1 00:00:04,880 --> 00:00:08,039 Welcome to Crying Out Cloud, the podcast that will make you 2 00:00:08,039 --> 00:00:12,000 laugh, cry, and reconsider all of your cloud security fears. 3 00:00:12,400 --> 00:00:14,640 I'm Eden. I'm here with my amazing Co host 4 00:00:14,720 --> 00:00:16,720 Amitai. Hello. 5 00:00:17,360 --> 00:00:20,800 And today we have a super special guest, Eric Block. 6 00:00:20,800 --> 00:00:23,000 Welcome, Eric. Hi, appreciate you guys having 7 00:00:23,000 --> 00:00:25,080 me on. We're pumped to have you here. 8 00:00:25,080 --> 00:00:28,120 Where are you calling us from? I'm in the Bay Area here in 9 00:00:28,120 --> 00:00:30,400 California. Today was the first day of 10 00:00:30,400 --> 00:00:33,120 school for my kids so they were up pretty early running around 11 00:00:33,120 --> 00:00:34,440 and I had to get them out the door so. 12 00:00:34,880 --> 00:00:37,880 Nice, so you already had your natural pump of coffee. 13 00:00:38,320 --> 00:00:40,840 Oh yeah, I'm, I'm still working on my next cup here still. 14 00:00:41,200 --> 00:00:44,400 Love it. Eric is currently the VP of 15 00:00:44,400 --> 00:00:49,040 Security at Alumio, previously having held leadership positions 16 00:00:49,040 --> 00:00:52,200 across some of the largest tech companies he built and LED 17 00:00:52,200 --> 00:00:56,000 detection and response and security operation teams at 18 00:00:56,000 --> 00:00:58,800 Cisco, Salesforce, Atlassian, and Sprinkler. 19 00:00:59,280 --> 00:01:03,640 Eric also serves as an advisor on the BCV Cyber Leaders 20 00:01:03,640 --> 00:01:06,120 Advisory Board at Bain Capital Ventures. 21 00:01:06,840 --> 00:01:10,640 He has a wealth of knowledge and we're super excited to get to 22 00:01:10,880 --> 00:01:12,440 speak with him today. OK. 23 00:01:12,440 --> 00:01:17,240 So we like to do this thing when we have guests on while cloud 24 00:01:17,240 --> 00:01:21,040 confessions. Good to know you a bit. 25 00:01:21,200 --> 00:01:24,240 It's not as scary as it sounds. I've seen a few episodes so I'm 26 00:01:24,240 --> 00:01:25,160 I'm familiar with. Yeah. 27 00:01:25,160 --> 00:01:27,440 If you're familiar, can we ask you some questions? 28 00:01:28,160 --> 00:01:29,960 Sure, far away. OK. 29 00:01:29,960 --> 00:01:33,360 So you started out in a very unique corner of security, 30 00:01:33,360 --> 00:01:36,720 reverse engineering hardware in the military. 31 00:01:38,680 --> 00:01:41,680 How did that shape your perspective on the digital side 32 00:01:41,680 --> 00:01:43,560 of things later on in your career? 33 00:01:43,960 --> 00:01:47,480 You know, it, it was kind of my first foray into kind of what 34 00:01:47,480 --> 00:01:50,200 security was going to become way back then. 35 00:01:50,200 --> 00:01:52,680 I mean, I mean, not to, to date myself. 36 00:01:52,680 --> 00:01:55,160 I mean, this was in the early 1990s. 37 00:01:56,160 --> 00:01:59,240 You know, I joined the the military out of high school just 38 00:01:59,240 --> 00:02:02,280 in time for the the first Gulf War, right? 39 00:02:03,040 --> 00:02:06,200 And this is when the military was just starting to use 40 00:02:06,200 --> 00:02:08,039 computers. They were transitioning from, 41 00:02:08,039 --> 00:02:12,520 you know, paper forms to using, you know, 286 computers. 42 00:02:12,600 --> 00:02:17,080 And at the time, as we started to to modernize, the military 43 00:02:17,080 --> 00:02:20,480 assumed that, you know, a lot of our our friends and foes was 44 00:02:20,480 --> 00:02:24,520 hard to modernize as well. So it made sense to them to form 45 00:02:24,560 --> 00:02:27,520 a new branch of military intelligence called Technical 46 00:02:27,520 --> 00:02:32,120 Military Intelligence. And we work with special forces 47 00:02:32,120 --> 00:02:35,320 who went out and basically stole stuff from everyone, friends, 48 00:02:35,320 --> 00:02:38,000 foes, went to war zones, you know, wherever they could. 49 00:02:38,480 --> 00:02:40,520 And they stole stuff. And they brought it back to us 50 00:02:40,520 --> 00:02:42,600 at Aberdeen Proving Grounds in Maryland. 51 00:02:42,600 --> 00:02:45,320 And from there, they'd ask us to figure out kind of what it was 52 00:02:45,320 --> 00:02:47,000 if we hadn't, you know, seen it before. 53 00:02:48,160 --> 00:02:50,720 And that's where I kind of got my, you know, first taste of, 54 00:02:50,880 --> 00:02:53,240 you know, why we were doing this, the importance of it. 55 00:02:54,000 --> 00:02:56,320 That's also where I realized that we were pretty far ahead of 56 00:02:56,320 --> 00:02:59,360 everybody else. I mean, we're using 280-6386 57 00:02:59,480 --> 00:03:02,440 computers and the rest of the world was still using vacuum 58 00:03:02,440 --> 00:03:04,560 tubes. It's kind of what lit my fuse to 59 00:03:04,600 --> 00:03:06,160 to get me into security later on. 60 00:03:06,440 --> 00:03:10,600 So how was the transition from like working the more physical 61 00:03:10,600 --> 00:03:15,840 side to these more SAS security world like what was the most 62 00:03:15,840 --> 00:03:19,400 surprising or or unexpecting unexpected aspect of that for 63 00:03:19,400 --> 00:03:21,760 you I. Mean it was a gradual kind of 64 00:03:21,760 --> 00:03:25,520 transition, you know, coming out of, you know, you had a little 65 00:03:25,520 --> 00:03:29,000 286 base computer at home, then you started, you know, putting 66 00:03:29,000 --> 00:03:31,560 these things in your data centers and racks and whatever. 67 00:03:31,840 --> 00:03:33,840 And it started to slowly evolve over time. 68 00:03:33,840 --> 00:03:36,760 So I mean, I came out of, you know, the the early days of the 69 00:03:36,760 --> 00:03:39,720 Internet where we're running, you know, arc site networks with 70 00:03:39,720 --> 00:03:44,640 the mobile 312 systems running IPX protocols, you over coax 71 00:03:44,640 --> 00:03:47,840 cable and then it and it transition over to Ethernet 72 00:03:47,840 --> 00:03:50,000 using, you know, the conventional, you know, cables 73 00:03:50,000 --> 00:03:52,400 we have today. And then I saw all the, you 74 00:03:52,400 --> 00:03:55,480 know, the kind of the, the cloud for the spin up and people 75 00:03:55,480 --> 00:03:57,600 moving things to the cloud initially. 