A Third NetScaler Zero-Day, 8 Million Danish ID Records, and Google Pauses Its Bug Bounty

Gwen Murphy | Content Marketing Manager: Patching a system, trusting a partner, reporting a vulnerability. These are all the things that are supposed to make us more secure, right? This week, a third Netscaler Zero Day sends admins back to machines they just patched. Attackers pull millions of records from Denmark's national ID system without exploiting any vulnerabilities. And Google has a new problem. AI can find bugs, but it also generates enough garbage reports to overwhelm the people who are supposed to be fixing them. Later in the show I'm gonna talk with Andrew Crotty of the Ginger Hacker Initiative about something we don't spend nearly enough time on, how people actually get into this industry in the first place. This is initial access. I'm Sean McMillan, community manager here at Bishop Fox. And joining me this week are Sergio Viegas, senior managing analyst, and Dylan Sparks, senior operator. Gentlemen, let's let's get into it. Let's start with ⁓ with this Netscaler business. ⁓ I feel like we just finished talking about Netscaler because we did. Citrix has patched another actively exploited zero day. CVE 2026 88779 affecting appliances using SAML. Citrix describes the impact as denial of service. Researchers are seeing some things in the wild that make that description a little interesting. ⁓ what's what's going on here? Yeah, so ⁓ just initially, I'm just gonna jump straight into it. ⁓ we are talking about Citrix again ⁓ because We haven't stopped working yet for the past like week. ⁓ my old friend. Yeah. Yeah. Yeah. All reliable, right? ⁓ so just gonna jump right into it. Kind of, you know, the article states, ⁓ this is for eight eight seven seven nine. You probably recall from like a week ago if you were working over the weekend, we had the release of CDE twenty twenty six, ⁓ eight eight seven one and eight eight seven two, also affecting Citrix appliances. ⁓ It's not super surprising to me personally. working on the T team here that responds to emerging threats. ⁓ typically what we see is we'll see one emerging threat for an affected appliance. ⁓ and then typically what happens is once that CVE is cut, we typically see other researchers go in and take a look at that. And then that's when it really starts to kind of bloom out and pan out. And you really kind of start to understand the scope and the actual impact of the exploits if there are any exploits. ⁓ so it's not super surprising to see the fast turnaround on a third C V. ⁓ it it just kind of feels like that's kind of the process now is something gets popped and then everybody comes in and just dogpiles on the vulnerable product. Yeah. Yeah. That's And and now this was w what's the deal with this being initially called a denial of service? ⁓ but that's like doesn't really look like that's what's going on here based on the logs. Yeah, so ⁓ again, the the C VSS score and everything else comes from ⁓ what can be proven, right? So again, at best within whatever research they're performing ⁓ over at Citrix, like That's what can be proven. It has to be stated as fact. ⁓ whereas attackers and security researchers, like independent researchers or who are doing bug and vulnerability analysis, that kind of just becomes the floor, right? So it's what's proven up to this point and what can be used. ⁓ I feel like it would be kind of irresponsible for vendors to hyperinflate the impact of these things, like, ⁓ my god, RC, everybody panic, just because. one person individually posted like a tweet or a or a misleading blog post. I can't tell you how much time I spend throughout the day reading through other people's research and then finding like a line at the bottom that disqualifies it from ⁓ this wasn't actually externally ⁓ you know externally available service ⁓ or I had to turn off This default configuration that blocked me from doing this. I had to set this up like a total buffoon to make it vulnerable. Yeah, yeah, yeah. Like under ideal conditions, I was able to achieve ⁓ such and such. ⁓ yeah. And what what we're kind of seeing is a lot of researchers that are posting kind of unfounded or like unproven, like, hey, we can see this in the logs. ⁓ and seeing things like command injection in the logs. Sure, that means you can put it there in in memory, right in the logs. ⁓ but is it actually executing? Are you getting anything back? Is it doing anything or drastically different than I'm able to just push up any sort of characters and it gets logged somewhere? And I think this is ⁓ go ahead. No, and and I think that's a very thin line, right? Because ⁓ when you look at the actual description of of remote code execution, it's like Well, are you able to execute any code as simple as it is? Well, yes. Does it mean does it carries an implicit risk of like, hey, you are super ⁓ like you everything is now under the control of the attacker? Well not necessarily, right? Like the line stated it perfectly. There is a lot of conditions. ⁓ it's also not kind of it's very common that remote code execution stuff ⁓ tends to be tied with the NLI of service stuff, right? At the end of the day, ⁓ some things, some some certain types of attack when you when you look at like buffer overflow, right? Like the the consequence of a buffer overflow is that you are able to like I know point back the the actual like at the at the assembly level, right? Like point it back to any given ⁓ in the stack anywhere you want it to point. So the consequence is that you're you're able to control the system and execute something. Right. ⁓ but the attack itself is mainly or partially a denial of service in some sense. So so that that's the other thing, right? Like how the terms are used in the whole industry, it's kind of weird. ⁓ so yeah, this is a this is an interesting one. It it doesn't it doesn't remove the fact that it's Citrix. It's an important type of service. ⁓ something is happening. ⁓ so it it reminds me of like in the past where we have seen ⁓ d Dylan take taking what Dylan mentioned, right? Like seen like atta or or rather C V E after C V E when you already patch it. Well in the past what happened is ⁓ I remember Palo Alto a couple of years ago, they tried to patch a vulnerability just by hiding the version. And because of that your POCs did not work correctly. But they realized that like it was just a hidden flag. If you just remove the version checking and you just throw it exploit, it will work. Right. So this kind of the this not saying it's the same, but I but Yeah, it's similar, right? Like you're seeing kind of you're beating the same thing just by different means, by different ways. And that's how you get also to like AI discovered the result also this nine of service to get to the same thing kind of deal. So yeah, this is a very interesting one because of that all of that. Yeah. So I mean it it is like a high score, right? ⁓ but if you just patched last week, how big of a deal are we are we thinking here? Does this move to the top of the stack or or is this kind of like you see it for what it is and and maybe you just check, make sure that configuration isn't isn't set? Well, I think our criteria internally here is drastically different when we evaluate emerging threats. ⁓ And when it comes to like how we classify things and prioritization, ⁓ because it means different things for different vendors, right? So, you know, if availability is your thing, ⁓ you certainly are going to raise denial of service. And I mean, everyone's gonna treat RCE like RCE. It's a patch now, absolutely. ⁓ but when you see things like this, ⁓ you know, memory corruption and being able to ⁓ inject specific payloads like even into logs, like that's still not good. Like, yes, you should match this and upgrade. ⁓ but yeah, it it really depends on what your security model is, right? ⁓ what your availability needs to be versus, you know, the business analytics of downtime. but yeah, this is an edge device where we're seeing memory corruption ⁓ and claims of RCE. So I personally, yeah. I would I would roll up and patch this one. Yeah. ⁓ people. I live in the Midwest and you sound like one of our weather people talking about like we haven't seen a tornado, but like everything's swirling and the cows are getting anxious and you know, sky's turning unnatural colors. ⁓ Yeah. So it's also like the nature of Netscaling, right? Like It's an appliance that by default, well not by default, right? But in the vast majority or of of architectures, you will have NetScale services