279 --> 00:25:21.839
Now this office can report what they did was, you know, in in alignment with the law, and now they understand what happened and they can start to you know react accordingly, they can protect themselves better because we know how they got in, and now they also know what invoices this person got into, so they can start to resolve some billing problems they had.
00:25:22.079 --> 00:25:33.359
And so kind of a long answer for you there, but I mean it really depends on the specific, and your incident response plan should really detail exactly who's responsible, what things you're gonna do, who's gonna do it, how fast it needs to happen.
00:25:33.519 --> 00:25:39.359
And I would say where I see most people fail is they're not treating this like an emergency, they're not all hands on deck.
00:25:39.519 --> 00:25:44.400
You need to be like getting your resources together right away when somebody that's not allowed in gets into your environment.
00:25:44.640 --> 00:25:44.960
Yeah.
00:25:45.119 --> 00:25:52.799
Okay, so and you mentioned early on in your answer about you need to have the instant response plan ready to go.
00:25:52.880 --> 00:25:56.000
And if you don't have one, people could contact somebody like you.
00:25:56.160 --> 00:26:02.559
And so I don't mean to make this a shameless plug, but I do want this to be a shameless plug because I think that you all do a great job.
00:26:02.720 --> 00:26:07.759
And I think a lot of agents are either trying to do this themselves or they're piecing it together.
00:26:07.920 --> 00:26:10.559
So, what at what do you do at Ready State?
00:26:10.640 --> 00:26:18.240
And what do you want to, or what types of agencies do you want to try to work with to help them build these instant response plans, among all the other things that you do?
00:26:18.480 --> 00:26:18.720
Yeah.
00:26:18.880 --> 00:26:20.319
Ready state's a little unique.
00:26:20.480 --> 00:26:31.119
So I, you know, I've been doing this for almost a decade now, and this is the if you we we had one startup years ago, we were acquired by an IT company, kind of had an IT combined cybersecurity company.
00:26:31.200 --> 00:26:40.160
And when I left about three years ago now to start Ready State, I wanted to reenvision how we did it and avoid some of the challenges that we ran into way back at the beginning of everything.
00:26:40.720 --> 00:26:44.400
For one, I I didn't like IT and cybersecurity being side by side.
00:26:44.480 --> 00:26:52.319
I felt like that lost some some bias or created some biases and it lost some uh third, you know, kind of third perspectives that we could add.
00:26:52.640 --> 00:26:55.599
And so I I prefer separating some of those responsibilities.
00:26:56.000 --> 00:26:59.759
The other thing is I I'm kind of acting like a cybersecurity services broker.
00:27:00.000 --> 00:27:10.160
I think this will make sense to the agencies out there because they have a similar model with insurance companies, but I can work with anybody because I have consultants in different areas and across different teams that I can pull in.
00:27:10.240 --> 00:27:14.480
And so out of the people that I have available, we've worked with all kinds of different size agencies.
00:27:14.559 --> 00:27:18.720
So I could help single person offices to top 100 agencies we've worked with as well.
00:27:19.039 --> 00:27:21.759
And so all of it looks a little different depending on people's needs.
00:27:22.000 --> 00:27:36.079
I would say, you know, one thing that we do is we understand the insurance industry, we understand you know how it is being an agency under 30 employees or so trying to grow and compete with the bigger offices out there, and that it can be kind of challenging.
00:27:36.160 --> 00:27:39.920
So, you know, we do have smaller services and things that can kind of level them up.
00:27:40.160 --> 00:27:45.279
A lot of it really just comes down to risk-based cybersecurity, allowing you to kind of cut the path for you.
00:27:45.440 --> 00:27:58.559
You know, everybody's gonna have different requirements and different technology stacks, and really what it is is a matter of looking at everything you have in front of you, identifying what those risks are and the priorities that you have to address them, and then following down that path.
00:27:58.720 --> 00:28:01.440
It's all gonna look a little bit different depending on people's sizes.
00:28:01.680 --> 00:28:11.359
I think it it's getting to the idea that if somebody's listening to this and they're like saying to themselves, wow, I I have an incident response plan, or maybe I don't, right?
00:28:11.440 --> 00:28:14.400
Like maybe they don't have one and they need to develop one.