76 00:03:58,800 --> 00:04:01,560 And then from there it kind of made sense to, you know, go from 77 00:04:01,560 --> 00:04:03,800 having your enterprise software, you deployed a, you know, a 78 00:04:03,800 --> 00:04:07,200 giant monolithic thing that you'd buy to offering as a 79 00:04:07,200 --> 00:04:08,960 service. And so I kind of watched the 80 00:04:08,960 --> 00:04:11,920 transition from, I mean, that the early days to where we're at 81 00:04:11,920 --> 00:04:14,440 today, where everything's SAS. And now I'm watching kind of AI 82 00:04:14,440 --> 00:04:17,600 eat that kind of market and we'll see what's left of SAS, 83 00:04:17,600 --> 00:04:21,360 you know, in, in 5 or 10 years. But it's been really interesting 84 00:04:21,360 --> 00:04:23,480 to kind of, you know, see the progression of it all. 85 00:04:23,760 --> 00:04:27,760 As a motorcycle enthusiast, why Ducatis? 86 00:04:28,120 --> 00:04:29,920 When I lived up in the mountains, I used to ride dirt 87 00:04:29,920 --> 00:04:32,280 bikes all the time. You know, they were cheap. 88 00:04:32,280 --> 00:04:34,240 You could throw them around. You know, they were they were 89 00:04:34,240 --> 00:04:37,400 pretty fun that in my biking when I moved back to the Bay 90 00:04:37,400 --> 00:04:41,040 Area here when I got, you know, called back to the office for 91 00:04:41,080 --> 00:04:46,000 for Salesforce, you know, obviously being in the city, you 92 00:04:46,000 --> 00:04:48,160 don't have those opportunities available. 93 00:04:48,800 --> 00:04:52,920 So I transitioned to riding a street bike to kind of commute 94 00:04:52,920 --> 00:04:55,320 to work is far faster than sitting in a car for, you know, 95 00:04:55,320 --> 00:04:57,320 an hour, hour and a half for anyone who's in the Bay Area. 96 00:04:58,600 --> 00:05:01,120 And so I just, yeah, I appreciated the the look of the 97 00:05:01,120 --> 00:05:03,520 bike, the sound of the bike and kind of the culture that goes 98 00:05:03,520 --> 00:05:05,680 along with it. I'm trying to figure out what 99 00:05:05,680 --> 00:05:07,920 what those things are on your shelf behind you. 100 00:05:07,920 --> 00:05:10,880 Are those planes or those are those paintball guns? 101 00:05:11,160 --> 00:05:14,440 Yeah, those are those are are paintball markers back here 102 00:05:15,400 --> 00:05:19,280 ranging from this. This blue one is from 1998. 103 00:05:20,080 --> 00:05:26,400 This is from 2006, 2009, 2011. It's back from my from my days 104 00:05:26,400 --> 00:05:27,800 when I used to play professional paintball. 105 00:05:28,560 --> 00:05:31,480 OK, last question. This is a classic. 106 00:05:32,040 --> 00:05:35,680 You are a vulnerability. Which type would you be and why? 107 00:05:37,200 --> 00:05:41,600 Man, I'm trying to think of like what is like the the lamest 108 00:05:41,600 --> 00:05:45,280 vulnerability out there That'd probably that'd. 109 00:05:45,720 --> 00:05:48,320 Probably be me. I'm thinking of like an old 110 00:05:48,320 --> 00:05:52,920 like, you know, back in like the late 90s when they used to ship, 111 00:05:53,000 --> 00:05:56,400 you know, Linux distros with like default passwords for your 112 00:05:56,400 --> 00:05:59,640 printer demons or whatnot. That'd probably be me like some. 113 00:06:00,480 --> 00:06:03,520 You could be like the OG bug, you could be like the the bug 114 00:06:03,520 --> 00:06:06,600 the moth in the mainframe. Yeah, it's whatever is some, 115 00:06:06,600 --> 00:06:09,480 some service or some account got shipped out-of-the-box that was 116 00:06:09,520 --> 00:06:12,080 on with a default password. Everybody knew, you know, or 117 00:06:12,080 --> 00:06:14,360 there was the fault service that was on with no password, you 118 00:06:14,360 --> 00:06:17,120 know, that'd be me. You killed it in cloud 119 00:06:17,120 --> 00:06:20,000 confessions. We're on to the big the big 120 00:06:20,000 --> 00:06:20,800 questions. Uh. 121 00:06:21,080 --> 00:06:25,280 Oh, OK. Let's start by talking about 122 00:06:25,280 --> 00:06:29,160 metrics. I think something that's really 123 00:06:29,160 --> 00:06:32,040 important is how security leaders translate risk into 124 00:06:32,040 --> 00:06:35,960 business language, and it's not so easily done. 125 00:06:37,080 --> 00:06:39,040 How do you translate it to dollars? 126 00:06:39,040 --> 00:06:44,760 Can you speak to like concrete data points or frameworks or 127 00:06:45,040 --> 00:06:48,120 mechanisms you've seen work well in doing this? 128 00:06:49,520 --> 00:06:53,760 I'm sure metrics is something that I've put a lot of time into 129 00:06:53,760 --> 00:06:56,920 thinking about here. You know, the last, you know, 130 00:06:56,960 --> 00:07:02,040 since 2015 or so, I guess last 10 years, I got a, a really good 131 00:07:02,040 --> 00:07:05,640 kind of front row seat into kind of how this stuff works. 132 00:07:05,640 --> 00:07:07,640 When I was at Salesforce, when they were building up the team 133 00:07:07,640 --> 00:07:12,160 there, when I first started, the security team was about 200 and 134 00:07:12,160 --> 00:07:14,640 2050 people or so. And when I left it was 2000 135 00:07:14,640 --> 00:07:16,800 people. So it grew, you know, 136 00:07:16,880 --> 00:07:20,200 exponentially. And I kind of watched our senior 137 00:07:20,200 --> 00:07:23,720 leaders, you know, the CSO and, and the, the SVPS there 138 00:07:24,000 --> 00:07:26,080 struggled to keep their hands kind of wrapped around 139 00:07:26,080 --> 00:07:29,600 everything was going on. So they rolled out a, a, a huge 140 00:07:29,600 --> 00:07:33,680 metrics program across our entire organization to help them 141 00:07:33,680 --> 00:07:37,600 kind of measure these things. And one of the one of the things 142 00:07:37,600 --> 00:07:40,080 I took away from that and I've kind of brought to my last few 143 00:07:40,080 --> 00:07:45,400 