Securing the unified workforce.

Auto-generated from the live recording.

0:07So, Ashley just told us that the workforce changed, and she set the standard for the rest of today. Not trust us, not take our word for it. But to promise an outcome. Then, prove that you delivered it. That's the whole job of this next 20 minutes. So, we're not gonna give you a philosophy, we're gonna give you 3 proofs. AI is a threat. AI is also your new workforce. Knowing the difference is critical. Kelly's gonna show you the proof. So you all know this. We've spent years teaching people the same basic things. Make sure you know the person who sent the message. Check the link. If something feels off, call them. And that was really good advice. The problem is, AI is now really good at removing the stuff that used to feel off.

1:06As Ashley mentioned earlier this morning, the grammar's now perfect. The message content seems to know legitimate things about you. It can sound like someone you know, and it can even look like them. And it shows up in the channel where you're already used to communicating with that person. So the old instinct Just doesn't cut it anymore. Trust but verify alone is no longer enough. And asking our entire workforce to become experts in all the nuances that can differentiate a legitimate business request from a carefully constructed AI-enabled attack It's just not realistic. With all the talk about the human being the last line of defense, we simply can't put all that on the employee alone. Nobody's gonna know every possible tell. And when people aren't sure, they need somewhere to go for help. A trusted expert, an advisor who can provide the needed guidance and expertise in the moment of uncertainty.

2:08And that's why we're building Ask Libby. So you get an email from the CFO about a, you know. But something's off, you can't tell exactly what, so rather than guess, Ask Libby And she shows her work, right there, 3 reasons, right in the thread. So now, you can report it, or check back with the sender. Good stuff. Real-time guidance and coaching absolutely helps when the message is real, but we can't sit around waiting for the real attack to be the training. We have to test that same decision ahead of time in the channels where it's actually going to show up. So yes, we're building AI-generate… an AI-generated phishing simulation natively into the living security platform.

3:09Multi-channel phishing isn't new. Plenty of people are doing that. What's different with running phishing out of your HRM platform is how you decide who gets targeted and with what. A risk-driven approach demands that we don't start with an empty campaign and find out afterwards who was risky. The Living Security platform already knows that and can answer that question for you. Who's being targeted by real attacks? What assets those users have access to, how they've behaved in the past. All of that goes into shaping the test before it ever goes out. With that risk-driven approach in mind, we're launching support for phishing simulations via email and Teams now. SMS, voice, and video follow shortly as part of our near-term roadmap. What you're about to watch is the whole playbook in action.

4:06So we start out with… Who do you decide to test? I'll give you a hint, it's not last year's training completion. We start with a real incident. We pull the life signal from multiple channels. That gives us 34 people in fin… finance, who's gonna… Improve wires, in this case, starting with a text message. Leading to a meeting with a deepfake avatar, where then it starts to get really interesting. Then, a simulated phone call to maintain urgency.

5:20And finally, the email that ties it all together. And, of course, Jordan clicks. 34 targeted, 6 clicked, 9 reported. And what happens next? Depends on which of those you are. Everybody who clicked gets training. The whole team gets a nudge, giving them a heads up. For those 6 who clicked, access tightens on its own. Step up off before they can authorize the next payment. So, obviously, the CAIC isn't just the thing that you report on. It's just one data point in a broader story that you need to be able to articulate, as well as be able to act on.

6:24The employee's score moves, and what you do about it moves along with it. Sometimes that's coaching, sometimes it's tightening up their auth, and changing what they can get access to at all. And that's the point for the people in the room, and those listening on livestream today. Who own this decision. You're finally testing your workforce's susceptibility to attacks based on the way they are actually going to arrive to your end users. And every result is a potential learning moment, and which makes your workforce smarter for the next one. But AI didn't only upgrade the attacker, Kelly, it joined your workforce. Human risk management was built on an assumption. The identity taking the action is a person. That assumption, as we know, no longer holds. AI agents have credentials. They have permissions. They touch data. They take action.

7:21Those tasks can change, their access can change, and their behavior can change. If it can create an incident, we have to be able to measure it, Kelly. That's right, Mike. An agent is an identity, full stop. It's got credentials, it does things we can't fully predict, and it can move risk every bit as fast and as much as a person can. That's the environment we're in today. Managing human risk and governing identity have stopped being two different jobs. It's one workforce, and you can't govern the part of it you can't see. We're going to take a quick look at the AI governance capabilities that we're building into the Living Security platform. This is real-world data, an organization of 18,000 people, and this is the agent side of their workforce.

8:23So we're starting out with an NHI dashboard that reveals 600 related identities. 31 are AI you'd recognize. But the rest? Nobody can tell you what they are. Including 9 AI tools that your own people bike-coded. Beautiful. One vendor shows up registered 6 different times. And a lot of this has no discernible owner. Let's double-click and open up one. What it reaches, what it does, who it talks to. So the question is, is it… what can it reach? How risky? So we score it. Fame index as your people. And you can actually defend this one, because it's built from how things… the things actually run. People have behavior patterns. Agents have execution patterns.

9:19It's job changed, it's permissioned through, you're seeing where it's headed, not just where it is. And all of it comes back to one person. Who built it? Who owns it? Who picked up the phone when the risk changes? So you go ahead, and you assign an owner. You go and review the asset. Very good.

10:15That's what we're announcing today. Your people and the AI they're using and building, approved or not, in one risk picture. Tied back to the humans behind it. And yes, there's a score. But honestly, the number isn't the only interesting part. Yes, it's knowing the number, but it's also about what you can do with it then. So what can you do with it? Well, two things. First, shadow AI. Every tool and agent in use, whether you approved it or not, including the stuff your own people built. And never mentioned to you. Second, risky usage. Who's putting sensitive data into which model? Your riskiest people and your riskiest tools, side by side, tied back to a name. So, Kelly just showed you a workforce that we can finally see, right? But a score is not an outcome.

11:15Moving the score to a less risky state is actually the outcome that we desire. We don't prove that with activity alone. We prove it by showing risk actually moved for one person, for a team, or for an entire organization.

12:56So, the numbers really speak for themselves. Those are actual outcomes that our customers are actually getting from our product today. That report that was referenced is actually available now. I think we had a press release that went out this morning, and I encourage everyone to read it. This is the follow-up to last year's SciANTRA report. Amazing data here. But I… As you saw from that, one person can make a better decision, and a team can close an entire attack path. Entire cohorts spent 52, 77, even 90% less time in a risky state. And those are defensible outcomes. But here's what you didn't see. Who was doing this work? Last year, on this stage, Kelly and I announced Livy, and we're showing you the results of Livy's work. Livy runs continuously, in the background of your program. trained on your policies, your risk data, and adapts to the threat landscape targeting your organization. She watches the signals.

13:59She sees when risk changes. She identifies who needs intervention, and what is the action that is most likely to work for that given person or cohort with their risk. So, you keep the judgment, human in the loop, Livy takes the execution. That's autonomous AI with human oversight. This is not a chatbot that I'm describing to you right now.

14:56And this is not a staged product story that we have just described to you. In the moving target, this is the research report that was launched today, we measured hundreds of anonymized action plans across thousands of anonymized users. After an action plan, they spent 68% less time in a risky state that triggered it. The improvement held. We opened with one standard, right? Promise an outcome, then prove you deliver it. The risk moved. Livy moved with it, and it's provable. And that outcome starts before the incident ever happens. When a real request creates doubt, employees can now ask Libby. And before the real attack arrives, you can test that decision across email, Teams, with SMS, voice, and video on the way. Help in the moment, preparation for the moment.

15:53It continues across every identity that can create the incident. Your people, your agents, your workforce, one continuous view of risk. And Livy? Well, she connects it all. She helps your people make the right decisions. She makes every simulation smarter. She watches risk across both humans and agents. And when risk changes, she brings you the action. Asks for your approval, and then does the work. The people, the agents besides them, the risk moving between them, risk doesn't stand still, and neither should your defense. This is human risk management built for what's next. Thank you.

Auto-generated from the live recording.

0:10Welcome, everybody. My name is Kevin Martin with Living Security. It's a pleasure to be talking with y'all. Please get a seat, get comfortable. Beats that are hard to get on, right? All people here. You look great, you look great. Alright, so Edna, I'm gonna come to you in a moment. So, in my role at Living Security. Without exaggeration, I've had the pleasure to speak with hundreds of enterprises over the last 4 years. Literally thousands of small conversations with people thinking about human risk management. And when you have a human risk management conversation with somebody. Thank you. Oh, I got a clicker. Alright. When you have a human risk management conversation with somebody. With today's marketing and vendors that are out there, it really varies. That conversation could be, I want to talk about advanced fishing. Two, I want to talk about orchestrations and automations and insider risk. And I often have to say to them.

1:09What outcome are you driving for? What's the problem you're trying to solve? Do you have an enemy? Is there a risk? Is there an enemy that you're actually trying to get ahead of and preempt? And if you can share that with me. Then we can teach you how to have a strategy and use the platform to achieve that outcome. So what I'd love your insight with. And, talk to me about… when people are thinking about HRM, what should they be thinking about? Is there an enemy? What should they be focusing on? Yeah, I think they should be focusing on exactly what business exists for, right? We exist to serve X, whether we're for-profit, and it's… Our customers and our shareholders, whether we're not-for-profit, it's the constituents who we serve via our mission. Whether you're in government, it's the citizens who you share. your mission with, right, and serve. So… For me, it's about resilience.

2:07And… I think we need to start talking more about… I love the line, the unified workforce, because that really is where we live today. And sometimes, we forget, however, that word, human. So at the end of the day, it all stops with us. And you've heard me say this more times, I think Ashley's sick of hearing it, but I'm going to keep reminding everybody The technology is here to serve who? Us, the humans, not the other way around. We invented it. We're using it, And we damn well better be able to understand what it's doing and control it. Well said, very well said. And I think, not only is the technology here to serve the human, from a business approach. you need a strategy, and then use the technology to help you get ahead of it. Scott, talk to us about, from a financial point of view, what drove you to human risk? Sure. So, it's no secret, Navy Federal is the world's largest credit union.

3:08And our motto, some of you may have heard this, the members are the mission. And what does that mean to us? Well, our primary constituents, our primary members are active duty or retired military service. So, these are people who put their lives on the line for our country, for us, and our job is to give them peace of mind when they're off doing this, that their finances are taken care of. Being that critical infrastructure for service members, being that world's largest credit union, also paints a target on our back. You know, it's great to be that big, but it also means we deal with nations. state actors, we deal with hacktivists, we deal with AI engineered deepfakes on a regular basis. So, for us, this is a problem that we can't just have a decent phishing program, we can't just have a decent risk program. We have to be best in class, because the best in class is what's coming after us.

4:08And what's on the line isn't just a scorecard or end-of-the-year dividends. What's on the line for us is the financial security of some of the most critical individuals in the country. So it's a problem that we have to get right. As a member of Navy Fed, I appreciate that. Very much so. Taylor, probably the most important human risk is health. So, talk to us about Abbott and your journey, and what's your enemy? What are you trying to do with your program? Absolutely. We, we certainly also work for a very mission-driven organization. Our purpose is to help people live their healthiest lives, in some cases, to… to literally save lives. So very important, that we, that we protect our, our products, our people, our customers, certainly. When we think about human risk, we… we start by… with the understanding that people are our greatest risk, and our greatest asset.

5:08And what we exist to do is empower our people to make safe choices, to behave the safely across the board. And with every initiative that… that we take on, every initiative has its own quote-unquote enemy, has its own set of goals, but when we… when we think about the end of the day, what we really want to do, again, is empower our people To keep themselves, their families, the company, our patients, our products safe. The… so we know why you're doing it, we know the focus, again, I have the privilege of speaking to hundreds of different companies, and I attend different association meetings, and what I'm hearing on a regular basis is. Probably 90% of our industry recognizes the why, of why we need to move to human risk management, why it can't just be check-a-box compliance, where we have to see the risk, and how do we get ahead of it.

6:12But I would say 90% of those people who understand the why Are stuck in how. how do I even start this? How do I begin this journey? How do I get leadership to understand this? It doesn't really fit in this silo. Should it be insider risk? Should it be security awareness? How do I begin? So, I'd really love to understand… Taylor, you probably have the more mature program, Scott, you have a more nascent program, so how did you begin this journey? I really like this question, and my simple answer is to start with what you have, and continue to build. We heard from Ashley earlier that a fishing simulation program doesn't cut it. I think we can all agree on that. But also, I will say that a phishing simulation program played, and continues to play, a really important part in the maturity of our HRM program. We started with a fishing simulation program and an enterprise annual training course.

7:13Again, training completions, phishing simulation program metrics do not paint the complete story. What was helpful about those. at Abbott was that they are relatively easy to understand. They're easy to understand for our employees, also for our leadership. So by starting with those two programs and really building a story around those, we got the trust of our organization, including our senior leaders. We then found that when our team, brought requests for, for additions to our HRM program, they were, they were relatively easy approvals for us, because we had already started to build the story, and we had already built trust. As a team, with our leaders, and with our approvers. So, since we started with fishing and training, we have built on many different layers of our program, that, that go in several, different directions, which I'm sure we'll talk a little bit more about, but that's my biggest advice, to just start with what you have and build from there.

8:28Yeah, your team's done a phenomenal job with that. It's… It's a message that we speak regularly about at Living Security. The… people get intimidated by, how do I run a marathon? So they simply don't start, right? And it's… how do you begin with the tools that you have access to, the credentials, the data you have access to? How do you start with a single incident, understand the… signals that you need to monitor to get ahead of it, understand the behaviors you need to monitor, and then the ROI by saying, did I change that behavior? So how do you really start focus with an MVP, a minimally viable product, and say, let me prove value, gain the trust of leadership, and then there might be another data set and another incident that I can grow to? Scott, finance side, you guys are… we could spend hours talking about your risk journey, but specific to HRM, what convinced leadership? Why are we doing it? So… We started with a social engineering program, and we've always had a pretty robust social engineering program, but we expanded our toolset in recent years. We started doing more advanced social engineering, smishing, phishing, deepfakes, and we were able to show clear risk reduction.

9:36we have quantified that risk, and that quantification is really what resonated with leadership. Now, as we start to look at expanding into HRM, I think it's really important to state that When we talk about HRM, we're not talking about just phishing rebranded. We're talking about all of the other behaviors, too, that influence security signals. Things you'd get from SIM tools, DLP, your privileged access management. All of this data paints the full, holistic picture around a user, and we've gotten to the point where we're classifying that risk narrative really into two buckets. You've got the active risk, the actions that the person is taking, clicking on the email, sending something outside the firewall, going to a blocked AI website that's active, and then you have the inherent risk, which is Does this user have privilege access management? Do they have access to a service account? Are they an executive staff assistant that can potentially approve something on behalf of an executive? So.

10:39Those two different buckets really help you understand the risk that you're carrying at any time, and the potential actions that your workforce can take to make that risk worse. Thank you. The, all that data does paint a picture. I remember a previous conversation Scott and I had, you said that the data can actually show you the ticking time bomb. The data can actually show you, you know, where your team needs to be spending time and attention, how to get ahead of it. So, Edna, you're in a lot of boardrooms, a lot of conversations, a lot of M&A, We, of course, are passionate about human risk management. You've heard Scott and Taylor talk about it. But does the board really care about this? Depends on the board. I think they don't think about it From a human risk management perspective. We think about resilience of an enterprise.

11:35And there are multiple aspects underneath that enterprise resilience. And this is an interesting question about Who… who do you… I always ask people, who do you report to? who actually picks to use living security? Sometimes it's risk, Sometimes it's the CISO. But it's not just about security now, is it? Because rarely is it HR, which is funny, because to me, how many of you have sat in a room… I mean, we've all heard this, right? People are our biggest assets. I believe that. People are our biggest problem. anybody who lives with another person, I've lived with mine for 51 years as a wife. I do for sure. Every day. But the reality is, the board says. I want you to come, and I'm not sure who presents it. I have a view on what that should look like. We can talk about that after. But, I want to know how I'm actually structuring resilience across the enterprise. If people are my biggest assets, how am I dealing with that? Most boardroom discussions today are, how much money am I spending on AI?

12:50And what is the ROI I am getting on it? If there's any board director who's ever in a room with me who asks the question, how many people can I cut? There will be a conversation in the hallway that will not use language that polite women should use, because that's not what the technology is here for. So I think the board cares, but they… you have to fit it under the construct. I mean, Taylor, when we were talking in advance, you were like, you need to know who… who you're selling to so you can make the pitch easier, right? If you have a board member who actually calls up a senior executive or talks to the CEO and says. We need to be doing something about this, what are you doing? I didn't see it, it's missing. That's invaluable. What really gets things moving is when the board member asks that question, and somebody says. I have a tailor a Scott, you should go talk to them, because we have a plan. Here's what we're doing today.

13:51Because my first question is gonna be. Great, what are we doing tomorrow? Because whatever we're doing today is not enough. And then the other thing the board really cares about, frighteningly enough, if anybody has ever either pitched to a board, or been told by the boss's boss's boss. I need this data, it's gonna go in a slide. I have 13 seconds to present to the board. I can only get 3 bullet points, tell me what I need to put in. The reality is we care about metrics. So if you can't show me how what you are doing meaningfully adds to my resilience. That's the reason why we started… so many people started with training in fishing, right? Because the answer was, well, if they click less, the theory is we're less likely to be attacked by that type of attack. My answer to that is, that is a great place to start, but it sure a shooting isn't enough. That's it. Underneath the resilience, think about why the company exists.

14:50And be prepared. And for Pete's sake, start to get to know who's on your board. So many people don't do that. Very well said. Very, very well said. I remember you taught me once, if you're talking to the board, or you're talking to a CISO, a CISO ultimately needs to de-risk the organization. And so, it starts with 3 very simple questions. Can you see the risk? What risk do you see? Prove to me what you're doing about it, and most importantly, can you prove you're making a difference with it? And I think about Mike and Kelly's presentation earlier about closing the loop. And you mentioned starting with phishing and training is integral. It's obvious, right? But there are two levers. And now the industry's talking about nudging, right? You can send somebody a nudge to say you did this positive thing, or maybe this negative thing. But Kelly had a great example of, you can change their approval. their authorization. You can change their access levels, and that's where the industry needs to start thinking bigger, of as we contextualize this risk and we use it.