exposed to the internet just because that's how it works, right? Like you have like ⁓ WAF. Yeah, that is where it goes. You have like WAF, you have like ⁓ network balancing ish kind of things, you have like handling SSL connections. ⁓ so it's a public appliance, right? I I guess the question is not Whether you need to patch it because it's an elevated or a minor kind of situation. It's okay, you need to patch it first because in your model of like your connections and your interwebs, you know, this is an exposed service, right? Like this is important because because of that. Maybe if it if this was not saying do not patch internal services, right? But a very obscure internal service. Okay, you may have time to test and actually deploy it with a more reasonable time. But still you need to worry, right? Because maybe you have an attack in the side and yeah, it gets fussy. ⁓ but this is an ex an and literally exposed appliance. So it's a it's a big target. Yeah. It's a big target because of all of that. I mean it's it's one of the big ones, right? Like you got you got Citrix, you got Cisco, you got ⁓ Palo Alto, you Ferdinand, like it's it's one of ⁓ you have F fives also, like. Those are the big brands that you almost always want to like patch right right away. Those are the things that attackers are attacking. Yeah. Yeah, and like like I said earlier, the C VSS score and and everything is related directly to what can be proven. So again, I think it's important that we start treating that like the floor of possibilities, right? And so it's really important for ⁓ security teams to kind of understand that as well. High score is very bad. low s lower score is not necessarily a whole lot better. ⁓ all right. Well let's let's talk about something that involved ⁓ really no misconfigurations, no zero days, anything like that. ⁓ this recent Denmark situation where attackers pulled names, addresses, and CPR numbers, which is like kind of like their national ID numbers, similar to our like social security or something like that. For roughly eight million people from Denmark's national ID registry. But they didn't have to hack it or break in or anything. It was abusing a company's legitimate access to query it. So ⁓ Sergio, talk about what happened here a little bit. Right. And and to talk about it, we can't actually A lot about it. The reason why is because I was checking the response that we got from the government of of Denmark them themselves, right? And they didn't post it a lot, right? the worst thing of all is that ⁓ it's an attack that happened through September, and that's the worst, right? Through September. I don't know if it's September one or the last day of September, it's just September, right? Which is already the whole thing, yeah. Yeah. ⁓ so it happened through September. ⁓ they discovered that in October second. And they notified everyone on October fifth, so a couple of days ago, literally, as as we are recording a couple of days ago. the the interesting part in here is yes, the the in the past in the in this podcast we have talked about like ⁓ just trusting everyone in your connections, in your APIs, like this is a similar situation, right? It's a vendor and because of how this type of national systems work with ideas. So we have a similar thing in in here in Mexico. Where you have like your national ID. It's like your citizen citizen ID for like serial number. Yeah, your seri basically your serial number. Yeah. They didn't want you to put it that way. Yeah. But what happens is that other entities they want or they need to confirm your identity. Let's say a bank, right? Yeah. They do scan your fingerprints whenever you're doing some kind of like hey, I'm asking for a for a a loan for a house. Right. So I need to scan the fingerprints to make sure you are who you serve you are. And they connect to these national ID agencies and and be like, okay, I have serious allegedly, right? Is this him? And and they confirm it. Right. So it's it's kind of a good thing to have this ⁓ I mean good thing, you know, privacy and stuff. I I I don't want to get into that. ⁓ but it's it's ⁓ it's ⁓ kind of a good thing that you have this type of systems. Verify identities. ⁓ But because of their nature, you have several connections to other agencies. So yeah, they got an abuse through that. ⁓ Something that wasn't disclosed, but ⁓ my hypothesis is that ⁓ this third party was compromised and they leveraged that trusted connection to pull all of the data, right? But again, the problem is that we don't have a comparison comprehensive report. ⁓ it was estimated ⁓ close to nine million people registered. ⁓ it was interesting because it it is like persons that are alive, persons that are deceased, persons living outside of Denmark already. Like it it's a lot, right? Yeah. And it contains basically ⁓ all of their private information. So ⁓ as always I I think we saw it was a few weeks ago. ⁓ we saw the DMV attack in the US. Yeah. Yeah yeah. With they leak the the literal ⁓ scanning of the license. This is a similar situation, right? Like it doesn't have to be like a whole national ID organization. It is very similar to that, it's close to that, right? ⁓ an eight eight million versus a country that ha that doesn't have that many people, it's a lot. And that's the that's an important thing to remember how you mentioned it's a third party thing here, that you can be talking about one of the best security programs on Earth. Yes. And no one operates in a silo. So there's always going to be connections. And they make judgments based on what they're going to trust. And those companies make judgments based on what they're going to trust. And as there's going to be a gap somewhere. ⁓ and it's just, you know, that's that's that's how these attacks often happen. And so like the The instinct is like, well, w what's going on with the Danish government? Nothing. They were doing their thing. You know, it's it's it's it's these these third parties. I don't know if you square that or if the next step is fourth party or ninth party. I don't know. But at any rate, ⁓ that's that's the that's the path. That's it's impossible to cover every base. Right. And I I think that that's that's one of the major kind of pivot points in here, right? Like everything That third market is saying is it was an abuse of a lawful access. That's how they are discriminated. It's not an attack, it's not a breach, it's not a leak. It's a malicious abuse of a lawful access, right? Which is I don't know. From my perspective, but again, we have this perspective of us being in this side of the of the war, if you will. ⁓ I think I prefer it being an an an an actual attack instead of a ⁓ an abuse of like an access, right? It's kind of Yeah, that's a little semantic. Like it's not an attack. Okay. Well, I think what they're not saying or not publishing about it really tells us kind of everything we need to know about, you know, how this kind of took place. right. And it's it's like we talked about there's this void between to siloed security programs, ⁓ whether it's an independent contractor, consulting firm, auditor, third-party vendor, like every business is gonna have some sort of dependence or relationship with another vendor, another team. Maybe you've hired a contractor to do independent code. You know, we see it in GitHub or like all these random repos that people set up. And you know, you can only do so much as the service provider to ensure that people within your organization are compliant. ⁓ but what we kind of see a lot of times, which makes this a really rich like hunting ground, is there's no comprehensive security program where both sides or tables are coming to an agreement. ⁓ or if they are, we have seen that before in some more mature like organizations. And then someone still violates it anyway because it's faster to just embed the API key in a GitHub repo. Oops. They left it there. They stopped working on that project. You know. To be fair, I probably wasn't gonna get caught. Yeah. And and I think that's also ⁓ an interesting kind of I don't know if necessarily a question, but an interesting point Dylan brings, right? Like who should be reviewing these authorized connections? Who is responsible? You as the one authorizing the connection or the other one connecting to you to make sure it's a viable, secure channel, so they don't get because I I'm thinking right like with government. If I connect to the government, I would I want to make sure I am in compliance. I don't want to get a lawsuit from the government, right? Right. Right. So