John Qian: Building Security Programs Under Fire

Libby Botsford: Welcome to In Progress, because nothing worth building is ever finished. I'm Doug Merritt, and today I'm joined by someone whose path, the CISO chair, is genuinely one of the more interesting ones in the industry. John Chen is the Chief Information Security Officer here at Aviatrix, and we are honored to have him representing us. ⁓ but before that, he was the head of security architecture at Zoom during COVID. The moment that Zoom infrastructure blew up and was tested like never before. ⁓ before that, he spent years at Cisco as a principal engineer where where he helped pioneer the company's secure development lifecycle. Ever since we started this podcast, I've been excited to get John on board. And I'm really, really glad that we are connected today. John, welcome. ⁓ very excited to be here. Thank you, Doug. It's ⁓ it's your career has fascinated me since we were in the interview cycle. ⁓ and I'd l I'd love to start there. It's it's ⁓ not many people get the chance to talk about how did they wind up being in cybersecurity and a chief information security officer. ⁓ I know you sort of more on the engineering side. Ha walk us through ⁓ what what led you to the cyber Yeah. ⁓ you know, it was not actually my original career plan, right? So ⁓ I did my undergrad in computer science, masters in C S. And my route I thought was always building products, building better products, more products. ⁓ so when I joined Cisco, that's what I did. ⁓ we worked on a multi device security management product. ⁓ actually not that different from what we're doing today in Aviatrix, years later, right? But slightly different context, right? Consistent security policy across multiple device types. Cisco and Cisco and on Cisco devices. That's right. Yeah. Like the routers, firewalls, different type of appliances. and what happened was it was mostly like the large Fortune 500 companies using our product for companies that need that type of ⁓ environment. and slowly I progressed from developer to managing the product, right? So as a leader for the product, I had to work with customers a lot. And There are lot of security issues in our product. Right. So customers are hiring pen testers or doing assessments before they deploy. Completely understandable. And they're finding security issues and they're coming back to our team. And as kind of the manager for the product, I'm like, okay, I need to learn about what they're finding. Right. Because you know, one thing that might surprise you is a lot of the developers who work on security products may actually not know security very well. Right. They kind of know their piece, right? But exactly how the hackers get into a system is something actually pretty novel, right? So I had to learn what's going on and to be able to respond to customers. And the more I learn about it, the more interest that I got. So eventually I was doing this so much that I transitioned from a developer to kind of a full time product security engineer. And that's how I kinda that's how I started ⁓ in cybersecurity. And that was still at Cisco that you were doing. Yeah. Yeah. And what was that transition like? And what what products were you working on when you were focused on product and security? ⁓ those it was our firewall. ⁓ so our firewall's a security management product. ⁓ so when I transitioned over, it was actually quite different because now I need to think about security program for the whole company. Right. So as you know, I I know you've been at Cisco as well, there's so many different products. At Cisco, so many different business units. ⁓ So it was a lot of it was specifying security requirements, what we need to do. But across such a large company, there was a lot of ⁓ security champion and kind of culture development. ⁓ so we started the Cisco security conference. ⁓ initially I think we had about a hundred people joining. ⁓ by the time I left, which was maybe eight or nine years after this effort, ⁓ every year the security conference had like around two to three thousand. Participants within the company. So like ⁓ trying to shift mindset in addition to rolling out a security program. Yeah. Yeah. It's definitely I'm I'm guessing your team wasn't enormous, which is usually the case, right? You've got you had to it's right, right. Yes, exactly. So there's it's not a big team. ⁓ what we had to do a lot of is work with different business units and they're all very unique, right? If you think about Cisco product portfolio. Like a WebEx versus a IOS router. Yep. ⁓ so working with technical leads or distinguished engineers in those BUs. ⁓ later on, different BUs have their own CSOs, right? So working with those CSOs, ⁓ making sure that kind of the company wide security posture is adopted by all the different y business units. A l a lot of collaboration actually, to be honest, at the end. Yeah. Yeah. Yeah. So that it hooked you obviously and kept you. Remember, what what did what did you like about about the role? Why why did you stay? 