15:50Phishing and training are important and integral, but they're two of the tools in your belt. There's many more that you can begin to use this data with as we move forward with. Alright, that was it. I told you I'd go rogue. Here we go! Here we go. If you think… if you think about living, and you think about what living security does in the whole context, right? And you see it in the big picture. You have a whole stack of your infrastructure, and then you have a whole stack on the security side. And heck, you might even have a… HRMS system, God help you. And the reality is, This is a tool that enables Matthew, you said this earlier, I don't know where he is, he got up, but somewhere in this room, you'll hear from Matthew Rosenkrist later today, and make sure you leave enough time for me to ask him a question, because our job to each other is to annoy one another in public places. I do think… That you have an opportunity to say.

16:50I give you the data that allows the rest of your tools to act A, perhaps predictively, but for sure, faster, on a more informed basis. So it's this linchpin to get to, how do I make everything else that's focused on resilience better. That's a ticket that everybody should want to have. the… how do we become more resilient? How do we not only see the ticking time bomb, but have a preemptive measure in place that is able to get ahead of it faster, and moving at the speed of AI? How do we use automation to get ahead of that? So that leads to this next question. Taylor, I'm going to start with you. What if the riskiest identity? What if the riskiest user is no longer human? That's the… the question of the hour, certainly.

17:47I'll start by saying that at Abbott, we take a very conservative approach to bringing on AI. So any AI-powered tool that can be used in the organization undergoes a very robust AI review process. Some would say too robust. Although, given what we've heard today, it's hard to argue that anything would be too much. So, our approach, then, is to really use the AI controls that are in place as our foundation for what we do next. So I mentioned at the beginning that our purpose as a team is to empower our people to make safe decisions. The same goes for how we, work with, quote-unquote, the controls that we have. The controls are in place to empower our people to be able to make safe decisions.

18:43once, once something that uses AI undergoes our approval process, then, there, there is a level of, there's a level of, I don't want to say comfort, it's never good to get comfortable, but understanding that tool, whatever it is, has been reviewed by a team of experts. So that is certainly a starting point that, allows safe decisions. But then our, our team Is, in place to continue to enable our people to use the tool safely, to help them understand what that means. To help them understand their… their roles in it, and to help them, really, utilize the tool for… for what it's intended. I think it starts with controls, right? And, I'm relieved and happy to hear that Abbott has very tight controls over AI and how it's being used. But Ashley Rose earlier talked about often the business moves faster, and there's business efficiency, and there's goals and outcomes that need to be achieved, and the business is driving the adoption of AI. Scott, are you seeing that within Navy Fed? We are, It's an emergent field, and with any large company, it's oftentimes very difficult to keep up with the needs of the business, right? Because you have to move with the speed of the market.

20:09And security often is the one coming up behind to close that gap. The good news is we are closing that gap. You know, you brought up controls, and one of the things I'll mention is a lot of times what we see when you start talking about AI controls is they're very focused on controlling the way a user interacts with an AI model, preventing model poisoning, prompt injection, that sort of thing. But that's assuming the model then does what it's supposed to do. So what we're looking to do is, I'm coining a new phrase, I'm going off track here too, that the next term, the next conference isn't going to be HRMCOM, it's going to be WRMCOM for Workforce Risk Management, because, essentially, if an AI agent has agency, it's acting like a person. And that means you should test it like a person. So, our social engineering team has identified some products within the organization this year that are meant to mitigate against deepfakes.

21:12We've got a deepfake tool, so we're actually working with those teams to socially engineer the AI tool to see how… resilient it is against social engineering attacks. Does it do what it's supposed to do, under those stress environments? So we're evolving our program to that next level, treating these AI agents like people. They'll have their own scores. I think it's brilliant. And ultimately, those AI agents report to a human, right? So, who are they tied to? And then their risk score, their vigilance score, should be tied to the performance of that agent, right? That they're a collective risk. And, you mentioned, how many jobs is this gonna cut? What's the savings this is gonna bring? At the board level, at the enterprise level, what's the theory on AI and risk? I think we're moving away from that slowly, because everybody looked at it as an efficiency play at the outset, let's be honest, right?

22:12I think it's an enabler, and so what I'm starting to see are… Are we deploying it in the right way? for the right purpose. Do we know what right means? And by the way, that can change day to day. And what's the cost? Tolerance that we have. To allow that. The last thing I think that I'll leave you with is, Look… We all understand Agents are not deterministic, but they have a mission, and they will go achieve the mission. And for anybody who dug deep into exactly what they did in the test case that was being run, all the credit to OpenAI for doing it, publicly disclosing it, and to Hugging Face for finding it. This is a great story, but it's like, oh my god, the world is gonna stop. I am not in the world is gonna end, and there ain't nothing that's taking me out. It's not gonna be AI.

23:14And, you know, last time I looked, we still have weapons and we can shoot the devices that run all of this, so let's be honest, okay? Calm down, people. But… What we can do is we can effectively say, can I put controls in so that when things happen, I can Decrease access, because access alone doesn't mean And authorization doesn't mean I'm safe. Have I balanced the risk? So what I'm starting to do is think about a risk score that I'm testing with the NACD and the Private Directors Association. To think about how we ask the question as board members. where is my resilience, and where is my speed to stop things from happening, to shut things off? And that gets everybody in the business all excited, because at the end of the day, you point… both pointed it out, right? We want to continue to serve our constituents.

24:19I've never met I've never met an employee who has said, I've been unable to do my job Because of what you shut off access to. Or if I did, it's because you don't have a job anymore, and you don't belong here. So, let's not be afraid. To leverage the power of… what… I like this, workforce risk management can do for us, but look specifically at agent-to-agent development, understand the way they behave, just like God help us psychologists and psychiatrists try to understand how humans behave, and I think we all need to talk to Bella Rose. I'm hoping she'll come today, and educate us all a little bit, but there's an opportunity here for us, and I think we need to be advocates, and I don't know where any of you sit in your organizations, but if you're not talking to your CISO, whoever owns enterprise risk in your organization, and if you're a smaller organization, I mean, at Microsoft, you know, I did get to talk to Satya, but even at my level, it wasn't all that often, right? It was usually a debate.

25:35and… I think you need to do that, because you become the evangelist for, this is what resilience looks like in the future. And… I'm pretty damn excited about these metrics that we might come up with. But my ask for everybody is, be not afraid to voice your opinion on when shutting things down, or reducing access, or reducing controls, or killing them. Remember the old days? We always said, you need a kill switch in security? I like the word kill. It's an agent. I'm not killing a human. Kill it. If it's gone rogue. to kill it, to make that argument, I go back to what you said to me, I don't know, a year or two ago. Can we see the risk? So, Scott, to your point, we need to bring that agent information in, and Ashley teased that a little bit, and we'll be talking about it more throughout today, but it's how do we bring that agent, their behaviors, their inherent risk, their active risk, into the system.

26:41reconcile that with the identity, with the human, so you can tell that story with the board. You can say, this is the actual risk, this is the acceptable risk, this is the scary risk, here is what I recommend we do about it. So it starts with visibility and bringing that in. Alright, I think I'm gonna… unless there's a question from the audience, I think we're gonna wrap up. We do. Crystal, in the back here. Okay, come on up. Questions? About how much time do I have, Crystal? Those are the questions. Okay. Whoever wants to… let me see. With Libby asking for human approval, is there a risk of alert fatigue? Taylor, what do you think? With Libby asking for human approval, is there a risk of alert fatigue? I think the short answer is yes. There's always the risk of alert fatigue, with any tool. I also don't think that's a reason not to enable alerts. That is absolutely a reason to have a plan for how they're addressed, to understand what is being alerted, which of those alerts do require action, if there's a threshold.

27:50At which action is required. That's absolutely a critical thing to map out, because there's no point in having an alert if no one knows what to do with it. Without a doubt. And we would advocate, start with positive alerts, right? Hey, you reported a real fish. You know, build a positive culture, use alerts to do that. Scott. How do you convince a leadership that AI agents and shadow IT are actually a threat to your organization? Well, it depends on the level of leadership, and I'm going to hit on something I mentioned earlier about risk quantification. I think one of the biggest things that helped sell the expansion of this program was being able to attach dollar signs to it. Not the cost of the program, but the risk reduction. So… being able to model out the actual impact, the bottom line. So, the CISO, for instance, is going to be very fascinated on how much cybersecurity insurance they need to carry.

28:53That's directly proportional to the amount of risk that they're carrying. So, how do you get them to believe that this is the problem, that this needs the efforts? You show them the strategic return on investment. Well said. You need the data to do it. Yep. Edna. How can we convince executives that security is not just a technical issue, but also a critical business concern. How do we convince executives that security's not just technical, but a critical business concern? Bring in 3 customers. Have the customers answer what they care about, which is availability, reliability of whatever it is that you're providing to them and its integrity, and that will answer the question. Very succinct. Well done. The, are you suggesting otherwise I'm verbose? No, I would never suggest that my lovely Italian friend is verbose. Never, never, never, never. The… okay, so this is a great, great question to finalize it, because as I mentioned, I have the privilege to talk to hundreds of customers.

29:53And we talk a lot about how do we go to advanced, to insider risk, how do we close the loop, how do we change authorization, how do we do all these advanced things of where the industry's heading? And oftentimes, it comes back to training. Somebody says, yeah, but I need to check a box today, or I need to do these specific things, and I need to do that better. And because although we're going to start with an incident, or we're going to start with one particular thing, we need to train and fish everybody, right? So, the question is. While training completion rate isn't everything. What do you do when a third of senior leadership or management team doesn't support a role-based trading program? that's… that's real. So it's… it's something that I think most of us in this room have experienced to, to some extent, and my best advice on that is to use your enterprise training program. and have a role-based program as an AND to that. So, to really make the connection as to what your enterprise program does, and what an additional role-play pro… program can do. And I'll give a very quick example of this. Scott talked about active and inherent risk, which, isn't how… those aren't terms that I've used before, but I'm going to start, because I really like those.

31:12So, there's… so, active risk, we all understand. Role-based risk is more inherent risk to me. So, one inherent risk in our organization, is people who have privileged access. We actually, with the help of Living Security and the data that's available within the platform, we have added a control that anyone who gets access to… has privileged access at Abbott is not granted their credentials until they complete an action within Living Security. And that was such a… such a technical example, like, there's no reason that everyone within the organization would need to be trained on what it means to have privileged credentials, because it is so irrelevant for others. That… that… posing that to… as kind of an answer to the question of why do we need a role-based program, that's one that we've used to kind of build the case for what, additional programming can do.

32:21You've done it really well. For those who are in the room, I encourage you to talk with Edna and Scott and Taylor if you have the opportunity. Others, use LinkedIn and network. They are incredible sources of information and have walked the walk. I want to thank you, the three of you, for joining us today, for teaching everybody You need to start. You can start small, you now know the why, you know the how. We know we gotta focus on an enemy. Thank you for your time. Alright, that was incredible. I really love that conversation.

Auto-generated from the live recording.

0:09Alright, so let me get this straight. It is Toothless Smile. Open posture, feet forward. You guys feel welcomed? Alright, good. I got it? I got it. Alright. So, security awareness has a crisis of credibility. For decades, we have been asked to provide compliance-centric information to our leadership. Have people taken annual training? Have people completed phishing simulations? Is our click rate kind of low? That's all that's been asked of us. But as we've been hearing throughout this morning, those questions are changing. We're being asked more. We're being asked to define and prioritize risk. To show that we can reduce risk. But we're not equipped for this. We've never been equipped for it, because we've never been asked to do it before. In order to do it, we need things that we've never had to have. And that's where our credibility crisis comes in, because when we go and ask for those things.

1:06We're asking for things that people don't necessarily believe we need when you compare us to other traditional technical security functions. So what I'm going to talk about today. My name is… Damon DePaolo is my monitor up. Okay, there we go. My name is Damon DePaolo, I work at CVS Health. I have had the opportunity to build two human risk management programs, one at a large financial services company, and now the one that I'm building at CVS. And through that, I've had to navigate this credibility crisis in order to get the buy-in to move forward. I'm gonna talk about… a little bit about that experience, and then I'm gonna talk about some of the lessons I've learned along the way, so as we're all working on building out our human risk management programs, we can take some of those lessons and hopefully address them up front to get the buy-in and support we need. So I'm going to start today by talking about the human risk management moment we're living in a little bit. It's important to level set. This is gonna be something that comes back time and time again while I'm talking to you today. It's really important to make sure we're all coming from the same page.

2:05Then I'll jump right into those five realities that I've learned through my two experiences building out human risk management programs. That I would really want to make sure I addressed up front if I were to start building a third. I'm gonna lay out a high-level roadmap, again, if I was starting on Monday at a new company, from a new compliance program, trying to build it out into HRM, these are the things I would start with, and this is the flow I would go with, and then I'll leave you with some small takeaways that you can work on. So let's get that level setting underway. As we all know. We've traditionally been asked for those compliance-centric metrics. Has your training been completed? Are you running simulations? What's that look like? Are people clicking? Are people reporting? I mean, we do those really well. That's been established, it's foundational, it's important. Even when we start to move, you have to have those foundational elements, if for no other reason, than to fulfill regulatory compliance. But we've seen increasingly recently, over the past two to four years, I'd say, leaders are coming to us with completely different questions.

3:08They want to know, did that annual training actually address the risks that we face in our company? And… Did it help? They might come to us about our phishing program and say, well, are the phishing simulations you sent, are those relevant? Are those really addressing the things that people are experiencing day in and day out? And the fact that people are reporting it, does that mean that they're less likely to click on something real? Or they might come back to you and say, alright, outside of phishing, like, where's our highest risk? What are people doing that's problematic? Are we leaking a lot of data to free mail accounts? And how are we training people not to do that? Well, that question is one we can't answer. We can come up with answers for the other stuff. probably stretching a little bit. Like, yeah, our annual training is aligned to our most important risks. We think. But until we can really aggregate data together and look at the behaviors across our organization in a meaningful way, we can't answer those questions, and that's what human risk management has grown up to fill, that gap.

4:11So, like most people, when I was asked those questions, or many people these days, I should say, when I was asked those questions, I decided, I'm gonna go out and I'm gonna find a platform that's gonna help me build HRM functionality into my program, and it's gonna be great. And this is what I thought it was gonna look like, because I have about 7-8 years in security awareness and human risk management. I have 26 years in aggregate in technology. I've went through a lot of technology implementations over my time. And those go pretty straightforward. I'm gonna find a platform, you know, maybe do some RFPs, do some POCs, grab a platform that I love, gonna bring it in, I'm gonna connect data up, I'm gonna surface whatever that data tells me, gonna throw it in a dashboard to show to leadership, and say, this is what I'm gonna impact, this is what I'm gonna make better, train some people, and I'll show them trends. That's what I expected was gonna happen, especially the first time I went into this. Sounds really simple, right? Finding a platform partner was not that hard. We have a really great one here that many of us have talked to in the past.

5:06And that did not end up being, by any means, the critical path of my program builds, either time. What the critical path surfaced as being was… alignment. Right? Alignment on what human risk means. Because let's be very honest, and we've heard people talk about this a little bit today. If I ask my CISO what human risk is, and I ask my insider threat team what human risk is, and I ask my privacy team, my legal compliance team, my HR team, what's human risk, every single one of them is going to come back with a different answer, and it's probably going to be different from mine. And then when I go out for those RFPs. All the vendors that come back to me are also going to define it differently, because there's no common understanding in our discipline on what human risk management really means. So it's important when you start out on this journey. That you look into defining that, right? So that was big, getting alignment there. Getting alignment on what we can have access to, getting alignment from our key stakeholders, getting alignment on what insights people wanted really ended up being the largest critical path in both of the projects as I went through.

6:14And a lot of that doesn't show up when you're getting those upfront vendor demos. People aren't pointing you in that direction when you say, this is what I want out of an HRM platform, you know, they just sell you their enhanced fishing platform, and you're good to go. So you have to cover these bases before you get going, so that you know what it is you're looking for. So that surfaced my five hard realities, as I'm gonna call them, of implementing a human risk management platform. And that's what we're gonna spend most of our time right now talking about. I'm gonna start with the first three together, because there's a lot of continuity here, and I did start to talk about that shared definition already. It is really important that before you take a step towards building out a program, you have this common understanding. Start with your security leadership. Make sure that the questions they're asking you align with how you're going to define human risk management in your strategy. in your proposals, in all the language that you're using. Once security leadership is on board, start to go out to those other stakeholders. Privacy team, this is what we want to do, this is how we define security human risk management.

7:17Do you agree? Do you see any challenges there? Is there anything that you think I'm not allowed to do because of where we sit in the organization? Get through those conversations. Once you have that shared definition within your organization. Then you go out to those stakeholders and a broader level. and start to really say, this is what we're doing, this is what leadership has agreed we're authorized to do, this is how we're going to move forward in building out our human risk management discipline. And this is what I need to eat from you. Are you on board? Right, so that's getting that privacy team, the legal team, the compliance team, the other security organizations to say, yes. We agree this is your responsibility. And we are going to support it. And then, expanding out into your… further into your security organization, going to the owners of the data that you're going to want to aggregate in order to do this, and saying, hey. I've never asked him for data before.

8:13I just want to remind you, like, we're brothers. I'm security, too. So, I'm gonna need this. Do you support that? Do you recognize that it's okay for me to access this data in order to achieve this responsibility that we've all agreed to across the security organization? Make sure that you get them bought in. You go through the due diligence of letting them understand what you're going to do with that data, building trust in your ability to utilize that data. So that when it comes time to really lay it down and ask for it. They're there for you, and they're not going to be a blocker. Once you've started to have those conversations, and you get those people bought in. I want you to go back to him again. and say, okay, now that you say I can have your data, what's that look like? What behaviors are really surfaced from the data that you own? If you're talking to your DLP team. What can I actually find from the tools that you have? Is the data noisy? Do you get alerts, disposition it, and put it back into that system so that when I consume it, it's the final understanding of what that data is?