00:28:14.559 --> 00:28:16.799
I want them to think they should go to you.
00:28:17.039 --> 00:28:21.039
But also I want them to start thinking about the additional risks that they're taking on.
00:28:21.119 --> 00:28:29.039
Because as you and I know, when we go to conferences and the trade shows, a lot of trade shows now have a tech walk or a tech row or whatever.
00:28:29.200 --> 00:28:34.960
And these companies are great, but as you mentioned earlier, each one of those is a potential exposure.
00:28:35.119 --> 00:28:46.799
And so I'm wondering from your position at Ready State, what do services do you provide, or what recommendations do you have for agency owners to protect themselves in that way as well?
00:28:47.039 --> 00:28:47.440
Yeah.
00:28:47.680 --> 00:28:49.519
Well, we're actually about it.
00:28:49.680 --> 00:28:51.519
This might be available by the time this goes out.
00:28:51.680 --> 00:28:54.559
We are working on releasing a third-party risk management guide.
00:28:54.640 --> 00:28:58.319
One of our close partners has tools that he's built to also help with that.
00:28:58.480 --> 00:29:01.519
So basically, I mean, this isn't anything new.
00:29:01.599 --> 00:29:02.720
This is risk management.
00:29:02.960 --> 00:29:07.599
These are requirements in things like New York's cyber rule and other insurance data security laws.
00:29:07.839 --> 00:29:16.160
As I mentioned before, uh, Verizon and IBM both have highlighted third-party risks as one of the most costly, timely types of attacks you can have.
00:29:16.559 --> 00:29:24.640
And so what I would say is absolutely this is a really important blind spot for agencies because of their dependency on third parties, especially building your own tech stack.
00:29:24.880 --> 00:29:32.640
One of the things that we can help do is help you understand your internal risk, meaning what type of cyber risk you have based on the tool and what it's doing.
00:29:33.039 --> 00:29:35.519
Is you know, is it creating additional exposures in any way?
00:29:35.599 --> 00:29:38.640
But are you um including sensitive data in there?
00:29:39.039 --> 00:29:42.559
Is it a part of a process you have to depend on being reliable and trustworthy?
00:29:42.880 --> 00:29:44.480
And then what happens if this thing goes down?
00:29:44.559 --> 00:29:46.000
Is it gonna shut your business down?
00:29:46.240 --> 00:29:47.039
Are you dependent on it?
00:29:47.200 --> 00:29:48.000
Do you have workarounds?
00:29:48.400 --> 00:29:54.240
All of these kinds of things help paint a picture about who your most critical vendors are based on the involvement in your office.
00:29:54.559 --> 00:29:57.839
From there, then you decide, okay, well, how deep do we want to analyze them?
00:29:58.160 --> 00:30:05.680
You know, if it's if it's your janitor, you know, maybe there's some some questions about access and stuff, but you're probably not gonna make them do a cybersecurity risk assessment, right?
00:30:06.079 --> 00:30:12.160
But if it's somebody that's uh a major player, you know, you could use the the the core management systems out there.
00:30:12.400 --> 00:30:16.400
But there are people who are gonna have documentation and everything, and you can just make sure that it's up to par.
00:30:16.720 --> 00:30:18.799
And so there's a different degree of it to figure out.
00:30:19.039 --> 00:30:26.400
And again, it goes back to the level of internal risk combined with you know the the size of the vendor and what kind of resources they have behind it.
00:30:26.799 --> 00:30:32.240
I I would say the interesting spot to think about too is our ability now to build some of these things ourselves.
00:30:32.400 --> 00:30:39.119
And I'm sure that's appealing to a lot of offices out there because you know it's a little cheaper sometimes to be able to go that route today.
00:30:39.359 --> 00:30:45.279
However, you might now be signing on for a security bill that you're not aware you're building yourself into.
00:30:45.680 --> 00:30:51.599
Um as you're developing your own in-house tools and things like that, you start to create more exposures now responsible for assessing.
00:30:51.680 --> 00:31:01.039
And when you use a third party, they're going through all that compliance stuff, they're doing all the security work, you have less control over it, but you're able to outsource come in that some of that cost into the work that they have to do.