'Cause you probably could have gone back and done classic engineering and product engineering rather than staying tracked. Yeah, I just felt like I was making a lot more of an impact than building a single product. ⁓ so you know, like we take a lot of pride in trying to help trying to keep Cisco secure, which in turn keeps service providers, large enterprise customers secure, right? So I just felt like that was a more fulfilling mission. and that's kind of what got me hooked. Yeah. Yeah, it's a great part of the mission is ⁓ unification for sure. Yeah. ⁓ how did you get up to speed on the way that adversaries think and act? Going back to the pen testing and your initial intrigue with cybersecurity. ⁓ so at Cisco we're lucky that we had a fairly large ⁓ offensive security team. So I spent a lot of time with those teams, ⁓ understand how they think, how they evaluate their own product. ⁓ so and then of course, you know, going to conferences like Black Hat, looking at industry publications. ⁓ yeah, so cybersecurity is so unique in that it's not like you take a series of classes and you're gonna learn everything about cybersecurity, right? It's constantly evolving, constantly changing. ⁓ so you really have to just stay on top of ⁓ kind of the latest nuggets. From different sources. ⁓ yeah, so a lot of time in terms of learning and also doing some hands on practice. I think that's really important. Like if you get into cybersecurity, ⁓ sometimes the best thing to do, especially nowadays, I think it's much easier, ⁓ just to try out some of the things you're reading about. ⁓ and that that's a good reinforcer. Try and be a friendly attacker. Yeah. Yeah. ⁓ so what led you to Zoom and and walk us through that must have just been an inquiry. incredible experience given when you landed at Zoom and everything zoom like while you're there. Yeah, I I mean I had no idea. ⁓ so ⁓ at you know after spending twenty years at Cisco, ⁓ I felt like it was time for a change. Right. And a good friend of mine actually he led WebEx security and then he went to Zoom. ⁓ so he kind of recruited me to Zoom. ⁓ so when I cool part of the WebEx team. That's right. That's right. Yes. Yeah. So 'cause I work very closely with WebEx folks. Well, I was at Cisco. So one of the first cloud environments, right? So ⁓ yeah, so I I joined Zoom and then that's I think pandemic started April or March. I joined in June. And yeah, it was it was one of the most intense periods, I would say, you know, for security and for everybody else at the company. ⁓ and you can't well you came into Zoom in my role. ⁓ so I was leading the security architecture. ⁓ so meaning that all the features that we're releasing will be revealed by my team first, right, to make sure they're secure before we go out. And then after a short period, I was also responsible for our kind of the overall infrastructure. So the cloud infrastructure and also the total data centers. Yeah, so ⁓ I think those really two things we had to do. First is we recognized very quickly that ⁓ there's not enough security controls in the product. Right. So if even if your product's perfectly secure, there's not enough features in it for, for example, like a meeting host to configure certain settings. So there's almost like a product management, but also security, right? So an example would be if you're hosting a meeting, do you have the ability to see all the attendees? Do you have ability to mute all the attendees, to kick out attendees who's not behaving, right? And So so all those different security features and controls ⁓ had to be added into the product. That was I remember when COVID kicked off. Yeah. There was all Zoom bombings, right? Yeah. Zoom bombing and disrupting people and yeah. Right. That's that was a really important part of of security as far as keeping high quality meetings in place. Yes, yes. And then and then so those are sort of the security features we had to add. And then ⁓ on the other side of it, we had to build out our entire security program. ⁓ so when I joined Zoom had about let's say 10 people on security. Not even formally, right? Just sort of that title in different ⁓ works. And then we grew up to about 300 in two years. So ⁓ we had to mature our security posture across all the different functions. ⁓ so it's kinda like building a flying at the same time. and I think, you know, on the product security side, it's really just racing ahead of the security researchers, nation states, trying to find as many issues as we can before they do. So yeah. You guys must have been under attack all the time. Yes. Yes. Thousands of times per day, I'm sure. Yes. Yes. Yeah, the ⁓ because Zoom had a so the client is native, it's it's not a it's not a browser, right? It's a native client. That's why the experience was really good. But also it means that the tax surface is bigger. ⁓ so we had all kinds of people evaluating our client, including kids from high school. We got some of the best reports from high school kids, right? So ⁓ yeah, so we we really had to ⁓ build a program, but ⁓ mature very fast. ⁓ and you know, the I think there's sort of three things we're doing at the same time. One is We recognized we needed help, right? So we went out and hired a lot of experts ⁓ in different domains. ⁓ we had to find a good framework for us to assess ourselves, ⁓ in terms of maturity and then very proactively prioritize and identify gaps and try to resolve those gaps quickly. ⁓ but having that overall framework