9:16It doesn't mean you may or may not want to take it, but you have to know it. You have to be very clear on what data you're going to bring into your future state. So that, when you bring it in, you know exactly what insights you can surface, and how you're going to act with them. We know, right, across security, we have no lack of data. There's a lot. It's noisy, it's busy, it's confusing. So getting this clarity up front is gonna make sure that When you take that next step. into finding vendors, finding partners, building something internally, whatever it is you're gonna do. You're focused on the things that you can actually influence. Okay, reality number 4. You may be asked for a human risk score, or you may be asked for where your highest areas of risk are, but I promise you, your CISO didn't just wake up one day and think, I want another number to put on a dashboard.

10:11Because they have enough numbers on dashboards. And they want anything they put on there to be meaningful. So, when you're looking for what you're going to do, how you're going to build, where you're going to bring it forward, it is critically important That the number you present is one that you can action upon. And that you have every intention to action upon it, so that when you give your security leadership that number back, whatever it looks like, a human risk score, a specific behavior score. You can also say, this is what I'm going to do about it. This is my baseline. These are the actions I intend to take. And I'm going to come back and prove that my actions are reducing this risk. If you can't do that, and you're not ready to do that. you're not necessarily ready to move forward into human risk management. So you have to figure that out in advance, make sure that you're clear on what's going to comprise any risk scoring that you're going to do, what's going to go into those dashboards, and are these things that you have the capability to action upon in order to reduce the risk?

11:15And finally… Reality number 5. Year one is all about small, proven wins. This one, I learned the very, very hard way the first time I built out a human risk management program. I… this was early on when this was… this discipline was really start… starting just to kind of gain traction. happily early adopter, and said, I'm going to connect every data source I possibly can right now. And back then, I was in a company I'd been in for a very long time, I had lots of personal credibility, so people said yes a lot more easily than if you're starting this from scratch. So we connected a whole bunch of data inputs into my platform, and my goal was not to worry about those other things that I just said, rules 1 through 4, My goal was, I'll connect all this data, and then I will be really forward-thinking. I'm gonna let the data tell me what the problem is. I'm not gonna go in with any preconceived notion.

12:11It sounds really wonderful, and the data will tell me what's wrong, and then I'll be like, hey guys, this is what we see as a problem, so, like, aren't you proud of me? I've identified new stuff, it's not phishing! Okay, so we did that, we tried that. The data showed us a problem. It was all about, you know. Website visits, blocked website visits, was what kept coming back, time and time and time and time and time and time again, because that's a really noisy system. So, even if we weighted that problem low in the system, in our aggregator. what it surfaced was always a high risk in that space, right? There's so much action happening here. So we kept trying to figure out ways that we could influence it, and having conversations, and saying, this is what the data's showing us, and it ended up just being a rabbit hole that we did not need to go down. So… when I went through this again a second time, the first lesson. that I worked on was my fifth one, right? I came into it with the new knowledge of, okay, year one's about small wins. Let's be really purposeful about what data we bring on. Let's have some of those conversations up front, see what we can get access to, inventory all the signals that we have available, and say, what are the ones that are really sort of important?

13:21That we can really confidently say provide us meaningful insight into something that people are doing. And we'll just bring those ones on. We'll leave the other stuff until we've established a really good process, we've established that credibility that we've been lacking, we won't be going to people saying things are a problem that won't, because we'll know it's with nice, clean data sources, so then the next time we come to them, they'll have trust in us, our platform, and the data we're presenting out. So it's really important, moving into your program, to think about small, proven wins. This is when you start to reach out for vendor demos and RFPs and making sure, because now you have a shared understanding of what human risk is, you need to share that with the people that you're going to look at to help you solve this problem. you have… Stakeholders that are on board, so they're not gonna block you when you get to that point where you're starting to connect data sources. You have a clear understanding of what data you have available, and you know that you're going to take intervention on it. Now I can talk to people, because you want to tell that story in your RFPs, right? When you go to a vendor, you want to say, this is my expectation of a human rights management platform and program.

14:27And I need you to be able to support this, because I promise you, if you don't, what you're gonna get is a half a dozen really fancy phishing platforms that call themselves human risk management, trying to solve problems that you're not interested in. You being clear before you take that step, before you reach out. It's going to really make sure that you get aligned with the right partner, the people that understand How to categorize the risk in your organization. How to surface that top 10% risky population that's causing the most problems. And how to intervene with them. Potentially, not through phishing simulations. Okay, after you've… built that trust by doing a couple small wins, partnering with an organization within your group to do something that's really great, you're gonna move on to demonstrating the value. So. It's really important, again, especially when you look at the first elements that you're going to want to go after, to find an organization within your security team that has a problem that can be solved with people.

15:25Okay, what this might look like, and this is an example that isn't actually going to get back necessarily to a direct tie-in to risk, but it's going to show value and build credibility. So what this may look like is working with your security operations center and saying, what's a pain point that you have? I did this once. They came back with DLP and free mail, right, sending stuff out to free mail. And I said, okay, let's talk about this more, let's unpack it a little bit. Let's talk about what challenges you're having there, what's the baseline frequency that you see this happening? And we couldn't really come to a data picture that helped support it. It was anecdotal, they knew it was a problem, they could feel it was a problem, but they didn't have the data yet to give me. Well, that's not a good first option for me, because if you can't really categorize your issue, I might not be able to right away, and I want to make sure that we have a win together. But through conversations, what did come out was that When our security analysts logged in in the morning. They were oftentimes really frustrated by a queue full of misreported spam emails.

16:22People using our report phishing button as a spam filter. Okay? Now, is that a risk in and of itself? Maybe not directly. I will say, when a security analyst has to go through a whole bunch of garbage in their queue to get to anything that might be real, that presents a risk. It's also a lot of wasted time, a lot of wasted brainpower on stuff that people can be focusing on real, valuable incidents for, right? So we said, let's tackle that. Let's look at what we can do about understanding the volume of misreporting that's happening, and then we can take that as an education thing, no problem. Tell people why that's not valuable for them. You don't want to use a report phishing button as a spam filter, because you're going to keep getting spam. We have other tools for that. Here's how you use them, here's how you differentiate. Let's get more precise on what you report, and increase that precision, and that becomes the metric now that we want to track with our HRM platform. How can we increase the precision of what's being reported to our SOC in this space and reduce the noise?

17:22Once we get there, we get to demonstrate value. This is value that any leader in an organization will immediately understand, because this is dollar value. This is people hours. When we can say it takes 20 minutes to disposition a misreported spam, and we just decrease that by 60%, Like, that's money in the bank. That's people being realigned to really important work that we're wasting time. And then once you've been able to demonstrate that picture, you continue to iterate. Year one is all about iteration, growth, and building credibility. Once you've built that, then you can look at accelerating the data that you bring in, taking on data sources that might not be as clean, that have a little bit more question in them, because you have some solid foundations, you can pay attention to what you're doing, and you can start using the AI tools that are available to you to make sense of some of that noise that might be a little bit dirtier. And continue to grow your program. And I think it's also important, I put across the bottom of the slide, one thing to start talking about from day one when you're going into this is some behaviors you can move in a month, two months, a quarter. Some of them take a long time.

18:26So, target early on the ones that you can change quick so you can demonstrate value, set the expectation that there are bigger things that are going to take longer to fix, and we'll get to them. But we need your support and your buy-in to continue doing this. Okay, so I promised a high-level roadmap. If I were to start Monday. Very high level, because we only have so much time here, and I want to make sure that we're being good about it. And I do have an appendix in these slides that you all get later on, so you can kind of dig a little bit deeper into these steps. But this is how I would do it. I would start off by defining what human risk means, get that alignment, get that agreement. I would move on to inventorying the data and signals that I have available, starting with what I own, and then moving on to what I have strong partnerships with, and what people have problems aligned to. After we've had those signals, I would move on to identifying specific populations aligned with those risk signals, and see, are those risky populations? Anecdotally, if we have to, to get started. Pick one. connect action to that insight, measure the impact, and start to grow. I know it sounds very simplified.

19:28But it's the way that you get support and you get buy-in from your leadership by demonstrating success. Remember, this is new to them, just as new to them as it is to us. And when they're asking for things, they might not know exactly what they're asking for, so we have to help show the way to that next stage. I would be remiss to not talk about AI. So, where does AI come into play? I see 4 really great ways that it can be helpful when you're trying to build out a human risk management program from the start. One is obviously, as you're pulling these data sources together, many of them have lived in their separate worlds for a very long time. People might be adjusting access based on just what they have in their access management platform. They might be, you know, changing people's email habits based on what they have in the email platform, but they haven't been brought together necessarily to look at, from the human behavioral perspective, what to do. AI is really great at helping surface some of those patterns that would be in that disparate data as you bring it together.

20:27Obviously, I think the one that everyone talks about in the security awareness, everyone's very comfortable talking about, is drafting things and summarizing. Why I say this is important while you're building out a human risk management platform is because I'm guessing, and feel free to raise your hand if you feel otherwise. Most security awareness programs are resource constrained. We don't get a lot of people thrown at us to do extra work, so we still have to run that compliance program And we have to build this new HRM program, and probably aren't going to get a lot of extra resources to do it right away. So… Being able to use AI to draft the trainings that you need to do, to manage the stuff that you have in your compliance queue, to build those targeted interventions that you're going to have to start building, it's still the same people that are trying to do all of this, it's just added work. So utilize AI to help maximize your efficiency in that space. And then also, as you're putting together new reports, as you're trying to summarize your insights in different new ways to be put up to leadership, it's a great tool for that as well. Just remember.

21:26At the end of the day, you gotta review it. It's your name on it. Scaling without headcount kind of goes along with those first two, so just increasing the efficiency of your team. Most importantly, at the bottom. It's all about tuning. So, as you have approved AI tools in your system, use them to turn it upon your HRM program to make sure that you're putting in content, interventions, and activities that align with your organizational needs. We talked about it earlier this morning. Load your policies into it so that all your trainings align to your actual policy language, so that you're really teaching people not what's in a generic module you brought from some vendor. But what aligns to your company's expectations? Turn that AI product back on your program. You've implemented a couple of data sources, you have some behaviors that you're trying to track down. Have your AI analyze the signals that you're getting, and identify gaps where you might want to integrate new data to better flesh out the behavior picture for what you're trying to reduce. Utilize it as a tool to enhance your program, to grow your program, and to be that thought partner that can bounce ideas back and forth with when you might not have enough resources to do it with another member of your team.

22:37Okay, and to wrap before we go to Q&A, Simple steps that you could take tomorrow. Now, I've been talking a lot about people who are just starting to build a human risk management program, or getting in those first steps, but I think these actually apply to anyone that has an HRM program, regardless of where it is in maturity. Because, whereas it's really smart to do these things up front, it's also a great idea to just take a step back at some point, periodically, and say, do we still have agreement on these? Do we still have these covered? So, Monday. When you go back, if you're in this boat and you're looking to build something, step one. Set up a meeting with your key stakeholders. And say, let's talk about human risk. What does that mean to you? Here's what it means to me. Come with a definition, get feedback, get people to talk about it. And go back and forth until you can agree on A real common understanding. Once you've gotten there, have the conversation around who owns what. Some of it might live with us. Some of it might live with HR. Some of it might live with insider threat.

23:35Understand where your realm is, so that you know that you're operating within it, and partnering when stuff moves outside of it. Step 2, start mapping the ownership of the data signals that you have access to. So go out there and make a simple grid. What data do I have? Who owns it? Is it me? Is it somebody else? How clean is it? What behavior signals map to that data? Get that grid ready, get it in pocket. Identify gaps for things that you want to do, where you don't understand the answers to those questions, so that you can go chase them down. And then, step 3, find that partner that has a pain that you can address. Talk to your SOC, talk to your DLP team, talk to your GRC team, whoever. Start talking to other security teams to see who has a pain that can be fixed with human intervention. That you feel like you can make impact on. And then dive deep into what that would look like and get their buy-in to be a supporting partner, so that you can prove something out.

24:31Provide real value, and start to scale. And with that, I'm open for questions. Thank you, David. You have quite a number of questions online, so… Oh, no, you have 2 minutes, that's all you got. Oh, wait, sorry. You're actually right, you have about 2 minutes, so… Kidding, so we've got, we'll go on for 4… 4 more minutes. So, the question is, I'm working on stakeholder alignment, but other departments like HR, are hesitant to give me their data. How do I overcome that? Well, step one is trust. Right? So, and we talked about that a little bit this morning as well. It's really important to establish trust in how you're going to utilize the data. I also recommend minimizing the data that you have to take. Sometimes, when you look at connecting with other platforms, defaults may be a little bit over-permissive for what we actually need, so refine down your ass to exactly what you need to accomplish your initial goals.

25:33Once you've established that, re-engage the conversations and say, okay, I can do this job with just this data for now. as we expand, I may need more. If you're working with an HRM partner. you know, work with them to understand how they utilize the data, how they store the data, how they disposition the data when you're done with it, and make sure that that's all being communicated to the appropriate people, because obviously, I mean, we're in security, right? It's really important that data security is paramount in everything we do, and if we can't speak to that trust, if we can't build that trust, and try to build credibility off of it. It's hard for us to say that we're We're really good security partners. So, minimize it to just what you need. Address any fears that they have that they express specifically. And then, re-engage the conversation. Great. Kind of related, what are the signals or data sources that are most valuable to look at first? So that is a question I cannot answer for everybody.

26:32Right? I think that every organization has different priorities. And, moving from a financial services organization to a healthcare organization, I was able to see this firsthand. Things that we thought were important here. That I thought I'd come in and say, okay, here's some really important stuff to start with, turned out to not necessarily be. So I think that's a question that you have to surface through those conversations with your key stakeholders. Have really meaningful conversations about the pain points they have. And which ones relate to human behavior. And then you can help to prioritize the data sources to go after. Awesome. Thank you for the insights, and we have one last one. Once the program was funded. How did the conversation shift from measuring risk to actively reducing risk? That is a great question. So, that comes down to the small wins, right? Once it was funded, it became incumbent upon me to then say, this is how we're going to provide value. This is how we're going to reduce risk.

27:31So, have that ready to go. as you go into those conversations. And you have that ready to go by doing what we talked about. Getting the alignment, understanding where your pain points are, and understanding where you can have influence. come before you start implementing platforms, before you move into proof of concept, because you could use your proof of concept to show that value already, with ideas as to how you're going to actively reduce risk. I'm going to baseline this, I'm going to intervene like that. And this is how we're going to measure to prove if it's working or not, and then adjust if we have to. Not everything… the other thing I'll say is not everything is going to be successful, right? Some interventions are just not going to work how you expected them to. That's okay. We're iterative. We're… innovative people. We can adjust and change how we approach things, so be clear about that up front as well. My first intervention may not reduce risk, but that doesn't mean we're going to stop trying, it means we're going to learn why it didn't. and then try a new tact. But I think that's something that we have to drive that conversation when we have these programs being built. It is our responsibility, it's our strategy, it's our program, so we should be the ones that are saying, this is how we're going to reduce risk.

28:36Well, thank you so much, David. Thank you.

Auto-generated from the live recording.

0:07Alright, hi everybody. Good to be back on stage and bringing my friend Gennady here with me. And… You know, as you saw, we had some great examples of Folks who have been pioneers in this space of human risk management. And these awards reflect that. And Gennady and Stewart title, really exemplifies, in my mind, that idea of leaning into a concept which You know, is fairly new still in the market. And when you are that pioneer and you're taking those first steps in that journey, you're really setting the stage for others to come behind you and feel a sense of confidence that they too can achieve the same goals and outcomes that you achieved. And so, I really appreciate what Gennady and Stuart have done in forging ahead, and really kind of creating a program I think that you guys should be very proud of, and I certainly find to be one of the more cutting edge in the industry today.

1:05So with that, Gennady, maybe you could give a little bit of your background. Obviously, there was a little bit of a intro there, but I think understanding your area of ownership at Stewart, how that's laid out, and how you kind of came to be, you know, the CISO of Stewart today. That would be helpful. Hello, everyone. This is my 12th year at Stuart, and prior to that, I spent in two fintechs, and thank you, Damon, for reminding me how old I am. Speaking of compliance, back in 2003, this was my first introduction, I self-attassed at that time voluntarily, to CISB. Most of you probably don't know what it is, but some of you might know what it became, and it later became PCI DSS 1.0. That was the first, probably, program that actually required mandatory training, employee training, so I've started it back in very, very, very long time ago.

2:11And, so I've known all cons and pros of this program. I've been running programs on my own using SAT tools, and at some point, I kind of reached that threshold where it's no longer working. Yeah, absolutely. And so, as you've heard throughout the day today, and we know just from industry research, 70% or more of security breaches have a human factor or a human-driven incident that kind of led to that. And we know that we can't train our way out of that, because the breaches keep coming. The security incidents are not stopping or ceasing. So how did you come to that realization that perhaps that status quo that you grew up in, of security awareness training as being kind of your primary tool to interface with your end-user community. How did you come to the realization that, you know what, there's gotta be something more than this? There's gotta be a better way?

3:07Yeah, our traditional tree that we've been using for decades, fish, train, report, and measure all the out… all of the metrics and performance, really doesn't affect the outcome, and each of those legs of that stool actually has its own problems. like, for example, fish. It's very contextual. It's very important to understand, you know, who your audience is. As a matter of fact, it was interesting, I visited our World Global Company web presence in different regions around the world. And I visit my Costa Rica office one day, and they said, and we've talked about it, and they said, oh, well, we know all of your phishing simulation emails. I said, how do you know? Well, because they all come in English, and, you know, ours is in Spanish. So, as you're developing your program, you need to start thinking about it. For example, you know, those FedEx or DHL emails that you're sending, click on this link to get your updates or your packages delay, well, it may not exist in India, or it might not exist in other parts of the world.

