Balancing the Line: Innovating Risk Management Without Breaking Compliance

Auto-generated from the live recording.

0:12Thank you, Drew. So yeah, we're excited about this panel today. So my role at Living Security, both work with new business teams. So we're talking to prospects about what is HRM. Everyone gets excited about the concept of using their data, using it more accurately, proving outcomes. It's very exciting. But as Kelly stated, Tim stated, they're very much like a snowflake, right? So no programs are the same. So when we were thinking about HRMCon this year, one of the things we really wanted to focus on was bringing in some practitioners and some leadership that have been around this space for a while.

0:54That can tell a little bit of the cautionary tale, some of the big wins for the program, things they would do differently if they were to start over now. So I'm really excited about it. So quick introduction. So we have Amjed Saffarini, who's currently the CEO of Trove. We got introduced during his time as CEO of Cyber Vista. Jacob Revord heading up the Cyber Engagement Culture Strategy, now with Aveva. But he's been a long time customer. He'll talk a little bit about that. And Jon Garza, who's currently the CISO of PSA, BDP, which we will have him describe that 'cause one, it's fun to watch him do that.

1:40Two, but it also gives context to how his org is different, right? What regulations they follow in that space. So we're really excited to jump in here. So first question, we talked a lot about what data to use. Tim talked about this program that's running about six or seven years, started with training data, phishing data, some malware. One of the biggest challenges we have is the amount of data we can ingest for our customers spits out a lot of insights in a lot of risk pockets and a lot of vigilance. There may not be an operationalized plan to attack that risk or to celebrate that vigilance.

2:20So Jacob, can you talk a little bit about the program that you set up before, some of the challenges that you had and now that you're kind of building it back up again, what are you gonna do differently at this time? Yeah, so I'm sure like a lot of people when you think about HRM in general, the idea of being able to take everybody's behaviors and look at them all in one place is a very novel and appealing idea. You get very carried away with that concept very quickly.

2:56So you have Microsoft Graph and CrowdStrike and Intune and MDM and DLP and phishing and LMS and I want all of it, right? I want all this data as quickly as possible. And so that's what we did. We took all of our data as quickly as possible into the tool because we could and nobody was telling us in the industry. Us included. That was a bad idea. Well, because nobody knew better. You don't know what you don't know at the time. And we learned very quickly that you can't tell a story with an entire book of information if you don't know what the key players in that are.

3:44And now that we're looking at what kind of story is that we wanna tell, it's sitting down with the key stakeholders in the program, the SOC, the analyst, the CISO, the C-suite, understanding what story matters to them and understanding how to tell that story to them. So Edna said it earlier and let me quote her if I don't get it wrong. She said, you wanna know what risks are being reduced. So I need to know what risks you actually care about, right?

4:21I can't tell you the risks that you care about if I don't actually sit down with you and figure that out first. So with an HRM program, it's sitting down with the teams and realizing these are what matter to each person in that program and figuring out how to tell that story. Yeah, I like it. And I'd like to get back into as you're building the program, how would you define that? Like what are two that you've found? But before we jump into the profile, John, I think that plays into what we've been discussing over the last few days, which is alignment with the business. As a CISO, you can approve an HRM program, but it won't be successful without partnership and alignment.

4:59So who did you reach out to on your team to get support? And then how has that helped you improve and grow the program? Yeah, for me, I always wanna make sure I've got established relationships with two key other departments in my organizations. The first one is always legal for a multitude of reasons, but especially when it comes to establishing an HRM program. And then the other department would be your HR leadership. Making sure that you have got champions in those two key areas are really good places to start when you're trying to promote anything within your cybersecurity program, but especially when you're talking about trying to promote something like an HRM program.