roles here too, is, you know, how critical metrics are in kind 144 00:07:45,400 --> 00:07:48,720 of showing kind of what the what the outcomes are you're 145 00:07:48,720 --> 00:07:52,120 delivering to the business. And also framing the metrics in 146 00:07:52,120 --> 00:07:56,080 a way where whoever looks at them, like hopefully just these 147 00:07:56,080 --> 00:07:58,400 metrics are targeted at somebody, you're making them for 148 00:07:58,400 --> 00:08:02,040 somebody to consume. And these metrics either have to 149 00:08:02,800 --> 00:08:05,960 give them enough information to be able to ask the next question 150 00:08:06,520 --> 00:08:09,840 or they have to be actionable where I can see this metric and 151 00:08:09,840 --> 00:08:11,440 I have a choice of doing you A or B. 152 00:08:12,560 --> 00:08:16,200 If they don't lead to that next question or next decision or 153 00:08:16,200 --> 00:08:18,680 they're not leading to a pivot point where you make a decision, 154 00:08:19,960 --> 00:08:22,000 they're not really providing any value to anybody. 155 00:08:22,000 --> 00:08:24,120 I mean, there are some metrics, you know, like, oh, you know, 156 00:08:24,120 --> 00:08:26,520 how many, you know, widgets do we have or you know, how many 157 00:08:26,520 --> 00:08:31,200 things happened that that will be useful to feed into those 158 00:08:31,240 --> 00:08:32,960 part of a metrics. So you have to collect those 159 00:08:32,960 --> 00:08:34,000 things. So I'm not saying all those 160 00:08:34,000 --> 00:08:37,240 metrics are, are worthless, but as far as you know what, what's 161 00:08:37,240 --> 00:08:39,799 actionable and what's not, what do you want to show to your 162 00:08:39,799 --> 00:08:41,799 executives? And what don't you want to show 163 00:08:41,799 --> 00:08:45,560 your executives any things that again, will either lead them to 164 00:08:45,560 --> 00:08:48,080 asking the next question or making the next decision. 165 00:08:48,200 --> 00:08:52,920 At my last role, my sock team was buried in alerts and they 166 00:08:52,920 --> 00:08:55,600 were all burning out and I had a couple guys disability. 167 00:08:56,040 --> 00:08:59,040 I went to my CSO and I said, Oh my God, I need help. 168 00:08:59,040 --> 00:08:59,960 He's like, you know what's wrong? 169 00:08:59,960 --> 00:09:05,000 And I'm like, my, my team worked 2000 incidents last month and 170 00:09:05,000 --> 00:09:07,600 the CSO kind of sat back in his chair for a second, looked at me 171 00:09:07,600 --> 00:09:11,080 and goes, Eric, like, I don't know if I should promote you or 172 00:09:11,080 --> 00:09:13,160 fire you. What does that mean? 173 00:09:13,720 --> 00:09:15,680 Like I've no 2000. What does that mean? 174 00:09:15,800 --> 00:09:17,440 Right. And then I realized I was part 175 00:09:17,440 --> 00:09:21,080 of the problem where I'm giving him information to to me, it 176 00:09:21,080 --> 00:09:22,880 seemed relevant. I'm like, Hey, there's 2000s a 177 00:09:22,880 --> 00:09:24,280 lot. You know, I got a team of, you 178 00:09:24,280 --> 00:09:27,360 know, X amount of people. Tim, it meant nothing because he 179 00:09:27,360 --> 00:09:29,960 didn't have the insects or the the context or insights and what 180 00:09:29,960 --> 00:09:31,920 it means. And so I had to figure out, you 181 00:09:31,920 --> 00:09:34,960 know, how do I make this data actionable where I can give him 182 00:09:34,960 --> 00:09:37,800 a clear decision path? And so I went back and started 183 00:09:37,800 --> 00:09:41,080 measuring like like engineering teams do, measuring my team's 184 00:09:41,080 --> 00:09:43,520 capacity, how much work can they do? 185 00:09:43,520 --> 00:09:46,320 How many people do I have and how much work are they doing? 186 00:09:47,320 --> 00:09:50,480 Once I measured my capacity, I could actually show that my team 187 00:09:50,720 --> 00:09:54,680 on a day-to-day basis was being leveraged between 130 to 200% of 188 00:09:54,680 --> 00:09:58,720 capacity every day. From there, from there, I was a 189 00:09:58,720 --> 00:10:01,840 clear decision point. If your team's over capacity, 190 00:10:02,080 --> 00:10:05,120 you have two choices. You can either add resources or 191 00:10:05,280 --> 00:10:06,840 reduce the work. It armed him with the 192 00:10:06,840 --> 00:10:09,080 information he needed to make the next decision of what do I 193 00:10:09,080 --> 00:10:11,720 do to help support him. And again, it's thinking about, 194 00:10:11,760 --> 00:10:15,280 you know, who wants to consume that and what action is it that 195 00:10:15,280 --> 00:10:17,080 they, you want to drive off of that? 196 00:10:17,760 --> 00:10:20,520 And that bubbles all the way to, you know, talking about budget 197 00:10:20,520 --> 00:10:22,600 numbers and doing kind of road map for the year. 198 00:10:22,600 --> 00:10:25,520 You know, I'm looking at, you know, what are the, what are the 199 00:10:25,520 --> 00:10:27,080 company's initiatives for next year? 200 00:10:27,240 --> 00:10:29,480 You know, what are the numbers and goals you want to hit? 201 00:10:29,480 --> 00:10:31,880 How many customers are going on board, what products we're going 202 00:10:31,880 --> 00:10:33,560 to launch, what cloud environments we're going to go 203 00:10:33,560 --> 00:10:36,760 into? How do I align my team to help 204 00:10:36,760 --> 00:10:39,360 facilitate and support those business outcomes they want to 205 00:10:39,360 --> 00:10:42,720 drive? And then tying my wagon to that 206 00:10:43,880 --> 00:10:46,760 and saying, hey, look, if you want to do XY and Z in business, 207 00:10:47,040 --> 00:10:49,240 I need AB and C to support you. Yeah. 208 00:10:49,240 --> 00:10:52,800 Also, I think a lot of the time it has to translate to dollars, 209 00:10:52,800 --> 00:10:54,000 right? Because at a certain point you 210 00:10:54,000 --> 00:10:57,680 need budget. And there's a phrase you 211 00:10:58,440 --> 00:11:01,760 mentioned, I think, in something you wrote about the security 212 00:11:01,760 --> 00:11:05,480 poverty line. And I think it'd be interesting 213 00:11:05,480 --> 00:11:08,920 to hear you speak a little bit about how organizations above 214 00:11:09,240 --> 00:11:12,320 that poverty line optimize effectively and those below it 215 00:11:12,320 --> 00:11:15,080 are still able to be resilient and effective. 