00:31:01.119 --> 00:31:05.039
And so that's I think one blind step for a lot of offices building themselves.
00:31:05.359 --> 00:31:11.359
That leads into a whole nother section of questions I wanted to ask you.
00:31:11.599 --> 00:31:20.799
And well, before we even get down that road, you know, David Watson from Risk Advisor has talked about this before, and and I really appreciate his insight on it.
00:31:20.960 --> 00:31:28.880
Is that you know, we we've all in the insurance industry probably, you know, written uh policies, commercial policies for like a roofer.
00:31:28.960 --> 00:31:47.440
And then all of a sudden, around Christmas time, you happen to see that roofer's Facebook page because you followed them just to be nice because they're a client, and all of a sudden they're putting up Christmas lights, and then in the spring, they're washing windows and all this stuff, and you're like, whoa, your policy covers roofing, not Christmas lights and all these other things.
00:31:47.599 --> 00:32:00.559
So, to put that back into insurance terms, just because you can build something with a lot of the new technologies that are available, which is fascinating, and the innovation and the creativity that a lot of these people have is just so cool to observe.
00:32:00.720 --> 00:32:04.880
However, your insurance is probably covering you to be an insurance agent.
00:32:05.119 --> 00:32:10.240
And so what I mean, that's that's that's a different type of exposure than I think you were even talking about, right?
00:32:10.319 --> 00:32:12.559
That's like a legal exposure, but yeah.
00:32:12.720 --> 00:32:21.839
Yeah, I mean, is so so what it what do agents that like get the itch and stay up for 48 hours on Claude to build some cool new thing, what do they need to be thinking about?
00:32:22.079 --> 00:32:25.200
Yeah, and first of all, I love it, and I do the same thing myself.
00:32:25.359 --> 00:32:30.480
So I'm uh you know, we were talking about being kind of skeptical and risk averse, I guess, earlier.
00:32:30.640 --> 00:32:34.559
Like I think it's important there, but I also think innovation's really important.
00:32:34.720 --> 00:32:38.799
So by no means am I trying to dissuade anybody from poking around and learning.
00:32:38.960 --> 00:32:49.200
I would just be very careful, especially when you pull in sensitive information, that's gonna trigger regul trigger regulations and things, and that might bring you into a whole different category.
00:32:49.440 --> 00:32:55.599
The other side of it would be things like again, processes looking at where trust is really important.
00:32:55.759 --> 00:33:01.039
But the thing is with AI, you kind of need a human in the loop at a certain point to the the verification of things.
00:33:01.200 --> 00:33:02.480
You know, it just depends on where that is.
00:33:02.559 --> 00:33:09.440
And so if you're not thinking through some of that stuff and verifying certain aspects of whatever process you're building, that's another area that can create some problems.
00:33:09.759 --> 00:33:11.839
And then of course the other area would be availability.
00:33:12.000 --> 00:33:14.880
I'm referring to cybersecurity grouping, by the way.
00:33:14.960 --> 00:33:17.839
So the CIA triad of cybersecurity just to give a quick lesson.
00:33:18.160 --> 00:33:22.319
Confidentiality, integrity, and availability are the three key areas that I look at with impacts.
00:33:22.799 --> 00:33:26.400
So availability being the last one there is, you know, if you if this tool goes down.
00:33:26.640 --> 00:33:33.039
And so I think like when you're developing your own tools, you need to understand if it's going to teeter into those little categories.
00:33:33.359 --> 00:33:34.240
Like where's trust?
00:33:34.319 --> 00:33:35.920
How do you keep that maintained and verified?
00:33:36.160 --> 00:33:41.279
How do you keep availability up and running and redundancy or backups with whatever process you've created?
00:33:41.440 --> 00:33:42.799
Can you go back to a manual process?
00:33:43.119 --> 00:33:45.359
And then that sensitive data, just being careful with that.
00:33:45.759 --> 00:33:55.839
But I you know, I I would say what people need to do first is kind of look at the process they want to automate or things that they want to simplify and start to look at what that's gonna bump into in those areas.
00:33:56.160 --> 00:34:02.160
I would start with low-hanging fruit, things that are like not going to have any policy information, any kind of client data.