4:16We have a presence in Canada, and Canada is, on the east side, is divided by French, Canadian, and English. Like, in Toronto, it's English. Up in Quebec, it's French-Canadian, so you really need to understand your audience. The second reason why it doesn't work is because it's very timely. And I've tested it so many times, so if you are doing… if you are doing your training campaigns that are resonate with an event, whether it's the new healthcare enrollment, or tax seasons, etc, you're gonna get more clickers. So basically, it doesn't really measure, you know, is it effective or not? Do the people… are the people actually reacting? Next piece is the training. Simone did a great presentation about how people perceive the information. Different generations perceive information different. And then different people are attuned to a different type of training material and how they perceive this. Some of them like series, some of them like cartoons, some of them like short video, long videos, etc.

5:21And the final reporting, that's actually interesting. I do a lot of, I do a lot of training and work that I create myself. I do weekly blogs almost every Friday throughout the year. I do my monthly video recording and video blogs, which I don't do anymore, my digital twin does. Full disclosure. And, so I've trained a user over the years, and what I… what was interesting is they're now… they became more resilient, but they became more resistant to click on anything. So what I start noticing, and while I was able to achieve the higher number for reporting… by the way, I hit the threshold, so I set myself a goal, 35%, then 45%, then 40, 40, 40, 45%, then 50. I never reached 50. So I think I stopped at, like, 42. But they really don't measure, they don't measure outcome, because they don't measure the reality. And what I found was there is actually less people now opening the email, opening phishing simulation emails, because they became more resilient, they take with critiques and everything else, and they just don't want to risk it.

6:31And that's a behavior that I want to embrace, but it's not calculatable. The last problem is, and I actually stopped reporting to the board these numbers, because they're hard to explain. The simulation numbers on reporting are very important. What's even more important is the real phishing emails, because they help my team To be successful, they have my team to stop the attackers and help them every day. And that's very hard to measure, because you really have to extrapolate, take the amount of email that are coming in, and kind of guess. But that's probably the most important number. So that, that's why it doesn't work. And, so we… we've talked about people perceiving information differently. And, so basically, at some point, I come to realization I can't fix the people. So there will always be a person or a few people, who will always click on phishing email, and by the way, you might not be surprised, but some of them are actually the highest performers, so it's a very hard conversation with a business.

7:41to saying, this employee continuously click on an efficient email, what are you gonna do about it? I mean, they bring in significant revenue to the company. So that's… at that point, I kind of realized I have to do something different. Right. Yep, so behavior change through engagement is a tool. But it's not the end of the story, right? Correct. And so, as we look at the modern cybersecurity team in enterprises today, now, generalization, but pretty consistent, I'm seeing a lot of siloed tools and siloed people, professionals working in those tools. So, there's a portion of a team that maybe owns Endpoint Detection Response, another portion that owns Email Gateway, SAT, GRC, DLP, the acronyms go on and on. But they're sitting in silos, staring down at a console that is specific to their domain. How do you break that? Or how do you actually solve for this problem when that's the construct that exists in a lot of organizations today?

8:39Yeah, not only the sitting in a silo, but they're also very binary. If you think about the protective and detective technology, there's an alert you, notify you, inform you, and your protective technology actually is their allow or block. So, the DLP with their allow or block action. Your IDS IPS will do the same. Your endpoint detection tools. So, it's very binary, it does not have a contextual information about the user, it doesn't have a contextual information of a behavior. And that's where this human risk attribute becomes essential. Because today, in my SOC, for my security analysts, after they analyze all of these different panels, all of these different parameters, etc, and then they need to make the determination, it's, again, it's a binary decision. It's not only a security technology by themselves are binary, but the decision my SAC analyst was doing yesterday had to be binary, either what am I doing? Am I blocking or allowing? Am I resetting a password I'm gonna let in through? Am I elevating MFA, or… so it was very, very binary without contextual information.

9:49Yeah, so human risk context. to enrich the decision-making of these folks who are within each of these various security silos. Correct. So, this is really interesting, I imagine, to a lot of our audience, right? Because this is ultimately where a more advanced human risk management program can go, right? Yes, you're engaging your end users, you're trying to change behavior, you're using the tools like training and nudging and phishing to do so, but when you can leap over. and be able to make that human risk context available to the SOC, to your DLP team, right, to your identity team. Now you're really cooking with gas. So, can you give some examples of how you guys are doing that at Stewart? Sure. So, that's a great point, because, you know, essentially what I'm doing now, and this is where the pivotal point for me from the traditional SAT was. So, if I can't control the user's behavior, and if I can't control the outcome for the user's behavior.

10:51So what can I do? How can I put the controls around the users, additional security controls around users, knowing their behaviors and knowing their behavior store using my existing controls? And what we've done is, Living Security is already incorporated, it already has all the connections to all of our security tools. It receives all of the telemetry. So what I'm using is… I'm using today the bi-directional connectors where existed, and then webhooks where they're not existing, and start enforcing different policies and different security controls using technology that I already own, security technology that I already own. not… for not making a binary decision. In order to be successful, I want to be able to make the risk-averse decision, and the user actually is the highest part of the risk.

11:46Right, so, maybe starting with identity. maybe you can walk through kind of a use case there today, I think, if you're… if you're comfortable sharing the vendor you're using. Sure. So, I think the pivotal point, and for some of you it may be a difference, so we have an IGA solution, identity governance administration solution, and that's… That's basically, the central brain for us. So this is source of truth. It's connected to a human capital system, it connects to Entra and Active Directory, it pulls the data, it knows everything and anything about the users from those two systems, and it also connects, and that's what provisions user permissions, users control, user actions. And, what we're using… what we're using today is we actually, through… through the Living Security, we're actually pushing, I'll disclose, I'll say it's… we're using CellPoint, Living Security has a CellPoint connector, and I think a few others, for our IGA system.

12:48So what we're… what we're able to do is to actually use the group membership, but either using or removing users to a specific group, or from a specific group to be able to enforce the controls. These controls could be different, and I'll go through… later, I'll go through some use cases. that we are… we're currently at… we implemented, currently implementing, and will be implementing shortly. But basically, that's our biggest pivotal point. So we're controlling through our IGA system, we're controlling what users can and cannot do based on their behavior. So, identity… and group entitlements being informed by the context of whether the user is risky or not right now. Correct. Right. Now, let's talk about insider threat DLP, right? So, DLP as a product category has been in the market for almost 20 years now, venture to say that the vast majority of DLP is not in a kind of blocking mode, because, frankly, we're worried that we might stop an actual legitimate business process.

13:53So, how can human risk context help you and your SOC team make better decisions there? Yeah, so, for example, DLP controls have a different control, so it can allow upload, it can allow download, it can… basically, it traverse, it controls the traffic, it controls the traffic flow, what's allowed to users, what's not allowed. So what I'm… what we're doing with DLP is we're actually fitting that data from the user's behavior, user score, to be able to adjust the actions. For example, for normal users, we're actually implementing DLP in kind of a in carrot mode, not a stick mode, because, you know, I believe the human behaves when humans are actually worn or put in specific circumstances, humans behave differently. So what we… what we're doing, actively doing now, is… We're actually prompting users to say, we absorbed this behavior.

14:51it doesn't match our rules, do you want to continue or not? And that kind of pauses and stops the users, and we actually inform them, that they're, whatever they choose, they continue… they can continue with the action, and… but it will be recorded and audited and potentially reported to their manager, etc. Your mileage may be vary, you can use it in different, forms. in the format. But what that allows us to do is, actually, it allows us to use the score to block certain. So, like, for example, if the user with a higher score, we'll just allow them to be… to self-approve and move on. For the higher users, we'll just block the behavior. So we're basically using the same binary zeros and one block and allow, but now we're taking it in a user's context. Frankly, you can take the risk to potentially block, because you have a higher level of confidence… Correct. …that that user is potentially representing a risk to you right now.

15:50Right? So you can make that decision. So beyond those specific use cases, how do you think about your deployment of HRM as you've described it? What does success look like? What are the outcomes you're trying to drive to, and how do you know it's working? First of all, I want to see behavior score changes. So, I gave you an example with a DLP. For example, if the user… if I don't see users exhibiting this.

17:29to this, to us, to this market space. So now, you have 3 different dimensions that you need to look at. Now you have to look… We've teach our users for decades, look at imperfect language, you know, bad punctuations, greetings, images, etc. Now it doesn't exist. Now, if you look at the second dimension, is it's very contextual, because AI can actually… can actually write an email in the tone of your HR. In the tone of your jersey, in the tone of your CEO, your CFO, etc, because it contextualizes and understands the concept. And the last components that we need to factor in is velocity. AI brings in. So remember, the fishing exercise and training that we're doing once a month, or once in three months, or once a year is no longer working. We're seeing new techniques and techniques. My team sees new techniques and techniques literally daily now, today.

18:31So… no. Yeah. Yeah, because of the speed of AI, being, you know, react and respond needs to be essentially replaced with predict and prevent. I need to be able to get ahead of it, because if I'm trying to react to AI, I gotta react at machine speed. Correct. I can't. Correct. And you can't really adjust, and this is where, I'm excited about where living security is going is, and that's where your training needs to be. Your training needs to be the nudges that are actually relevant. Some of the, some of the use cases with the training we're looking, and I'm very excited about, is, again, using the same technology. For example, user was blocked go into the website, and the category that reported by my secure web gateway was, website is less than 30 days old. Maybe I'll send a nudge to the user 5 minutes later and saying, hey, we've noticed you, you sent… there is probably nothing wrong with this website, but just be aware that attackers are now creating websites, sending these phishing links.

19:39with orchestrated, websites, they're usually less than 30 days old. This is why we blocked it. So that creates the teachable moment at the moment when it's fresh with users, because when you give them a teachable moment next month, next quarter, etc, it doesn't… that's number one. Number two, it's resonate, and this is where it has to be… you can no longer land them on a page and say, here's the red flags you should have recognized, and here's the seven of them, because these red flags are not relevant anymore. Because they won't exist tomorrow. Yeah, I love that. And this morning, Kelly and I spoke about two things. One, ask Libby. Right? Which is, you know, a capability that's in development now, where the end user has their own AI agent, their own security analyst, who can help them navigate those potentially fraudulent or risky situations, to your point, in the moment, so I can navigate that myself. The second thing we spoke about this morning was the convergence of the human worker and the Agentic worker, right? And having an integrated understanding of risk associated with both.

20:45You've already started some work in this as well, and we've spoken about how we can kind of meet together with Living Security's direction and what you're doing. Would you expand on that a little bit? Yeah, so there is… your agent needs to have an identity, and if they don't, you probably need to think about it how to assign them identity. There will be non-human identity, but there will be a lot of telemetry affiliated with your agent. So your tools, whatever they are today, whether you're a Google Shop or a Microsoft Shop, so Microsoft E7 license actually has an Agent 365, and Agent 365 has a capability a lot of capability for auditing, for using Purview as a DLP, to have and monitor an added safeguard, and guess what? All of this logging, all of this capability will be bi-directionally fed into your human risk management platform.

21:42And your platform will be able to determine what's the… whether behaviors of these agents are normal or abnormal. I can also tell you your users change slowly, they're drifting slowly. Most of the users… most of us humans don't change behavior pretty frequently, or it takes a long time, or agent to change the behavior. So the agent will… will be very, very dynamic. They can change behavior very, very quickly, so you need to build a baseline of what the normal behavior of the agent looks like, and start alerting and monitoring and drifting from normal behaviors. Yeah, it's exciting to see this evolve, and we'll be working with UGNATI and our other customers as we bring that new technology out to the market and to get that feedback. My final question really is kind of building on what Damon was saying before about getting buy-in, right? So you're… at your level, at the CISO level, you had a vision.

22:40and you brought that vision to your team, and you were able to cascade that vision into the different security silos. That buy-in was there from day one. That's not always the case. And so if someone's listening here today on the livestream or in the room, and they're not a CISO, but they believe that this is the right direction, maybe some words of advice for how they can get that buy-in. Yes, I was fortunate because I own, a lot of the stock myself, so I own SOC, I own Identity, I own DLP, I own tools, endpoint detection tools. So, this is all within my power, within my ecosystem, I can connect the dots. Depends on your function and where you're at. You need to build this relationship, you need to build this trust with the different business functions, but not only business functions, but different security functions, because you will need this support. You can be successful. I'm gonna give you some examples some takeaways in a minute that you can take, some use cases I've been working on and continue working on. There is a huge potential in this, because you can Finally, you can control the outcome from the user's behavior. You can control it through the system's control, through your security systems, through turning that binary 0, 0 or 1, allow or disallow, now factor in the user or human's behaviors.

24:03So, partner with the team, with your leaders, partner with your CISO, if you're not a CISO, if you're in a security… if you own the security awareness and training program. Partner with your identity team, maybe it's belonging IT. Partner with your DLP team, partner with all of these teams, because you can't be successful without them. I want to share… do we have time? Absolutely, go ahead. So I want to share some, and forgive me for kind of reading. I juggle some notes. Some interesting cases, Mike asked me earlier, and I kind of left it for, for later, but, this is… this is my journey, and your mileage may vary, depends where you're at in the journey. I highly recommend you kind of start looking at, because you can't… you can't control, you can't fix people. I… I'd say you can't fix the people. So we, we were already implemented, and it's been, it's been up and running for us for months. for over a month now. So if the user fails a certain number of criteria, I'm not going to give you parameters because it's relevant. Yours will be different. So if the users fail a certain number of times within a certain period of time, they get added to the sale point of the group, and they actually get prompted MFA every single time, as opposed to behavior, as opposed to conditional access that we control for all of the other users that are kind of behavior-based. In order to get off that group, they actually need to exhibit the positive behavior, not click on efficient simulation, and then report over a certain period of time. Here is a great scenario, it's been working for us, we've been very, very successful with it.

25:40In Security Operations Center, we actually implemented the webhook. Now we're feeding this data, the human risk score, HRI score. We're actually feeding into a security operations. I'll give you a couple examples. I'll give you two examples. One is a geolocation, we trip to alert that's saying users in a location where they haven't been before. So today, before, it was binary. It's actually going live in a couple weeks. So today, or yesterday, this was a binary decision. What do we do? We'll contact the manager, we try to use outbound channels to confirm whether a user is traveling or on vacation. So today, the score allows us to make my SOC to make the immediate decision by either blocking them. Or still going that manager route, if the user is exhibiting good behavior, or if the user is bad behavior, we're just locking them out. It's similar with the password alerts, etc. There's a lot of different telemetries and alerts coming that are related to a user that were before binary, now it allows us to add the intelligence to this.

26:46So our next chapter in the months, we are… in two months, we are, gonna deal with privileged users. The privileged users, again, depends on the score. Your privileged users have a key to the kingdom, and whether it's the privileged users, privileged administrators. or whether it's your users, privileged users to your application, it really doesn't matter. They still have a key to the kingdom. So you have to tie, behavior, their behavior scores to what the access they have. So we're planning to have multi-factor authentication for user… for administrators or privileged users who have a low score. To use multi-factor authentication every time they connect to the systems. There's a little bit, longer horizon, about 4 months, is the GLP and security web gateway. For risky users, we're gonna block the download, and uploads, and for, not risky users or vigilant users, we're gonna allow them in. And for security web gateways, this is actually a perfect, case if you have, if you have a technology, is… So for the risky users, if they click on an email.

27:56Then… and they went to the website, so their web sessions will be in remote browser isolation. So that actually protects them from typing in any credentials or uploading or downloading, downloading any information. And then, our longer horizon, about 5 to 6 months. on Secure Email Gateway is, you have this data, you have users are… remember, there is a… there is a behavioral score, and there is a HRI score. One is, driven by users' behavior, something they can't control, and some of them is driven by something they cannot control. For example, I can't control if I'm attacked more than Mike, if I receive more efficient email, more spec… etc. So we… we're planning to also factor that in and use it as a leverage or as a control for users who have access to a sensitive data, and then attack Moors and other users. You know, we'll set up additional parameters and security controls.

29:00So, I finally found a platform that gives us the power to be able to actually intelligently use the control around the users. Thank you. And context is king, right? When you have the context, I can make better decisions. These use cases and more are the kind of conversations that my team has with you, and would love to have with all of our customers and attendees here, as you look to design out your programs going forward. And I think we might have a question or two From the audience. First question, Gennady. As a CISO, which stakeholders do you recommend are involved when evaluating an HRM solution? Is it the same as SAT, and if not, why? Knowing now what I know, this would be my last answer I just gave 2 minutes ago. Make sure you partner, with your security leaders, because if you want to be successful, if you want to take it to a next level and use it as a leverage, as a control lever.

30:02you need their buy-in. So you need them to be comfortable, you need them to be on board, if you don't support… if you don't own that function. Obviously, if you do, then it makes it much easier. And when in the life cycle of considering a solution would you bring those folks in? I would bring them at the very beginning. Right away. Right away. Okay. Correct. Because you need to know how you… what capability you have, and whether you can be successful or not, whether you can design the system or not. You're designing the solution together. Correct. Second question, would baselining expected agent behavior against the related human behavior, so human-to-agent relationship. Does that make it easier to detect problematic anomalies? Take it for what it's worth, it's my personal opinion. I would say no. I'll give you an example. I gave this example earlier today. We as a human, our natural-born behavior is always positive. We always… We always think, you know, about good. We always… we intentionally do good things.

31:08So, example I gave was, I might have permissions and privileges. And I know what I need to access, and I only access what I need to access. I'm not trying to go and poke… find the holes and poke. This is my natural behaviors. But, depends on the complexity of your company. Through inherit permissions, you might have other permissions you don't even know exist. Agent will find them, because that's what this is designed for. They design for to achieve the task. So they'll be able to crawl across your networks, all the niches, and find the permissions and access you didn't even know existed for you. So, I would say… this is why I would say no. So, you have to… you have to treat them from a behavioral perspective, and they would be the same as humans, so you need to monitor them, but I would say you need to baseline them differently.

32:04Well, I think that's all the time we have, but again, Gennady, I really appreciate you and the program that you've built, and I believe you're a pioneer in this space, and I think there's a lot that the folks here can learn from you, and look forward to continuing your success. Thank you. Thank you.