216 00:11:16,480 --> 00:11:19,400 Well, it's, it's kind of a loaded question because I know 217 00:11:19,400 --> 00:11:22,600 there, there are strong opinions about the security poverty line. 218 00:11:22,600 --> 00:11:26,720 It doesn't exist, First off. And you kind of what are the 219 00:11:26,720 --> 00:11:31,080 impacts of it, You know, having been at both, you know, your 220 00:11:31,080 --> 00:11:33,520 fortune ones all the way down to, you know, seed state 221 00:11:33,520 --> 00:11:35,280 startups. I can definitely say from my 222 00:11:35,280 --> 00:11:38,640 experience, there is a, a line, you know, it's kind of fuzzy 223 00:11:38,640 --> 00:11:41,280 where it's at because it kind of depends company by company. 224 00:11:41,880 --> 00:11:44,000 You know, like I got a, you know, kind of a front row seat 225 00:11:44,000 --> 00:11:47,240 when I was at Cisco and at Salesforce where we've had blank 226 00:11:47,240 --> 00:11:48,960 checks. I mean, you know, it's all if 227 00:11:48,960 --> 00:11:51,920 you justify the thing, we had the money to do it again, the 228 00:11:51,920 --> 00:11:56,200 Salesforce going from 250 people to over 2000 people, you know, 229 00:11:56,200 --> 00:12:00,280 in just a matter of, you know, 3 1/2 years, that's blank check as 230 00:12:00,280 --> 00:12:03,760 fast as we could do the things we were doing them like hiring 231 00:12:03,760 --> 00:12:08,000 people, you know, you know, bringing people on board was was 232 00:12:08,000 --> 00:12:10,280 tough. Bringing things up to speed 233 00:12:10,280 --> 00:12:13,560 quickly. I mean, our time became our most 234 00:12:13,960 --> 00:12:15,600 valuable commodity. Was it money? 235 00:12:15,640 --> 00:12:17,760 The same thing at Cisco, we're rolling out, you know, in the 236 00:12:17,760 --> 00:12:20,480 early days, we have the largest idea sensor network in the whole 237 00:12:20,480 --> 00:12:22,280 world. You know, time was our most 238 00:12:22,280 --> 00:12:26,320 critical resource. It wasn't money versus other 239 00:12:26,320 --> 00:12:31,680 places I've been where, you know, you didn't have the the 240 00:12:31,680 --> 00:12:33,360 budget of the money. You had to kind of ruthlessly 241 00:12:33,360 --> 00:12:35,080 choose like, what are we going to do? 242 00:12:35,080 --> 00:12:37,640 What do I think will make the most impact because I can't do 243 00:12:37,640 --> 00:12:41,320 all the things, you know, you know, do I, do you know, IAM or 244 00:12:41,320 --> 00:12:44,200 do I do DLP? You know, how much money should 245 00:12:44,200 --> 00:12:47,360 I invest in my application security program versus my 246 00:12:47,360 --> 00:12:49,680 operational kind of operational teams? 247 00:12:50,200 --> 00:12:53,680 It all comes down to being a trade off and kind of you're 248 00:12:53,680 --> 00:12:55,800 doing kind of, you know, calculated gambles because you 249 00:12:55,800 --> 00:12:57,800 know, you can't cover all the things, you know, you're not 250 00:12:57,840 --> 00:12:59,200 going to have all your bases covered. 251 00:12:59,560 --> 00:13:02,480 And so you're trying to do your best, you know, via whatever 252 00:13:02,480 --> 00:13:05,200 data you have or your kind of your gut feelings of what you 253 00:13:05,200 --> 00:13:07,840 should cover. And again, the disparity is, is 254 00:13:07,840 --> 00:13:09,600 huge. A lot of the, a lot of the 255 00:13:11,080 --> 00:13:14,040 frameworks that are out there are kind of designed around 256 00:13:14,040 --> 00:13:16,800 larger companies where they assume you can do the things, 257 00:13:17,240 --> 00:13:20,200 you know, and I hear it, I heard a lot from, you know, especially 258 00:13:20,200 --> 00:13:22,080 people that are making the frameworks, everything from this 259 00:13:22,080 --> 00:13:24,240 to miter. I'm like, no, I can't do that. 260 00:13:24,560 --> 00:13:26,800 Actually, right now your, your framework is becoming a 261 00:13:26,800 --> 00:13:30,480 distraction to me because I'm having ruthlessly prioritize XY 262 00:13:30,480 --> 00:13:33,160 and Z, you know, a / B and this and that. 263 00:13:33,560 --> 00:13:36,440 And I have people coming in, hey, how, how is your coverage 264 00:13:36,440 --> 00:13:38,760 of this framework? And I'm like, doesn't really 265 00:13:38,760 --> 00:13:40,440 apply to Louis because we're too small. 266 00:13:40,560 --> 00:13:44,080 And you having worked and having runs through operations teams 267 00:13:44,080 --> 00:13:47,040 for various sized companies, you know, one of the things I, I, I 268 00:13:47,040 --> 00:13:50,600 saw from that is, you know, while the inputs are very 269 00:13:50,600 --> 00:13:52,920 similar and the outputs are very similar, you kind of how the 270 00:13:52,920 --> 00:13:55,920 sausage is made in between is vastly different. 271 00:13:56,040 --> 00:14:01,040 Every company does it completely different, even though again, 272 00:14:01,080 --> 00:14:03,840 the outcomes are the same, like you've resolved the incident if 273 00:14:03,880 --> 00:14:05,760 you you've fixed the thing, whatever it is. 274 00:14:06,200 --> 00:14:09,320 How they get from A to B varies wildly. 275 00:14:09,600 --> 00:14:13,640 And that comes down to kind of what, you know, what sector are 276 00:14:13,640 --> 00:14:18,200 you in and how much budget do you have, which again, the 277 00:14:18,200 --> 00:14:21,320 budget drives a lot of things. And if you're above the security 278 00:14:21,320 --> 00:14:24,400 poverty line, like you have things like, you know, threat 279 00:14:24,400 --> 00:14:27,400 intelligence and threat hunters and you have all the all the 280 00:14:27,400 --> 00:14:30,120 latest shiny objects, you have teams, you have your own data 281 00:14:30,120 --> 00:14:33,640 science teams building things, you know, versus below the 282 00:14:33,640 --> 00:14:36,360 poverty line, like you're buying whatever vendor you can afford. 