to kind of know what we're what we are and where we're progressing to. and then another thing that was I thought more difficult than we expected initially. Sometimes if you have pockets of success, but you want to make that into a corporate wide process. Right. So like making it operational, making any sort of best practice actually operational across a company was another thing that we really focused on. So it's I mean there are very few success stories like or I I guess situations like Xam. Yep. Yeah. Probably Google, definitely the open AI anthropic world where you've got this combination of insane scale, global reach, and critical infrastructure build-out, all happening simultaneously. Yeah. Couldn't be a better better honeypot for them to go after. Yes. Legitimate. Like they want they want in. ⁓ and as a CEO, like I think one of the many challenges that CCOs have is trying to balance. Like any other operational team, trying to balance how do I keep you secure and not get in the way of business. Right. And and oftentimes the board and CISO support is critical. ⁓ what what was it like? I mean, because the I I remember me had revenue was I've never be up before OpenAI had never seen revenue explosion like that before and used its explosion. And there must have been battles all the time on, hey, we've got to meet demand. No. ⁓ yeah why why do we have to pay attention to the security thing right now? Yeah, yeah. I mean, you know, l luckily for me, at least when I joined, it was recognized across a company that security was critical because of the Zoom bombing and all those ⁓ very public events. Yeah. Right. So ⁓ one of the first things we did was we paused development for I forget how many weeks, but it was very similar to what Microsoft did in the early two thousands, right? Yeah. So he paused development and you just fixed the convenient moment, yeah. Yeah, yeah. So you you fix security bugs. ⁓ what we had to do though is I I think as a security team, you have the responsibility of of course improving security posture, but also do it in a way that's not that doesn't just put everything to a grinding halt. Right. Right. So I I think it was very clear across the company, engineering owns security. Like engineering has to release secure product. So our engineering leadership made that very clear, right? And of course, security team, we had our own KPIs and benchmarks to see how we're doing, right? ⁓ but what we really try to do is to integrate security into the process in a way that's lightweight. use tooling when we can to reduce friction. But then for the critical features, ⁓ we do need to make sure that it goes through a very detailed manual review. And in those cases, we want to engage as early as possible. Right. So nobody's surprised. So like even the whiteboarding phase, ⁓ we'll have security architects over the development team and the product management. And and so that's a way to try to help reduce friction, but ⁓ improve the overall security. Yeah. Yeah. So you you report up through engineering. Yes. Which made which made it I I guess easy and and hard. easy in the sense that you're part of the core team, but still a layer to remove from Eric and the rest of the executive team. Yeah. So initially we were and then we got moved out into a more separate, right? But still like it was very clear top down that 'cause in terms of ownership, it's good to have a very clear owner, right? So like engineering, you guys have to release secure products, right? So the engineering leadership made that clear. It's a responsibility and we have our own KPIs and tracking, right? But of course we're gonna have to make sure security posture improves across the company. ⁓ so it's it was a very good collaboration between the two. yeah, I think the the most friction would be things like if for some reason security have requirements, that's not really very actionable, right? It's it's more like a compliance check. And then those are the times where engineering or DevOps team pushback. Like they don't really know what we want. And ⁓ that caused a lot of friction. What's what's a good for the the audience? What's good example of one of those versus the more obvious show? ⁓ sure. So we had a lot of debate. So there is a so this is before I took over the infrastructure team. But those are requirements like you have to make sure everything is encrypted. Right. Okay, what does that mean exactly? Right. ⁓ the obvious one is maybe like some data path is encrypted, right? But let's say you get into a Kubernetes cluster itself. Yeah. Do everything inside the cluster have to be encrypted? Okay, that has to be encrypted on a node between the pods. Do those traffic have to be encrypted, right? Or anything between two processes potentially could go through a port, like a local port. Does that have to be encrypted? So it's not clear, right? So people don't know like how far to take this requirement. Yes. And and that's kind of thing that that drives development team a little bit crazy, which I I I agree with them. Yeah. And that's such a good example, right? With Sol Typhoon coming to surface and have been Blown away that we're not seeing this greater rush toward full encryption. Yeah. But it'll bet as you get in touch with customers, it it you start to go down that rabbit hole of like, what does that mean? I'm encrypted, encrypted in these areas. Like, do it does the rest matter or not? Yeah. ⁓ so on that topic, shift left 20 30 year topic, probably 40 year topic. Yes. They should know how to write secure code. Like, why do we have to have a separate QA group or separate separate security group or secret separate infra, like why can't developers do it? ⁓ what i because you've been in product security for so long I've you've been battling you've been collaborating and battling this yep entire career, I'm sure. What what what makes it hard and what are some examples of some of the breakthroughs that you've seen? 