so I have certain degree of like worriness to make sure it's a secure connection. Like even if I get compromised, I want it to be protected. I don't want it to be like or which is again my hypothesis. I think that is what happened. ⁓ still waiting on Denmark to confirm or night or say nothing else, maybe? Maybe. Yeah. I don't know how much they have to say. Yeah. ⁓ but but also on on on on the then Denmark, ⁓ kind of were they aware that they have this level of access? Like to pull this level of sensitive information, like 8 million records through September, like a whole month? Like it's it's a lot, right? Maybe if it was like, hey, I detected like a few thousand and I pulled the plug pull yeah, and I pulled the plug and we are good. But no, it was ten million. I how many? I I think last I saw I think it was up to eleven million. It's like eleven million now, I think. Yeah. ⁓ it whole the the register holds eleven million records. ⁓ and Roughly eight million have been pulled out of there. So three million are AOK. And the population of Denmark is six million. So it's like, wow. They might have us. Yeah. ⁓ So the other thing I think about with this story is this is one of those things where ⁓ you know, your credit card info gets pulled and you can rotate that. Right. You can get a new credit card and they have that old info and it's worthless. This is like a permanent ID, like I mentioned, similar to a social security number, or like those things that are that are set in stone. This is like once it's out there, it's out there. And and I think that kind of changes the the severity of something like this. That that's 11 million people that just now have to live with that. I think it changes the severity, but it also changes the timeline drastically. Right. Like I dropped a credit card ⁓ like a while ago and within like an hour or two I got a fraud report for the first charge because it was an abnormal like purchase attempt, right? I rotate the card, it was fine. And then like I had peace of mind within like the hour. I was like, Great, cool, whatever. This is what it is. They mailed me a new card. but it definitely changes the scope of this incident, right? You can't just assign new numbers for what is it like eight eight point eight million people when it's tied to banking records, like you know, loans, housing. ⁓ it's tie I'm pretty sure like their medical, ⁓ it's required for like their medical cards and things like that too. ⁓ just think about all the things that you have to put your social security number down for in like an application for something like it's it's that. Yeah. Yeah. And it and they don't just give you a new social security number because, you know, you were in a breach. ⁓ you just have to live for life monitoring ⁓ and making sure no other shots or or Sergio's pop up. Yeah. ⁓ I used to work in banking and it's Yeah, that is a very real thing. People would come in for relatively routine things, and something weird would pop up and they get denied or something, and we look into it, and it's because of, you know, ten years ago someone got my social security number and did X, Y, and Z with it. And that's that's awful. Oof. You know what else is awful? This is how we transition. These AI reports that are coming into Google. ⁓ Google Had to at least temporarily stop accepting ⁓ bug bounty, stop the bug bounty program. ⁓ it's I'd love to say that it's because they found all the bugs and everything's fixed. But it's not. It's we talk about how AI is speeding up attackers, speeding up this, speeding up all that. It's speeding up people's Ability to report bugs to huge organizations like Google. and the problem is they are now getting so many AI-generated reports that ⁓ they're not able to deal with them fast enough. And most of them, not like just a significant portion, but like most of them are just junk reports. So it's not worth their time to actually spend. investigating these and dealing with them versus just, you know what, shut it down and we'll handle it. This this feels like a weird kind of moment for Google. ⁓ what do you what do you guys make of this? I think it was it was noisy already, right? There goes there goes your your your extra money on the weekends, right? That you guys were banking on. ⁓ I I guess from my perspective again, it's like it was already noisy. We already had like trash reports. We already had like all of the random cross head scriptings, all of the random like weak ciphers, all of the random, you know, PDP programs were already that noisy. ⁓ and and I guess everyone saw this coming. I bet we ⁓ we called this out in a lot of episodes. Again, we don't have anything against AI, but we we knew, right? Like We will see a ramp up in reporting and having to deal with that. ⁓ I'm wondering AI if if we are doing something similar like AI screening for AI generated reports, which is kind of a it will be kind of a paradoxical situation, right? AI detecting AI for sure. But yeah. The problem is the problem is not AI in my sp in my perspective. AI is great. The problem is that there's a it's it's how convenient is like twenty bucks a month, you get your AI. You don't need like being approved or anything to do like research. It's not like escaping the sandbox or anything, like very easy to hey, help me discern this information and you did do it really fast, right? Like there's like questi questions as simple as that. So it is it was expected. It is normal. I'm curious, I'm very intrigued by Google is one kind of stopping that, right? Like Google themselves, one of the big AI companies. You have some AI that can deal with this. Yeah. Correct. And maybe that's part of it too, is that they're using AI on their own situation to just say, you know what, you guys are all sending all these terrible AI reports. We've got decent enough AI we can just do this ourselves. Yeah. The amount of the amount of fake CDEs and bad bug reports I have had to read over the last several months thanks to AI. ⁓ yeah. This is what you get, Google. This is what you get. No. I think it just created yeah. Yeah. Welcome to my hell. I think it just is you know, it's come full circle, really. I am kind of shocked to see. ⁓ a very AI prominent and like AI forward leaning ⁓ company kind of just absolutely shell shocked like ⁓ we can't believe we've gotten this many reports and they're crap and it's like I don't know what you expected. You held open tryouts and you're complaining you're complaining about the people that showed up. Like I don't like no requirements. Well there you are, Riley. Yeah. Yeah. Yeah, and it's it's like ⁓ there has to be some sort of not like gatekeeping, but pre filtering requirements before a submission is even considered or hits your pipeline, right? Like I think human attention human attention and ⁓ like detailed research cycles need to be prioritized and we we have to respect and And vet our leads appropriately, right? So that we're not wasting cycles on garbage reports. ⁓ otherwise we're just creating another echo chamber. Yeah of crap, right? And I think the the I am not a robot captcha is enough. Yeah, my ⁓ my cloud skill my cloud skill handles all my captures. Amazing. Yeah, I mean it's it does. It feels like you guys kind of kind of put this incentive out there and gave them the tools to do this whole thing. ⁓ and you know, I mean, realistically, most people probably aren't using Gemini to do this, but it's it all kind of falls into the same bucket of like, well, yeah, I guess we did kind of go off the rails there a little bit. I'm also curious if this like Google like this isn't the first bug bounty program to close, right? Right. But I wonder if a giant like Google doing it maybe is like a a sort of a thing that people were waiting for at other places to say, well, if Google shutters theirs, I mean it doesn't look that bad if we shutter ours. ⁓ and there could be kind of a ripple effect with other large companies, not as big as Google, but you know, let it give it a couple of weeks and see what shakes out. I wouldn't be surprised if more more organizations do that. I mean like kind of joke or not joking, but that that that's great for us, right, as a business. That PDPs are are are closing down, right? Like ⁓ Anyways. Yeah. Like no, but serious seriously, right? Like one of the things we advocate for is like AI is fantastic. We use a lot of like AI documentation programs internally. But like we still pride ourselves on the craftsmanship and the human in the loop doing the actual like that that specific medication. Like what Lun