283 00:14:36,360 --> 00:14:39,400 And hopefully it covers as many of the boxes you need to check 284 00:14:39,400 --> 00:14:41,440 as possible. And for the things that you 285 00:14:41,440 --> 00:14:43,960 don't, you just kind of cross your fingers and, you know, hope 286 00:14:43,960 --> 00:14:46,080 for the best. I wonder if there are customer 287 00:14:46,120 --> 00:14:49,800 like companies that make very extreme decisions just because 288 00:14:49,800 --> 00:14:54,480 they specifically because they can't afford to do, they can't 289 00:14:54,480 --> 00:14:55,680 afford to deal with the consequences. 290 00:14:55,680 --> 00:14:59,040 Like like just to, to give an extreme example, they might say, 291 00:14:59,320 --> 00:15:02,960 you know, we don't use laptops because, you know, we can't 292 00:15:02,960 --> 00:15:07,400 afford endpoint security, which I guess like in and under and 293 00:15:07,400 --> 00:15:10,600 under very extreme and very unique circumstances that might 294 00:15:10,800 --> 00:15:14,360 make sense. You know, like, you know, we 295 00:15:14,360 --> 00:15:18,360 think we only use phones or we only use typewriters, but I 296 00:15:18,360 --> 00:15:20,920 guess that would start harming the business at some point. 297 00:15:21,280 --> 00:15:22,960 Yeah. I mean, you still be able to do 298 00:15:22,960 --> 00:15:26,880 business, right? But I've been places where, hey, 299 00:15:26,880 --> 00:15:29,920 we need endpoint protection for our systems in the cloud for PCI 300 00:15:29,920 --> 00:15:33,440 and they're like, hey, you know, use clam AV or some free thing, 301 00:15:33,440 --> 00:15:35,160 right? I'm like, isn't that a virus? 302 00:15:35,160 --> 00:15:36,920 Like, Are you sure you don't want to install that? 303 00:15:38,080 --> 00:15:40,800 Anything you check the box, anything to, you know, not 304 00:15:41,200 --> 00:15:44,440 provide more funding at the same time telling you to just go 305 00:15:44,440 --> 00:15:47,240 figure it out, you know, or kind of fudge things, whatever. 306 00:15:47,520 --> 00:15:50,280 While the smaller environments can be fun because you do have 307 00:15:50,280 --> 00:15:52,680 the, you know, kind of the wiggle room, you can also be 308 00:15:52,680 --> 00:15:56,480 kind of stressful as well versus, you know, a large 309 00:15:56,480 --> 00:15:59,440 company where you can do all the things and you're probably doing 310 00:15:59,440 --> 00:16:02,960 most of them correctly. At the same time, you're at a 311 00:16:02,960 --> 00:16:05,040 big company and you're kind of locked into, you know, how they 312 00:16:05,040 --> 00:16:07,040 do things and you're in your lane and that's about it. 313 00:16:07,040 --> 00:16:10,120 So, you know, there's trade-offs on both sides, so. 314 00:16:10,440 --> 00:16:14,400 I think one of the things that exists in in most big companies 315 00:16:14,400 --> 00:16:18,160 and I think it's become sort of a household name over the years 316 00:16:18,680 --> 00:16:22,880 is soccer team. And a few years ago, I think you 317 00:16:23,440 --> 00:16:26,680 you sort of declared the sock was deceased. 318 00:16:28,480 --> 00:16:31,280 So do you think that that still holds true today? 319 00:16:31,280 --> 00:16:33,680 Have we resurrected the sock somehow? 320 00:16:33,680 --> 00:16:36,760 Is it is it somehow on life support? 321 00:16:37,720 --> 00:16:39,920 Like it looks like socks still exist. 322 00:16:40,720 --> 00:16:43,720 Have they changed enough to still be relevant in your eyes? 323 00:16:44,520 --> 00:16:47,080 What do you think? Yeah, Also just to jump in on 324 00:16:47,080 --> 00:16:51,400 that, like also with the rise of AI, has it doubled down on its 325 00:16:51,400 --> 00:16:54,240 death or is it giving it a new chance at life? 326 00:16:54,400 --> 00:16:57,200 It's kind of a loaded question. So first I I kind of break this 327 00:16:57,200 --> 00:16:59,080 into two worlds. There's kind of the enterprise 328 00:16:59,080 --> 00:17:01,960 world and then there's the, the kind of the managed service 329 00:17:01,960 --> 00:17:04,079 provider world. You know, the MSS PS of the 330 00:17:04,079 --> 00:17:07,119 world who have their managed socks, even when they're both 331 00:17:07,119 --> 00:17:10,240 called socks for the operation centers, how they operate is 332 00:17:10,240 --> 00:17:15,359 vastly different in the world. And so when I refer to kind of 333 00:17:15,359 --> 00:17:18,359 the, the death of the sock, I'm, I'm kind of referring to 334 00:17:18,440 --> 00:17:22,079 enterprises, tech companies versus demand service providers 335 00:17:22,599 --> 00:17:26,920 in, in enterprises. It used to be very similar to 336 00:17:27,280 --> 00:17:29,840 MSSP to be a giant room with a bunch of screens in it. 337 00:17:29,880 --> 00:17:31,840 You know, kind of came out of the knock world. 338 00:17:31,840 --> 00:17:35,680 We just kind of cloned it. It was a, a physical location 339 00:17:35,680 --> 00:17:39,120 where people were at looking behind screens, You know, as 340 00:17:39,120 --> 00:17:42,960 kind of the, the rise of SAS has come around and the way we are 341 00:17:42,960 --> 00:17:45,040 able to kind of distribute our teams anymore. 342 00:17:46,160 --> 00:17:49,200 You know, first I was kind of pushing for a distributed model, 343 00:17:49,200 --> 00:17:51,400 which kind of made sense. Everyone else was distributed. 344 00:17:51,400 --> 00:17:54,200 Why should a sock have to be a physical place anymore? 345 00:17:55,440 --> 00:17:58,520 And now I've kind of changed a little bit to saying, hey, look, 346 00:17:59,680 --> 00:18:03,880 the sock is no longer a noun. It's a verb, it's an action, 347 00:18:04,320 --> 00:18:07,480 It's a capability, right? In my last couple roles, 348 00:18:07,480 --> 00:18:10,440 wherever I had my kind of SoC function, which is kind of like 349 00:18:10,440 --> 00:18:13,760 your, your Tier 1 triage functions, your 24/7. 