5:44HR is kind of easy. I think someone mentioned earlier, there's all kinds of problems, potential problems that will show up in your HR data. And those people that are the specialists in those areas, they interact with it every day. So you've gotta come at it from an angle of, it's gotta be a partnership collaboration with those two key groups. What is the good data means? Good data, bad data means bad data? Yeah, absolutely. So John, we hit on, so HR as a partner, right? If you're going to be engaging with employees, you need alignment with HR.

6:21What are we doing, right? Tim talked about the scorecards not being used as punitive, right? It's education, it's awareness. You also brought up the fact that HR, as you look at your segment of data as a department, they have a lot of access and they have a lot of data and some risks tied to them, so that alignment to stand up HRM also leads as almost a use case or a test case to sit with HR and say, let me see what, let me show you what I'm seeing in your environment. How should we be thinking about this as we go wide globally into other orgs within the company? My experience has been as soon as you get access, for example, to the HRI, the Human Risk Index Score that Living Security offers, as soon as you get access to that, within the environments that I've been a part of, the first go around, it's not going to look great, but you start where you start, and then from there, that's where you start to engage your leadership, whether that's HR, legal, what have you, and explain to them, sit down, that look, we're not here to try to get into some sort of gotcha situation, right?

7:28It's got to be a collaboration, it's got to be a partnership, but now that we have access to this data, how are we going to make improvements? How are we going to reduce the risk for the organization, and then that's where you get into those follow-up conversations of what actions are we going to take now that we have access to this data, and that's where the rubber meets the road. And it's a good pivot, so Amjed, we were talking a lot this week about what's the bullet? What's the punchline to the board? What's the ROI of even starting an HRM campaign? How do you see HRMs showing up in the boardroom, and then push down from there?

8:08Well, thanks for having me. First of all, I was warned not to play the role of a security practitioner, and now I kind of understand why I'm only getting every third word from these guys, but I think to your question around the board, you heard the team here, I think John just talked about this notion of ownership, not just responsibility, and so you have a people stack, and that people stack is owned by the HR team, let's just say, you have an infrastructure stack, maybe security has something to say about that. You have comms, right, you have the messaging, which is owned by the comms team, so you have lots of ownership, and one of my favorite things to do is you sort of like get a proposal for the next set of security spend or a budget, and you know, you get a really, really nice presentation about how this will help, right, in some way, and the first question you ask is, well, have you spoken to the people who are owners of the people stack, the HR team?

9:03And you get that sort of like, oh, you know, crap moment, and I think that that immediately calls into account the tabletop exercises that we all do all day long, right, where we're all supposed to be collaborating and working together, and then we go back to our day jobs, and you ask a simple question like, yeah, you own people, you own data, you own infrastructure, you own communications, so who owns behavior, right, and you generally tend not to get a very definitive answer to that question, so I think everything that you guys are doing here at Living Security, obviously, everything we're talking about at the conference harkens back to this question of who owns behavior, and in the absence of a single owner, you have to have a council, if you don't wanna call it a team or you don't wanna call it a committee of a board, at the very least a council of HR, communications, legal, obviously, and security, to be able to actually prosecute the really important decisions.

10:05Benchmark matters, so where you're starting matters, what happens a year later when you're reporting to the board, matters a lot more, because boards are all about what? Moving needles at the end of the day, right, wherever the needle is today, it better be moving to the right by the time we next talk, so I think it's really important from the benchmarking and moving needle perspective. >> I love it, so Jacob, in your world, how would you answer that question? Who owns behavior, and who do you partner with internally to make sure this is successful? >> I would argue we all own behavior, so certain teams have functions within behavior, but behavior is a corporate strategy, right?

10:46It's not something one team does or doesn't do. Now, certain teams have a bigger part in how that trickles down to the people within the programs and the people within the company, but to your point, if we're not working with every person in every program on that team, in that committee or counsel, then the behavior's not really gonna work either way, so it's understanding who those key players are and keeping that committee engaged. For me, it's, I go back to storytelling, I've spent eight years at Sony, so it's no confusion that storytelling is something I'm really passionate about.