Auto-generated from the live recording.

0:07Hello, y'all! Hi, everyone. Hello, y'all! Hi, everyone online. My name is Ashley Atiles. I know we both have a little bit difficult last names, but Atiles. Yeah, thank you, but… Ann? Alfonso Mancuso. And I'm not from the South, so I won't y'all. Y'all. What's that mean? Okay, well, anyway, so, so again, I'm Senior Director of Human Risk at Labcorp. what is human risk? Of course, that's all we're talking about here. So normally, when I say, what is human risk, it's all the risk that comes from a human, which sounds really daunting, but that's what I do, and I'm also, lead of… oh, excuse me, leading data protection right now, but that's just interim. Alright, and, I am, Vice President at Labcorp and the, Digital Trust Officer, and I… Have responsibility for anything that makes us advance our digital trust footprint. Security architecture engineering, our application security enablement program, product testing, and all of the identity and access management function for the enterprise.

1:15So, the first thing I want to say is thank you to Living Security for our Precision Award. So, thank you for recognizing the hard work that my team does. So, Addison and Jen, I know you guys are watching. Very, very good job, great, thank you. That's me clapping for you guys, so sorry. Alright, and if you guys were with us last year, I mean, at HRMCon, we actually did a presentation that was kind of the precursor to this, so it's kind of going to be a continuation, but if you weren't there, it's kind of self-explanatory, so you guys weren't missing anything. So, what we'll cover today, those time limits might not work because Alfonso's on the stage with me, but they may, they may. So, what we're gonna cover… the first thing is technology doesn't make MFA stick. Actually, the people do, and we all know that people are the most important things, not just really technology. So every MFA… Every MFA workaround is a signal, not a compliance problem.

2:14Problem? Nope. Struggling? Yes. Okay. And identity risk is no longer limited to people, now that we know AI and AI agents are first-class identities. As well as identity programs, they succeed when security aligns and how… with how the work happens. It has to be embedded, it has to be complementary, not just layered on top. So, the first thing, of course, technology doesn't make MFA, people do. So, when we talk about adoption is the real MFA challenge. So, we can say everyone is enrolled in MFA, but what are they actually doing with it? Are they using it securely? Are they using the right factors? All those types of information pieces that we can gather and kind of make decisions from there. So, security teams measure. Well, okay, well, we measure coverage, or adoption, assurance levels, and the stronger the authenticator or multi-factor type, the better. Compliance, meaning not just checking the box, but compliant with Being able to authenticate safely and securely.

3:24And then the risk posture, right? We're extending that beyond just the application and the user, but also a combination of the application, user, and location signals, device signals, and anything we can get our hands on. Yeah, so looking from the technology, so he would be the technology part, or the identity part, and I look at it from the workforce. experience. What are they experiencing when they're going and using MFA? So, we always hear there's friction. Why do I have to do that if I… it's my data, or why do I have to do that I mean… I'm pretty sure that at least all of us have said. Why do I have to do that again, even outside of the organization? I'm talking about real life. You know, really. So, and interruptions. Is it taking too much time to actually do what we're asking them to do? learning curve, so we have everything from service workers, phlebotomists, up to CEOs, so there's a lot of different aspects that we have to consider. So, we have to meet them where they're at.

4:24And also the trust in the process. Why is it that they need to be using phishing-resistant MFA? Why is it that we're asking them to do this? It's always the WIFM. I think we've always said that, is what's in it for them? Not only are we asking you to do it. So it's secure on our end, it's also secure on your end. So the two main questions. R? Are we… are we actually securing our credentials and our identities? Are we reducing account compromise? And the answer is yes, but… And then, always from the workforce is, but can I get my work done? Can I get my work done in time? Can I get it done without any interruptions, or the minimal amount of interruptions? And it's always the balance between friction and security, security and friction. So, every MFA workaround is a signal, not a compliance problem. So, you've heard a lot about signals and behavior signals. So, we would just want to say behavior reveals where security and work are misaligned. So, a couple years ago, and I think last year, I did a presentation with Ashley.

5:30That said, 72% of people break security policy on purpose, whether that be MFA or anything else, because we put a barrier in their way that doesn't allow them to do the work how they need to do it. So we're not meeting them where they're at, where we actually could sit down and understand the business process and say, okay, how can you do this more securely? So what we observe is actually the behaviors. So we see delayed enrollment. So we're asking them to enroll in MFA. Are they doing that timely? And if they're not, why? And then bypass request. So, are they trying to do some type of request going around the security controls? And we all know about MFA fatigue approvals, where they're just saying the happy clicker, yes, yes, leave me alone, even if they didn't really send the request. And then, of course, what we see at Labcorp, and I'm sure a lot of people see, is the secure accounts and devices. So we have phlebotomists using one computer, maybe there's 10 of them using the same computer, maybe under a shared account or shared device. Yeah, and one of the most impressive things that we're seeing from the behavior and The encouragement, the nudging, which we'll get into a little bit more, is… Almost half of our workforce are frontline workers. They don't have an assigned asset to them, whether it's a laptop, MacBook, or a corporate phone.

6:51And we're seeing close to 95% of our workforce is enrolled in MFA. Many of these individuals are doing so largely because of the communication and the program awareness of the importance of securing your credentials. So, and on that, Ashley always talks about her daughter, Bella, so my daughter, Carson, actually works at Labcorp as well, and she is a lab worker, and she'll message me sometimes to be like, why do I have to do that? Like, just leave me alone, like, and I'm like, okay, here, let's step back and understand what it is we're asking you to do and why. But she's really just trying to be facetious and make my life hard, but, you know. That's what kids are for. But that's what the signals are, right? We take that behavior and then look at them Well, they get translated to what we look at and consider signals. Friction. Now, why do I have to be prompted all the time? Hey, I'm on the network, why am I getting prompted for MFA every single time I try to access this application? We're taking all of that information and additional signal information and trying to analyze it, and we are using AI, analyzing what that means.

7:56Relative to the environment, so that we can cater more targeted… a more targeted approach. To try to improve not only the behavior. But the net… the net adoption of what we really want, which is more secure, with less friction at the same time, right? And that's what phishing resistance is really all about. Gary and I keep fidgeting with my hands, because I don't know what to do with them, because you got me, like, should I have my hands closed, open, like, behind my back? I don't know what's going on. But here, I'm just going to stand like this, face forward. Alright, and how we respond using that behavior and the signal. So, our actions, so just like Alfonso said, we're trying to simplify that access. Meet the person, or the colleague, or the workforce Where they're at. excuse me, reduce that disruption, because we always know, in our line of business, the patient is the first priority. We need to make sure the patient care is not disrupted. And improved communication, so that's definitely our wheelhouse. So, under our human risk area, we don't reach out to corporate comms or anything to get communications sent out. We actually send all those in-house. So we craft them specific for whatever use case that might be, and then we send those out.

9:08and definitely still the improved workforce experience. So we want them to think about security. kind of have it in the forefront, but not have to think about how to do it. I want to do it, but it's gonna be designed securely. I don't have to think, okay, I need to do this, this, and this to make it secure. It's just inherently secure. Oh, AI agents. Yeah, they are workforce identities. The industry… really recognizes them, and we look at them and need to look at them as a native identity class, not just a non-human identity like a service account. And why that matters, all AI agents are doing, Really, acting on behalf of a user. So, whatever the user security is, the AI agent will… will take that. I mean, prior… the prior speakers have talked about how agents will just discover what… what access you have, and use it to get the job done. That's where… that's where secure… more secure authentication methods, tighter authorization, as… as well as other controls are essential to ensure that The agents aren't doing something that they're not really… Intended or should be doing.

10:23So, we're not going to cover this slide in depth, because you guys can read that on your own, and we don't… we just want to make sure that we mention AI, because we're in the error of AI. So, this is one of my favorite slides, is actually, identity programs succeed when security aligns with how the work happens, and that means trust connects security and the experience. So when we talk about security, experience, and trust, what are we actually talking about? So when we talk about security, we're saying protect identities without creating unnecessary barriers. So we're giving them strong authentication methods. We're allowing them to use, or we're providing phishing-resistant MFA factors to them. And then we also think about the risk-based access. Yeah, and one of those… one of those key elements of risk-based access is adopting principles of zero trust. We haven't heard that term today, I believe. But, where the device is trusted, or the location, the network you're coming from is a known trusted environment. That, paired with Strong authentication and context, Will allow us to, Provide a more seamless, frictionless experience, but at the same time, assure that we're reaching our security objective and targets for risk management.

11:37And when we talk about experience, we're making secure behavior easier to adopt, and that's actually what we wanted to talk most about in this one slide, is what we're doing at Labcorp to allow this to connect the security with the experience and the trust. So we're trying to reduce that friction, streamline the enrollment, and support workflows. And the way we did that, we actually looked at the signals Because, again, signals is something that's going to help us to say, okay, what are people doing? Are they enrolled? Yes. We want to make sure, yes, they're enrolled. Okay, so what are they enrolled with? Are they enrolled with SMS, which we know that that's not what we want them to be enrolled with, but they were there, they were at the first step, they were at SMS, but now we want to convert that to a more phishing-resistant factor. We want to mature that factor. How do we do that? So we actually look at the data we have from our human risk platform and our human risk program and say, okay, so this, this subset of people have corporate devices. Are they using SMS?

12:32If they are, why? They shouldn't be using SMS, because then they don't have that barrier to say, but you can't make me download something on my personal phone. This is a corporate-issued device. It's for you to use in corporate locations, so we're not asking you to do something outside the norm, quote-unquote. Yeah, and what we saw from the numbers were… when we first started with our MFA, Enterprise MFA program years ago, probably 6 or more. the overwhelming, dominant authenticator type was SMS. Why? It's easy. I have a mobile device, all I have to do is plug in my number, and I get a text message with a code. I don't have an app to install, and Labcorp doesn't… have access to my private information if I'm using my personal device. So we… we targeted our program to say it's only being used for this purpose. We don't know anything about you or your device. And it is optional if you want to use your personal device. And by doing that, we saw very high enrollment rates and adoption rates, and now that's why we're taking it to the next level. If you're willing to use your mobile device.

13:44Use a push notification with a number challenge. making it phishing resistant, and stop using SMS, which is not… not as secure. As a matter of fact, we nudge them. with those communications, and they… their Precision Award winner, targeted at exactly the behavior that we're looking to change. So just recently, we introduced and modified the text message when you get an OTP through an SMS authentication. We give you the code, and then say, tip. Use Okta Verify, well, we're an Okta platform, no secret there. Use Okta Verify Push, it's easier, it's faster, and it's more secure. Yeah, more phishing resistant. Well, and phishing resistant, of course. Yeah, and some of the other things we did is, so when we're seeing not only corporate devices, we also used the data and said, okay, are the people outside of that using their personal phones, are they enrolled in SMS? Are they enrolled in OktaVerify? Are they using phishing Resistant?

14:46And a combination of those, we also modified some of the communications and gave those targeted nudges to say, okay, you logged in with SMS, one time a day, but we also see that you're using, or you're enrolled in MFA, I mean. enrolled in OctoVerify, why did, you know, kind of like, please use the SMS, discontinue the use of SMS, and use the OctoVerify. Yeah, and, and… Since we started measuring, 5 weeks? we've seen a 15% decrease in SMS for authentication, and a 17% increase in phishing-resistant MFA in the authentication flow. And every time we… implement a target, one of those nudges. We see a spike, and then a sustained sustained action or sustained behavior that we then use for the next one. And we keep building on top of it. So we're not spamming people, we can send a broadcast email to all 75,000 plus of our workforce and say, every day.

15:55do this. By day 3, it'll all be ignored, and you'll have an email rule that just trashes it. This is why we took a targeted approach, and it's not just through that one channel. It's through multiple channels, and the only way we were able to achieve that is by looking at the behavior, looking at the data. And using that to be precise. And that's kind of like where I was talking about meet them where they're at, just because, like, say my daughter is the example. She doesn't get to read her emails, she has a shared computer, but she might get that SMS text. for that, and it says, okay, thank you for using SMS, blah blah blah blah, but don't use that again. Actually use OktaVerify. So we're driving the behavior based on their behavior prior. And kind of learning from that. Small sample size, because we just enabled that knowledge on Tuesday, but we're already seeing an average, over the last 3 days of approximately 400 people a day. doing that real-time conversion and adopting. They log in with SMS, and soon after, we see them doing an active enrollment, or the next time they authenticate, it's with phishing-resistant MFA. And that's great, that's just great data in real time.

17:07Alright, so 3 things for you all to do Monday, this is for you guys to actually take this home and into practice, is to measure adoption and not deployment. So, kind of like what we've been talking about. Are they enrolled? Great. That's not the only… kind of like what we used to say with phishing simulations. Give me that phishing simulation data, great. Okay, now we've matured to give you an entire human risk index, or we're giving you a behavior score. We want to know more, more in depth about that. So enable doesn't mean adopted. Secure behavior must become part of the work. So we want to… we want you to track your workforce adoption metrics along the MFA coverage with your identity and human risk teams, barring that you have human risk teams, but I'm sure you all have identity, or identity teams, but if you don't have human risk teams… We hope you have identities. Okay, yeah, sorry. We hope you have identity teams, and if you don't, then, I mean… Something… there's another conversation there, but… Yeah, and interpreting workarounds, right? Why are people using SMS? Because it's easy. It's something that they know. Maybe their bank app allows SMS.

18:11We're looking at that as, okay, well, do you know that this is better, and here's why it's better, and more effective. And we're using that information at scale. just some numbers, right? We measure the number of workforce users that are using SMS, but just equally as important is the ones that are enrolled in SMS plus another authenticator, or a stronger authenticator. We're targeting them, make that shift. New hires. A lot of new hires are enrolling with MFA for the first time, they have to. Especially in a remote workforce, and what they're doing is, we're seeing that they're just picking SMSs the de facto. Well, soon, that won't be an option. If you're using a mobile device. For multi-factor, whether it's company-issued or your personal. we're not gonna allow you to do SMS any longer. Install the app, and soon.

19:09pass keys, right? That's our next phase. That's our more advanced targeted phase, especially in labs and other areas where you can't have a mobile device. you need something different, and a hardware authenticator is key there. And of course, the last thing is expand human risk management beyond humans. I think we've heard that a few times today. Actually make sure that your agents or your AI workforce is getting the oversight that it needs. So make sure you're discussing that across your identity, security, human risk, governance. all those partners. And this is not on here, but I just wanted to make sure that I highlighted it. So you're probably like, why are they talking about MFA, and we're here talking about human risk? So we just wanted to make sure that the… you saw that we have a partnership that we've had, and we've grown using the data from the human risk management. program. So, without the data, and without all of the insights that we have.

20:05his actual MFA project, sorry, I'm gonna take a look… wouldn't be as successful. It wouldn't. And that's the truth. But in return, we're getting that telemetry, that behavioral data, and feeding it back, right? So we can make even… better decisions for the future. So from where we were last year, where we're doing this continuous loop between identity and human risk, this is the next stage, right? And there's future stages to come, and we're just going to continue to build on that success. All right, well, thank you guys for staying awake with us. Hopefully you all did. I won't call out anybody that didn't, but no, I saw you, okay? Everyone's still awake. As indicated by the number of questions that we have. Oh, at home, okay. Is one of them how to properly pronounce my name? Point taken, so… I will, I will get on that. I'm only joking. I know, so… Do you typically report defensible improvements in your security, program.

21:12Can you repeat the question? Sure. Do you typically report defensible improvements in your security posture? You want to take that? You can take it. I'll go right ahead. Okay, so from the identity perspective, we do, and we try to pick… these are many KPIs and KRIs, and some are both. So we try to pick the ones that are relevant, and in… not… Relative to the human risk side of the house, but in the identity space, we look at, Access recertifications is one. The number of delinquinquents, the people that we have to continue to nudge to do what they need to do, and how we can improve that. Mfa, we spent the last 20 minutes, almost 20 minutes talking about that. Don't want to beat that to death. But also from our, access management side, we… we do automation at scale. How can we get more of that adoption in place across enterprise applications? Automation, not… well, with and without AI, is more secure. Not only is it faster, but there are no mistakes, right? Our defect rate on access management and access requests and fulfillment across the environment are, .03% defect, meaning where there's a human involved, that's where the mistake is. And even then, they were very highly trained and very,

22:42Mistake-averse. And I think if I understood the question correctly, so, like, what type of metrics we use from the Human Risk Management Program, so we actually use the behavior score from Living Securities platform to be an ESG metric, and it also gets reported to the board every month. Yeah, and we've introduced MFA enrollment or type as a contributor to the restore. Excellent answer, using the Libby, Libby metrics. Does rolling out the MFA, impact the phishing, the resistant ones, impact, for example, help desk calls, like, are they getting more? What are some of the, sort of, I guess, symptoms? So, so far, we're not seeing any… increase in help desk calls or assistance. We also leverage your enrolled MFA for account recovery and lockout, which leads to self-service.

23:38And that's a… that's a big… that's a big win as well. Where we see some service desk impact is when people don't know that they can use a self-service flow with their enrolled authenticator to do recovery or a lockout, and we've been partnering with our service desk team and the tech ops group in general to improve on that? How can we get those numbers down? Look, there'll always be people that just want to call. Can't avoid that. But how can we make it so that we're driving them to the more secure. Better, less friction user experience, and… and… and not… talking to a human being. So, short answer, I think it's done quite the opposite. Right? Yeah. Next question is, how did employee feedback change your rollout strategy? I don't think it did. It actually, if anything, we've seen a very positive response.

24:39People have reached out directly, hey, do you know this… the number challenge isn't available here, or you know that this is… yes, we know. We have a couple of people who said, hey, I used to be able to do a push notification on my Apple Watch. Well, that's not really something we supported anyway. So, you're not really losing much. But they were more informational questions. We've actually had some people reach out, because we have a Mission Safe, we call it Mission Safe box, so it's actually… anyone from the organization can email us and ask us any type of user behavior questions. So, we sent out the targeted comm. But someone responded back and said, can I actually roll this out to my entire team? They're overseas, can they use OctoVerify? So, although it wasn't meant for them, of course they can. Yeah, great, we would love you to. Well, please join me in thanking… Thank you. Actually, in a hunter.