350 00:18:13,760 --> 00:18:16,160 It's kind of like the security is equivalent to an IT help 351 00:18:16,160 --> 00:18:18,640 desk. And it doesn't matter where in 352 00:18:18,640 --> 00:18:20,480 the world that's at. If you think about the IT help 353 00:18:20,480 --> 00:18:22,680 desk, if you open a ticket with IT help desk because whatever 354 00:18:22,680 --> 00:18:24,320 your VPN is broken, whatever it is, right? 355 00:18:24,560 --> 00:18:26,600 You don't care where they're at all you want your problems 356 00:18:26,600 --> 00:18:28,600 fixed. Or if you're having one Slack, 357 00:18:28,600 --> 00:18:29,440 right? You don't care where in the 358 00:18:29,440 --> 00:18:31,680 world they're at as long as your problem gets fixed. 359 00:18:32,120 --> 00:18:36,440 And these kind of tier one teams are the kind of the same thing 360 00:18:36,440 --> 00:18:39,760 for enterprises because you've actually look at all the things 361 00:18:39,760 --> 00:18:42,080 that these SoC teams do for enterprises. 362 00:18:42,440 --> 00:18:45,520 Only about half of their work is actually dealing with alerts 363 00:18:45,520 --> 00:18:48,400 generated from security tools. The other half of the work they 364 00:18:48,400 --> 00:18:51,960 do is dealing with people, you know, if you have a, you know, 365 00:18:52,080 --> 00:18:54,240 help security channel on Slack or if you have a ticketing 366 00:18:54,240 --> 00:18:56,960 system, open tickets with security, if you people are 367 00:18:56,960 --> 00:18:59,560 reporting issues or reporting phishing emails or what not. 368 00:18:59,880 --> 00:19:02,800 Like there's a lot of volume that comes from people that's 369 00:19:02,800 --> 00:19:05,440 also landing in your, in your tier one function rate or your 370 00:19:05,440 --> 00:19:09,040 enterprise sock. And the, the bigger your company 371 00:19:09,040 --> 00:19:12,240 gets, the more prevalent that becomes. 372 00:19:12,240 --> 00:19:14,200 When I was at, you know, Salesforce, we had a, a pretty 373 00:19:14,200 --> 00:19:18,320 large sock there and over 60% of the, what they did was dealing 374 00:19:18,320 --> 00:19:22,160 with people and people reports versus machine based detections. 375 00:19:23,080 --> 00:19:25,560 And if you actually, you know, kind of double click on that for 376 00:19:25,560 --> 00:19:28,960 a second, it kind of makes sense where the larger you get, the 377 00:19:28,960 --> 00:19:31,240 more resources you have, the better you get it kind of 378 00:19:31,240 --> 00:19:34,400 refining your alerts, get your detection pipelines running, you 379 00:19:34,400 --> 00:19:36,960 know, you're more mature in, in making your detections or what 380 00:19:36,960 --> 00:19:39,640 not, and you become better automating things away. 381 00:19:39,800 --> 00:19:42,320 So on the machine side, you start getting better at it On 382 00:19:42,320 --> 00:19:46,000 the human side, human noise scales literally, right. 383 00:19:46,000 --> 00:19:48,280 If you have, you know, 1 complaint for every 100 people, 384 00:19:48,640 --> 00:19:51,840 if you go from, you know, 30,000 to 60,000 people, those 385 00:19:51,840 --> 00:19:55,520 complaints go up literally. And so that noise coming to your 386 00:19:55,520 --> 00:19:58,280 sock grows, but you know, literally as well. 387 00:19:58,720 --> 00:20:00,880 And there's not a really good way to automate that away. 388 00:20:00,880 --> 00:20:04,000 There's no sore platform to, to automate a way people 389 00:20:04,000 --> 00:20:07,320 complaining about things, you know, it just doesn't exist yet. 390 00:20:07,480 --> 00:20:09,720 But you know, I wish it would. Maybe AI bots will solve that 391 00:20:09,720 --> 00:20:13,000 for us, but that's a big chunk of what they do in in 392 00:20:13,000 --> 00:20:14,840 enterprises. Again, that's why I kind of draw 393 00:20:14,840 --> 00:20:18,600 the analogy like IT help desk for security, because they are 394 00:20:18,600 --> 00:20:21,080 routing a lot of issues. OK, I have a, you know, 395 00:20:21,080 --> 00:20:22,720 questionnaire from a vendor. Where does it go? 396 00:20:22,720 --> 00:20:25,000 It goes to GRC team. You know, hope I have a, you 397 00:20:25,200 --> 00:20:26,880 know, XYZ problem up it goes to IT. 398 00:20:27,040 --> 00:20:30,400 Oh, that goes to dev OPS, not us or a phishing e-mail. 399 00:20:30,400 --> 00:20:31,920 Yep, Yep, it's legit phishing e-mail. 400 00:20:31,920 --> 00:20:34,200 I'm going to go into the e-mail boxes now and delete it from the 401 00:20:34,200 --> 00:20:36,480 company, add a block list, you know, blah, blah, blah. 402 00:20:36,920 --> 00:20:39,560 And so half again, half what they do is that and half is 403 00:20:39,560 --> 00:20:42,080 dealing with the alerts coming from, you know, tools like Wiz 404 00:20:42,080 --> 00:20:45,280 or Crowdstrike or whatnot and triaging those as well. 405 00:20:46,200 --> 00:20:48,480 And out of all the work they do, when, when I've taken the 406 00:20:48,480 --> 00:20:50,960 metrics from Salesforce in spring car and last year my last 407 00:20:50,960 --> 00:20:53,080 few Rolls and kind of bubbled them down. 408 00:20:53,800 --> 00:20:57,440 One of the universal kind of themes I saw running across all 409 00:20:57,440 --> 00:21:01,880 three of those is the actual ones where you catch the bad 410 00:21:01,880 --> 00:21:04,760 guys when there's an incident, things escalated. 411 00:21:05,160 --> 00:21:07,560 That's only about 5% of what they do. 412 00:21:08,560 --> 00:21:10,200 And and that's why they want to be there. 413 00:21:10,200 --> 00:21:12,080 They want to be there to catch the bad guys, right? 