'Cause you I've I watched make a huge impact at Aviatrix in a short time also. No ⁓ thank you. ⁓ so I I think like I said before, ⁓ Collaborating with development teams early in the process. So nobody really wants to get a surprise at the end, right? So ⁓ very early the design stage. So make the security team feel like part of engineering. So the weekly architecture design meetings, the feature design meetings, be part of that. Start very early and then just kind of embarrassed. How just w starting there, how did you make sure that you were able to show up there and that you how did you show up in the right way so that people found value in that instead of just like we're trying to get this thing out. Like why is in here talking to us about it? Yeah. ⁓ so I I think, you know, what we did was we first obviously document the process, right? So people can at least see what is expected ⁓ from start to end. And then ⁓ we worked with the product management team to identify some of the more critical products. So we we're not there every single feature, right? So what we do is we do a very quick ⁓ risk assessment of all the things that's going out. It's something we do today at Aviatrix as well. So we looked at all the kind of the committed features for release. We identify the subset that we feel like would be important for us to engage. So it's not everything. And then for that subset, then we go into the kind of the early design meetings, right? And we're not trying to be disruptive. You know, sometimes a lot of times what happens is engineering might ask, how do I actually implement this? ⁓ this feature security, like this piece, right? So so this is where like having good security architect is really important. You wanna be able to answer that question live in that meeting and not so much like, okay, I'm gonna write this down, go back and think about it. Right. So we ⁓ so when we hire people definitely look for folks that's very experienced that can kind of respond to the engineering team in a productive way. Right. So if folks find value, ⁓ then They don't like us to be there. So get in make sure you get in pick your battles. Understand lands number one. And prioritize. Get in early. Yeah. You're highly technical and collaborative people that have good skills. Those three a lot of sense. What what what else do you see as some of the the real ⁓ secrets they're the real levers to make security part of everyday life? versus because it never works you're trying to do at the end of something. Yeah, yeah. ⁓ you know, the other piece I think is automation and tooling, right? Building that into the pipeline. ⁓ with AI, it's I think it's much easier today to have more effective tools. ⁓ 'cause some of the security tools do produce a lot of false positives. So so as a security team, you want to tune those as much as you can before deploying. Otherwise you're going to lose credibility with the development teams. Right. So ⁓ so understand the development CI C D pipeline, ⁓ and then understand where you can inject into that process so it feels more natural versus, you know, something heavy handed at the end. So every pull request, ⁓ maybe even before the pull request on developers machine themselves, if you can produce secur security signals as useful. ⁓ And can be resolved early. Not only is lower cost, but it's also less friction. How how impactful have you seen over the past year or two years AIB on this entire landscaping set of processes? Yeah, I I think it's it's really impressive. ⁓ so some of the things we're doing here at Aviatrix is ⁓ you know, we talked about the security design review, right? Just just the initial design. And then also the when developers write code and they're committing code. Right. So on the design review side, ⁓ you can imagine kind of what a typical security architect would do and try to replicate that into AI, right? So like the security architects should have very broad knowledge about the product. Right. And then you can do that for AI by documenting your overall system and feeding that into the model. And then ⁓ understand the feature. So you can take the PRD, the product requirements document or whatever description you have in your org, right? Feed that into AI. And then just have AI kind of do the analysis. And then you provide it some guidelines on how to do security reviews. What's really nice I think is it's more comprehensive than the human. So you identify a lot of different things across different areas. And you know, just based on my experience, even if you have really strong security architects, they