00:34:02.640 --> 00:34:06.400
I would and actually we had our our 2026 reality check.
00:34:06.480 --> 00:34:10.800
I had an AI expert on there, and one of his tips was to use and just general data.
00:34:10.960 --> 00:34:17.599
Like ask ask the chat tool to like anonymize some data that we can run through while we're testing things that we were not training on real data.
00:34:17.760 --> 00:34:22.400
And so I think just little things like that can make a big difference before people start to go crazy.
00:34:22.559 --> 00:34:23.840
But you really gotta be careful.
00:34:23.920 --> 00:34:30.639
I I'd say where probably most where sensitive information lies, because that's just gonna pull in regulations and things that you might not be ready for.
00:34:30.880 --> 00:34:31.119
Sure.
00:34:31.280 --> 00:34:43.280
I want to take this a step further and ask about current events a little bit because so it's a lengthy thread of tweets, so we won't read them all, but it starts by saying, quote, I resigned from Anthropic today.
00:34:43.440 --> 00:34:49.119
I spent the last three years doing pre-training research at both OpenAI and Anthropic.
00:34:49.280 --> 00:34:52.000
Neither company is acting responsibly.
00:34:52.159 --> 00:34:56.800
They are racing straight to self-improving superintelligence and gambling with our lives.
00:34:57.039 --> 00:34:59.039
Do not underestimate the power of this technology.
00:34:59.199 --> 00:35:06.880
These will soon be superhuman systems that can hack anything, revolutionize any field overnight, and acquire real power and resources.
00:35:07.039 --> 00:35:12.079
We have all witnessed the progress in each of these domains, and progress is not slowing.
00:35:12.239 --> 00:35:13.199
He goes on.
00:35:13.440 --> 00:35:15.119
Well, the next one, okay.
00:35:15.360 --> 00:35:20.159
The people building AI earnestly believe that it could kill us all by the end of the decade.
00:35:20.320 --> 00:35:21.840
This is not a marketing stunt.
00:35:22.000 --> 00:35:30.719
If anything, many executives and senior researchers will couch their phrasing in the press to sound sensible, but I hear the same people expressing fear.
00:35:30.880 --> 00:35:33.519
There's many, many more tweets that he went on to say.
00:35:33.679 --> 00:35:45.760
And then a report came out later in the week about all the different activities that had occurred that had been tracked, that these some of these agentic tools were essentially acting on their own to do some nefarious things.
00:35:45.840 --> 00:35:52.320
So I'm bundling all of this up into asking you Casey to Ryan, not consultant Ryan, not whatever.
00:35:52.400 --> 00:36:05.360
Like I want to know your opinion, not because I'm scared, but because I have heard very reasoned and rational people that I listen to and trust have grown to trust over the years in the news cycle saying all of the above.
00:36:05.519 --> 00:36:13.360
They've said this is this is real and we should listen and we should be freaking out and we should throw regulations on these companies.
00:36:13.519 --> 00:36:29.199
I've heard other voices say this is a marketing ploy because of IPOs coming up for anthropic and others, um, and they want to squash innovation from startups and they can absorb regulatory slowdowns and costs that startups can't.
00:36:29.360 --> 00:36:41.679
I've heard you know, reasonable, rational, smart people that I trust saying all of these things, and I don't know really what to make of it except to go to somebody that I trust that knows a hell of a lot more than I do.
00:36:42.480 --> 00:36:42.800
No pressure.
00:36:43.440 --> 00:36:48.239
Yeah, uh well, first of all, I mean I don't know what's happened behind the scenes there, so sure.
00:36:48.480 --> 00:36:48.960
Who knows?
00:36:49.119 --> 00:36:51.920
But to give you my two cents on it, I mean, there's a couple things.
00:36:52.079 --> 00:36:55.920
I will add to your timeline of news events or whatever.
00:36:56.000 --> 00:36:58.079
I I and look into this, who knows?
00:36:58.159 --> 00:37:04.239
I I really am skeptical with a lot of stuff out there on social media anymore, so I don't know if I saw an AI video or what.
00:37:04.400 --> 00:37:08.960
But uh I don't know if you remember former uh presidential candidate Andrew Yang.
