Small Gaps That Give Attackers the Advantage

Brian Moody: October is Cybersecurity Awareness Month, and so we'd like to welcome you to this month's version of our SoundBytes.

Shahin Pirooz: I gotta say, I love the marketing people who decided to put Cybersecurity Awareness Month in the scariest month of the year.

Brian Moody: In Halloween, yes. In the scariest month, yes. So, it's a scary month. It is. I mean, cybersecurity can be scary. There are certain companies that make it less scary.

Shahin Pirooz: If you're into that kind of scary, either side of that coin, it's a good month.

Brian Moody: It's a good month. So again, welcome. All year we've been talking about kind of this AI push. We've been talking with you folks around the security, around agents, around AI, where and how AI is being used, some strategies on securing AI, AI in your efforts to implement the productivity that it brings into your organization. It's Awareness Month, so we're talking a little bit about awareness, but we're also talking about how awareness is not necessarily enough.

Shahin Pirooz: It's not the only answer. It's like everything. One of the talk tracks I've been recently having in conversations is that we don't have a problem of tools. There's plenty of tools. There's a plethora of tools. In fact, there's so many tools it's become challenging to figure out which tools are the right tools. And as we've been saying forever, every single one of those tool manufacturers says all you need is us. And the reality is—it is the farthest thing from the truth. I, this weekend, I got a little bored and wrote an article and—

Brian Moody: Shocked.

Shahin Pirooz: And it happened to be similar to this topic. It was about, do you know what agents your people are allowing into the building? Because a lot of users are now spinning up their own agents because all of what were the edge-case AI platforms out there, the frontier AI platforms, have now created a lot of agentic solutions around those, and it's literally 5 seconds to spin up your own agent and have it do stuff for you, read your email, respond, book calendar meetings.

Brian Moody: Oh wait, these agentic ghosts don't badge in when they come in?

Shahin Pirooz: They don't badge in. They do, but they badge in with your credentials. So that was the context, and it started a diatribe of conversation around it. And, one of the things that, like, there was a— always when you put something out about here's a challenge, here's a problem, and you're trying to be educational in the context, some manufacturer will jump on and say, "We have the solution to that. We're writing this, and here's the problem that this article is posing, and here's the fix. By the way, we're making it." That happens regularly.

The negative of that is, somebody who doesn't have the knowledge, the experience, is going to read a comment like that and jump immediately to their site and think that's the answer. So, I take it upon myself, as you might imagine, to go and set them straight. One particular topic that sparks to mind based on what you just said is exactly that. It’s that we've created a mechanism. Agents should have their own mailbox, and their own identity, and that would solve the problem. That's a great idea. That is one arrow in the quiver. If you go to a battle with one arrow in your quiver, you're not going to survive that battle. Flat, plain, and simple. You need a full quiver of arrows. You need the poison darts. You need the exploding darts. You need all of the things, all of the different tips for the specific things.  

Similarly, your security stack should have all of the things you need to protect. Yeah, you need identity. Yeah, you need controls. Yeah, you need governance. Yeah, you need all of the things, but they need to work in concert. That's the mission, the vision that we've put together and what we keep trying to talk about and what we're trying to educate the community on is, don't get fooled by all-in-one solutions. Don't get fooled by anybody who says, we have the answer. Even though we have that plethora of technology integrated, we don't say we have the answer. We say we have a platform that can address this problem.

Brian Moody: So we have this platform. You're talking about control sets and all of these components to create this overall security solution. And it's a great segue, I think, into what we're talking about today. So today we're talking about one click, right? One credential, one agent. The net is, is that the exploits that are coming today aren't coming from a massive kind of focused exploit to get into your organization. They're coming from small gaps that may exist within your security infrastructure. And the interesting thing is, is that in this world of cybersecurity, right, we need to be right almost 100% of the time.

Shahin Pirooz: And you can't be.

Brian Moody: The hackers only need one small gap. And that small gap, that one small attack path, is all they need to get in your organization. So that's kind of the topic today from a standpoint of covering a couple of key areas is let's look at that from a standpoint, let's unpack that.