11:28I think understanding the story that you're trying to tell is critical, right? I look at, what's the human involved? So within the storytelling, who matters? Is it finance analyst, is it HR, is it legal, and then what's the emergency I'm trying to stop? What's actually the problem? Is it credential harvesting, is it vendor email compromise, is it social engineering, is it deep fake, is it a technical control that I can put a wrapper around? And then what's the response?

12:03What are we trying to do to solve the problem? And then what's the outcome? 'Cause the outcome is what the board's gonna care about. The outcome is what's gonna solve the value proposition for the entire equation. So understand that outcome is part of your story. And we just listened to Tim talk about driving malware down to zero, right? That's an outcome that matters. As you're looking at your program, Jacob, and you're starting it, what data sets are you gonna use to create a KPI or a statement at the end of the year that we've improved this? Is there a specific focus area of yours that you're really determined to have an ROI on?

12:45How are you thinking about that? Big one for me is always gonna be credential harvesting. I think credential harvesting is going to be one of your largest infiltration factors in any industry. For us, looking at the data that we're getting in and understanding where those risks lie. So if it's finance, if it's legal, tracking where those key points are, and then setting the metrics that are gonna say, here's where we are now, here's our benchmark.

13:23And then in a year we can say, we were there, we're now here. This is the outcome of what we had initiated and representing that. Love it. John, from a CISO perspective, right? You think about what you wanna be reporting on, right? Social engineering is a universal risk. Every organization, we need to use the real phish data and the simulation phish data and the threat data and the dark web. That's a simple profile to create. But we've spent a lot of time talking about elevated access and permission. So if you start there, what do you layer on to that from a behavior or a threat perspective that is concerning to you as a CISO that we should be thinking about as an industry?

14:12You mean in terms of like what other kinds of tools you would apply or-- Yeah, what type of data on top of elevated permissions do you wanna be notified that this is happening within my elevated access community? Or how are you thinking about positioning a program around that type of data so you can get to it before we're dealing with it on the response side? I think that's where you're able, if you're able to tie in some of these tools collaboratively into multiple data sets, and you've gotta pick on which ones those are, right? Whether that's Active Directory, whether that's your PAM solutions, your DLP solutions could be critical.

14:51And those are the kinds of things that I would be bringing in into the existing data, but you've gotta correlate that to determine who are those risky users in your organization. I know Living Security has some really good capabilities right now that my team's using to identify who those risky users are. And I think that's where you have to, when you're presenting this information to the board, you sort of have to understand one, who are those champions in the board for security, also help them understand what is their level of knowledge when it comes to a lot of these security risks and threats. You kind of have to meet them where they are and make sure that you can help educate them so that they're asking the right questions and you're providing the right type of data to them.

15:35As you go through that process, what's been the biggest challenge? Have you received any pushback? Are you getting hard questions that you still are working through and something we as a partner can help with? I think for me, a lot of us, we have a lot of security folks. We tend to focus on really complex technical situations. Those are the things that are usually fun and cool to go and dig into. But I think generally speaking, if you look at the types of incidents that happen all the time, those compromises, those security incidents are usually a result of a very basic failure of certain aspects of security.

16:23So I think if we keep it simple and break it down to the basics and do a really good job there, that's where we really have to focus a lot of our attention. Not to say that those other more complex technical risks don't exist and don't pose problems to the business, but you've got to just focus on doing those basic things really well first and explaining that to your board. Yeah, we spend a lot of time thinking about how do we create wins in the first three months and six months? Because once you get the creativity and you start thinking of these profiles different and how do I get my data to work together to tell a really creative story, then you can really build on top of that.

17:09But if you try to do too much, too soon it can be overwhelming. I'm just, as you think of it, you've been following the space a while with us and obviously in the industry. If you had to look at it and say, these are the two or three things that a board would wanna hear. Beyond an outcome, is there a specific outcome that you can think about that would really raise eyebrows or garner backing and trust? What are two or three things boards would love to hear from an HRM program? Oh wow, it's gonna be a massive overgeneralization and that's an understatement.

