Distilled Security Podcast

menu close

Episode 29: TRISS Pittsburgh, CMMC Update & Should We Be Pacing AI? — feat. Doug Salah

/ 02:05:44/E29
Justin:

Today on the episode, we're talking about upcoming TRISS conference with Doug Salah, where CMMC stands today, AI Security and Should We Be Pacing, and TPRM is Dead. This is Distilled Security Podcast. Somewhere right now, someone is digging through folders trying to find the right version of an evidence file for the third time this week. Controls scattered across a dozen system, who left the company months ago, due dates that already passed and nobody noticed. It's how it's always been done, and somehow we just accept it.

Justin:

There is a modern, better way. Episkey. Visit us at episkey dot com slash d s p for a special offer.

Speaker 2:

If you're leading a company today, you're not short on ideas. You're buried under them. More tools, more frameworks, more initiatives that were supposed to help and somehow made everything harder. Minus Partners exists for leaders who don't need another thing added. Minus Partners helps leadership teams remove friction that's been normalized over time.

Speaker 2:

So execution gets easier, not harder. Less noise, clear decisions, faster execution. Minus Partners, what you remove defines you.

Justin:

Alright. Welcome back to Distilled Security Podcast. Before we go too far in the episode, we got a special guest here with us today, Doug Salah. Doug. Hey.

Justin:

Great to see you guys.

Doug:

Yeah.

Justin:

Again. This sets a record here.

Doug:

I don't know if you know.

Justin:

Right. Yeah. You're the first. You're the first of the second. Second and first.

Justin:

Got a twofer. Yeah. Twofer. First to repeat.

Doug:

Was I the only one that would come back?

Justin:

Yeah, man. Yes. We had to

Rick:

get Wow.

Justin:

I was wondering.

Doug:

I was wondering how that worked.

Joe:

We were wondering if Rick or I would come back.

Justin:

Yeah. Right. You know? And I keep offering booze, and they're like, alright. Alright.

Justin:

Sure. Fine. So the booze the booze helps. Yeah. Welcome back and everything.

Justin:

Yeah.

Doug:

It's been been great two years. Has it been two years? I think it was episode four.

Justin:

Okay. Gotcha.

Doug:

What episode's this? Twenty eight twenty nine. 29. Yes,

Justin:

I think. So we'll find out when we do put it all together. Notes will tell us. Yeah. But, yeah, welcome back and everything.

Justin:

Appreciate you inviting me. We wanted you for a couple of topics, but there's one in particular that we wanted to talk to you about. Tris is coming up here in Pittsburgh.

Doug:

It is. What's the official dates to that? It it... Yeah. It's super exciting.

Doug:

The official date... Oh, I shoulda had that right in front of me. October 22 Okay. At the David L Lawrence Convention Center again. So so we're real...

Doug:

We're really looking forward to having that. We're in the midst of all kinds of stuff right now. So it's it's very exciting. I need to stay close to this microphone. Sorry.

Justin:

It's an adjustment and everything. So tickets are still open. People can still get them online and everything. Yep. Still accepting sponsors coming in.

Doug:

We'll we'll take sponsors even a month after.

Justin:

Oh, yeah. Just so you know.

Doug:

That's awesome. If you're thinking about it and it passed and you still have some money Like, I can't... We'll take it.

Justin:

I can't put... Give you a table. Maybe I'll give you a physical table, you know, that you can take home and

Doug:

Yeah. Sponsorship's been slow. I I think you might have mentioned it on b sides for this year too. I think I think the economy hasn't really helped a lot, and we're really really trying to make sure we're gonna break even.

Justin:

Okay.

Doug:

You know? Because that's important. We we are a nonprofit. We carried over some money from last year, but also we love giving away the scholarship money to all the kids. Yep.

Doug:

So very excited about that. We had a great lineup. The the the talks that we have, probably the best lineup that I've seen since we started. Really?

Justin:

That's fantastic. You're gonna give us... Is it secret, are you gonna give us No.

Doug:

It's even online. You know? 33riversinfosec.com. I could I could hit on some highlights. Let me just make make sure I can read here.

Justin:

And Rick might even got finangled into doing Maybe.

Doug:

Yeah. I haven't I haven't announced the the c... The full CIO panel, but you guys will all see a familiar face on that. Okay. So that's good.

Doug:

There you go. I wanna I wanna kind of announce the whole thing. But like Don Capelli, my wife said Capelli, she wanted me to make sure I emphasized the Italian part of it there. She's gonna be our our keystone. So it's not a keynote, so there'll be other speakers at the same time, but she's been in the industry forever.