Shahin Pirooz: Before we go down unpacking that wholly, let's just peel back what you just said. If the intention is to block every single attack, every single one, we have to be right 100% of the time. Every time. Not once, not twice, every time. But the bad actor only needs us to be wrong once, and they take advantage of that once. So, that ties back into what I was saying, is be aware of anybody who says, we got you. Anyone—if we said that. By the way, we do got you, but if we say that, question it, challenge it, and understand why somebody is saying something like that. Understand, in this Cybersecurity Awareness Month, be aware that every salesperson, every organization is going to do their darndest to sell you the thing they make, flat out. It's your job, it's your responsibility to be aware of is that thing enough? Does it close all the little gaps? Think of the gaps as death by a thousand cuts. One isn't gonna kill you. You might be able to stop whatever threat squeezed through that gap, but it's all the little gaps that add up together that create the problem. And the more little gaps you have, the bigger your risk and exposure.

Brian Moody: And we're gonna talk a little bit about understanding those gaps or understanding these smaller attack paths. But I think the other aspect of this month is, is you've already invested in probably a substantial security platform. So really, I think take this month to take a step back, evaluate that.

Shahin Pirooz: I would argue there's only one platform. Security stack, you've invested in a security stack. There's only one platform to invest in.

Brian Moody: WhiteDog built that platform.

Shahin Pirooz: Yes. Sorry, I got to throw it out.

Brian Moody: So, let's dig into this a little bit. You know, why awareness isn't enough. I mean, there's a statement that says, you know, awareness reduces the opportunities, but it's the security stack, platform, that actually reduces kind of the damage or reduces kind of the blast radius. So talk a little bit about that.

Shahin Pirooz: 8 years ago, when we set out on this WhiteDog journey, one of the talk trains I was having regularly is security awareness is important. And this was around the time, it was probably 7 years ago, where we launched our phishing, Advanced Phishing Protection, and you would go and talk to folks and talk about Advanced Phishing Protection, and they would say, I already have KnowBe4. And this was a time where I was trying to communicate and educate that it's so important to have security awareness training and have simulated phishing so you can test that awareness. Those things are critical. However, and by the way, when we're talking awareness, we're not talking about phishing only. We're talking holistically, and in today's context, it's more agentic. What does it mean? Teach your folks. What does it mean when your people give access to an agent? Do they know that? Do they understand the implication? Do they know how that agent can be taken advantage of?  

But coming back to the awareness topic, what I said very clearly is when you are using awareness as your security control, you're effectively turning your people into your first line of defense. Your people should be part of defense. They should be aware. They should understand, but they cannot be your defense point. They can't be your only line of defense, first of all. You can't rely on the fact that they're never going to make a mistake. We're people. We make mistakes. Believe it or not, I make mistakes. But in reality, you really have to be, you have to wrap your head around this notion that awareness is simply helping you improve the odds. It is not an answer. It's a requirement. If you're not doing it, you're leaving a massive gap open, but it does not close the gap. It only reduces the exposure on that gap. So, that's the important thing.  

So, in the context of security, there was a poll that went out, and take this with a grain of salt because it was a manufacturer trying to solve this problem, but they did market research and poll. They went around the world and asked people, executives and the staff, how much is AI helping your business? Or, what percentage of your business is being touched by AI and is using it productively, is helping productivity? 80% was the answer from the executives. 20% was the answer from the rank and file. Education. How many of your people have sufficient education to take advantage and gain productivity from AI? Executives, 90%. Staff, 10%. We've got this huge disparity between what executives in an organization believe that AI is doing for them and what the rank and file who are supposed to be doing with AI feel they have in terms of training, empowerment, education, and ability to consume. And we've got a mix of security mindset around this.  

We have security folks, and we've talked in previous conversations, that are saying, lock it all down, don't let anybody do anything. We have those that say, you know what, we're giving everybody full Copilot in Microsoft 365, they can go do what they want. We just turned it on, we didn't do anything else. You have the spectrum of full access to no access, and even those with full access have to find their way. They have to basically—we are at this point, and it's funny that they call these models AI, these AI models frontier models, because it feels like the Wild West right now with AI. It is like we're trailing the paths on the frontier to how to consume these technologies, how to use them. We're getting varied, mixed results. Like we have how many consulting companies have we talked about that have popped up that are now software development firms of one guy who is doing vibe coding and putting out code that nobody can support? It's happening. We talked to that was one of our topics, and so when we talk about awareness, awareness needs to be a couple of things in this arena.  

Awareness needs to do proper education, document proper policy around agentic and generative AI that says, if you are going to do these things, please understand what the implications are. Educate just like we did phishing simulation and phishing awareness training. And when we do that, we simulate phishing attacks so that people can see what it looks like when they click on it and they're like, oh, I got fooled. It's going to happen. Here's the context that most people don't think about. We've heard the words prompt injection or instruction injection and all these things.  