say, right? Like let's let's Yeah, let's make better filters to like focus on the human Or priorities human based ⁓ reports and whatnot. Not necessarily human as in purely human, right? But human as in not just garbage, not just like the same report a thousand times because all of the scanners, all ⁓ everyone that is scanning the world isn't in the same side report, like you have ⁓ an outdated version of your TLS, right? Like brother, I don't care about that. Like give me something real. Yeah, I think I think the interesting thing too about AI and you know it's the easy it's the easy take of well AI lowers the barrier to entry, right? So you're gonna have more people doing this. But you have to remember that AI is also a tool and all it does is amplify the operator, right? So if you have a less qualified operator, they're going to submit slightly lower quality stuff, right? ⁓ versus if you have an operator there, how many prompts have you have you given to, you know, an LLM and it's been like, yeah, this is a vulnerability because of X, and Z. And then you go, that's not externally reachable. And they're like, you're right to correct me, or you are correct on pushing back. And it's like, yeah, because I know how this thing works, right? So you do still have to have like some semblance of knowledge about what you want to do. And while I will admit like AI can help get you there, you know, faster and it can increase your trajectory. ⁓ it really just creates this kind of imbalance in the ecosystem. So I think the real issue is that there's a a systemic problem with the way that we do traditional bug bounty or like VDP programs. ⁓ The initial premise was was based on the idea that we're gonna crowdsource this stuff because, you know, the research efforts to create this exploit or to ⁓ the resources to look into this and writing a report was roughly equivalent to the time to triage it, right? So now that we've applied this catalyst to one side, what kills me is that I'm not seeing a whole lot of people that are like. ⁓ we should also apply that to the other side. Or some sort of trickier to apply it to the other side. ⁓ I mean, I just I don't know. Yeah, I guess you really can't. I mean you can do whatever you want, right? But you can't in a sense because you cannot have the the triage part is the most critical part of ⁓ vulnerability, right? More now than ever, yeah. Yeah. And and just letting all your automation to the actual triage is like, well maybe you can augment your triage triage. I don't know what's called the triage. ⁓ But you can just let it run on its own, right? Because what the the what if you miss something? It's it's too big of a risk. Right? Like what if you miss what if you miss on an R C E that is a denial of service? Right? ⁓ what if that's the next Sir next big zero data you didn't pay it and now it's out there in the wild because an actor decided to pay twenty thousand bucks for that in the black market. And the operator that created it is super happy. Yeah. Right. ⁓ and I know, for example, I I don't know how companies like Hacker One are doing it, but I bet they have some certain automations because I I don't see them trying to slow down or or shut it down. They they actually have this new not new. Right. With our new validated automated accounts. Like they flag you like, hey, you are a an an auto an autonomous system, ⁓ that are importing. So they they surely have something. But I bet it's very private. ⁓ which is a good thing, right? If it works, it works. ⁓ and this could be a temporary thing where they kind of recalibrate and they do exactly what we're talking about and say, All right, boys Welcome back in, you know? ⁓ I I don't know. Honestly, I think a temporary pause in the short term is probably the more responsible angle here because what you what you've got right now is probably a handful of legitimate reports that are just buried right in trash. Right. And until you figure out a smart approach to clean that up and clear that up, I know Some people are probably gonna disagree, like, ⁓ no, you should still be accepting reports because like you're you're definitely still gonna get legitimate stuff in there. yes, but like to what to what effect, to what end? we're talking about Google here. If it's clearly overwhelming them, then like you know, what are what are our smaller security ⁓ teams and firms really up against? This really is in many ways a case study of of A it validates exactly what we're talking about, humans in the loop, like how important that is, and how yeah, everyone can scan, but you know, like like you said, Dylan, it it kind of multiplies, it amplifies the the skill level. And if if there's a lot of people with a negative skill level, you multiply that and you just have a bigger negative number, right? So so yeah, there's just a lot of of Garbage coming in and and yeah, it's it's you probably do just have to press pause. Yep. And clean house a little bit. ⁓ there's there's just too much too much going on. Re-evaluate. Yeah. No, there's there's a difference between pausing a program and stopping a program. ⁓ and they specifically state they're pausing the program, which to me means they're taking a knee, they're recovering, recouping, and they're probably gonna come back at this with a stronger posture and a better way to, you know, mature their organization and mature their program, which to me is why I lean towards this is the right responsible choice now, versus the other alternatives are completely turned off, which I think is a bad idea. ⁓ and then two, let the trash continue to flow, which I think is an even worse idea. Let the plane while flying sort of approach. So yeah, I I think it takes a mature organization to to realize that this the current iteration isn't what they thought it was. ⁓ and that they need to collectively pause it, sift through everything that they have and and reflect on real data, like real data points, not projected this, projected that, look at what they actually have and figure out, you know, the right way to proceed. And kind of a final remark on my end. ⁓ They are part or were part of Project Glass Wing with Anthropic with Mythos. They were. It's like Aren't you supposed to be really good at this, right? Like You got the tools. You got the tools. But anyway, maybe I I guess it makes the whole myth the whole Mythos class wing project look really bad, right? Is is this the company? Like Yeah, I know. But again, maybe it's they're pausing it because their own internal work is so good they don't need all this slop. It maybe it's it's probably a combination of all these things we're saying, you know, like it it just kind of adds up. So all right, well, we we often spend a lot of time on this show talking about people like Dylan and Sergio and ⁓ and the fine folks at At Google, who are very good at breaking things. But there's another question that we wanted to spend a little time on. How do you become one of these people? And ⁓ at Black Hat this year, I had the pleasure of meeting Andrew Crotty, better known as the Ginger Hacker, for reasons that will become apparent ⁓ in just a moment. ⁓ he runs the Ginger Hacker Initiative, a nonprofit built around helping students, veterans, Career changers and other newcomers find their way into cybersecurity through training, scholarships, mentorship, and community. So I invited him on the show for a longer conversation about getting into cybersecurity in 2026 and why, despite everything you hear about this talent shortage, breaking into the field can still be very hard. Here's that talk. Andrew, welcome to Initial Access. Thanks so much for joining us. Yeah, so glad to have you on and good to see you again, at least virtually. I know we got the talk at ⁓ Black Hat, so it's yeah, good to see you again. In our it this is our little virtual booth. Well, I think one of the reasons out of all those interviews I did there that I wanted to have you on the show was because we spend a lot of time talking about vulnerabilities and attackers and and cool new research and all that stuff's really important. But only if we're also investing in the next generation of people who are defending these systems. And that's really what you've been doing with Ginger Hacker Initiative. ⁓ you help students, veterans, career changers, all that kind of find their way into cybersecurity through whatever means, whether that's training or mentorship or both, you know, kind of a holistic community approach. ⁓ I guess before we get into the details of it. ⁓ why don't you give a little