Doug:

And she's gonna she's gonna have a talk entitled nuclear power spies and safeguarding civilization, a Pittsburgh story of career career serendipity.

Justin:

Oh, nice. Interesting. So it's about Westinghouse then, I would presume.

Doug:

Well, it's gonna be about her career, how she got

Justin:

there. Okay.

Doug:

It's it's really good. There's a good synopsis on the website if... I'm I'm happy to read it if you guys want, but her career is is very intriguing.

Justin:

And Yeah. I was just putting the the nuclear Pittsburgh

Joe:

Oh, yeah. Yeah. Kinda Well, actually, she was with Rockwell Automation forever.

Justin:

She was with Rockwell.

Doug:

That's 2016 to 2022. She's doing a lot of stuff with Steel City, OT SEC now with Dragos and in the past. She's had she's had a really interest... She was on the CISO panel one one year and Okay. Talked about how she got started on, and it's a great story.

Doug:

And I was really excited to have her be able to speak and talk about that. So maybe it'll inspire some up and coming CISOs.

Justin:

Yeah. Oh, that'd be great.

Rick:

That's awesome.

Joe:

Yeah. In fact, her husband, Fred, is involved with OT SEC, and they did a wonderful job with the

Justin:

The wall.

Joe:

Besides Pittsburgh in... At the village. So, yeah, great great couple there who are constantly giving back to the community.

Doug:

Mhmm. Yeah. It's great. Pittsburgh's community is is the most amazing. I know you guys talk about it all the time.

Doug:

One of the reasons, you know, I got Tris and Cyber and Cigars, and I just like doing whatever I can for this community because it's done a lot for me. You know?

Joe:

It's it's true. There was a time where it really wasn't all that well put together, and then you have people who just came out and started to do stuff and get these conferences organized, and and they all... And and then 2016 is when the first. Were you involved with the first Triss in 2016?

Doug:

Yep. Yeah. Yep. I think I started in 2015 planning and everything. Me, John Costich, and, well, I hope we can squeeze her name in.

Doug:

I'm I'm drawing a blank. FBI agent.

Justin:

Long? Or No. I'm just... There's just

Doug:

her name slipping. She she was really instrumental in getting us started, but she's she's no she's no longer in Pittsburgh.

Justin:

Oh, okay. Yeah.

Joe:

Oh, I know who you're talking about. I can't remember her name right now.

Doug:

Yeah. I'm surprised. So John Dwyer speaking. Have you guys ever spoke to him?

Joe:

Oh, yeah.

Doug:

Yeah. Really neat guy, but how to build detection programs that outlive your sim. Kind of interesting topic, and he's he's gonna talk a lot on on those things.

Joe:

I think I met him the first time at one of the... Your other events, the Cyber and Cigars.

Doug:

Yes. Cyber... He's been to Cyber and Cigars. Brilliant guy. Just amazing.

Doug:

I mean, all of our speakers are just amazing. So I'm just trying to hit a couple top ones. It's it's interesting. I think there's a couple of speakers from Microsoft on on... Up online and...

Doug:

Yeah. I'm not seeing all of the ones that I wanted to mention, but vulnerability management, AI governance, there's all kinds of fun things. Stakeholder management. Good ones. Yes.

Doug:

Stakeholder management for information security projects. So we have Deborah from Pittsburgh PMI and Kimberly from from, First National Bank to talk on that, and I think that'll be really interesting because I don't know about you guys, but my career, most of the cyber projects that failed were because they weren't managed well. It wasn't Oh, project management. To me. It's it's just I was just talking

Justin:

to somebody the other day that the higher you go up, the more it turns into nonsecurity stuff, and it's culture and politic Alright.

Rick:

Politics. All people.

Joe:

Yeah. Were you at the I s... Were you at the ISSA meeting where Lauren from my team came in and talked about

Doug:

project management? Job. Yeah. That was that was great. We have a couple panels too.

Doug:

I know, We Sick is doing a panel, Women in Tech, the CSO panel. We also have, Tracy Koboda Brown Oh, yeah. Fantastic. And her talk is gonna be amazing. I don't see the name of it right now.

Doug:

I...

Justin:

I like her. She's good people.

Doug:

She is, and she's gonna be doing a panel also.

Joe:

Yeah. It's criminals have a product road map too.

Doug:

Can help me out. You can see much better on that thing than my my tablet here. So she's doing that, and I think that's gonna be pretty amazing. I don't believe I'll be able to listen to that talk only because I'll be in the panel room, which is the the sad part about my role in Tris is is I don't get to see a lot of the talks that I really wanna be able to see. But she is doing a panel also.