tend to focus on certain, you know, it's very hard to Think of everything. So expertise areas. Yeah. Yeah. So in that sense, I think on the design review side, that's really useful. And then ⁓ we've been running Opus, ⁓ latest Opus models to do the code scanning. And it's finding a lot of really interesting issues that, you know, we simply missed ⁓ in the manual review. ⁓ the other thing it's quite strong too is if we had to build a like ⁓ demonstrate in f in terms of exploits. AI is very good at building those ⁓ prototype as well. Like you have to get some clearance from Anthropic to do that. But ⁓ sometimes it's really hard manually to come up with those. It's very time consuming. Right. So getting like a sample ⁓ exploit development done, that's ⁓ I've seen that to be really useful as well. Yeah it's where it's gonna get so interesting for the next year is it's it's one coin. It's one point the how do I want to help the good guys code more secure characters, interrogate their code, find vulnerabilities, that exact same thing and the bad hands. You know that bad. Yeah. The only way to really regulate it is you gotta figure out what the intent of the human is, which you know, maybe in three or four more years when it all mine melds and and and we're glaring right now we're not Yeah, it's ⁓ it's really a race. ⁓ and you know, one thing I I kinda learned that Zoom too is it it's very hard to eliminate all vulnerabilities in your product. even if you can patch some vulnerabilities, it takes time for folks to ⁓ update Mutosa's versions, right? So there's always like vulnerable spots in the environment and Yep. one of the things I think you really have to think about as a security team is ⁓ let's assume that there's vulnerabilities in your environment that's exploitable that folks can get in, right? Like so how do you actually secure and harden your environment, contain those ⁓ potential exploits in your environment. Right. And and ⁓ especially at scale of Zoom and also a lot of software, like once it's out there, it's out there, right? So it's Yes, you can patch and do all those things, but ⁓ you gotta make sure your own infrastructure is ⁓ resilient. So as faster as AI, like you mentioned. Segway into some of the trends in the industry. 'Cause again that I know that we are so like minded on this, but it's just it's so hard. I found it so hard over the past five, ten years to have first principles to ring conversations with with people that that that you need to have first principles to ring conversations around. ⁓ And so something like this vulnerability management and patching and guardrails around LLMs. Yeah. There's so much energy being spent on this topic right now. And I'm not sure. I mean, if people just slow down and really look at the foundational characteristics, I think there might be less energy. Do you wanna wanna walk us through how how you're thinking about that that whole topic? Because right now the narrative From everyone that I've talked to, everything I've got and everything I understand is find vulnerabilities faster, patch faster, get to a hardened environment. ⁓ just touching on why I mean the the dilemma with these systems is they ⁓ for any system to for almost every system to have value, it needs a whole series of connections ⁓ and complex and a whole series of components to To provide that value. And those connections and components are even with their perfect, if e i even if there's no such ⁓ thing as a vulnerability, if even if the code is hardened, still provide huge opportunities for adversaries to take advantage. It's like if I if I want to really be safe, I've got to live in a box with no windows, no doors, no no way in or out. But that's impossible. Like it's life is risk. So w walk us through a bit of how what you're seeing in the industry and how and how you're thinking about it. Yeah. I mean ⁓ Doug, like you said, I think traditionally security teams are thinking about prevention, detection, right? And ⁓ I think some of that has to do with the tools they have access to and ownership to, right? So security team owns the scanner. it's kind of a workflow folks are very used to. Right. And when the numbers go down, it makes everybody feel good. Yes. The numbers are going down. It's less red and more green. but I think if any security teams really honest with themselves, even today, before AI, right? Even today, if you look in your environment, there's a lot of vulnerable points, right? And that could be exploited. ⁓ so with the advent of AI discovered vulnerability and exploit chains, ⁓ you know, for models like Mythos coming out at some point. ⁓ that's gonna accelerate dramatically. So I think, you know, it's not a new concept, but I think security team from this point out really needs to think about assuming you're breached, right? Or or the board or the CEO. Assuming you're breached, like how bad does it get in a breach? Like how do you contain this? What is a blast radius? ⁓ a lot more focus have to be spent here. ⁓ 'cause it's gonna happen in your environment. ⁓ it's it's not just like people accessing your environment, but you know, some of the ⁓ so for example, Team PCP campaign recently on supply chain. It's not even a remote ⁓ anonymous attacker trying to get