introduction into who you are and what it is you do? Yeah, well, hey everybody. Thank you so much for allowing me to come on the channel. And yeah, my name's Andrew Crawdy. I also go by the the handle of Ginger Hacker. And I've been in cyber for just under 10 years. My background goes into my prior days into the IT world where I was actually in law enforcement. I leveraged the military to kind of pivot into the cyber world, leveraging networking, training, great mentorship. And from those kind of fun trajectories, it got me to where I work today, where I work for the federal government doing cyber threat intelligence. ⁓ but on a real strong passion between that as well, I made this nonprofit called the Ginger Hacker Initiative where we partner with all the certification vendors and kind of made this awesome community to help kind of skill folks up to tackle that skill gap and kind of help folks kind of find their place, find their people that ask stupid questions and try to help them break into cyber. ⁓ you kind of mentioned it before there's this weird ⁓ Almost like Oodaloop it's like there's this huge job shortage, but there's not enough talent, but it's then so hard to get in. And you you're a great candidate, but you're missing one or two small skills where if you had those, maybe you would have ⁓ gotten that next round of interviews. So yeah, what the Ginger Hacker Initiative is doing is we're just helping by providing scholarships in a strong community to help folks find their people, get them in the right trajectory and ca ⁓ course of action to skill up, learn, and ⁓ share their knowledge with everyone trying to break in. Yeah. Yeah, that is that is true. That's some that's part of this that comes up from time to time is well, I shouldn't say from time to time, all the time, is this this kind of shortage. ⁓ and it is it's tricky, especially with AI changing the field of the changing the point of entry to cybersecurity. Like it kind of becomes difficult if you if you just graduate or you're or you're just getting started in cyber, the rules have changed. Five years ago, the entry point was different than it is now. and I think I think that's that's important work. ⁓ I I I kind of want to rewind, take it back to where it was that you kind of saw the Ginger Hacker Initiative as a necessity. Like where did that go from just kind of a hey, that'd be a neat idea to actually let's let's do this? Yeah, so two years ago. I got a great chance to donate some time with a good friend of mine, Josh Mason, who created a village community in DEF CON called Noob Village. And I met him from Simply Cyber, ⁓ from Simply Defensive with coming onto their podcast. And I heard he was kind of creating this kind of new villager group for the DEF CON community. And the target audience was exactly that. It was for noobs, which is for those that don't know, it's kind of a slang term. That's like if you're a beginner at something or super new at something and you're you're trying to learn it, you're considered a noob. And ⁓ but that we took it in like a a positive light saying, hey, look, like it's not a bad thing to be a noob. And we wanted to create a place or a community where folks could ask questions, do like a CTF-friendly capture the flag where we actually partnered them with like seasoned red teamers where if they had a question. A red team would come sit down with you and not give you the answer, but they'd actually sit down with you and actually walk through that process to do the CTF. We hadn't Ask Me Anything booth and we had we had such an amazing turnout at DEF CON. And I looked at Josh and I'm like, man, I need to do more and get back in the community. And so when I came back to Arizona where I'm based out of, I began kind of reaching out to a few nonprofits and I was kind of getting crickets because nonprofits are busy. It's a volunteer staff. And I mean, the amount of email traffic and things they kind of get through is a ton. So I said, you what? I can probably just get something going on my own. And so with my YouTube channel called Ginger Hacker, I went ahead and threw the initiative before and after, and the Ginger Hacker Initiative was kind of born. Yeah. And the thought process behind it was is it it's so easy to talk about change and wanting to do something. And usually the hardest part is like doing the thing. So And we all know within Cyber that yes, you can be an amazing pen tester, a compliance analyst, a sock analyst, a dev. You can completely be homegrown, self-taught, go through all the GitHubs, learn the YouTube Academy way. But at some point in time, you're gonna hit that paywall. And as we've been seeing the last few years, like certifications and trainings are getting more and more expensive. And at the end of the day, it's a business. Businesses have to adapt, change. There's inflation, they gotta make sure they pay the employees, update the material. But when I was seeing that security plus by itself was $500, I mean, when I was back in college, $500 could feed me for two months. Now it can feed me for two weeks. So I wanted to kind of create a a community and a nonprofit to where it's like, look, like I want to help folks have the right community, the right leverage, the right training to ask stupid questions, to Get these scholarships where we've all been there when we're trying to apply for a grant or a scholarship. It's so long, it's a six month process, it's super tedious. You don't know if you win it. Maybe you did and you missed the deadline. And I wanted to simplify that. And that's exactly what I did. I I relatively have a relatively quick and easy five-step process that gets someone in, applied. If we have the funding and grants to provide the training we do for the scholarship for actually certification. But even if we don't have the certification funding, we can actually still provide you the resources for free to actually still learn the thing. And that's kind of initially what I did. I did the hard job. I made nonprofit. I reached out to all my other kind of friends and colleagues and and peers that were all at our mid-level of our careers. And then we just did it and we made it happen. And yeah, ⁓ I think that's the aspect of coming back from DEF CON two years ago and just seeing the Amazing impact we had on that huge community. That's what kind of really made me turn the light switch on saying, hey, this is needed. There's still folks asking, not able to find their people, not find their community, not finding mentors. Let's let's go ahead and get this stood up. And yeah, we've seen nothing but huge success from those joining the Discord, watching the YouTube videos, joining our LinkedIn. And just getting to hear success stories of how they get their first certification or they get to meet link up with a really cool mentor they met from the Discord, where they get to have that quick five, fifteen minute conversation that's like, hey, it really got me on a good path trajectory of now what I need to do to be successful to get into X role. Yeah. Yeah. And it seems like you you mentioned, you know, it's part of it is resources. Part of it is, I think, a roadmap. It's a it's a big scary field. And and you building a framework that kind of says, Well, here's how you actually tackle it. And then not just building that framework, but also providing the mentorship. So it's like we've got a roadmap for you and guides all along the road. ⁓ I think that's that's huge, right? I I I joke only an out the analogy I'm gonna give like a World of Warcraft analogy because one Wow Forever something be coming out soon. It's like when you go to like the all the leveling guides and like I can give you the guide and show you how to do it and like, yeah, you just read this, here's this guide, you're all set. But not everyone thinks that way. And you could give me a book with all the answers and say, hey, all you gotta do is learn all this, learn these answers, and you'll break into cyber. That's not how some people learn. So the way I kind of took my community is like, yeah, I wanted to be able to have the all the different aptitudes and ways that folks learn, whether that's audio, physical, ⁓ reading books, jumping into small groups, having those good conversations, and being able to share those either successes or those losses. Cause let's let's face it, breaking into cyber is not As easy as it used to be, I'd say probably about eight to ten years ago. We are we hear and see so much now about all the rejections. Folks have been applying for six to eight months. They're