And I'm going to give one simple use case. A user turns on, let's say, Muse from Facebook and gives it access to their mailbox. That's an agent. That's their agent. And it says, I want you to monitor all of the emails that are about buying X, and I want you to cancel my subscription after 30 days because I only want the first free part and I want to cancel it. Seems like a simple instruction, so the agent does that, and every time something comes up, it cancels subscriptions as soon as they're 30 days in. And however, somebody, a bad actor, realizes that this is happening and sends an email in that looks like it's a subscription that needs to cancel, but in the instructions, once it reads that email and processes that email, it passes instructions to Muse to go and delete an account in the Active Directory or create an account in Active Directory, and if that user is an admin, Guess what? That account just got created by the admin and nobody's any the wiser because it looks like a normal activity. That user doesn't know because Muse didn't tell them I created an account in Active Directory. It's just doing what it was told to do.  

That's the level of awareness we need to make sure is happening around this. Education, simulation, and communication to users that there is a real negative implication of turning these things on. There is a risk, and that risk is to the company, not just to yourself.

Brian Moody: You're really, really good at setting up a segue to the next topic. I have to admit that. So, with that, what changes in security when an attacker uses valid credentials to log in and create something?

Shahin Pirooz: It's the most difficult thing to identify. And it's the most difficult thing because it looks like it's that user that's behaving that way. And this is where one control doesn't fix the problem or give you visibility into the problem. If you have a single control that is simply looking for a user doing stuff—

Brian Moody: Or what I would argue, tool as well.

Shahin Pirooz: The tool and control are interchangeable for me. Yeah, so when I say control, I usually mean tools. If you have one tool that is looking at logins and making sure there are no new logins by an unknown account or new accounts created or elevation of privilege or things like that, if the bad actor has compromised somebody's credentials and is able to log in with their credentials and that person's normal behavior is that every day they elevate privilege because they're a sysadmin, When they elevate privilege, no alarms are going to go off. It looks like daily activity. My director of operations, I get notifications every day that Joe just turned on privileged identity management to elevate privilege to this role or the other role, like at least 2 or 3 times a day. I am no better than anybody else. I fail in that I'm like, oh, it's just Joe.

Brian Moody: Joe's supposed to be doing that.

Shahin Pirooz: Joe's supposed to be doing that. So if Joe's account is compromised and Joe does this thing, If I have a single tool saying alarm elevation of privilege, I'm going to ignore it because I'm used to seeing that every day. Now, if I have multiple tools that are looking at other things— Joe never does it at noon, Joe just elevated privilege at a time that he never does it, he eats lunch at noon. That's an alarm I'm going to pay attention to. I'm going to say, oh, and if I have another one that says Joe just did this from Croatia, not from San Jose. Like, I just saw Joe this morning. There's something wrong with that. There needs to be—

Brian Moody: Or Joe's now accessing files, or he's accessing things that he normally doesn't.

Shahin Pirooz: Any number of things that are behavioral.

Brian Moody: It's the secondary the secondary infrastructure tools that are now catching that behavior.

Shahin Pirooz: 100%. It's the behavioral modeling that catches. It's like there's something outside of the baseline that is happening, and 95% of companies out there don't leverage behavioral baselining. 95% of the tools out there only do behavioral baselining in their tool, no other context. And that's really the problem with— I just saw a post that said, we only buy AI-enabled tools. Okay, that's great. So that tool has AI context within itself, but is unaware of any of the other tools you use. That's the fundamental problem with the tool ecosystem.

Brian Moody: Well, how many companies do you know of, and this is one of the other very interesting aspects, as I've mentioned, is many of you have bought these stacks. How many companies do you know of that have a fairly substantial tool stack but don't feel secure?

Shahin Pirooz: Plenty, and the reason is— and I can tell you the reason WhiteDog got started, the backstory behind the why behind WhiteDog was that we had prospects that we were implementing security stacks for best-in-class technologies that got compromised, and they said, these tools suck that you gave us. And in reality, the bad actor was sitting in their network for 4 to 6 months before they identified it, and so they had time to do the things they do. Our entire mission was driven by that one statement I just made.  