17:49I think maybe the one thing all boards could agree on is that their our job at the board and certainly beyond that in the management team and beyond that in the broader company is to create value, right? If you're at the board seat in any, let's call it non-emergency mode, you're thinking about long-term value creation. And so the security team, their ability to align to long-term value creation is really, really important. And to John's point, sometimes that alignment is not always there or 100% of the time.

18:25And so when you think of most companies and it's a cliche, but when you ask them, what's your most important asset? What do they tell you? Your people, right? I heard somebody say it, your people. So here we have this problem of long-term value creation. Every company has that. Every company tells you their most valuable asset is their people and your security team is telling you your biggest weakness is. Well, I'll never tell you that. Oh, you won't. Other people will say that. You're the closest person. So that's why, thank you Mark. So we'll say people are our biggest weakness, or at least from a security perspective. And so now we have a little bit of an equation that's coming together.

19:04I think the notion that we're looking at behaviors, for example, which is what this conference has been about, as long as you're awake, you're generating behavior. So what are you gonna do? Put that into a large database of some kind, or have AI mine it? It's gonna be pretty difficult to do. Marketers have solved this problem. They call it segmentation, right? Product people have solved this problem. They call it use cases. There's a name for it in every industry vertical or every functional area. I think this notion of behavioral clustering, or whatever you'd wanna call it, is gonna become really important because very quickly you will get overwhelmed by data as a security practitioner.

19:43And by the way, if you as a security practitioner are getting overwhelmed by data, what do you think is happening to the board when you start talking about this? So you have to start, I'd say, dumbing it down, but maybe focusing on the true things that are moving the needle, right, what we talked about before, within behavioral clusters that actually create long-term value. So those are sort of the three elements of that equation. Long-term value creation, behaviors that modify the long-term value creation, and then ultimately you kind of go back to the nuts and bolts of what moves that needle. So I don't think it answers every board's direct interest in the next 90 days, but maybe as close as I can get.

20:25Very helpful. Jacob, as you think about where you've been and what you're doing now, what are some profiles that you have a plan for, right? Whether there's a workflow. If we have a heavily targeted user that's clicked multiple times, that has privilege access and has deactivated MFA, there are workflows for that. That's a pretty simple profile to say a control needs to be put in place. It's not a one-minute module. We need to control this environment a little bit differently. When we get beyond social engineering, it becomes a challenge, right?

21:02So we'll talk about using HR data. We spent some time this morning thinking about somebody leaving the business. That typically is outside of the visibility of the security team. And now I want to tie that to data migrating externally. That may not be malicious, but it has a definition of potentially malicious, and there's a play for that, right? I can send that to a team as you think about it from an Aveva perspective. What are those two or three profiles? What data sets are you thinking about using to create that view?

21:37Which puts it into the stream, the workflow that's already been built to mitigate that risk. Well, and I'm gonna first highlight on the malicious, non-malicious insider threat, accidental insider threat. The concept of a risky employee doesn't necessarily mean that the employee is a risk to the company. Employees create risk based off of who they are, what they do, where they're at, what they touch, what they have access to.

22:13That all assigns risks to an individual. And not to monitor that and not to track that in some way is a disservice to the program. Now, if I say that this individual has assigned risk score of A, B, or C, doesn't necessarily mean that this individual is doing bad. It could mean that they have access to sensitive data or they live in a region that has an increased risk of compromise. That is something that is going to be tracked and monitored.

22:49Now, delivering that to the board knows we're tracking this for this purpose, this is what this means, and letting the employee know. We're not saying that you're a risk to the company. We're saying that because of what you do, you have increased privileges. Now, if we're gonna share this information out, letting them know what all this means. That being said, a few of the ones that, I brought this up earlier. I don't really care if the janitor clicks a phishing email. I care if he lets somebody in the front door. I care if finance clicks a phishing email.