Auto-generated from the live recording.

0:07I click her? I click with it? Hi, everyone. Good afternoon. So, I'm in a bad spot. I am standing between you and break. I will take bribes. If anybody wants. Also, a little bit of a bad spot because Damon took my best stuff. Alrighty, so you'll hear a lot of repeats. I think that's actually good. I think these are themes that we generally see in this space. If I had had more time, I would have made bingo cards for this time, just to kind of, you know, as I repeat something, you could mark it off and have a prize, but… I did not get to that point. So, again, yep, Jennifer Miller, I am from Bayer. A little bit about myself. quickly. I, have a pretty long time in IT. I've been in this role with security culture for about 10 years. Prior to, I was, working in the commercial space, supply chain space.

1:04infrastructure, a lot of areas, actually. And what's been consistent across my career is I've spent a lot of time systematizing processes that are typically manual, which is a lot of what we're doing here today with our Living Security implementation. also want to tell you a little bit about Bayer. Large company, 3 divisions, we're global, we have a footprint in 80 countries, I should check. We, have a lot of, requirements from a regulatory standpoint, from a data privacy, we have lots of workers' council, considerations. We are a European-based company, so a very complicated environment. We are early in our implementation, just to be clear. We are gaining momentum, but we are, like I said, anything in the company of this size, in this complexity.

2:00There's a lot of things to be done in advance of getting anything. Kind of up and running. So what we'll talk about today is the trap of waiting for the perfect data or the perfect situation before we begin a project like this. We'll talk about signals that we already had, information we already had, knowledge of our workforce that we already were pretty intimate with. how we can act on it and expand that into… kind of into more additional war wins and momentum, and then, what you can do Monday to get started as well. So, there's a trap that I think we're often stuck in, Have we ever sat in a room, and we've got, we're looking at… we're evaluating a system for, implementation, and you've got, in that room, you've got the vendor who will tell you that they can do everything and anything and things that you never even imagined you'd want to do, but now you want to do them.

3:00badly. You've got your visionaries, kind of the people who are in leadership, or in kind of those visionary roles, who also want to now do those things quickly, now, yesterday. And then you've got the folks that are maybe a little bit more closer to the details, who are going, that'll never work, that's not gonna work here. Or, it's gonna be really hard. You've got to marry all this together to somehow figure out how we're going to bring this to life. And this is where we started as well. So, and I think everybody thinks that we can't start until we have everything. We need all of the information. Damon talked about this, I think, right? We want to be able to see everything, and we're going to let the data tell us what to do. And that's gonna… and then we're gonna know things we never knew before. In most organizations, and particularly in a large organization, that's going to take a long time. And in that time, what have you lost? And what opportunities have you lost? So let's look at what happens when you go ahead and just start moving forward.

4:00So for us, we started with a pretty roadmap, planning for a bunch of integrations and a bunch of regional rollouts over a very nice measured timeline, and like I said earlier, we thought the visibility would give us all the answers, and then we would… everything would be perfect, and the world would be great, and… Yes, and then we would have the most mature program in the world. But what happened when we started is we realized that that, was even more complicated than we had thought, and we knew it would be complicated. I mentioned some of this earlier about the complex environment with regulatory, data privacy, things like that. Our data owners were… you know, sometimes a little resistant, or really wanted to understand our intention, what we were going to do with their data. So, there was, yeah, a lot of things that… made us want to look at this a little differently, and this is what we did. So we re… we reordered the program, or we looked at where we could get things going quickly, and that was, I think on my next slide.

5:09Finding our first wins. We looked at data that was available. Most awareness teams, risk teams, culture, call it what you will, they have their fishing data. We have our fishing data. We have training data. We probably have some level of understanding who has elevated access in the environment, those sorts of things. So we looked at what we already had, and then we understood, and we also understood, kind of, the motivations behind some results in that area. To, to, to utilize those insights to kind of start to make, to make forward momentum or forward movement. And we also looked at what was relevant. What is really going to help us, you know, begin the trend towards, really changing the culture in the organization. So what would help us, and what's just nice to know, fun to have, that sort of thing, and really tried to focus on the relevant. And what could we take action on? So, if it really didn't result in an action that altered behavior, or helped modify or address behavior, then does this information or data that we actually needed, is this something we needed to put effort into? Is this something we really needed to spend cycles on?

6:21And then I'm going to take a little shift and talk about stakeholder management, because I think we've heard a lot about this today, and this concept of trust. So, in order to continue to build that momentum, to move forward, to grow, we need, then, good partnerships, we need to build trust within the organization, and also with our employees, as we start to expose them to something they've never seen before. And I think this is where it becomes very important to be very purposeful about what you're doing, and what you intend to do. So look at the signals. And then what decisions will those signals drive? What will we do with those signals? And then what's the action that finally comes from that, right? So just really being clear about our intentions, I think has helped to build… to begin early in our process, trust. But I think overall, when you're looking at working with your internal stakeholders. Whoever it might be, that transparency, that openness, that willingness to have the conversation and build the trust goes a long way towards driving your program forward as a partnership.

7:24As opposed to just, hey, we want this, give us this information, trust us, it's gonna be fine. The humans are all gonna do what we want them to do, right? Because… The goal isn't better dashboards, and don't get me wrong, I love a good dashboard. I love, love, love a good dashboard. Beautiful, nice, shows all the things. However, a beautiful dashboard won't get you where you need to go. We really need to be able to make better decisions. So have information in those dashboards, or whatever repository of information that derives better decisions overall from your program, and then ultimately better decisions from your employee base. So I talked a little bit about how you get those early wins. So once you start to get that, you can act, and then you can expand. So, leverage the partnerships, the partnerships you've built with your stakeholders, with your partner teams, with the teams that support your efforts from, like, a legal perspective, data privacy I keep talking about, or your internal cybersecurity teams. So look for the people who really want to.

8:32Get behind what you're doing, who understand the importance of managing human risk. And then work with you on it. And with them, find the proof points. Like, with the wins. Where are we going to prove that this is actually valuable, that collecting this information, that implementing a tool that essentially automating what was manual processes before brings value into the organization. And it's just not another effort to kind of consolidate information and, you know, kind of just make dashboards and those sorts of things. And then scale. So use the credibility that you've built and the lessons that you've learned to grow, to accelerate implementations, and to drive adoption elsewhere. Was I fast? Because I thought I'd be slow. I really think this brake thing was really weighing on me, because I just blew through everything! Okay, four things you can do Monday. You could do them later today if you wanted, however, I really wish you'd wait for Monday. Focus on what you already own. So, look at… 1 to 3. Nothing complicated. Take the data you own, the data you understand, and, bring the source of that data into the room, and then build your plan on what you're going to do with it.

9:48Name one risk you can point at, so be very, very, very specific about the risk that you're looking to manage with that data, and then what you intend to do with it. And then pick one use case you could finish. We had quite a few use cases earlier. We actually have a pool of use cases that we can kind of bring forward or, deprioritize based on either what's happening in the organization or, or the needs of the project. So, pick one you can finish, but then also have some others in backup if something doesn't go according to plan. And make your plan repeatable, or make your process repeatable, and then simply copy it. So, you know, get the one thing that you can do well going in your implementation, and continue to grow, expand, and take that out into the world. More and more.

10:43Thank you. Big questions? Thank you, Jennifer, for those insights. Yeah, we do have a few questions for you. So, how did you prove the program was reducing risk while your visibility was still incomplete? That's a really, really good question. Pass. I pass. Do we allow for that? I just started pass at 2.30 in the afternoon. No, so, a couple things. So, we have had our ongoing, kind of, regular activities in the culture space, and then we looked at how we could those were influencing behavior change, and then how we could use the living security tool to make that better, to make it faster, to, I guess, yeah, improve how we did that and make it more measurable, ultimately. So, that was… like I said, this is emerging for us. We're early on in the process, but this is the approach we've taken so far. So far, it's just working.

11:49That's great. Do you have a process for continuous improvement? Now I use my past. Yeah, of course, yeah, we have it, we do, we do, we do. So luckily, we're, we're all very, accustomed to working very agile, I call it modified agile, where we, you know, we work in short sprints. We do a lot really, really… what did I do? Okay, I moved it around. They'll fix it. Yeah, yeah. And then, so what we do is we gotta do something very quickly, we take learnings from that, and we implement the changes and the learnings from you know, that cycle into the next one very, very quickly. So this allows us, to, you know, really quickly identify where things aren't working and shift. So we do have an overall plan, roadmap. Tension, but we would make shifts in that, or we'll make adjustments based on learnings from… from prior experiences.

12:48Very cool. And for the last question, if you were standing up here one year from today, what is… would you have hoped to have accomplished? Everything. It would all be done. And I'd be getting an award. That is a very submitted thing. And they wouldn't put me right before break. No, I'm kidding, I'm kidding, I'm kidding. So, in one year, I really hope that we have We have gotten… gotten our… we've kind of expanded into two regions. Ideally, probably the entire… I'm sorry, I'm thinking and talking at the same time, because this is… I'm like, I want everything, right? It's that earlier conversation. It's like, yeah, everything's organ, we know everything, but… That we have the visibility, the complete visibility into the organization to understand where the risks are that we maybe aren't as familiar with, that we have implemented in, and I would say, like, a full intervention, or what we call the nudging.

13:50With the toll in… Let's say, at least 75%. Yeah, that would… I would be pretty happy with that. We would still have a long way to go, but that would have… that would have… proven that the approach is working, that we picked up some pretty good momentum, and I think we would be pretty well positioned to continue to grow the program. The work never ends, right? That's why we all got jobs. Oh, yeah, that's right. If it ended, we'd be sad. Alright, well, a last name that I can pronounce, please say, Jennifer Miller. Thank you.

Auto-generated from the live recording.

0:09Hello, everybody. Can you hear me? Yeah, awesome. So… Hello? Hello. You know, before we start, I wanted to just give a quick background on who I am, why am I here, why should you be listening to me? My mission over here is singular. And always has been. Which is helping people recognize, resist, and respond to manipulation. All forms of manipulation. and build cognitive resilience in this era of AI. And so, this mission, Took me through a journey. From being… which started as a documentary filmmaker, all the way to working for a company that was building deepfake technology, to learning about psychology, neuroscience, the impact of these technologies on the human mind, on human cognition, and how it's altering it. And what does this actually look like, and how do we help humans Adapt to these technologies, the tsunami that's coming our way.

1:14And so, currently, I'm doing my PhD in the field of cyber psychology as well, to answer this question. And this solution in MindShield was built out of this question. So I want to start with a simple scenario. Imagine you go into a doctor's office, and you see 3 patients with stomach pains sitting there. You know, the doctor comes out, and you see the doctor see, oh, 3 people with a stomach ache. Okay, here are some antibiotics. Go home. They take it home, Do it for a week. They come back after a week, one person is cured. The other person is not, and the third person is not either. And the doctor says, oh, I think you just need another round of antibiotics. So here. They come back after a couple of weeks. They do a couple of rounds of this. Before realizing, hey, it's not solving the problem. And now, guess what? Their bodies are building immunity to antibiotics. It's counterintuitive.

2:11Why is this happening? The doctor is not a great doctor. He skipped diagnosing them. Why were they having the stomachache? Because if he diagnosed them, he'd find out one had appendicitis, one had acidity, and only one of them had a stomach infection. You would never go to this doctor. They would lose their license within, like, a few hours of… But this is the exact issue we're seeing in cybersecurity today. you have Say, two individuals in your organization. Right now, you run a phishing test. They get flagged up because they clicked. Oh, repeat clickers, put them through training. But then they're clicking again after a few months, and they're clicking again after a few months, and we keep wondering, why is this not working? What else do I do? So, what MindShield is trying to do is say, okay, why don't we, like, peel the cover a little and go into the diagnostic? Let's take a diagnostic approach to this. And if you take a diagnostic approach, you know, there's one layer of data that we could see that living security is already really mastering, which is what kind of social engineering attack Have they really fallen far?

3:22So now we can see, okay, two people may fall for totally different attacks. One falls for an impersonation, one falls for a donation scam. Why? Why does person… why does Chris, the gentleman here, not fall for the CEO scam and verify, versus Tira over here, not fall for a donation scam, and ignores it? And so if you add the cyber psychology layer and the cognitive data layer, which we are building right now. Amongst many, many traits that we are assessing for, you could see that there are a few things that get highlighted. You have Tira over here that showed high levels of authority bias. And you had Chris show high levels of altruism and empathy. Now, we can ask why, you know, maybe someone came from a background where obedience was etched into the culture, you do not, you know, you don't question authority, and so she didn't have the reflex to even do so, or it feels awkward and uncomfortable.

4:19Whereas Chris comes from a culture where that's totally normal. You can call up and, you know, it's less hierarchical, but, you know, he has high levels, it makes him a great manager, especially in the healthcare space, but this is exactly the thing that gets him hooked. So… Tira and chris, what makes them susceptible is totally different, and therefore they should have different interventions, and this is the layer of data that is missing that we want to really bring into the game. So we know about 65%, social engineering, all of us know that, and psychology is the thing hackers are attacking. So why are we not looking at interventions from a psychology perspective? Why haven't we yet? For the last 50 years, we have been looking at cybersecurity from a technical standpoint. Now it's time to evolve beyond And, Thanks to Mike, actually. You gave me this great illustration last night. I had to put it in last minute. But this is the evolution we're seeing, right? We started with casting wide nets, this is the biggest problem. We started with the casting of the wide nets, with the hackers casting wide nets, and then having spear phishing, which was targeted to an individual, took a lot more resources.

5:29Today, the game is completely different. We are seeing mass-scale, hyper-personalized, targeted spear phishing attacks everyone. And we're really not prepared for this yet. We have to, and we are racing against time to do so. We have some other small problems. Actually, there's pretty big problems that we're dealing with. One is that we know that expertise does not equal behavior change. Right? Because you have even CISOs sometimes falling for phishing attacks. The second is, even though people recognize a fish, there is a very low reporting rate in most organizations. So why is it that even though someone understands and perceives it, they're afraid to actually take action on it? And third is, after a while, training engagement starts plateauing. Right? And the fundamental thing is people are different, so we need to start understanding people.

6:29And so that's what MindShield is. We call ourselves a cognitive security platform. Cognitive security is the protection of the human mind, thought processes, decision-making, and judgment against manipulation, deception, and external influence. So what we found was there are specific psychocognitive markers in an individual that can be actually mapped To identify the root cause of what makes them susceptible. Therefore, improving their self-awareness prior to the fact. And using that data, To hyper-personalize the interventions down to the individuals. So now we have those two, basically what you saw with Tara and Chris. The goal over here is… How can we create a simple system that makes cybersecurity training more relevant, interventions and the entire concept of cybersecurity more relevant to the individual?

7:26So we found it's a simple flow. We have an assessment platform, you know, it takes behavior telemetry data, and it also has employees actually engage in some simulations and microgames. And we create a cognitive… cyber-cognitive archetype. And we have come up with these cyber-cognitive archetypes for different people falling for different kinds of social engineering attacks or manipulation tactics. And then we use that. Inject the data to hyper-personalize the interventions. So, what I'm really excited about, and I was just so excited to see, especially what you're doing, Ashley and Mike, with, like, Livy, and how it's integrating and trying to close the loop, because Living Security is really, like, pioneering the… bringing what and who into one system. And what we are hoping to add to this is the why. Right? So, they're working with behavior, threat, identity.

8:21MindShield is working with psychocognitive markers, understanding what drives and causes behavior, and the archetypes. And then we can use that information cohesively to build one singular profile of an individual that now maps not just their behavior, identity, and threat, but also their cognition. How do they make decisions? For example, you could have an executive who now gets flagged that, hey, you know, it's 4.59 PM on a Thursday, you've had 6 cups of coffee, and you've also been on 6 back-to-back meetings. Your cognitive load is really high. And, you know, you're hitting a level of fatigue, you have to make this really important decision, maybe postpone to tomorrow in the morning. Or go take a break. Right? Or these are the kind of scams that you might be susceptible to, so improve your vision. Vigilance to that particular tactic. And so the goal over here is, again, hyperpersonalization of the individual. Training, so matching the training to what they're susceptible to.

9:21Second is, in-the-moment nudges, like I mentioned, someone has high cognitive load, a bias, or they are, you know, dealing with something, they can, in the moment, actually change that behavior, and also flows into the controls so that you can have proactive controls around the individual. So the goal over here is very simple. It's three things. Let's hyper-personalize our simulations and our training in the same way that the bad actors are hyper-personalizing their attacks. Let's match it. Second, let's reduce social engineering and manipulation susceptibility. But there's a third very beautiful thing, and you know, this is a longer conversation, but… Using AI is fundamentally changing how people think and make decisions. Cognitive surrender, cognitive offloading. And so, the goal over here is we have to maintain decision integrity, too. So imagine if we were able to reduce susceptibility to manipulation and simultaneously improve resilience, decision-making, and judgment by giving them the tools to make them think better.

10:20That is what the vision over here is. And it all starts from helping people understand themselves. Understand your mind. Big tech, hackers, they know your mind. Why don't we? Why don't we know the same things they know about us? Right? So let's equalize that playing field. And so I, like, end with, you know, people's judgment is the last line of defense, we can make it the strongest one, and that humans are not the weakest link, we've just been the most unprotected. And that's why we are trying to build a MindShield. Literally, a shield for the mind. In the digital world. And, you know, if this is something you find interesting, you think it could add value with your current program, we have a QR code hovering around in some places that you can scan, it takes your landing page, you can learn more. That's all. Open to questions. Thank you.