still only getting two to three interviews. And so the methodology I kind of take is depending on when I get that initial entry question of hey, I want to break into cyber, it then comes down to like, ⁓ cool. Well, what do you want to be when you go up? Do you want to be a pen tester, a sock analyst, a GRC analyst? And then that's how we kind of direct them onto a specific path. That way they don't have 10 tabs open. Two audiobooks playing, a practice test going on on their phone, they're reading a comp to you book in their hand. You're describing my life. Yes. So and I I explain this to a lot of learners because let's face it, learning cybersecurity is drinking from a fire hose. That's the phrase we've used. It's a term and it's constantly evolving, it's constantly growing. So I try to take that step back with folks when they're just trying to over consume and I have them. Focus on like a top three list, they make a priority list, whether that's in word, physical pre pen and paper, and I have them kind of do a reset. Okay, let's take a step back. What are the top five priorities you need right now? And then let's focus on those rather than you trying to tackle an entire thing all in one. Cause you're you're getting overwhelmed, you're not obtaining the full information from it, and you're losing skills where it's like I had a great colleague of mine, he's sitting for Xinux Plus, Net Plus, and CYSA all at the same time. But he's taking all these practice tests, like, yeah, I'm just not doing really well on exam A and B. I'm like, well, yeah, man, because you're you're only absorbing a percentage of it because you're so scatterbrained on all the other two. I'm like, you need to focus on one of the time and then just go within that kind of proxy and within that procedural thinking. And I'm telling you to have more success. Yeah. Well, and I think, you know, you kind of mention ⁓ it providing these kind of resources and and And working with people in this way, getting them to focus, like I think the hacker mindset is a little different than the average person's mindset, right? And I'm that's that's not good, that's not bad, that's just you gotta think a little differently, right? And sometimes that doesn't necessarily jibe with consume everything all the time. Sometimes it really does require that kind of thing. What what would you say to that, to to kind of like how that mindset or how what what set of habits kind of tend to be associated with the the people who have success in this program? I I I would say it slightly differs because everyone learns differently, but then you look at the the pen tester, the hacker mindset, and it's usually a hey, why did this happen? And now I need to solve it and make it make sense to me. And specifically in the pen tester world, it's hey, how do I make it make sense to me? But now I also need to make this a business kind of paper report because it's awesome if it makes sense to you, but your your client or the person you're providing all your findings to is a completely separate person that has a different mindset of like what they want to see and do. So when I when I tell people that breaking into cyber is kind of a choose your own adventure and also one, all because you get a cool procedure of how something happens, that doesn't mean that's the SOP your standard operating procedure you have to stick with. Break it down and have it make sense to you. Cause especially in this neurodivergent world we live in in cyber where we all have that little tism, it has to make sense to you in order for you to be successful on it. When you try to just go with a certain processor, well, this is the process I was given. This is the robot I have to follow. That might not work for you. Right. I would say be curious, ask questions, and don't be afraid to break something down even further. Even if they say, hey, or here's a broken down version of it. Decipher it more and have that make sense to you to actually grow and make sure that everything you're learning makes sense. Yeah. Yeah. No, ⁓ you you mentioned a minute ago about like all these different certifications that everyone's chasing and you know, focus in, start small. I think I think it's safe to say no one goes from from from noob to expert overnight. Like you you chunk it out sort of. What ⁓ for for someone starting, what kind of certifications do you think are smart to start with? And how do those kind of fit into the bigger picture? Yeah, I'm gonna pick on I'm gonna pick on sock analysts, just being a blue teamer at heart. So that's where I kind like to ⁓ be a little selfish on because that's what can really talk on heavily compared to the GRC red teamer world. And for those trying to break into like the security world as a sock analyst. The you can never learn enough fundamentals. I can't emphasize that enough. And an analogy I'll give is like you'd never build a cat, you'd never build a house in the sand. It's not sturdy, it's not gonna hold, the house is gonna fall apart. So when you're trying to break into any range or field within cyber, and like I said, blue teaming specifically, we need to make sure we have a strong foundation. So the first golden certification I'm probably gonna have you learn and do ⁓ is one that's globally recognized is gonna be CompTecurity Plus. That's going to give you your acronyms. It's going to teach you your fundamentals. It's going to give you a good baseline as well to also kind of allow you to deviate of like which what part of cybersecurity do you like? Do you like the DLP portion of it portion of it? Vulnerability assessment or VAT, ⁓ back-end, front-end dev, purple teaming, sim engineering, creating the rules and detections within your SOAR. Those are the pieces of it I think that some folks don't understand where it's, I wanna break into cyber and they don't know the path they want to go. So they start getting all these certifications and not really having a path or process of like, ⁓ yeah, well, I want to get in the GRC, but I got my EJPT or my pen test plus. I'm like, well, why'd you get those if you're trying to get into compliance? So I I would argue that those aren't follow fully aligned with going into a policy aspect of it. So security plus would be the one. I would also then actually point them to probably either Blue Team level one, which the cool thing with these ones and same thing for Triacne's SOC Analyst Level One. It's not just a multiple choice question test. It actually throws you into an environment. You're writing commands, you're writing reports, you're doing the thing that these organizations are looking for on a job resume saying, Cool, we see you have the the knowledge base foundations, you have these certifications, which was a multiple choice test. But hey, we saw this other one that you said it was actually a practical exam. And those are the things and even your home labing and things like that that you can get into that I have folks saying, ⁓ yeah, I have this home lab and I've done all these projects. And they see unfortunately a poor job at describing all the things they learned onto a resume. Because if you just say I have a home lab, okay, well, that's great. But then I tell them to elaborate, and it's usually also a golden question that if it gets brought up on an interview, if you mention you have a home lab, they're gonna ask you to describe your home lab. And being able to decipher that from the ones and zeros of how you set it up, the tools you had to download, the struggles you faced with it, but were still able to troubleshoot and fix. Those are gonna actually carry more weight than the certifications. But those are those would be the kind of paths I would say when it comes into like as I mentioned, certifications are helping you get through the HR algorithm. They're they don't make the best analyst or the best pen tester. You can have every certification behind your name, but if you're not learning to do the thing or you're not learning all the stuff out of those certifications and then maintaining them, it's it's to me personally a waste of time. You have to make sure no matter what certification you go for, whether it's a completely globalized, recognized one, or maybe it's a free like Coursera Eugenymy One or a LinkedIn learning, but there's still really good golden nuggets out of it. That's what you have to take out of those trainings and courses and then translate onto a resume to showcase the skills and knowledge that you're learning from all this training that you're trying to do. Yeah. I I almost