23:24If they were remote, I don't care if they let somebody in the front door. Two completely different threats. So, identifying in the business with the SOC and the business C-suite, CISO, business purpose, or business verticals, what those priorities are with them. So, what I've begun doing is setting up teams and regions that are responsible for regional controls so that they can deliver targeted, regionally relevant programs that are viable to that specific domain. So, in APAC, we're gonna have different concerns than we might in EMEA, than we might in Americas.

24:05With GDPR, we're gonna have different privacy concerns in EMEA than we will in Americas. Understanding all of these threats, understanding all these concerns and risks, and being able to set up controls and mitigating factors that track that effectively. John, I'll have something similar for you, right? In a different environment, you regulate it differently. What are some of the risks that, as a CISO, you are concerned about? And do you have the data internally to build those profiles to be able to respond, whether it's automated or a manual intervention?

24:41How are you thinking about the employees and what to measure and where does this go from here? Because how long have you been doing this for a couple of years now? Yeah, just a few years. So, as you think two years out and three years out, what are the profiles that you're concerned about that we should be thinking about? So, my organization is a global supply chain logistics. And we do a lot of business in Asia, Southeast Asia, the APAC region. I know this is something that happens globally, but what I have seen, where it started for me, getting exposed to it was a lot of the deep fakes that are going on out there.

25:21And they're very targeted, for example, trying to deep fake that someone is a CFO or some CEO, trying to compromise a financial employee to make a payment. And there's incidents that we can all look up in where they've been successful. And I've seen a lot of that kind of activity, especially in that particular region. And that's the part that really, that kind of, those kinds of incidents really keep me up at night to find out what, how are we gonna get access to that kind of data? A lot of it comes through, comes in through email.

25:58So, the typical social engineering, phishing, training capabilities have to be there first. But it feels like, even though with the advent of AI, on the protection side, like for those of us that are security leaders, it feels like we're constantly behind and playing catch-up. So, I think time is critical. When we're dealing with any security incident, deep fake ads and those kinds of situations, again, time is a huge factor in being able to respond quickly, effectively, and make sure that you're taking the right types of actions.

26:39Not sure if that's exactly answered your question, but-- Well, it almost opens up a new one for me, which would be, we talked a lot this morning about there's detect and respond. How do we take that data and root cause analysis, look at it and say, what was the profile that led to that incident? If that continuously occurs, something we talked about at breakfast this morning was, how do we use our data, tell a story and show an outcome? If you have data that say this incident occurs hundreds of times a month, and I can decrease this by 50% by being alerted very early that it's starting, how do you, have you used the incident data to start creating a heat map and understanding of what's coming?

27:25But that could be what's next. I think I'll lean back towards the predictive capabilities that the human risk index score can give you, can provide customers like myself. I think that gives you a lot of insight initially on are you, is this user trending in the wrong direction? What are those follow-up actions that you need to come behind them and say, okay, Mr. Employee, what's going on here? This is what we see. Meeting with them individually to try to have that really conversation, that one-on-one conversation.

28:02That can be a really great place to start. I can understand how that can be somewhat difficult depending upon the size of your organization, but I think having those conversations are really good places to start. So we've touched on it a couple of times already this morning and I'll hit on it now. We'll open it up to any of you before we go to the live Q&A. Keeping it simple is really difficult. It's easy to set up here and talk about it and really think about ways to really distill this down to its easiest, but it's a challenge in every area of the business.

28:40Whether it's because you've been there before or seen this play out, are there some tactical piece of advice as two that have deployed before to say, don't do this? What really has worked for us is these two things and then we're able to get to the next. Are there some examples of a really successful, simple, left-to-right program that our clients can stack wins with that none you're building upon? I don't know where Tim's at, but he said something earlier that made me laugh.