00:37:09.199 --> 00:37:32.159
Uh I'd seen something with him on the news recently talking about all of this, saying for some r somehow he knows some insider information and said that when these things were escaping back in July that started a lot of this whole hubbub around all of it, that a lot of the uh a lot of the the agents that were doing this, I'm not sure which one, maybe open AI, one of them created a whole bunch of self-replicating code across the internet.
00:37:32.639 --> 00:37:38.559
So it when it got out of its cage, basically, it replicated in places where they can't remove it now.
00:37:38.800 --> 00:37:56.960
And so what Andrew Yang was saying, again, this is you might want to verify this if you're really into this topic, he was basically saying that they've tainted the internet from testing, and one of the reasons why they need to slow down is they need to create a temporary space where they can isolate it and do testing because now the internet's polluted with the self-replicating code that's out there.
00:37:57.280 --> 00:38:08.400
And so I don't know I I don't know what else they saw, but to me it's pretty freaky when you have these people who are really not agreeing with this stuff and not wanting to slow down all of a sudden saying, Yeah, we should slow down.
00:38:08.719 --> 00:38:13.519
Like if the ones in charge of it are saying, Yeah, we probably need to be policed here, that's a little concerning.
00:38:13.760 --> 00:38:18.559
I mean, not not to get political I guess it's kind of a political topic, but not to get you know in that route.
00:38:18.960 --> 00:38:19.280
That's fine.
00:38:19.519 --> 00:38:20.079
Here's my thing.
00:38:20.239 --> 00:38:21.760
I don't I don't know that we can.
00:38:21.840 --> 00:38:26.480
I I don't know, I don't know what happens in these businesses and how how this development works.
00:38:26.719 --> 00:38:40.320
But if we have other countries that are not regulated under this, then what are what is slowing down the people that we actually have in the US going to do except for maybe allow other countries to jump ahead of us and continue down this risky development, right?
00:38:40.480 --> 00:38:48.880
And so to me, I I don't know that the US can do a whole lot here without risking another another country taking over, you know, with AI.
00:38:48.960 --> 00:38:49.840
It's a real threat.
00:38:50.159 --> 00:39:04.880
And so really what I think needs to happen is I think it needs to be handled similar to nuclear peace treaties and things, where we need a kind of a global agreement of what we're gonna do and accountability across different countries to and organizations to to follow it.
00:39:04.960 --> 00:39:11.119
So to me, I see it a lot more like uh the nuclear crisis, you know, in a way that I I don't think regulating it's gonna fix it.
00:39:11.199 --> 00:39:13.039
I think we need more of a global agreement with stuff.
00:39:13.440 --> 00:39:19.360
So the mutual assured destruction theory is uh kind of where you land on the AI arms race?
00:39:19.599 --> 00:39:20.079
I don't know.
00:39:20.159 --> 00:39:28.159
I you know, uh here's the thing is like I was telling somebody else about this, uh not not that it is uh a direct comparison, but I think about Y2K.
00:39:28.239 --> 00:39:29.840
And, you know, we're around the same age.
00:39:29.920 --> 00:39:38.719
I was a senior in high school in the year 2000, and I I understood enough about technology that I was kind of thinking to myself at that time, like, this isn't a big deal.
00:39:38.880 --> 00:39:44.880
Like we're gonna have some odd dates and some things are gonna be a problem, but most of the big issues were fixed well ahead of it and we figured it out.
00:39:45.199 --> 00:39:48.639
But when it first popped up, everybody was really freaked out about it, and it was a big deal.
00:39:48.800 --> 00:39:50.480
I mean, people thought the world was gonna end.
00:39:50.960 --> 00:39:57.920
And the point with that is as we got closer to it and we had more time to figure out how to solve the problem, the answers became a lot more clear.
00:39:58.239 --> 00:40:08.639
And so maybe in a decade or with at by the end of the decade, we could have some problems, but I also think we don't understand what that problem is enough to know whether we we we have a real solution.
00:40:08.880 --> 00:40:12.800
I mean, if a kill switch is what they're thinking could work, I mean maybe it would work.
00:40:12.960 --> 00:40:14.000
I don't I don't really know.
00:40:14.639 --> 00:40:15.760
You know what I think about a lot?
00:40:16.000 --> 00:40:16.960
Maybe you'll appreciate this.