414 00:21:12,080 --> 00:21:14,080 And it's a small fraction what they do. 415 00:21:14,480 --> 00:21:17,760 The other 95% of it is the crap work they don't really want to 416 00:21:17,760 --> 00:21:19,800 do. Again, phishing emails, tickets, 417 00:21:19,960 --> 00:21:22,360 you know, benigns, false positives, you know, blah, blah, 418 00:21:22,360 --> 00:21:23,600 blah, blah. All the things we hear about all 419 00:21:23,600 --> 00:21:27,400 day long. And they wade through that 95%, 420 00:21:27,600 --> 00:21:30,480 you know, of the junk all day long to get to that 5% of the 421 00:21:30,480 --> 00:21:33,040 things they want to do. If this is what those guys are 422 00:21:33,040 --> 00:21:36,360 doing, it doesn't make any sense for the sock to be a noun. 423 00:21:36,480 --> 00:21:39,040 You know, it can be a verb. It's a capability where they're 424 00:21:39,040 --> 00:21:41,800 delivering this, this function to the company. 425 00:21:41,800 --> 00:21:43,960 Doesn't matter where in the world they're at, as long as you 426 00:21:43,960 --> 00:21:46,240 have a process in place where you can distribute the work, 427 00:21:46,720 --> 00:21:51,240 cool, you're set. And you contrast that to an MSSP 428 00:21:51,680 --> 00:21:55,400 where it's a profit center versus a cost center. 429 00:21:55,560 --> 00:21:58,960 They're delivering a a unifying service to all their customers. 430 00:21:59,720 --> 00:22:01,360 They know exactly what they're doing. 431 00:22:01,360 --> 00:22:03,680 They know, you know how much it cost to process an alert, how 432 00:22:03,680 --> 00:22:06,160 much time people spend on it. You know how much it costs from 433 00:22:06,160 --> 00:22:08,640 end to end for the entire life cycle because that's their 434 00:22:08,640 --> 00:22:11,160 business and their customers want to know what am I paying 435 00:22:11,160 --> 00:22:14,560 for? So if you look at it from the 436 00:22:14,560 --> 00:22:17,280 kind of the two contrasting lenses, what these guys do is, 437 00:22:17,280 --> 00:22:19,800 is vastly different. The responsibilities they have 438 00:22:19,800 --> 00:22:24,120 is vastly different. So applying that conventional 439 00:22:24,120 --> 00:22:27,760 sock model MSS PS Sure, it makes sense, right? 440 00:22:27,760 --> 00:22:30,520 Again, because you're uniform service, they're dealing with 441 00:22:30,520 --> 00:22:34,240 customers, they have to have that kind of central location or 442 00:22:34,240 --> 00:22:36,880 the central capability enterprises doesn't make sense 443 00:22:36,880 --> 00:22:38,480 anymore. And we're seeing that today. 444 00:22:38,480 --> 00:22:40,760 People call, you know, I have my sock team, where they at? 445 00:22:40,760 --> 00:22:42,680 Well, there's a guy in Europe, there's a guy in Asia, there's a 446 00:22:42,680 --> 00:22:46,080 guy in South America, there's a guy out here there wherever it's 447 00:22:46,080 --> 00:22:49,360 a verb versus a nail. You had mentioned that you might 448 00:22:49,360 --> 00:22:51,560 write a sock manifesto. Did you ever do it? 449 00:22:52,800 --> 00:22:57,680 I did. I got about 80% of the way 450 00:22:57,680 --> 00:23:00,080 through it and I was actually writing it with the help of 451 00:23:00,080 --> 00:23:02,400 Anton Chouvakin, who I saw was on here a couple weeks ago. 452 00:23:02,720 --> 00:23:04,680 Also has opinions. Opinions on socks? 453 00:23:04,840 --> 00:23:07,040 Yeah, I've known Anton for a couple decades now, so I'm 454 00:23:07,080 --> 00:23:08,440 constantly bouncing things off him. 455 00:23:08,440 --> 00:23:10,120 And he was helping me write this manifesto. 456 00:23:10,680 --> 00:23:14,960 And part of it was kind of what levels of maturity can you be at 457 00:23:14,960 --> 00:23:16,200 if you're below the poverty line? 458 00:23:16,520 --> 00:23:18,400 And what level of maturity are you at if you're above the 459 00:23:18,400 --> 00:23:20,360 poverty line? And we come up with kind of four 460 00:23:20,360 --> 00:23:25,240 levels of maturity and each one of those levels of maturity had, 461 00:23:25,240 --> 00:23:27,480 you know, kind of certain things tied to it, The things that you 462 00:23:27,600 --> 00:23:30,720 you should do and can do or, or the kind of options you get, the 463 00:23:30,720 --> 00:23:34,280 trade-offs you can have probably like the, the, the team size 464 00:23:34,280 --> 00:23:37,040 that you have, you know, kind of rough budgets compared to the 465 00:23:37,040 --> 00:23:39,960 size of your company. Because again, like I was saying 466 00:23:39,960 --> 00:23:43,160 earlier, a lot of the frameworks we use today, you know, they're 467 00:23:43,160 --> 00:23:46,200 kind of one-size-fits-all and they're kind of tethered towards 468 00:23:46,200 --> 00:23:47,720 big companies. Of course, you can do all the 469 00:23:47,840 --> 00:23:50,000 things your Google, right? You can just do all the things 470 00:23:50,000 --> 00:23:53,200 you want you to do. And for, you know, probably 90% 471 00:23:53,200 --> 00:23:55,480 of the companies in the world, they they can't do that. 472 00:23:55,880 --> 00:23:59,160 And so I'll strike them over the way to to kind of bucket those 473 00:23:59,160 --> 00:24:02,000 into different categories and say, Hey, if this is the size of 474 00:24:02,000 --> 00:24:04,720 the company you're at, this is kind of the team makeup and 475 00:24:04,720 --> 00:24:06,920 composition and and numbers people you have. 476 00:24:07,160 --> 00:24:08,520 Like what's the right fit for you? 477 00:24:09,080 --> 00:24:10,680 Yeah, exactly. I want to make something that 478 00:24:10,680 --> 00:24:15,480 wasn't one-size-fits-all, that was a little more tailored to 479 00:24:15,880 --> 00:24:18,600 the size that you're at, the budget that you're at, and kind 480 00:24:18,600 --> 00:24:21,440 of realistic expectations. I'm curious cause also you've 481 00:24:21,440 --> 00:24:24,360 done detection and response at multiple companies. 482 00:24:24,880 --> 00:24:29,120 What's kind of surprised you when you've switched between 483 00:24:29,120 --> 00:24:33,360 them were the things that were standard, maybe like securities 484 00:24:33,360 --> 00:24:39,680 reputation, that have changed or evolved in the past many years. 485 00:24:40,040 --> 00:24:44,200 When I've gone from org to org and whether that be a, a big 486 00:24:44,200 --> 00:24:46,200 company to another big company or a big company or a small 487 00:24:46,200 --> 00:24:50,160 company or a small company to a big company, you know, one of 488 00:24:50,160 --> 00:24:52,520 the things that I've, I've realized is it kind of what I 489 00:24:52,520 --> 00:24:54,680 raised earlier is every place does it different? 