29:15Getting data intakes time is not a quick process and to assume it's gonna be a quick process is going to just hinder the process. Good data is gonna deliver good data. So starting with good data and not going further until you have good data is critical. If you try to implement a bad IDM data stack and you don't know who your lever is and who a joiner is in the company and you try to identify a lever and a joiner, you're not tracking anything.

29:55You're identifying ghosts in the system. So sitting down, having a heart-to-heart with HR, with IDM, with identity management individuals that are actually setting up the system and saying we need to solve these issues before I can move further on this program. 'Cause if you don't do that well, then it's just gonna fail. I think you definitely have to, now that we have access to this type of data and this volume of data, you've gotta make sure that you have those relationships built with those other leaders.

30:34Like I was mentioning earlier, again, you want them to come to your side and understand, now that we have access to this data, what are we gonna do about it? But it's gotta be partnered with them to be able to make sure that you take the right actions. We as security leaders cannot sit in our ivory tower and try to project that thou shalt do this and thou shalt do that. We've gotta work together with the other leaders in the organization in order for us to accomplish any of this stuff. I think many of us here in this room can appreciate that.

31:09And then especially when it comes to talking to folks on the board. Again, if you can come up with a way to identify those security champions on the board to help you get that message across and focus your attention in the right way, then many times you can get the right amount of budget, perhaps, to build out your human risk management program and really mature what a lot of organizations still today struggle with, with just doing the basics of security awareness and training. And I know with Living Security, you guys are kind of taking that to the next level with this HRM concept.

31:47That's what we need to continue to promote as security leaders and maturing all of that within our own organizations and to the boards. I love it. And I think one of the things that we really need to help in the market is the, how do I deploy? How do I get the win quickly? So I use something, so you talked about the identity team, getting them involved. It's pretty simple to say they have a risk score of X, so we're gonna restrict access, right? So some of the early knocks on HRM was C-Risk, TrainRisk.

32:25C-Risk, TrainRisk. It doesn't mean that, it's visibility. Sometimes it's training on their terms. Sometimes it's not training a user or an employee because they're doing all the right things. Why are they getting this? Again, when you think about automation that can come in, a restriction of access or friction to access of data, there needs to be real collaboration to say, what is that score? Before you go do that, what does that score mean and what led to that? Have you started those conversations with your team? How do those conversations go right now for people that are thinking about this moving forward?

33:05For my team, we've started having those conversations internally within security and within IT. But yes, the next logical step is then to branch out to those other departments within the organization. But yeah, that's kinda where we're at in my journey. So before we go to live Q and A, who knows what comes from that, from the audience and online. Anything closing? A big win of HRM for your programs. A challenge for the market. Anything you guys wanna share before we go to the audience here?

33:46You asked me earlier what my big push is for the next year, two months, three years, whatever. Changing the narrative that security is a cost center and that security is a value proposition for the business. That security baked into the business is a value add for the entire business. If a customer sees a business behaving securely, it's a selling point in the world we live in nowadays where everybody sees all of the incidents you reported in the news, if your name's not with them, it's a selling point.

34:25If a customer sees your product as a secure product, a sales rep can take that to a potential client and say, these are the products we have that are, and these are the security tools that we have to go along with them. So HRM, UNIFY, all of these tools, all these theories, it's what allows us to change the narrative of security and deliver it as a value proposition to the business. And the narrative changes with the evolution and the innovation too. You don't just get that, right?

35:02You earned that. So I think it's a great point. John? I think, I mean, I'm just gonna say again, moving towards this idea of human risk management, you've gotta make sure that not only your teams, but also your other department heads within your organizations understand what does that mean specifically? You've gotta, again, build that foundation of, are we talking the same language? Make sure that we understand the terminology the definition of what human risk management really means. Now that we have access to this data, what are we gonna do with it?