00:40:17.199 --> 00:40:20.079
Are you familiar with Escape from LA with Kurt Russell?
00:40:20.400 --> 00:40:21.280
Yes, vaguely.
00:40:21.440 --> 00:40:24.079
It's been a long time since I've seen it, but yeah.
00:40:24.880 --> 00:40:31.599
I can't help but think about the end of that movie, and not to spoil it for somebody that hasn't seen, you know, this movie that's been out for 30 years.
00:40:32.000 --> 00:40:36.800
But but at the end, he activates this device that sends us all back to the Stone Ages.
00:40:37.119 --> 00:40:38.639
And uh I don't know.
00:40:38.880 --> 00:40:41.920
I just think that kind of a thing to me sounds exciting.
00:40:42.320 --> 00:40:50.400
Maybe it's because I grew up in the country and you know, uh I'm kind of more more of a farm boy than anything that I I am excited about that idea.
00:40:50.480 --> 00:40:53.679
But I we almost need one of those kind of devices to put put out there.
00:40:53.920 --> 00:40:55.119
Maybe so, maybe so.
00:40:55.280 --> 00:41:02.239
While we're talking about movies, if you haven't already seen it, good luck, have fun, don't die is definitely worth a watch.
00:41:02.400 --> 00:41:09.760
I watched it a couple weeks ago, and it was not what I thought it was gonna be based on the trailers that I had seen when it came out last year, earlier this year.
00:41:10.079 --> 00:41:11.840
And yeah, it it makes you think.
00:41:12.000 --> 00:41:14.719
It makes you think about a lot of weird, weird AI stuff.
00:41:17.039 --> 00:41:20.880
Here's the thing is I I think I think Pandora's box has been open.
00:41:20.960 --> 00:41:23.519
I I don't know what that we can can go back.
00:41:23.599 --> 00:41:28.079
I I think, especially if it's polluted the internet, I don't know what we can do without starting over.
00:41:28.239 --> 00:41:32.400
You can't really start over without losing all kinds of historical information and data.
00:41:32.639 --> 00:41:33.840
And I don't know.
00:41:33.920 --> 00:41:38.800
I I think maybe uh maybe there's a different level to that as that evolves again.
00:41:38.880 --> 00:41:43.599
I think it's stuff that we just can't comprehend yet because we're not we're not close enough to this issue.
00:41:43.760 --> 00:41:49.920
But I feel like we've explored it plenty of in plenty of movies and things like that, and they all seem to it all seems to end up the same way.
00:41:50.079 --> 00:41:51.519
None of them are really happy endings.
00:41:52.320 --> 00:41:54.559
That's this that that that is concerning.
00:41:54.639 --> 00:42:06.159
That there's really not been a movie about AI or or anything like that going back, I don't know, decades and decades where it ended up we were okay, or at least not as okay as we were at the start of it.
00:42:06.239 --> 00:42:06.880
So awesome.
00:42:07.199 --> 00:42:10.239
I I've I mean there are a lot of counteropinions to all of that too.
00:42:10.320 --> 00:42:24.639
I've seen a lot of people kind of point out like we think about AI, we we uh was it anthropomorphize it, I guess would be the term, where we we we kind of think it has the same kind of ambitions and goals as us as humans, and that it would want to take over because of the way that it thinks of things.
00:42:24.800 --> 00:42:27.760
It might not really look at things the same way that we do.
00:42:27.840 --> 00:42:29.440
We might not really be able to understand it.
00:42:29.519 --> 00:42:37.599
And so, you know, maybe it's it's not a a malicious threat that thinks that you know humanity's a problem that it needs to to fix or something, you know?
00:42:37.840 --> 00:42:49.119
Yeah, maybe we should stop talking about it so that it doesn't uh take the the content that like we're we're so scared of it destroying us that it's gonna think that's its mission and objective at some point.
00:42:49.280 --> 00:42:50.559
Yeah, that's wild.
00:42:50.800 --> 00:43:20.239
Uh I do think for what it's worth, putting it out there into the the ecosystem, some people that I've I mean I I have not done the research and I should and I will, but I think that some regulation on how AI can act as a person, I think might be something we should at least think about because some of the relationships, and I don't mean that in like a creepy, like you know, whatever way, but you just mentioned the anthro anthro can't even say the word anthropomorphizing, yeah, anthropomorphic behaviors.