490 00:24:54,840 --> 00:24:57,080 I mean, the inputs are the same as much noise comes in, the 491 00:24:57,080 --> 00:24:59,640 outputs are the same. You fix whatever the issue was 492 00:24:59,640 --> 00:25:00,920 or you need the risk, whatever it is. 493 00:25:01,600 --> 00:25:04,600 But how you get from point A to point B is different from every 494 00:25:04,600 --> 00:25:06,960 single company to every other company I've ever been in. 495 00:25:07,080 --> 00:25:08,960 Yes, to, OK, these ticketing systems, they might have 496 00:25:08,960 --> 00:25:12,040 something in common, right? But what thinking system they 497 00:25:12,040 --> 00:25:13,800 use Salesforce. We use Salesforce. 498 00:25:13,800 --> 00:25:16,560 So the last time we use Jira, you know, I use ServiceNow here. 499 00:25:16,560 --> 00:25:20,960 I mean, it all varies. So how the sausage is made is is 500 00:25:20,960 --> 00:25:24,400 completely different between every company I've been to. 501 00:25:24,880 --> 00:25:27,200 The level of maturity is completely different everywhere 502 00:25:27,200 --> 00:25:30,080 you go, depending on what the priorities were, the person that 503 00:25:30,080 --> 00:25:32,160 was in the chair before you, what the company wanted them to 504 00:25:32,160 --> 00:25:34,160 do. There's no one-size-fits-all 505 00:25:34,160 --> 00:25:37,320 kind of best practice for how you do, you know, DNR or on a 506 00:25:37,320 --> 00:25:40,680 sock or do incident response. Everybody kind of makes up their 507 00:25:40,680 --> 00:25:43,720 own IR plan, you know, You know, to give an example, and 508 00:25:43,720 --> 00:25:46,600 everywhere I've been, it could be a check box, it could be an 509 00:25:46,600 --> 00:25:49,560 outline, it could be a 20 page document, you know, with 510 00:25:49,560 --> 00:25:51,400 pictures. So when you start working in a 511 00:25:51,400 --> 00:25:55,480 new company, never probably don't assume anything. 512 00:25:56,360 --> 00:25:58,400 I've made that mistake a few places I've walked into. 513 00:25:58,400 --> 00:26:00,680 Oh, of course we're going to have this or we should be doing 514 00:26:00,680 --> 00:26:02,200 it this way. Why are we doing it this way? 515 00:26:02,560 --> 00:26:04,680 Oh, because XYZ. That's why we're not doing it 516 00:26:04,680 --> 00:26:06,160 that way. I'm like, oh, yeah, OK, that 517 00:26:06,160 --> 00:26:07,960 makes sense. I I should shut up now? 518 00:26:08,320 --> 00:26:12,120 We have one last question for you, which I think we're one of 519 00:26:12,120 --> 00:26:15,000 the things we found really exciting and interesting about 520 00:26:15,000 --> 00:26:18,640 your career is that it's very much doused with like your 521 00:26:18,640 --> 00:26:22,640 entrepreneurial mindset. You had a cool company that did 522 00:26:22,640 --> 00:26:27,160 work for paintball something or another. 523 00:26:27,160 --> 00:26:30,840 You could tell us more and you had a security startup for a 524 00:26:30,840 --> 00:26:33,960 moment. And I would love if I think it's 525 00:26:33,960 --> 00:26:35,720 like an amazing outlook to have on the world. 526 00:26:35,720 --> 00:26:39,640 But I'm also curious what drives you to build and what you think 527 00:26:39,640 --> 00:26:43,080 maybe is still missing in the world that you want to create. 528 00:26:43,720 --> 00:26:47,880 Besides the Sock Manifesto. You know, but, but you know, 529 00:26:47,880 --> 00:26:50,280 I've had a, a couple, you know, start-ups. 530 00:26:50,280 --> 00:26:53,880 I've, I've tried on my own. I've had, you know, one a long 531 00:26:53,880 --> 00:26:57,840 time ago that was successful. We exited after a year back in 532 00:26:58,640 --> 00:27:01,600 early 2000s. I want to say it's a lot of fun. 533 00:27:02,120 --> 00:27:05,000 You're doing something you're very passionate about because 534 00:27:05,240 --> 00:27:08,200 again, it's, it doesn't become work, it becomes fun, you know, 535 00:27:08,240 --> 00:27:11,480 in a lot of ways. And that's how I kind of felt 536 00:27:11,480 --> 00:27:13,360 about, you know, most of my startup ideas. 537 00:27:13,360 --> 00:27:15,320 It was something I was very passionate about, something that 538 00:27:15,320 --> 00:27:18,280 I, I actually enjoyed doing. And so of course, you, you, you 539 00:27:18,280 --> 00:27:21,240 pour yourself into it until you, you know, run out of money and 540 00:27:21,240 --> 00:27:24,160 have to go back to get a regular day job, which is what's 541 00:27:24,160 --> 00:27:28,040 happened the last couple times. But I mean, eventually what of 542 00:27:28,040 --> 00:27:31,680 them is going to stick? Amazing, Eric, what a joy to 543 00:27:31,680 --> 00:27:33,800 have you on. Thank you so much for joining us 544 00:27:33,840 --> 00:27:37,320 and talking with us today. Sure I'm I'm glad I was just 545 00:27:37,320 --> 00:27:38,760 awake after only One Cup of coffee. 546 00:27:39,920 --> 00:27:42,960 I think your maybe your drop off of the kids may have helped. 547 00:27:43,160 --> 00:27:45,440 Yeah, they, they were running around like 6:00 this morning 548 00:27:45,440 --> 00:27:47,880 all, you know, panicking. Oh, I can't find my shoe. 549 00:27:47,880 --> 00:27:50,160 Where's my pencil? And, you know, all the things I 550 00:27:50,280 --> 00:27:52,600 arranged for them yesterday were all magically missing this 551 00:27:52,600 --> 00:27:53,240 morning. So. 552 00:27:53,680 --> 00:27:56,440 Lovely. Amazing. 553 00:27:56,720 --> 00:27:59,240 Yeah, parent life. If you enjoyed the show, be sure 554 00:27:59,240 --> 00:28:02,720 to subscribe and share a link to the podcast, but not your cloud 555 00:28:02,720 --> 00:28:05,520 keys. And as always, if your cloud 556 00:28:05,520 --> 00:28:08,360 security strategy is making you cry, don't worry. 557 00:28:08,360 --> 00:28:09,840 Just cry out loud.