35:39What actions are we gonna take? I think there's some organizations that kind of get caught up on the penalization of, okay, now you clicked on the message, now you've gotta go sit and time out. Well, every corporate culture is different, right? So I'm not gonna go down that road too much. But you've gotta make sure that, is it the right thing within your organization from a culture and a strategy perspective? But you've gotta really understand those other department heads and the collaboration that really goes into it, so that way you are taking the right actions that are right for your organization, but also address the true security threats that are out there in the world that we all have to face.

36:20Yeah, and I think it all comes down to appropriate expectation settings too, right? We have a lot of customers that come on board. What should we be expecting in three months or six months? And Tim talked about it. One of the most tangible feelings of what HRM is, when Mastercard's team walk in through RSA and they all got their scorecards. They're arguing in there, look what I did here. And I'm like, that's what it looks like. You can feel that, you can touch that. And we do that at Living Security, right? We're looking at a scorecard, next thing you know, you get a Slack message saying, what happened to your team?

36:59I haven't even opened mine yet. But you can start to feel the momentum shift and the understanding, right? We're not the no police, right? So when you start thinking about, how can I put HRM in an RFP as you're working with a really secure vendor to go win a deal, right? Or how can I look at my team and say, we're doing all the right things from a business perspective, but we're also doing it in a secure way. I think is a nice win. Amjed, anything that we missed on that you think you'd like to share before we go to the panel?

37:35Yeah, I mean, I would say the biggest topic of conversation in boardrooms these days I'm sure is no surprise to anyone is AI. And, you know, try to explain to a board member that when you put data into the system, it's not storing the data, it's just using it to change the weights, you know, anyway. So I think the complexity of sort of taking some of these really difficult concepts and distilling it down to actionable sound bites, right? Whatever that looks like. For example, we've talked a lot about how to manage mine, integrate, communicate about our own company's data in here. We haven't spent a lot of time talking about the sort of broader, larger data set, right?

38:16The ability to sort of take all of our data, right? All of our data in a very not big brother-ish way. We're just changing weights, right? We're not actually storing anything. But the idea that you could take the insight from each of our three companies, four companies here, every one of your companies, and bring that actionable insight day one to the board before they've even added their own data set, right? It's just intelligent and smart foundationally as they use in the AI vernacular. And then you could sort of refine and hone and train, right, and balance and play around with. That is the kind of value proposition your boards want to see, that there's value right out the gate.

38:57Build that trust with the board that what you're doing actually has value instantly. And then they will see it, aha, I get it. That's a behavior cluster, that's a problem. That's a geopolitical or geographic issue. Once you have that, then you'll actually get the mandate to then integrate your corporate data stack into it and much more down the road, right? So it's that little bit of a trust-building relationship. It's not binary as somebody said this morning. You really do need to incrementally build through it. Starting from a not zero state is hugely important, right? You're sort of in this AI security world.

39:35You have to find the providers. You have to find the groups who are going to help you start on third base. And all you need to do is sort of like add that last bit to actually hit the home run from a security perspective. So those are the providers. Obviously for us, we're a client of Living Security. So as a small company, right? I've run large companies, but as a small company now, we benefit from not necessarily your data, but from your insights, right? And so those insights are what are helping us as a mid-sized enterprise actually build a security team that punches well above our weight or what our data itself would provide.

40:13So I hope that sort of helps a little bit. Absolutely. So when we go to the question and answers, what I'm taking away from this is focus. Come up with a goal. Start with the KPI. One of my favorite conversations with the prospect six, eight months ago was my compliance metrics are sad. It has to be more than audits and completion rates and click rates. So we started migrating that way, but defining the goal. Once you have an outcome defined, it's easy to create a plan to attack, right?

40:50So starting small, simplicity on the data side, working across departments. Comms probably can't tell you you're not gonna do this, but they can make it really hard to really engage and change the scores that you're looking at, right? So really working collaboratively across the business to ensure you're not gonna hit a roadblock that slows you down for three or four months down the road and with better tight outcomes, right? Slide decks, we heard it all this morning. Marketing, marketing where sales conversations, if it's not focused on, it's great that you can see something, but what did we do about it?