feel like it's like a a curation. thing too, where like when you look at someone's bookshelf, you can tell a lot about them or their their record collection or something. You can tell. And if it's just random mishmash of certifications and you don't see like what's the path? What's this person's specialty? ⁓ and not not saying that more certifications necessarily hurts, but like a really good collection of them can maybe tell a story as as well as your cover page can. Yeah, it's it's that it's that aspect of finding your niche because it's just like folks say they want to break into cybersecurity, especially young, young juniors that try to break in out of college, they're like, I want to get into cyber. But then it's just like, well, cool. Well, what are you trying to do? Because the the path directories and the training I'm going to recommend to you, the training I might tell someone to get into GRC compliance is completely separate than when I tell someone to get into pen testing. I might recommend them toward like burp sweep or n map or bloodhound or metasploit. But then on the GRC path, I'd be recommending all the frameworks going to NIST.org, Simply Cybers GRC mastery course, ⁓ ISCT squared GRC certification, CISA. Like those are gonna be completely different avenues and paths. But the thing that is hard is when you're preparing to break in and you don't know what you want to do, that's the hardest portion, I think, when it comes into trying to break in. And then that's where you're seeing this, this ⁓ Almost like a layout of like the someone has like eight certifications, but they're kind of all over the place. Yeah. And it's I think it's a it's one either due to a lack of knowledge and knowing what certification probably is beneficial for the role, or two, if they don't have a good mentor to talk to and ask those questions or hey, I want to get in the DRC, should I go take my EJPT? No, probably not. Probably not the best certification you need right now. You should get this one instead. And that's where that mentorship also really comes into play to help help these juniors kind of navigate into their path of Honing in their skill, getting the right skill sets to be the best candidate to get these roles. Yeah. Now I would be remiss, since this is a cybersecurity podcast, if I didn't bring up AI. So here we go. Buckle up. ⁓ we talk about AI attacks. And and one of the things that it does is it it clearly lowers the floor of ⁓ the the barrier of of entry for attackers. You know, we're always hearing about like huge attacks that are orchestrated by one person in the middle of nowhere that like years ago this would have been a nation state level thing. so it's it's changed that, but it has also come up in the news and I've got kids. I hear about it at school, like it has changed how we learn things. do you find that that is kind of Helping like lower the barrier to entry and ⁓ and giving more access to some of this stuff. Or do you think people are maybe leaning on it and not learning those fundamentals? ⁓ is or is that just a trap that you could fall into? It's a mixture of both. So I was actually having a great conversation of mine from a colleague of mine that's a SOC manager for a fintech organization. And a huge issue they're seeing right now is just everyone is using AI. And there's a joke that one of me and my colleagues says where it's like, yeah, man, I'm gonna kick you an email and ⁓ let me know what you think. And it's like it's just it's like two AIs having a conversation because like folks are regressing to using AI to do everything for them now, write emails, do analysis, write out summaries. And the personal piece of that coming from like the thought process of like doing deep analysis in the military, the the part that makes an an an analyst dangerous isn't the resources they find. It's their mindset and how they can link and assess their reports and their assessment to the things that they're seeing. When you're heavily relying on AI to do all the things for you and bluff your summaries, write your reports, parse through logs, yes, it's fantastic, it's faster, but it's that and it's the thing I can't emphasize enough, it's it's you're losing your fundamental skills. And not knowing how to index in Splunk, or not knowing how to write a query in CrowdStrike, or not learning how to write out your own bottom line up front or a bluff summary to a C suite level exec, and now just leveraging AI, hey AI, write this all for me. Like I could teach a high schooler to do that. Now, the thing that I think that the big fear of like AI is going take over jobs, the the pitch I say to that is it's not that AI is going to replace the analyst. It's that the AI that is leveraging AI To improve and expedite their work function, those are who are going to be replaced to those that can actually leverage AI to further their work and improve the metrics. So an example would be Jim and Sally. Sally refuses to use AI, she goes through everything manually, and she can only generate two to three reports a week. And then you have productive Bill, who is leveraging AI, still writing out his own reports. But is doubling or tripling those reports because he's just obviously being faster with having AI summarize things, scripting, and improving that process. If if there is a a left to right comparison, one would argue that Sally, unfortunately, is not performing to the team standard because the output of the rest of the team or Bill is three times the work. So if I then pull someone outside of school or inside that actually can leverage AI but still has the skill set and tools and fundamental knowledge. That is leveraging AI the same thing as Bill, you've now tripled your production. And unfortunately, Sally's now out of a job because she's not conforming to these new tool sets. So just like when Linux updates or ⁓ Sliver S ⁓ Sliver C2 or Metasploiter, we get all these new tools, the pen testers that learn these new tools to then enhance their work or script out their processes compared to the manual hacker that's doing it all by hand. It's obviously going to be a like a night and day comparison of who's getting further along in their pen test reports or their their studies or their work that they're doing because they're automating stuff. So that's my thoughts on it. The the over the over ar overarching thing is that you see like hugging face AI and all these other breaches that are happening as we're getting more and more pieces of it throughout the news. Is gee I I strongly believe that AI in the workplace is going to be more and if not already should be heavily Integrated within your GRC team and your policy organization. Because ideally, what these organizations are doing is AI is getting invented or invited into the workplace and they are doing sudo sue and they have access to everything, which is such a risk reward to some organizations. Yes, it can now see everything in your environment. Fantastic. But also negative, it can now see everything in your environment, which is also a negative. So Depending on the policies you're setting into place to allow these things to run, is very ri it's it's it's that it's that risk matrix that CISOs and leaderships have to really take into consideration where you see some organizations that are behind the AI power curve that are trying to play catch up because they're a little more conservative, and then compared to these other organizations that are spending millions, if not thousands of millions, ⁓ on AI tokens monthly. So that's the thoughts on AI. So we could probably have a whole nother kind of AI. I'm back in another fire video. Yeah. I do. I I think it's, you know, whatever field you're in, whether that's mathematics or ⁓ art or you know, cybersecurity, you know, it's a different use case for everything, right? ⁓ but I think the thing that always resonates with me is that idea of if you offload everything to AI and you're not monitoring and you're not learning those fundamentals, then you're not gonna have that light bulb moment that you need to have because you don't understand what it is that that AI is doing. If it's just doing routine tasks that you know like the back of your hand, okay. That's clearly a use case where it's it's gonna shine. ⁓ but yeah, yeah, that's I I I think about that in education. I worry about that in education with my kids. Like they see dad has ⁓ access to Claude and GPT. You you guys don't touch it. Not yet. So ⁓ I I imagine you talk to a decent amount of people because you you have you have students, you