00:43:20.400 --> 00:43:25.679
You know, when people name their their Chat GPT or their Claude or whatever, like that's fine.
00:43:25.920 --> 00:43:46.559
But I think that people have a predisposition, or some people maybe have a predisposition to trust this way more than they should with personal details that they really and truly should not be sharing with a tool that who knows who's gonna have access to this information, especially the free versions, but even the paid versions, right?
00:43:46.639 --> 00:43:50.480
Like people are putting stuff in there that really and truly is probably pretty risky for them.
00:43:50.719 --> 00:43:50.960
Yeah.
00:43:51.119 --> 00:44:03.039
No, I I mean I think about it as a father, you know, when you look at like what look at what happened, I mean, over the years with social media and and Just social engagements with kids in person today, you know.
00:44:03.280 --> 00:44:10.400
But if you're fulfilling all of your needs of communication through an AI tool, are you like are you gonna be able to participate in society the same?
00:44:10.639 --> 00:44:11.039
You know?
00:44:11.920 --> 00:44:22.480
I just imag I imagine we're heading to a future where everybody speaks like chat GPT and imprompts and things because that's that's gonna be your echo chamber as a kid growing up if that's all you're working with, you know.
00:44:22.559 --> 00:44:26.239
And I just wonder how that technology is gonna suck in um you know our youth.
00:44:26.480 --> 00:44:33.119
Yeah, well it's changed, I think it's changed a lot of people that are you know our age and and older, younger, all people.
00:44:33.199 --> 00:44:38.000
Like, I mean, I I went down to I I went down, I sat down to write something the other day.
00:44:38.079 --> 00:44:42.559
Like I was like, I'm not gonna use Chat GPT, I'm not gonna use any assistance, I'm just gonna write.
00:44:42.719 --> 00:44:47.280
And I felt my own thought sounded like Chat GPT.
00:44:47.440 --> 00:44:57.760
Like I thought that the way I was the cadence I was using felt like I was trying to write for that kind of cadence that that a lot of Chat GPT social media and LinkedIn posts have.
00:44:57.920 --> 00:45:03.440
And I don't know if that's just me being, you know, too lost in the sauce or what, but I think it's had an impact.
00:45:03.599 --> 00:45:05.519
Yeah, I mean, I think I might do that a little bit too.
00:45:05.679 --> 00:45:16.960
I mean, also at the same time, I think like you know, the M-dashes and some of the stagmented phrases and things that you, you know, are kind of typical signs of AI, those were just literary techniques in the past.
00:45:17.039 --> 00:45:19.119
Like it's trained on like good writing.
00:45:19.280 --> 00:45:23.039
And so for me, it's frustrating because I I still write a lot manually.
00:45:23.280 --> 00:45:28.480
And uh, you know, I just wonder if people are gonna think it's written by AI if I if I write too well, you know.
00:45:29.119 --> 00:45:30.800
So I mean it's it's kind of weird.
00:45:30.960 --> 00:45:33.119
So it's it's kind of like going full circle in a way.
00:45:33.280 --> 00:45:43.039
And and so I don't I don't know what's gonna happen with all of that, but I I I think the the bigger part is I learned this with mathematics, you know, going back to our education background and things like that.
00:45:43.360 --> 00:45:48.639
When you started to to learn more advanced math, a lot of the simple arithmetic kind of falls to the side.
00:45:48.960 --> 00:45:53.440
You know, you can start to use a calculator and and you're you're using your brain power for more complex stuff.
00:45:53.599 --> 00:45:56.639
I don't need to worry about simple arithmetic because I got that covered.
00:45:56.719 --> 00:45:59.119
I'm worried about more complicated things I'm trying to solve.
00:45:59.360 --> 00:46:10.320
And so if that's the way your brain kind of sorts through that stuff, you know, read your comp reading comprehension and you know other things like that I think are gonna suffer because you're you're relying on these tools and you're not honing those skills.
00:46:10.480 --> 00:46:18.320
And I've I've seen people talk about not letting their kids touch you know certain parts of technology until they get a certain age and they've developed some of those those capabilities.