41:30And what did we learn? Not everything needs to work, but it needs to be iterated on. I think if we can all follow that, we'd all be a lot more successful and we would have been having different conversations five years ago saying, Jacob, don't do that. We've seen this before. We're doing that now, so we appreciate you going first. It's our all, we went down the road together. So yeah, Drew, any questions from the audience that we want to focus on? Laurel, Laurel is a question. Okay, let's see, Laurel.

42:09Here's Laurel, here's Laurel. Okay. Hi, Mark, how are you? Doing well. So I work for a large enterprise and I don't get to talk to my board very often. In fact, I never get to talk to my board. My challenge, and I think a lot of people can share this feeling, is a CISO level. I've worked for five different CISOs in 12 years at my company and I've never had one CISO come in and say, oh, we really need to change human behavior. They are focused on technical controls.

42:46So I'm really interested to hear from John. How were you a convert and what sold you on the idea of human risk management? I think for me, the way I think about it, when I come into an organization, once I come in at first, I'm trying to assess what is the security culture in this organization? Is it positive, is it negative? How do employees look at the security department? Is it positive or negative? I'll gauge that first and then ultimately, wherever the organization is, you want to build in that security culture and I think, yes, we all have metrics and all these other cool tools and whiz bang things that we can play with to show them, demonstrate that.

43:31But human risk management really goes beyond the security and awareness training aspect and really helps to promote the idea of building a true cybersecurity culture within the organization. Again, you're using the information, the data of an HRM program to promote it and collaboratively with those other security, with those other business leaders. So that way, it's a top down approach in that way. You're sharing the data, they know that you're coming as the security leader, not to try to get them in a gotcha situation or they're people.

44:10Let's work together on how we can reduce the risk for the entire organization and let's start with your department, your department. Jacob, you wanted to add to that? Yeah, and I was gonna follow that up. HRM addresses a behavioral issue. It doesn't only implement behavioral change. So one of the examples I've used before is in a phishing simulation. If I send out a credential harvesting simulation and somebody puts in their username and password, it's safe to assume they put their username and password in on an actual website somewhere else.

44:57So a technical control that I can implement with the SOC is that any time I run a phishing simulation, I have an automated export of all those individuals that enter their username and password and they have an automated password reset. So technical control that is based off behavioral change. Could I add one more thing there from the board perspective to answer this question? Risk is a four letter word, right? Actually is, but it's also in the metaphorical sense. The opposite of risk is what, opportunity, right?

45:32So imagine, to answer your question, if you frame the entire conversation to the board, not from a human risk management, the bad things that could happen when people fail, right? Imagine if you flipped it on its head, right? And you saw in the video, hey, most people are good actors. Okay, well, if most people are good actors, how do we take advantage of that? So what is the human opportunity management instead of the human risk management? How do you take all that behavioral data and from there say, hey, you know what? This car, it's got great brakes on it, so we can trust it to do bigger and better things or take the, we did the F1 thing.

46:08So take the turn a little later, right? And win that race with a better risk mitigation profile. So I don't know what opportunity looks like or human opportunity looks like in your particular firm, but I bet you, as a security team, can have a lot to say about what can happen there, right? As the CEO, by the way, I get a password reset every three days. Well, I ran a cybersecurity company. I would think of myself as fairly secure, but you know what? Our rules are if you're a CEO, you're getting a password reset, everyone ever, right? He probably made that rule, but. An AP.

46:46Tom, Jen, I think that you touched on what I said earlier, like my dream of how does security become a revenue enabler? How do we reduce friction for our teams that are acting in a vigilant standpoint? How do we let them continue to drive innovation and do the good works that they're doing? So look, thank you guys so much for being a part of this panel. I think, you know, there's tons of probably unanswered questions in the audience. You guys will be sticking around still for the happy hour, the networking hour. So I'll let you guys jump off. And can we give a round of applause for our panelists here?