11:28reiterate something that maybe wasn't entirely clear, when Shimona presented earlier about MindShield. So, we are announcing a partnership today with MindShield, and as our customers, as our valued guests and member of our ecosystem, we're announcing a pilot program. Whereby if you have interest in testing out the MindShield capability, that's something that we can offer, at no charge, right? And we're gonna have a pilot program to see, is this something that could be a good fit for you? And then, ultimately, we see a scenario where that MindShield cognitive data could be integrated with Living Security Platform to produce those kinds of very hyper-personalized, tailored interventions that are taking cognition, into… into effect, okay? So, thank you very much, Shimona, and happy to have you as our partner. Alright, so, next up, we're gonna bring Gary back on stage, and I had the privilege of seeing Gary perform in Manhattan earlier this year in front of a very skeptical audience of about 40 CISOs.

Auto-generated from the live recording.

0:09Alright, we've got the post-gra break group, and you know, fun fact about me, I was, when I was… my youthful days, I played drums in a rock band on college campuses, so I've seen a lot of rooms like this. And typically, we'd open back up with, hope you had a good break. The more you drink, the better we sound, but I think with iced tea and Diet Coke, you're only gonna get more caffeinated, which is okay. My name's Aaron Pritz, CEO, co-founder of Reveal Risk, and, spent a long time, two decades, in the pharmaceutical side, inheriting cyber workforce awareness. Before, HRM was a cool thing, right after an insider threat arrest of two of the scientists at our company. So, awareness in this whole field became a passion for mine. Excited to share some stories, as well as some tips on, things that we're seeing evolve in the HRM market. So, my name's Jim Wales. As I said, I'm a senior consultant with Reveal Risk. Come from kind of a non-traditional background, got a background in military intelligence and law enforcement, and through that career path, I got pretty good at Being kind of a translator for some highly technical concepts and, making those understandable for non-technical audiences.

1:22Like juries and judges and, attorneys, things like that. And, I… took that experience, and now I lead the Human Risk Management Service at Reveal Risk. Awesome. And I told Jim 5 minutes before we went on stage here that I'm gonna go off of the script a little bit, which I saw him visibly gulp. But two things. We have the benefit of being closer to the end of the day, and hearing a lot of the great speakers, and I put some notes together to draw some insights. to kind of open up the fourth topic of… really, we talked about four topics, and I think this last one's a little bit different. And then second, guys, we are at a Human Risk Management Workforce Awareness Conference, and no one has gamified their presentation. So, we are going to try to gamify a little bit of our talk today. Some of it's planned, some of it's not. We didn't bring prizes, but I did find that I have two, socks, they're brand new, branded socks, in my bag. And then, if there's a third prize, we'll let somebody do the claw and get one of Kevin's, magical balls of, prisery, so… You're welcome, Kevin. Alright, so let's open up with some comments. So, I wrote a blog article probably a week and a half ago, some of the Libyan security team commented on it. I believe there's four action-oriented, results or actions that we can take from human risk management.

2:41Before, and then we'll go into a little bit of detail, risk intelligence. That is Living Security and what the data's coming together. Tailored education and interventions, again, a lot coming out of Living Security, a lot of you probably have custom interventions or training or things that you do specific or bespoke to your program. Technical control changes, I have a couple comments on that, and then Jim and I are going to be focused on business process, remediation, and re-engineering. So a couple of thoughts from earlier talks. Intelligence. One, it was great to see Semano's MindShield product. That's a whole different level of intelligence from a psychological standpoint. that I hadn't thought about yet, and how that can intersect. I have questions on how to get that through the GDPR Council… Works Councils that we struggle with, but I think there's an option… option there. And then Alfonso said in his talk, workarounds by the business are signals, not failures. And to me, that really underscores the reason for why you might roll up your sleeves and get involved from a process change standpoint with the business partners that you support, versus sending things from on high, from what we kind of always did, the training awareness.

3:51Second, training… tailored education and interventions, definitely nudges, targeted cohorts, all of those things, both powered through Living Security and the programs that you likely have in place, or expanding. And then a lot of good, the last few topics were all about technical changes. Ashley and Alfonso talking about, fishing resilient MFA and how to bridge all that stuff to data, and have data help open up the buy-in and sponsorship for that, and then Geneti from Stuart Title talking about how to add specific tech controls for high-risk users. I really liked kind of hearing, okay, here's different groupings that people are in, and we're able to block or enable or change the, kind of, the controls around that. And then, I'll let Jim kind of… we'll open it up into the process side, but with business process remediation. Actually, Ashley shared the quote with me prior, but it sunk in even more the second time from Labcorp that 72% of employees were knowingly bypassing security policy on purpose.

4:50And it's probably not because you didn't send them training, or there wasn't a policy, it was probably because they had a business process documented or tribal knowledge that they were just doing it the way they always did. So… I want to really push us to change the convention of we have to stay in awareness and our mindset, and really, if we're pushing HRM into more of the risk management. We need to be out there assessing, we need to be out there driving controls, we need to be out there driving mediation, and doing it as a partner to the business, not an inflicter to the business. 100%, yeah. Alright. So, next up, this is part of the gamification, and we saw some deepfake stuff from Ashley this morning. Everything in this session is real, except for the part that isn't. Little bit of a spoiler, we will have a little bit of a deepfake into one of the processes that we're gonna ask you guys to dissect and help us figure out what's wrong with it, so… Know that going into it. Disclosure, so nobody's tricked, even though… That's the goal with Deep Tech.

5:50All right, so, like Aaron, I'm going to riff just a little bit off of what I had originally planned. I think that's the benefit of coming in a little bit later in the day, get the benefit of hearing everybody else's talks and kind of getting some additional ideas on top of that. So, I want to throw out what I feel like is kind of a little bit of a provocative question. I, I met, the, Ashley and the Lumi Security team, like, 3 years ago, at a different conference, and, kind of, synced with them really early on with the whole idea that, I didn't… I've never been a fan of humans being the weakest link, right? So, I think that there's a lot to be said about, when they're the weakest link and when they're our greatest asset, but when they're not our greatest asset, when they're causing us problems, the provocative question I want you maybe to consider is, whose fault is that? Is it their fault? I mean, that's an easy… that's an easy out, right? It's their fault they're being lazy, or they're indifferent, maybe they're malicious. You know, that's not very often, but sometimes that happens, right? Is it security's fault? Are we giving them bad advice? Are we not giving them good directions that they can use? Sometimes, yeah, that happens.

6:55Maybe it's the process owner's fault. That works in the department that they work in. Maybe it's the leader's fault in that department who's never taken a look at those processes and found out, is this a process that works for them? Is this secure? Why are we always getting nastygrams from security when we can't do what they're asking us to do, because our process tells us that we can't. But this is the way we've always done it, right? So, this is just our process. It is the way it is. Well, processes can change. Yeah, and Jim, maybe I'd challenge you. Not only their fault, their opportunity. Let's do the feedback as a gift thing, and swap it into an opportunity. Exactly right. Alright, so this is gonna start the interactive part, so a little bit of background, we're gonna walk through, kind of, where processes can bleed, and if you guys have been… how many of you, show of hands, have you been in, like, a risk management role, done risk assessments? Third-party risk, I know I was talking to a few, so 30% or so have some crossover skills, that's awesome, because I think that can help you. So what we're going to do is we're gonna walk through a common process And it's one that we already know there is risk, because there's a lot of targeted attacks, and it's accounts payable just to seed the clouds a little bit. But regardless if it's an accounts payable process that we're analyzing, or a research and development.

8:13candidate selection process for advancing advanced molecules, now I'm talking about my old role, in pharmaceutical, into the clinical study pipeline. Crown jewels. Those are two very different processes, but they all break in the same spots. So, five things. This may not be fully inclusive, but it's where we've seen most of the process gaps and the workarounds. One, the process steps. Are they undocumented? You'd inherited it from Joe, who you took over from the job. You're kind of winging it. It's different every time, there's nothing down on paper. That's the easy one, right? Like, helping to get that cradle to grave, where does the data go, and how does this process work? That is the starting point to working and partnering with your business partners to help them understand what's going on in the context of how they might get social engineered. Secondly, approvals. So, I think in the Ashley video, for the deepfake, it was kind of pushing, like, hey, I need this approval, there's no time, it's urgent, you know, classic techniques, but that deadline under pressure, and trying to trick the person into maybe skipping some of the steps that they might do, or the hesitance and double-checking something, because it's, it's the CEO. Handoffs, cross-functionally, going between departments.

9:27big… if you're part of a big company, I know we have several big companies here, very little business processes happen within one group. There's a lot of… you know, big processes that have small little working pieces and lots of handoffs. Handoffs can result in oversharing, that kind of translates into access issues. How many teams have had SharePoint sites owned by the business that it's pretty open access because there's so many people coming and going? And before you know it, you've got all your crown jewels there. And then lastly, third parties, because a lot of our companies outsource specific pieces or steps. you've got to worry about third parties and identities and how you're interacting with those as the process is going. So that's the setup. Those are the clues that you're looking through. Jim's going to walk us through the process, and we'll do a little live Q&A of where you guys think some of the breakpoints are. Alright, so here's our process. We've got 5 steps. This is an accounts payable, kind of scenario that we're working through with this process.

10:25So, what we would like, is, if you see a part of this process that stands out to you as one where there is an opportunity for an attack to be leveraged against this, if there's a vulnerability here, Call it out. Don't be shy. I mean, it's, it's, it's, you know, everybody can… there's… nobody needs to raise a hand. This is where you might win the prizes. Yes, yeah. Alright. So the first step, in the process, the, request arrives, it's an email. It's marked urgent, of course. Arrives, from the CEO to accounts payable. Alright? That's what gets the ball rolling. Step 2, the requester is verified. The CEO calls and leaves a voicemail for accounts payable, requesting the same payment. Now, you already got an email. It's urgent. And then you get a follow-up voicemail.

11:22Okay? Anybody see any issues yet? Oh, yep? Classic fishing plus deepfake combo is what he said, so, yes. Okay. So step 3, request approved. The approver, the, the accounts payable analyst, signs off and adds the new vendor. well, they got the email from the CEO, right? It's urgent, it's gotta happen fast, and then you gotta follow a voicemail that it sounds like your CEO. Better do it. Okay, payment gets released in step 4, approver releases a payment, and then step 5, reconciliation. Okay? Any… raise your hands if you… we don't have to talk about them now, a few more holes in the process? Any other gaps? On Step 3, you have a single unit to approve that is already deceived by Steps 1 and 2, then step 3 is autonomously doing a foolish thing that a two-person system… The lack of a segregation of duties on that vendor ad, yep, vendor master, yep.

12:27Good, anything else? Alright, let's make it more complicated, and let's assume we were analyzing this 10 years ago. The deepfake comment probably wouldn't have been front of mind, because that wasn't really legit. And how many of you… we do a lot of deepfake end-to-end with real executive simulations. How many people have had the… opportunity to train their employees that deepfake, both voice and video, can be live in real time, in Teams. no out-of-band videos sent. Does that, like… We still are seeing about 50% of even cyber people that are seeing that, and I know we chatted earlier, you're doing some of that advanced training, which is awesome. But there's still, you know, a catching up knowledge. A lot of people were stuck on Deepfake being for political campaigns, and it's a video created in some lab. Post, or prior to the incident. Let's keep moving, let's, and I… here's my voice, get a good sense of it, because the next part is the, the guessing game of which is real.

13:28Alright, so… We have a voicemail, alright? Let's take a listen to the voicemail, and see if we can figure out which one of these is real, and which one isn't. Hi, this is Aaron. I hope you saw my email. I need you to go ahead and approve the payment for the Austin, Texas project. We are looking to get that support rolling this week. I appreciate your help on this. Alright, that was voicemail number one. Hi, this is Aaron. I hope you saw my email. I need you to go ahead and approve the payment for the Austin, Texas project. We're looking to get that support rolling this week. I appreciate your help on this. Alright, any guesses? Alright. Who says… by show of hands, who thinks that voicemail 1 was real?

14:23Okay, got a few, alright. And by show of hands, who thinks voicemail number 2 was real? Okay. Who doesn't know? Oh yeah, that's, that's, yeah, that's a great question. Right. Okay. So… For those of you who thought that voicemail number one was real. You have a very keen ear. Those of you who thought number 2 was real, you might need a stronger process. Alright, cool. A little bit of fun with this, so, this specific audio video, we've done a lot of real-time and… like this one, we wanted to… we didn't want to wing it on stage with a mic and a separate translator, but you can do that with the audio real-time fake. It was created with less than 3 minutes of video, the team ripped it off of my podcast. That's how they got my voice. And then, this one was a commercial tool, so you can get a lot of open source tools as well to do it and do scarier things with it, but this one was a less than $20 tool. And then within the process that we showed you, there was zero controls. One other sidebar, and we did a podcast on it a few weeks ago, with some of the Agentic technology, the one that I played with was VAPI, V-A-P-I, you can use a 11 Labs voice fake, and create an agent, and then with a prompt, which I use Claude, create instructions to make calls on your behalf, and do it at scale. So just as a test, I… tested it with one of our marketing people, and then Jim, and had them receive calls that came from a local area code.

15:59As… as a person that we selected, and it went through the script, and it was basically… I programmed it, again, within… it took 20 minutes. Yep. In a morning, I'm like, hey, we should jump on a recording and film this, but basically it was, basically a very safe social engineer Using an agent to drive forward. Alright, we got 5 minutes. Yeah, we got 5 minutes. Too much audibles. So, Jim, break down the process for us. Alright, so, you guys are good, looking at the process, right? So we take a look at our process, and we find where our weak points are. The request comes in? Okay, fine. They're number two, the request is verified. No out-of-band verification for payment requests. Right? So, there's an issue there. Number 3, the request is approved, weak vendor master file, so anyone with accounts payable control can add a new vendor. No control there. Couple of other issues that we have, no dual-channel confirmation, not even with a high dollar first-time payment.

17:01No invoice matching steps exist, and no reconciliation checks in place to flag an incident early. So, several areas where the process breaks down, where there's an opportunity for process improvement here. So, is anybody here an accounts payable expert? Now, was it fun and helpful to kind of break this down? I think one thing that I'll say, and I don't know if we'll get to the slide. doing this exercise and having the process owner grab the pin from you and say, okay, let me start drawing, that is the sign of a win. That is the workshops that we feel go the best, and they start seeing the problems. You give them some scenarios, like the deepfake one, and they start to think about their world differently. Let's skip that one, that's a little bit of a redundant. Yep. Go quick on this one. This is a story before Living Security and HRM data existed, and I'm so excited that now, you know, 10 years ago, when I was on the corporate side, we were using DLP on the R&D Secrets post the insider threat FBI arrest.

18:01to look at other signs of exfiltration where individuals were taking intellectual property of scientific value. Very hard for DLP. It sucked at it. 10 years ago, it probably still sucks at it now. But at the end of the day. we, with DLP, we identified key areas and key processes that were lighting up, and we were able to go through and find overprivileged situations, too many handoffs, third parties that didn't need to be involved, and literally, in this case that I'm talking about, go from 21 touchpoints to 5. And that actually provided business value, and that they… their process went faster, and security took the win. So there's a lot of examples like this. Now, with living security and the data, we're able to say, okay, now we're not just tackling the known high-risk areas that we know have things that we need to address with this. We're able to see some other pockets, or say, you know what, this… Group over here was interacting with this high-risk function that we had no idea, so we're super bullish on that.

18:58Alright, I'm going to cover this one quickly, but I don't want to skip it, because this is where I get really passionate about this. As we build these programs, we talk very often about building a security culture. And with the advent of human resource management platforms like Living Security, bringing the information to our attention and letting us focus on some of these areas where these processes may be breaking down, and we have an opportunity to go and interact with those other areas of the business, we have the opportunity to build relationships with other areas of the business and get out of our security silo, get into those other business functions, and really start to build that security culture. And the whole organization. And that's a huge step if you can get out of that kind of security silo and start to build those bridges with other areas of the business. And this is not fixing it for them, it's fixing them with them, and taking the data that's 100%. You might have an opportunity here, not a problem, to make this better, and by the way, let's get in there and make it better for your business as well. All right, real quick on this one, this is not saying you don't need training. This is still important for the masses, I think that's been consistent with other messages. Still important with training if there are one-time behavior shifts, new tools, things you need to get out, but if you're seeing the same thing recurring over and over.

20:08bypasses are happening, that's when, really, this technique can happen. And we do have a job aid giveaway here, so two last slides. One, this was an account… this was a payroll process that I did, I think it was, like. a year after COVID, when things were just starting to open up. It was a smaller company, but working with the CEO, driving out. I started with the marker, you can see my sloppy handwriting. He took it, drove it out, had a bunch of changes, he was like, this is literally the best. use of time from a cyber standpoint that we have talked about, and we talked about no cyber controls. It was all what my employees can do, and how we can shift the process to be better. Alright, as promised, last slide. QR code. We don't have any salespeople, so I'll promise that no one will be hounding you. We're all word of mouth and a boutique, but if you want to grab our Secure Process Design Worksheet, it's just two pages. Doesn't give you everything, but it's really a way to think about this, it's a good starting point. And then, yeah, if you have any questions, Jim and my email is here.

21:10We like talking about this stuff, we think there's a lot of missing opportunity in the HRM programs and field to drive this action that gets you credible experience hands-on with the business. Yeah, the last thing I would like to say is, if we really want to make the human element, that human part of our security stack. the… our front line and as capable as possible. We have to take care of them, we have to set them up for success, and they can't do what we're asking them to do if they're stuck in a broken process. Awesome. Thanks, everyone. Thank you, Aaron and Jim.

Auto-generated from the live recording.

0:12Right? We already struggle. With the challenges we face today. Right? It's complex, it's hard. doesn't matter what aspect you look at cybersecurity, it's tough. So, why would we even ask? What's out there? What's beyond that horizon? In fact, you should ask, what is beyond the horizon? Okay. Thank you! Thank you! Okay, so we are going to kind of talk about, and we've heard so many great things today from different leaders here about best practices, about challenges, about what they've learned. So we're going to pull some of that together as we take a journey in looking forward. Because it really matters. When we look forward, it gives us an advantage. Because we can start preparing now, instead of being surprised, instead of responding to what happens.