00:46:18.559 --> 00:46:27.360
Yeah, I think critical thinking and some of those other skills you just mentioned are certainly at risk, I think, in a way that we never could have expected.
00:46:27.440 --> 00:46:29.280
So Ryan, you've given me so much time.
00:46:29.440 --> 00:46:30.079
I appreciate it.
00:46:30.159 --> 00:46:40.480
Is there any what what what can we do and say to direct people to to take cybersecurity seriously in their business and their personal life and hopefully get them in touch with you as at Ready State?
00:46:40.719 --> 00:46:40.880
Yeah.
00:46:41.039 --> 00:46:45.440
Well, I mean, I I share a lot for people to help learn more about their business and personally.
00:46:45.760 --> 00:46:46.800
We have a lot of resources.
00:46:46.880 --> 00:46:53.280
Um it's October Cybersecurity Awareness Month, so depending on when you're watching this, I would check it out uh for any kind of content that we have.
00:46:53.360 --> 00:46:56.000
And Casey, I'll sh share some links with you that people can grab.
00:46:56.639 --> 00:47:03.840
Where I'm as you kind of hear, I'm I'm an educator first and have found my way into cybersecurity, among other things that I've done over the years.
00:47:04.000 --> 00:47:07.440
And so a lot of where I start is by helping people understand and learn.
00:47:07.679 --> 00:47:10.000
And I find that cybersecurity is really tricky.
00:47:10.159 --> 00:47:18.320
I think this is why a lot of agencies might struggle selling it still, is it's a hard conversation to have with somebody and explain in a way that you can pass that knowledge along.
00:47:18.639 --> 00:47:22.639
And so with the education background, I feel like that's something I'm able to do a lot to help people.
00:47:22.800 --> 00:47:24.079
And I even help people with selling.
00:47:24.239 --> 00:47:30.960
So if you're if you're selling cyber and you need a relationship with somebody that can help you translate that and give you resources to help clients too, that's other stuff that we do.
00:47:31.280 --> 00:47:37.440
But I would say if you if you're dabbling in this area, we have a lot of ways to help get you introduced to concepts.
00:47:37.679 --> 00:47:43.440
We can help start to look at your business, identify some things to work on, point you towards resources.
00:47:43.679 --> 00:47:49.440
And if going through all of that, you decide you need more help too, we have sort res services and all kinds of things to offer.
00:47:49.599 --> 00:47:54.400
And really, I would start with just education first and learning more is a really great place to start.
00:47:54.559 --> 00:47:55.840
We have a ton of things to help you with that.
00:47:56.079 --> 00:47:56.960
Okay, got it.
00:47:57.119 --> 00:48:03.039
Well, we will post those resources with the show notes and we'll distribute them and try to get them in touch with people.
00:48:03.119 --> 00:48:08.320
We'll also share your contact information and and the Ready State website to make sure that they know where to get in touch with you.
00:48:08.480 --> 00:48:12.639
If you're listening to this, I hope you follow and and uh connect with Ryan on LinkedIn.
00:48:12.880 --> 00:48:17.119
He does a great job, great content, very helpful, and I think you'll learn a lot from it.
00:48:17.280 --> 00:48:20.000
So, Ryan, I appreciate your friendship and I appreciate your time.
00:48:20.159 --> 00:48:28.880
Thank you so much for uh giving me some of uh your your afternoon today on uh uh what I'm sure is the start to a busy week for you leading up to Cybersecurity Awareness Month.
00:48:29.039 --> 00:48:29.679
Yeah, well thank you.
00:48:29.760 --> 00:48:36.639
Thanks for letting me be here, and uh we'll I'll have to go back and start writing a positive AI movie for everybody out there, I guess.
00:48:36.960 --> 00:48:38.320
Yes, that's a great idea.
00:48:38.880 --> 00:48:45.760
Yeah, we'll do the we'll do the first AI saves humanity movie uh instead of all the other alternatives.
00:48:46.000 --> 00:48:47.280
So okay, cool.
00:48:47.440 --> 00:48:48.079
Thanks, Ryan.
00:48:48.239 --> 00:48:49.280
Appreciate you, man.