into your cloud environment that way, right? It's through supply chain. ⁓ you're deploying this vulnerable workload into your environment yourself. it's j it's just very hard to sort of prevent every single thing that goes into your environment. So So I think you're gonna have to have a more mature containment posture. And I would say the way to think about it is just like you have ⁓ maybe secure by default type of ⁓ principles, right? So you think about containment by default. Like if you deploy something new into your cloud environment, what is the containment posture of the set of workloads? Like and what what what does it connect to? What can it reach? Right. Right. And then and then ⁓ by Specifying policies around that. Right. Exactly. Yeah. So that's kind of how we're thinking about it. ⁓ it's not a new concept at all. Assume assume breach, assume they're inside. I have I've heard that for my entire career. Yeah. I don't believe that many people, much less C COs or CEOs, actually believe that. ⁓ There's a stigma if you weren't able to prevent which is sad because we're living in this very hostile world where an innocent person's walking down the street and someone throws a rock and hits them and it's the person's fault is this way I view cyber right now. it's it's gonna it's gonna happen all the time, like hundreds of times per day going forward. What what do you think has to occur for people for that to be really lived? Like assume breach. Assume. Not just words go in and out, you know, w in your left, your out, your right, and never end till you're like how do we make that transition? Yeah, I I think ⁓ certainly more education ⁓ would be helpful. Like from ⁓ so I'm part of ⁓ a few different CISO communities, so we're talking about this ourselves, right? So how can we, you know, especially in the world of AI, right? How can we develop content? that helps rest of the CISOs across the industry ⁓ to think more about containment, to be able to measure containment. Like what does it really mean to contain, like to measure your blast radius, ⁓ to be able to have that feedback. And I think one of the things that's looked missing a little bit, especially since we transitioned from data center to cloud, right? In data center, you kind of think about containment as here's my data centers contained. Even those blast radius inside it. You can still sort of envisioning there's a border and it's contained. But in the cloud it's just much harder. because the way the service providers ⁓ want you to be able to spin up your applications quickly, right? So a lot of things are open by default. And and there's like it's little different pockets of V PCs. ⁓ so I would say, you know, like think about your production environment first, right? Your critical environment. How are you securing that and how are you containing that? ⁓ So one example is, you know, at Zoom, we're very concerned about, extremely concerned about actually access into production because production has customer data. Yes. We don't want developers the insider or outsider. We don't want developers to be able to access anybody who's not allowed to. So making sure those typing environments well contained. ⁓ think about east west traffic, right? Where can a workload go laterally in your environment? And also where can it go outbound? Right. So if there's a data exfiltration, where do those data go? So yeah, so it's ⁓ and and then maybe power has that first and then kind of the rest of your cloud infrastructure or the rest of your infrastructure. Yep. Yeah. It is ⁓ secure by secure by default. Yeah. Understand reachability and blast radios. Yeah. I I think there needs to be better tooling in this area as well. You know, just just like there's very good we're like very clearly defined tools for scanning for CSPM, for CNAP. ⁓ I think there needs to be more done in this area, in the area of containment, blast radius measurement. yeah. There's a few renders trying to, ⁓ but I think there there needs to be more. Needs to be more. Yeah. ⁓ so we when you think out, the probably last key question before the speed round, when you you you're deeply involved day in, day out. ⁓ in cloud, cloud architecture, customer interactions, AI utilization on both the defense and the offense side as well as in strong. How how different is this environment for folks? And and how do you how do you help manage through the the noise level and the competing priorities and the demands that you face? Yeah, I I think the environment's so different now compared to a couple of years ago because of AI. Right. ⁓ so as other part of my job here, ⁓ I'm also responsible for AI enablement across the company. And and that really starts with my security team, right? So really working with a team to think about how we can leverage AI for some of the use cases I talked about, and there's more, like in Security Operations Center. in enterprise security, right? ⁓ how can we make that more effective and measurable so that we can scale ourselves as the tech scales. Right. ⁓ and then the other thing, you know, taking from what I learned at Zoom is really just to keep prioritizing, measuring how we're doing, right? Understand our overall security posture, what we need to focus and then like focus on and then ⁓ prioritizing ruthlessly every quarter. We're we're a finite bandwidth. So focus on the things that that's really critical for the quarter and then try to get those delivered. Very, very practical. Very practical Yeah, and it's and then and so I I think we got a pretty unique architecture where you're ⁓ both ⁓ part of the LT and director for CEO and it's not artificial to have you in the front of the board in board meetings, but then also combined CIO CEO. Yeah, it it's been a great experience. ⁓ it's I think as a CSO for a security company especially, right? There's kind of a unique lens in terms of being customer zero for some of our products, as well as trying to, you know, talk to other CISOs about importance of things like containment and ⁓ hardening infrastructure. ⁓ it's great experience so far. Yeah, it's been it's been awesome working with you on this for sure. And it really goes back to how you who you how you show up as a human being. ⁓ and your early insights on collaboration and enablement and you know the the fact that the business is running quickly and you've got to help people with security, but you can't get in the way of business. And and I I think if with more and more CIO CISOs had that perspective, we'd be in we'd we'd be in better shape as an industry. ⁓ yeah, it's it's ⁓ actually a great working with you Doug. I mean it's ⁓ you're you're very aware of the security issues, right? It's impact and ⁓ I think you'd be a great evangelist was ⁓ across industry. So yeah, it's you know, the other thing with A matrix too is our solution ⁓ is really elegant and simple, but I think ⁓ you know, when my team deploys it within the company, we're we're ourselves impressed. by what it can do. ⁓ and we're not the only vendor, to be fair, for containment and things like that. So I I definitely would love to see more emphasis in this area across industry. Yeah. Yeah, me too. And and your feedback, you know, going back to all you guys out there and talk about drinking their own champagne and ⁓ it is something we all want to do. But your feedback has been so invaluable to the product teams. It is ⁓ yeah, we obviously we believe so deeply in containment and we need it. In believe within a company and made sure that we can help ⁓ live the assumed breach and how far and how bad can it get. ⁓ but there's always lots and lots of improvements and Yeah, absolutely. Yeah. You are you guys are so keyed in on the meaningful high priority improvements ⁓ as well as the foundation ones. Well, lo I'd loved talking to you. Yeah, same. ⁓ why are you game for a quick speed round of just some of your thoughts on the industry? Okay, let's do it. Okay. ⁓ let me got a couple of these written down. Let me cue some up. All right. First one, what do you think is the biggest myth in cybersecurity today? ⁓ I think we talked about it a little bit. I I think patching all the C V E's and and you'll be okay. That's ⁓ I love that one. I I agree. Everyone out there read my vulnerability deficit white paper, please. Yes. John helped me with it. what do you think is the most overrated security tool or framework? ⁓ I think anything that's sort of a standalone, ⁓ so again, picking out C Vs, like a C V scanner, right? Without any context into the larger environment, ⁓ those tools tend not to work very well, i in my opinion. Yep. Good one. Best career decision you've ever made. ⁓ so ⁓ honestly transitioning to a security company at the CISO. ⁓ you know, like we talked a little about, you know, it gave me visibility not only just into product security, but overall business, right? Beyond the ELT. I'm very thankful for that. ⁓ so I understand our business operations, our product roadmap. ⁓ go to market strategy is I mean super interesting. It's and and and it's awesome how much value you add ⁓ across all those. ⁓ if you weren't in cybersecurity, what would you be doing? ⁓ well so career wise, I think, you know, with AI, it it's just so interesting, right? So like I I also am lucky I get to do some of that right now, which is how do you help an organization improving the AI posture. It's almost like security, but kind of a complement to that. ⁓ how do you help ⁓ individual contributors, managers, ⁓ leverage AI better. So like this whole I think in in the in the industry sometimes it's called like, you know, frontier deployment type engineers or just AI and everyone in general, understanding technology better ⁓ and helping people get on this wave. ⁓ I think that would be really interesting. I like that. No. Like that. All right. And last one, ⁓ end of a tough week, your go to stress reliever. ⁓ honestly I I don't just stress that much. ⁓ I used to like early in my career. Yeah, no nowadays I I don't. ⁓ but ⁓ you know, I I I I live in San Diego, so we're very close to the beach, right? So I love just going to the beach and just, you know, if you listen to the ocean, it's relaxes you for sure. ⁓ and then, you know, like ⁓ I always feel pretty good after workout. So that's what I do too. I love those too. Yeah. Relate to both of them. Well, John, it's an honor to work with you and ⁓ and I thank you so much for coming on the podcast and sharing your career journey and your insights with everybody. Thank you so much, Doug. It was great to be here.