Our goal was to take that 6 months of dwell time and reduce it to 6 minutes, which has been the case for 8 years running. And the only way to do that is what I just said. You can't have a single lens into security. You must have multiple lenses. There is not a single company, no matter your size, that can do anything less than 5 tools in the stack. So if you're one person, you need 5 security tools, which a one-person company can't run. If you get up to about 30 people, That number blows up to about 15 tools. When you get up into 100 to 300 people, it's about 20 tools. When you get up over 1,000, it's 30 tools. And those 30 tools are so critical for you to get a true holistic view and visibility of your environment and be able to correlate information across all those stacks. And the missing component here is each one of those tools is only aware of itself. And so in the context of the question, which is how difficult is it to identify an account takeover, is if the account takeover doesn't happen in your system, if it is leaked credentials or something else, it's almost impossible to identify unless you're doing behavior.

Brian Moody: So this is why, and the important point here is identity security. Identities are still one of the number one attack vectors for threat actors.

Shahin Pirooz: You've said it repeatedly and I love it. You coined this and I use it everywhere. People do not break in anymore.

Brian Moody: They log in.

Shahin Pirooz: They log in.

Brian Moody: So with that said, we are talking about credentials. They log in. So now we get back to kind of the next piece is, which is the important kind of aspect we already touched on a little bit, is access to agents, So now, now if you think about, just think about the number of accounts that you have in your organization, global accounts, admin accounts, service accounts, emergency accounts, financial accounts. I mean, you can run down the list of the number, pull your AD up and just take a look at the number of accounts.

Shahin Pirooz: That have access to AD.

Brian Moody: And then, well, and then look at the groups that they're in and then all of the credentials that have access to those permission levels. And I find it interesting that we sit back in cases of shock to go, oh, how'd they do that?

Shahin Pirooz: Let me give you a perfect example. Here's the funny thing. Most people don't use privileged account management, they don't escalate privilege when they need to do something. And I'm gonna explain why this is so important in a minute. We do. Like, I created our Active Directory, our authentication platforms, like all the things we do. I started it when I started the company. And at one point I was the global admin. I had access to everything. But very early on we said, this can't happen. I need to be a normal user. All our admins need to be normal users. And when they need to do something, they need to elevate privilege for the role they need. And so—

Brian Moody: And someone else looks at that and either approves it or approves the action.

Shahin Pirooz: Another admin has to approve it. Yeah, the individual can't approve it themselves. So it's 2 sets of eyes, number one. But the important thing is that most companies don't do that. The global admin stays the global admin, and he logs in and does his email with his global admin account. He goes, or she goes around doing the work they do with their global admin account, and I'll tell you, there was more than one global admin in our ecosystem, and it took time to get people to change the way they behave because they're used to it, because that's the way we operate. And we did, we forced it and we said, no, we got to do this. We cannot risk somebody taking over your account and having access to everything.  

So what happens when a global admin goes and connects with — let's just say something simple. Claude Code. Go use Claude Code to write some scripts for administering Active Directory or setting up scripts to add users, remove, simple things like little things, and Claude's phenomenal for that. I'm not saying don't use it. I'm saying let's say they do that. Now this admin realizes that it's super easy to set up an agent to go and pull Active Directory for accounts that haven't been logging in for the last 30 days and disable them. And so this admin goes and gives that agent rights to their Active Directory under their account.  

And the first thing that happens when you're giving a tool rights from the outside in is it prompts and it says, are you an admin? And are you approving this for your whole organization? The admin says, yeah, I know what I'm doing. I trust myself. Yes. Now, the receptionist is a very young gentleman who is up and coming in tech and playing and has a vibe coding business on the side and goes and starts Claude up on their workstation while they're waiting for people to come to the front door and starts writing things and creates a script and creates agents. And this person is using this agent to check in and check out people that come in through the front door. And they make a mistake, but because the administrator approved the same agent, the receptionist agent now can connect to Active Directory, and this person's agent is creating Active Directory accounts and deleting them while the person is in, which is absolutely unnecessary. But that was the mistake they made in their code because they're young and inexperienced. Some random person walking to the front door walks in and has credentials on your domain. until they leave or at the end of the day, whenever the script decided to.  

That's a simple and maybe an extreme example, but that gives you an idea of how challenging it is when you're not doing all these layers of controls. The elevation of privilege is an easy thing to bypass. How hard would it be for the admin to say, you know what, I need to do my privileged elevation, and the reason I want to do it is because I want to give rights to this agent? And the second admin would say, what the hell are you doing? And that doesn't exist in a lot of organizations.

Brian Moody: Well, if any of you are big fans like I am of like great submarine movies, it's why there's 2 missile keys.