1:12So, again, my background, you can look up the bio, online. I've been doing this 36 years, and I absolutely love it! I love the chaos, I love the ambiguity, I love dealing with that intelligent adversary. Okay? And that's what we need to start thinking about, and a lot of what we talked today is that adversary will also include AI, and various forms of AI. Right? So, we need to start baking that in, because, let me tell you right now. Right? It only gets harder. The only easy day was yesterday. It's… it's not gonna get any easier. I don't have good news in that space. I've got good news in other spaces. But we'll cover some of that. And at the end, we're gonna talk about what do we need to be thinking about now, and how do we need to start evolving now?

2:10To get ahead of these risks, and not be just… Bulled over by them. Okay? And we're gonna cover it in a framework that we should all be familiar with. Alright, how many people, technology, people, process. Okay? We all know that. So, we're gonna kind of break it down into those different areas, and I'm gonna cherry-pick. And… help elaborate some of the risks that we're seeing now, and how they're going to evolve in the future. Okay. So, from a technology perspective, we know AI, it's here, it's being adopted rapidly, we know the attackers are using it. Right? To their benefit. So we've got this technology issue we're gonna get into, and from a people perspective, we have to worry about the people who are coding the next generation of product.

3:06Right? That's on the front end. The technology that's being built today, yeah, they're using AI to do that. We also have to look at… the people that are gonna be victimized, because our attackers are going to use AI to victimize them in new, better, more efficient ways. And on the back end, we have to think about it, all organizations, and the critical infrastructures that we all depend on. They're also… integrating in AI, and there's processes. How do they vet it? How do they secure it? How do they attest to it? There's a lot of things in the processes that also can be undermined, can represent a threat, and can impact us at the end of the day. So, let's tear down a little bit at the technology side. And I want to focus on the mythos effect. Everybody familiar with Mythos? Anthropic's latest model. It was specifically designed to look for vulnerabilities. And as it turns out, it does 3 things really good.

4:14One, it finds vulnerabilities in software, operating systems, firmware, and hardware. Does it really well, does it really fast? The second thing it does, which is kind of magical. Is it can create exploits for those vulnerabilities that it finds. Okay, that's… It's a lot harder than actually just finding the vulnerability. And the third thing is it can chain together vulnerabilities. So when you get a low or a moderate, you can't push that off, because mythos, and it's not just mythos, right? It's all the frontier models. They're really good at chaining together even low-level vulnerabilities to create something much greater. Alright? So… The result of all of this… Is the lowered confidence in the software, firmware, products, devices, services that we use And this little thing called patching, maybe some of you have heard it, Right? That… fundamentally breaks… It's already starting to break.

5:30Alright, everybody familiar with Microsoft Patch Tuesday? It's our favorite second Tuesday of the month! For the last 3 cycles, Microsoft has put increasingly num- higher numbers of vulnerabilities that it's patching. This last Tuesday, over 600 vulnerabilities, and it's just going up. Okay? So, let's look at that. Oop. Let's look at that from a kind of process perspective. Alright? Now, I want you to put yourself in the mindset of your organization that has to deal with some of these vulnerabilities. Okay. So you have software, you have a product, you have a service, whatever it is. When you have to manage these vulnerabilities. First off, you have to discover the vulnerability yourself. And hopefully, it's an ethical cybersecurity researcher, or it's somebody from your team.

6:33Right? If it's the bad guy, you're not gonna find out about it until your business partner says we were hacked because your software had a vulnerability. Right, that's bad. But let's just say, for the sake of argument, it's someone on your team. But they have to figure that out. Is there a vulnerability? And then they have to validate it. Is it a real vulnerability? Okay, let's grade it. Is it low, moderate, high, critical? There's lots of debate. That entire process. can take months, and in some cases, Microsoft, years to actually discover the vulnerability, grade it, and then start developing a patch. Now, here's where the problem comes in, because the people that know the code the best Those are your developers. You need their expertise. But… They're not just hanging around. You have them working on the next generation product. So you have to rip them away.

7:31And go, guess what? We need you to work on the software you already finished. There's nothing a software developer hates worse. then finally coding something, and it works. They just step back. I don't want to touch it. It works! I'm moving on to the next thing. So you're gonna pull them back to their chagrin. Now they have to develop a patch. But we're not done. They then have to hand it off, and that patch has to be tested. Has to be tested on the current. product? But you know what? All your customers don't use the current product. You have to retro-test it to all the old versions your customers are using, to make sure it closes the patches on those, too. And you're still not done. Because remember that next generation product you have? you have to go validate that it's not gonna undermine that as well. Okay, so we're done with testing, and that can take weeks.

8:29Depending on how many variants out there. Now it's time for rollout. And you could just hit the big red button and push it to everybody. But what if there's a flaw? Right? We've seen this. Microsoft, we've seen it with CrowdStrike, we've seen it with McAfee and so forth. You push a bad update! You may get a blue screen of death. You may fry components. You may end of life a device. So you have to rule it out slowly. Fair enough? Okay, so the chart you're seeing here is this whole life cycle that you have to do. And it typically takes… A long time, depending. So long, in fact, many organizations, if a vulnerability is low or moderate, they'll put it off and say, you know what, we'll just bundle all those together, and once every 6 months, or once a year, we'll address those.

9:24And we'll only focus on the criticals and highs. Okay, this is where the window of opportunity of the attackers now using AI comes in. Because mythos, as we said, is REALLY good. And what I mean by really good? I mean an order of magnitude. better. Faster. More accurate. At identifying vulnerabilities, and even more so in being able to create the exploits. So, AI tooling… by the adversaries. Can do it in much shorter periods of time. And the whole idea with Microsoft Patch Tuesday, by the way, once a month, Microsoft figured this out years ago. As long as they get the patch out to their customers. before the attackers can exploit it and cause victimization, they're good, and they'll stay on that cycle. But they have to make sure they can get that patch out.

10:31The reality is, it's flip-flopped. If you go out, and it's a great site to go out and take a look at, it's Zero Day, ZeroDayClock.com. I pulled this a few days ago. When we look at how long it takes for exploited vulnerabilities Right? For the attackers to come in and take advantage and harm people. we can see that, let's say 2018, right? It took about two and a half years. Those are the good old days, by the way, right? When we start getting into 2021, Right? It's 18 months. Alright, a little closer, but not too worrying. By the time we get to 2024, 2025, actually the last quarter of 2025, It was inside that 30-day window. That's why Microsoft has Patch Tuesday, and then they'll deploy a few more patches after that. Nobody noticed, don't worry, right, because the attackers are inside of that.

11:33On the right here, if you can see it, it shows you the progression. In… it took 1 year for the attackers to exploit a vulnerability in 2021. Okay. By 2025, it was at one month. By 2026, it took them a week. And right now, where we stand. In some cases, we see it in a day. So, I want you to think about this for a second. Right? You're security, and you get notified, hey, there's a new vulnerability, so you're gonna go call your developers, and you're gonna say, okay, you have one day. 24 hours to validate the vulnerability, build a fix, test it, and roll it out. But it doesn't end there. By 2027, It'll be estimated to be an hour.

12:31And then a minute. So these are some of the challenges that we have to deal with. It's not just the timing, it's also the numbers. I'll throw some stats out here. So, before Mythos came out, Mozilla, who creates a Firefox browser. You guys are familiar with that. They were going through their normal patch cycle, and they identified 22 vulnerabilities in their browser. Right? And they went off and they patched it. When Methos got limited release, they brought in Mozilla. Mozilla grabbed it. Within a couple of weeks, they started running it against there. Do you know how many they found? New ones! Right? In that short period of time, it was in under 2 weeks, Over 270 new vulnerabilities. Where the best and brightest only found 22.

13:29The previous several weeks. This is an order of magnitude difference. Now, couple the fact with… it's not just finding the vulnerabilities, the vast number of vulnerabilities never get exploited, because it takes so much time and effort to develop exploits. Mythos and its peers out there can now develop the exploits at the same time it's finding the vulnerability. Typically, within days. Alright. So, that's the good news on the technical side, right? So, let's go with the people side. And when we think about the people side, we've got the accidental, the non-malicious. Right? And then we've got the malicious side. Well, again, you've got a lot of people out there that are using AI. Probably some of you right now, in fact. You're using AI.

14:25We have developers that are using AI to write code and develop products, and it's amazing! Because they can give a short prompt, and the AI will come back. It'll pull the libraries it needs, and it'll write the code, and it'll put it on the screen. And that developer can see if it works. And if it works, number one rule in software development, by the way, if you write code and it works, you don't touch it. You don't add or remove a space, a comma, nothing! Right? And it works. So they just move on to the next piece. They don't go back and look at the libraries. They don't go back and look at the code. They don't have time for that. They're being pushed. What we see is AI, which has been trained on code. Its whole library is massive amounts of human-created code. Guess what? Those code was riddled With bugs and vulnerabilities. It's no surprise that the code that AI is generating today also has bugs and vulnerabilities. What did we teach it?

15:26Right? But we're not doing those checks, unfortunately, so we're seeing a lot of code. It's not intentional. What is intentional are the attackers who are using AI to be able to do social engineering, and we've seen a couple of them here today. Right? You can impersonate, you can do phishing, you can do, all sorts of things, you can create synthetic deceptions. And with that, I want to introduce you. Well… to Celeste. Celeste is my favorite. When I say my favorite, you have to understand, she's not real. In my position, I get the pleasure and joy of every month going through and trying to find the latest scams in my inbox, or SMS, or on web pages, right? Most of them, I'm waiting for the ones directed at me. I've got some great little research stuff that I do.

16:27Alright? Celeste is now my favorite. She is totally awesome! So, Celeste here, right, is a very carefully and crafted synthetic identity. The name itself actually comes from a Swedish investment family. She purports herself to be part of, I think it's TCG Finance, or something like that, which is a real company, by the way. Okay. So, she engaged me, Right? Started in email. And of course, I'm going to engage back. Right? She, in her first engagement with me in email, did OSINT, right? She researched me, looked at my recent posts and articles, crafted a message using cognitive vulnerabilities, appealing to topics that I'm interested in.

17:24Right? Appealing to urgency, opportunity, all these things. So of course I engaged back. Right? Started doing research, and one of the things I typically ask is, hey, connect to me in LinkedIn. Right? Because if they give my… their LinkedIn profile, I've got a whole bunch of info… more information I can go dig into. And she gave a great response on why she's not in LinkedIn. Okay, no problem. We go back and forth, multiple times a day, and get to the point where she says, I have a webpage. Really awesome! So I go look up this webpage. The webpage was created less than 24 hours before, has full SSL certs, has the domain. She's already seeded it in Google and search engines, she has… A new email address, right? She's got all of this. In fact, I can look up all that information and see exactly when it was created. It's fantastic.

18:28So now I'm trying to get her online. Hey, join me in a video. She was willing to do it, but not in something like Zoom, where you have a higher resolution. She wanted it on other platforms, where I had to give more information, she could put layers over it and do some other things, right? But the question is… Right? Would you be fooled? If somebody's approaching you or your workers, and they had web pages, they had social media accounts, they knew your interests, they were leveraging cognitive vulnerabilities. This is what we're seeing. I'm seeing, you know, intelligent threats create contracts on the fly. Job requisitions, on the fly, custom. Just for me, I'm very flattered. I was very flattered when she created a webpage for me. Right? So… That's what we have to worry about from the behavioral side. It's going to get worse. It's not just multimodal.

19:31which was text, image, video, voice, video and voice. We now have to worry about The multi-provenance, because they're gonna back that up with social media accounts, web pages, job requisition, all this other material that is highly convincing. Fun stuff, huh? Okay, I'm gonna go through process real quick. We have to worry about shadow AI. Make shadow IT back in the day look like child's play. It's really tough to understand what AI is being used. And there are more and more challenges around this. The implementation of MCPs and APIs, which is the interface to allow Agentic systems to use your technology. It's fantastic. It also creates a tunnel through all your security tools and platforms and oversight and management To allow attackers to get to your most critical data, unfortunately.

20:36MCPs were designed specifically for functional use. They even tell any opposing agent what access they have, what data… Get it. Right? It's a hacker's wet dream. And all of this happens at machine speed. A speed in which security operations… there's not a human in the world that can detect that and respond to it in time. Right? We're seeing orchestrated attacks by AI. Blowing through an organization, and they don't know until it's done. So what do we have to do? We either adapt or we get crushed. And this is where you're gonna hate me, right? Because the first thing here is probably the most important. Alright, and this is the I-told-you-so moment. You gotta do the basics. And when I sit and I consult and sit down with companies of all sizes, all over the world, this is the first one.

21:33If you don't have good basics of cybersecurity, no matter what else you do, you could buy some fancy AI tool and tracking and whatever, it's not gonna make a difference. So if you're gonna do anything. Do this. Ignore the rest of what I say. Right? So this has to be in place. The second thing, and this is a change, Know your enemy. Our industry in cybersecurity has Since the beginning. Focused only within our walls, or firewalls. Right? We looked at, well, what vulnerabilities, what issues do I have, so on and so forth. And how many people watch World Cup? Anybody watch a World Cup? Oh, great games, great games. You're a coach in the World Cup! If you only focus on your players, what's your best defense play? What's your best offense play? What are the conditions of the field?

22:32You're probably missing something in your next match. Because you should really be understanding what the other team brings to the table. And we haven't done that in cybersecurity. We have to start doing that, because it allows us to be more efficient, more effective, and we can allocate our resources better. We can't peanut butter across anymore. We have to focus. Military has learned this for decades, or hundreds of years, back to Sun Tzu, in fact. Third. We're trying to run a race with a Toyota Corolla, and the enemy has just jumped in an F1. Right? We have to change the tooling. We have to get the same tools or something comparable, which means we have to embrace AI. They have the advantage, by the way. They don't care if it works completely, if it breaks something, right? They can just jump in at its current state. We have to wait.

23:28In security, we can do no harm. It undermines the trust that we bring to the organization. Therefore, we have to have trustworthy vendors before we can adapt to it. But we have to move into this and work with them. And lastly. And we've talked about this a little bit. As security professionals, AI's coming. Yeah, we don't get to stop it. We can't try and block it. We can't be the office of no. We have to be a welcomed partner. Otherwise, we'll be the last to know. So, we have to get over that. Governance requires cooperation. And the last thing I'm gonna go through here is really the accountability. Because out of all these things that are changing, the one thing that doesn't change Because our neck is still on the line. We're still accountable for all of this! Right? The customers, the business partners, the board, they don't care about all these other changes. You still own risk.

24:29So we have to adapt to that. So we have to be that partner. Without a doubt. We have to build our tools, processes, people, and everything else to continually adapt. If you think you can build a static system and go, it's built, I'm done. You're lying to yourself. This is moving way too fast, and it will continue to move this fast. And lastly, and I'm gonna close on this. This is for all of us in the room. We have to embrace this ride. It does not get any easier, and it does not slow down. And there's a lot of people out there, they're at the end of their rope, they're stressed. Right? So, if you are not somebody That enjoys that ride. That is okay with ambiguity? Ambiguity? Right? That… doesn't like chaos, right? This may not be the role, because it doesn't get any easier.

25:29But if you are that person. Oh, it's gonna be a good ride ahead. So, questions! I know I brought up a lot of stuff here. Question, right up here in front. I'm sorry, Stacy. It'd be safe to say that there is… Wouldn't it be safe to say that there's a lot of AI tools available to help prevent these, vulnerabilities from appearing to begin with? Absolutely. And by the way, we've had tools like that, we've been using them, SAS and DAST and all sorts of things, and yet still vulnerabilities get through. there is an inherent, race condition, if you will. We need to get the product out as fast as possible, do scans, but it needs to be done in 2 hours. Right. The same business limitations are there, and we have to reset those. But yes, we are seeing, and this is why Microsoft released over patches for over 600 vulnerabilities in the slash cycle, because they are using Mythos and other products to find more.

26:40But every time they look, they're getting more, and these engines are getting better. Since Mythos first came out, it's already had two major revisions, and what it finds is even more every time, and it finds it faster. Do we have an online question, perhaps? Alright, they're asleep. Alright, we got more ques- the indomitable Edna Conway, yes! It's not so much a question as I want your opinion on something. So, you and I have talked about, at the end of the day. While we embrace the technology, we believe that the humans are the solution as well. So what I've been doing is I've been getting a lot of, Celeste-like folks in my life who know that You know, I sit on boards. And they found really great ways to do all kinds of cognitive research.

27:36And set up just the perfect board seat that… it's amazing that they're looking for somebody with my bizarre background, right? So what I've been doing, and I've had a lot of success, and I want your opinion on this, and I'd love to encourage people to do this, when I realize what's going on, and, you know, you and I might be a little quicker at figuring out, but many in this room can do it, I actually contact the company that they have Claim that they are part of. Many of them boldly use the names of people in the particular field and or on the board. I contact them, and then I contact the local FBI agent. And I sick all three of them on… on them, and gleefully send them a message back that says, you will be hearing from the following three. communities, and I appreciate the fact that you gave me ample evidence to come after you Try not to do this with somebody who's as smart as me next time. Setting aside the glee that you experienced from this, it brings up a really important point.

28:48Right? Our industry is already stressed. Just to achieve the deliverables we're on the hook for now. For us to move forward and be able to adapt to things like this. Sometimes it needs a gentle nudge. Sometimes it needs an Edna nudge. But… We're not… and it's really tough for organizations to be able to justify. We need to do this now. But we have to find a way. Because the people in this room and on the bridge, we are the experts. And what it's really gonna take, and what Edna does really, really well. is she translates that cyber risk and puts it in the context of business value. Because the moment you do that, now you have your C-suite attention. You now have your board attention, and it also travels downwards. You now have your product line management attention, and everybody else.

29:50That is a skill that we're going to have to do and apply to make sure that we are moving our industry. We can't stay stagnant. Everything I've shown you today, It's gonna get worse. That's today! What's it gonna be like tomorrow? So we have to move and be in the mindset of moving and upgrading and adapting to the risks that present themselves. And if you can do it ahead of time. With foresight, you will have an advantage. Thank you, Matthew.