have career transitions, you have all sorts of people that that come to you for for this kind of help. what do you what do you think about like people that you talk to in their thirties, in their forties, or even beyond, ⁓ who feel like they maybe missed their chance? ⁓ but they want to get into cyber. What what kind of conversation do you have for someone like that? I tell ⁓ that it's I I'm a prime example of someone that did it late twenties, early thirties, that there's there's no gap of when you can't jump into this field. Because the thing I talk to hiring managers and recruiters on all the time and mentees and mentors that jump on that want to give more as well is it's not that they're looking for that young eighteen year old, twenty one year old hooded hacker that knows everything. There's so many different things that go into corpor like into to finding the best candidate, the best person for a role. And that's where I challenge folks where look, like whether you're 70 years old, which is pretty late in a career change, but hey, some people I've seen I've seen it happen. Or whether you're 18 or in your late 30s or early 40s and you're making this pivot, you need to make sure you stand out and you're you have to be the best candidate. And If you just have an individual resume that you're shooting out to the world like spaghetti throwing it on the wall to see what sticks, that's not what a best candidate's gonna do. You need to do your research, you need to figure out what roles are looking for. And this is where being part of a community like Hack Smarter, Simply Cyber, Ginger Hacker Initiative in our Discord, we have hiring managers, we have recruiters in there all the time. ⁓ I'm constantly asking, like, hey, because recruiters and hiring managers are talking and looking at roles all the time for fulfilling positions, we're getting folks into a role. I'll reach out to a monthly saying, hey, what are the top five things managers are looking for? And when you're doing that type of research, or if even you're looking across and scraping the job board, saying, okay, well, what does a junior pen tester need to know right now? Okay, they need to know Metaspoint. They need to know burp sweep. They need to know how to write reports. They need to know how to document. They need to know how to use Nmap. If I was a junior pen tester trying to break into that field, And I'm scraping and looking at like doing a 30-day study of okay, well, what's the number one tool or asset most organizations are looking for from a junior pen tester? And now I have all that data I can now kind of pivot my study progression toward. That's how I'm gonna actually go and be the best candidate. I'm gonna go learn the tools that are they're looking for. Maybe I'm gonna go look at those certifications that they they're the top five or three certifications I've been seeing on those job posts. That then when you're applying for these specific roles and you're checking all those boxes. That's what's gonna land you your interview. Not that you're 30, not that you're 18, not that you're 50. It's cause, hey, Jill Sl Jill being Sloan meets all of our requirements. He has these certifications, he's done all these projects, he's he's annotated the tools he's familiar with, he's explained to us in a relatively smooth and condensed manner on a one to two page resume that they know how to do the thing. They provided a GitHub repository. Look, they even provided a link to some YouTube videos of them. running Nmap scans on Hack the Box or try Hack Me and explaining their process analytically and systematically might be the best candidate we've seen so far. And that's what's gonna get someone in an interview compared to some eighteen year old that has their OSCP or some forty year old that has their CISSP. It's great you have the certifications, but as we mentioned before, just because you might be a certification bunny and have ten or twenty certifications upon your name doesn't mean you're the best fit for a role if you can't do the thing. Yeah. Yeah. So what I'm hearing is it's not it's not like the NBA where at a certain age your knees just aren't gonna cooperate. Like you can still do this. And there's so many Yeah, and that that is a joke, but it's it's true that there's like there's communities like this, there's tools out there that kind of just, you know, anyone can. ⁓ it's it's it's just cool to see that in action. ⁓ we were I'll add this because we were talking about Disney before we started recording. Yeah. And I'm I'm gonna reference Ratatouille to the Anyone can hack. Any anyone can cook, anyone can hack. Whether you're a script kitty or an or an APT, as long as you have dedication and you learn the skill, anyone can do this. It's just gonna take it's gonna take repetition. Yep. ⁓ so I would I guess I would I would I would wrap with I always like to kind of give a takeaway. So if anyone's listening to this right now and thinking, I didn't think I could do this, but it sounds like I could do this. This is this is what I need. ⁓ what's the best way for them to get involved? Getting involved and getting started with this is honestly just going to Google and running that first kind of Google search of like, hey, how do I break into fields you want to break into? SOC analysts, GRC, compliance, pen testing, and start doing research. Find your people. There's so many different ways, and you don't have to physically go meet people up at meetups. There's Discord communities, there's YouTube channels, there's GitHubs, there's Reddits. Find your people that you can ask those stupid questions to and not feel embarrassed about. Because you're gonna have questions while you're trying to make this pivot or trying to break in. And just be curious and don't be afraid to fail. Everyone's gonna tell you their stories, including myself, of how we applied over at a hundred some places and received many, a, many, a, many rejection letters. But the cool thing is it only takes one to get your journey started and for someone to give a chance on you breaking in and getting your first role. So yeah, just don't quit, be curious, and just ask for questions and yeah, find your people and then get started. Yeah. I I appreciate that you ⁓ continuously come back to you don't mind people asking you stupid questions because now I understand why you signed up for this podcast. No. ⁓ no, but it's true. It it's it's true. I think there's a lot of I've I've seen it in in people I've talked to that you get started in this industry and sometimes you are just in the presence of giants, it seems, you know, but like at some point everyone was a noob and someone helped them out. ⁓ so so yeah, don't don't be afraid. And I I would say also, you know, if you're getting started, join the Ginger Hacker Initiative Discord. Get on there and and get to it. You know, the hardest part of any project is just doing it, just starting it. So that's a great starting point. And if you're if you're looking to red team or pen test or something like that, join the Bishop Fox one too. Come on. How many servers can you be in? A lot, right? no, I I really appreciate you ⁓ spending the time to to come and and talk. through this a little bit. We really haven't gotten into this on the pod before, the kind of how do you actually get started? And I think it's really useful information for for a lot of people. So ⁓ I hope you find this useful out there. And yeah, we'll ⁓ we'll definitely stay in touch. Yeah. Awesome. Last thing I'll send off with is if you're already in your journey and you're finding another way to get back, be a mentor. Jump in a Discord. Yes. Offer mentor services. And don't be afraid to once again we're the Warcraft reference. Do some give someone a carry through some training. And be that be that peer that helps them understand something or kind of just give like five to fifteen minutes of your day. I know they'd very much appreciate it. All right. So with that, I'll ⁓ I'll end it with ⁓ for the horde. For the horde. Awesome. Thanks again to Andrew Cradi and of course to Sergio and Dylan for joining this week. If you are just getting into hacking, please stop by the Ginger Hacker Initiative's Discord server and have a look around. And then of course, if you want to have somewhere to talk shop, you can find us over on the Bishop Fox Discord server and at r slash bishopfox on Reddit. If you found this episode valuable, please share it with someone in your organization who also might. Thanks for listening. Stay safe and we will see you next week.