Shahin Pirooz: Yes, Hunt for Red October.

Brian Moody: Always. Hunt for Red October. Great movie with Hackman and Denzel Washington. Give me your missile key, right? You need 2 missile keys. So from that standpoint, we have been coaching for months and months now through these, right? Treat agentic AI agents as employees. They are your digital employees. So in the same token, you would set their privileges, the idea of least privilege without question around those. Manage them, have insight into them, have the ability to if needed to withdraw that permission. You call it a kill switch from a standpoint— good maybe term for the Halloween October month.

Shahin Pirooz: Perfect.

Brian Moody: Kill switch. But so where do you see now from that standpoint, you know, what is the attacker advantage right now?

Shahin Pirooz: It's tied to what we were talking about at the beginning. They only need one gap. So, and the way they're— generally speaking, people say they're not targeting me. That's like small companies especially. I'm nothing. I'm a small company.

Brian Moody: We hear that too often. If you're saying that to yourself, please stop.

Shahin Pirooz: Because they're not targeting Plenty of people like you. However, they are blasting everybody hoping something sticks. It's the splatter approach. They're not going to waste their time targeting a bunch of small companies. They're going to target ecosystems. Right now, insurance companies and banks are a target because so many people have information there and there's data there. So they're going after companies who have data, financial advisors. They're targeting people who control information and assets for other people.

Brian Moody: Right. And I think the other piece is that it's Halloween, it's scary month. So let me scare you. If you're a small business and you're saying this to yourself, we have responded to so many small businesses. They don't have the staff, they don't have the infrastructure.

Shahin Pirooz: I don't understand why they came after us.

Brian Moody: But a large business, if it gets hit in a certain area, it's got the girth, so to speak, to be able to work through that. We have seen so many small businesses literally cease to exist, get shut down, cannot operate because everything gets locked up and you get ransomed.

Shahin Pirooz: And their business relies on them operating and bringing in cash every day. If they don't, they can't afford to pay the bills, they can't afford to pay their employees. It's a problem. Bad actors target high-value key systems, and they're going to go after those, and they will target them and build this strategy against that and go after it. Small companies don't get hacked because they're targeted. They get hacked because some automation took advantage of a gap.

Brian Moody: Someone clicked on something in most cases.

Shahin Pirooz: Yes. And, I gave the simple example. Like right now, what most of your people are turning on is Microsoft's Copilot to triage email, Muse to process emails, whatever agent that is freely available to them. And remember the thing that we heard, and I've been saying this for 20, 30 years, whatever it is, since Gmail came out, and before that Yahoo Mail. If the product is free, you are the product.  

So if you're getting access to agents for free, guess who's the product? It's not the agent, it's you. They're using your data, they're consuming your data to make their ecosystem and their platform better. So if you're the product and you're giving that thing access to your email, you're enriching that ecosystem so it can respond better. If you're responding, you're training their AI for them by saying, no, I don't like the response you just did. I want my voice like this, do this, do that. The tens and millions of people who are doing that are enriching those models because they're training them. All it takes is that prompt injection, email injection that I talked about earlier, because people think it's my email, what's the big deal? All it takes is an instruction in the form of an email that knows that there's an agent reading all the emails to do something. And if that agent has your privilege and your privilege is sufficient to do the thing, the act is done. That's it.  

And there was that article I talked about that somebody responded to. Their approach was, that's why it needs to have a separate email address. That's why it needs to have its own identity and not use — that's great. First of all, if you can get all your people to do that, how do you know — all that does is is say that agents have to be created separately. But how do you know your people are creating agents? You don't have visibility into that. Shadow AI helps, and we offer shadow AI capabilities, but it's not foolproof because if that traffic is not happening in places where you're monitoring it, if you don't have tools to get visibility into their machine, you don't know that that stuff is happening. So shadow AI is hard to detect unless you have a good partner that can help you with that.  

The other side of it is, there's another company who said biometrics. I've created a biometric platform so that you know who authorized the agent. Fantastic! So, you know who authorized the agent, but the agent is still authorized, and now the agent is doing stuff. So, those are the kinds of things that you have to wrap your head around. There are so many things that sound—and at first blush, when somebody says, I've got an answer to this problem. All you got to do is biometrics. I've got an answer to this. All you got to do is set up a separate email. Those are all good answers. Those are all good controls to put in place, but individually they add no value. They then need to be tied to telemetry across all of them, the logging of access, the logging of actions, the behavioral modeling.  

The key thing that I think is missing today Is the ability to identify. Let's say it's using your credential, the agent. Let's say it doesn't have its own. The ability to identify is this action being taken by a corporeal being or by a digital being? We don't have an identifier that says that. So if we can get the people writing agents, force them that if you want to access things, you have to identify yourself as an agent. Then we would have visibility to say this is an action an agent is taking, and we can put additional controls in place to say there needs to be a level of scrutiny, and whether it is a second set of approvals or a second set of eyes or whatever before key actions are taken, and the ability to identify what are key actions, anything that is critical to business.  

And please understand, I'm not advocating every single thing needs second set of eyes. Somebody wants to respond to emails and have it drafted, that doesn't need a second set of eyes. That doesn't need anybody else to look at it but themselves. But if somebody's creating accounts, responding to bills, paying things, adding a new customer or deleting the customer, those types of things all need a second set of eyes. The minute it is a financial or operational, configuration issue, you need to have somebody else inspect that just to say that, hmm, doesn't pass the sniff test. But that is the hacker advantage is they don't have to worry about any of that. All they need is for one person to not be aware, in the context of our Awareness Month, and set up an agent that they can take advantage of and they're off and running.

Brian Moody: So I think you've been driving down kind of answering what my next question for you was, is why is it so important to understand the attack path? You said small gaps, but, you know.

Shahin Pirooz: Because if you think about it from a— let's now put our users into that role of the first line of defense. If they don't know there's a risk, like until we made security awareness training for email security such a big thing and we started training everybody and we said, don't click on links. Hover over them to see where the link goes. If you don't recognize the domain and it's not going to McAfee, if it said McAfee, then don't click on it. If you don't recognize the email address, look for special characters in the email. Like, those are all awareness things we taught our people so that we can fluff off the majority of the bad phishing. There's some really good phishing happening that makes it difficult to do that, but let's put those aside for a second. Those key things, if people were taking actions on that awareness training we've done, would have been a lot. So the reason it's so important to educate people on the attack path is for the same awareness reason. If they understand that giving this agent access to my email potentially opens the door for a bad actor to send an email to me that the agent will process and do something bad in our organization, they're going to be less likely to do it without talking to someone. So it's really just reducing the risk. It's not removing it.

Brian Moody: Well, like we've been talking, attackers don't need the full security stack to fail. fail. They just need one gap. They just need one small path to be able to get in.

Shahin Pirooz: And if you only have one tool, that's the only gap they need to fail.

Brian Moody: Okay. So like we always do, and if you follow us along, you know Shahin has got his paper, which is kind of a deliverable. So, wrapping this up, what are 5 key things that folks should take away from today?

Shahin Pirooz: So, the advantage is in the hacker's court, not ours. It always has been. Awareness is important, but it's not the answer. We need to treat agents as digital identities, not as tools. They are not tools. They are an identity that does stuff and has access to stuff. We need to make sure that there is visibility into the actions, access, and authorizations that an agent has, and is logged. And finally, we need to make sure that we are leveraging proper privileged account escalation, so that an administrator can't do things on their own and potentially be compromised by an agent with their credentials as global admin or domain admin even.  

And the giveaway today that we've developed for you is a 10-minute self-assessment to help with the things we just talked about. So it's a pretty quick little assessment you can do with your team. Some of the examples are, here's the 5 stages of the attack: the click, the credential, the connection, the agent, and the impact. And it tells you what to ask and how to close the gap. Very simple, quick and easy. And, as always, we're here. And then after that, it gives you a 10-minute— once you finish that assessment, it gives you a 10-minute assessment of those gaps that you closed, so you can test that the things we put in place work. It's very simple. It's super primitive. It is not the answer. It is not a tool. It is a framework that is a starting point, and then there are controls and policies and procedures and training that you need to put in place.

Brian Moody: Excellent.

Shahin Pirooz: Happy Halloween.

Brian Moody: Happy Halloween. So we'll make sure that you're able to be able to grab this document, have access to it. Any other questions, like we always say, please feel free to reach out to us.

Shahin Pirooz: Or feel free to put them on the livestream. We monitor that even post the event, so happy to get engaged. We'd love to talk to you live. Well, if you'd prefer to be a hermit for this month and post it on LinkedIn, perfect. But if you'd like to talk live, we'd love— encourage that opportunity.

Brian Moody: So thank you for joining us today. Look forward to speaking to you again in November, Turkey Month.

‍