Doug:

I'm trying to remember the name of the panel right now, but I think I put it someplace.

Joe:

Are you guys doing any... Not recording anything? No.

Doug:

No. No recording. You know, recording's challenging. First of all, we really want Trist to be an in person event. We want it to be a Pittsburgh thing, and and peep...

Doug:

We don't want people not showing up because they know they can see it later. Yeah. I know that that kinda hinder some things. I think for some of the speakers, it'd be nice if we did record them so that they could use that as a as a piece. But Plus, I'm sure It's expensive.

Rick:

Yeah. It is expensive. It's expensive. Yeah.

Doug:

I'm I'm I'm surprised at how expensive it it really, really is.

Justin:

But for a lot of those, for convention and for the casino, it's like a full AV project and everything. Like Oh, yeah. I'd even tell you guys, like, you know, last week, I was at the PCI conference, and they always deck it out. They have it in Vegas most years, but they bounce it around. This year, was in Vancouver.

Justin:

And literally, I'm I'm watching, like, one of the presentations, and there's smoke building up on the sides just like soft smoke. Oh, wow. Because they have a whole bunch of lasers that go around. So it looks better with lasers going around with the soft... I'm like, wow.

Justin:

Like, what per... You know, this is some production value here.

Rick:

We thought this talk would look better with lasers. Yeah. Which one does... What what talk doesn't? Right.

Justin:

Seriously, when they when they come into the opening, it's like, you know, like That's

Doug:

pretty cool. This is this is the ninth, Trish. Watching We're gonna do lasers on Yeah.

Justin:

Lasers. Yeah.

Joe:

Tenth. We need our sharks with lasers. Yeah.

Justin:

Yeah. It... It's pretty impressive. And all I can think about is, like, how much money did they drop? Oh.

Justin:

You know, type of thing. It's like...

Doug:

Yeah. That's the hard part. You know, our mission... Obviously, we want great speakers. We want great presentations for the professionals there.

Doug:

But, you know, we really are trying to figure out the best way to get the most information in front of everybody. And really, the scholarship program, you know, every time, you know, there's always a debate. When we spend a dollar, that's $1 that's... We're not able to give away. So we wanna be really, really cautious with that.

Doug:

And if we find sponsors

Justin:

Lasers never make that cut.

Rick:

Yeah. There's probably one Scholarships over lasers. That's fair. That's fair.

Doug:

Yeah. I mean, it really is, you know, carrying carrying the mission into the next generation. Right? Trying to help build that next generation of professionals. You know, one day, I'd love to hear from someone say, you know, I'm I'm the CISO at XYZ,

Justin:

and Yeah.

Doug:

You know, I really got inspired at Tris twenty nineteen. Yeah. You know, those are the kind of things or or even b sides or just someone coming from Pittsburgh saying that community just wrapped their arms around me and helped me become the best that I possibly could.

Joe:

The scholarship stuff's amazing. Looks like you've given away about, what, a 110, $120,000?

Doug:

Yeah. Yeah. I got those stats. 118, just over 118,000 over the nine years. Wow.

Doug:

That's phenomenal. Last

Justin:

year, $33.05.

Doug:

Cheers. Wow. That's And and the the the kids really... I say kids. Some of them are 30 years old because they're in school,

Justin:

but, for me it's still a kid. Young whippersnapping.

Doug:

Yeah, the next generation, right? And I think that that's really the thing, and that's one of the things that we don't market as well with the sponsors that I think we should because it's not just the marketing thing that you're doing there, but can you just, you know, even if you can just give $500

Justin:

to help, right?

Doug:

Even if you don't need a table, what what can you do to help? And I think we do actually take donations that go straight to the scholarships. Obviously, we need some general funding to make sure the event happens. Of course. But we also take take things like that.

Doug:

So that's really exciting and I I I really enjoy enjoy the way that we've impacted that. You know, Robert Morris has been with us from the very beginning, but many of the other colleges have been more and more involved. West West Virginia was there last year. They're more involved this year. West Virginia University.

Doug:

I know Duquesne University has been, you know, well represented. CMU, they they they they bring people all the time. Pitt, I'd like to get them more involved. So if you're listening and you're from Pitt and wanna get more involved, I think it would be phenomenal. And even some of the smaller Saint Vincent College

Joe:

Saint Francis is there.

Doug:

Saint Francis was there.

Joe:

Yeah. That's right. Advisory board for their NSA program. Yeah. Yeah.

Joe:

And so they they do a

Doug:

good job of showing up. Yeah. They... So I'm I'm I'm excited about that. But the hard part is transitioning that with the with the sponsors.

Doug:

You know, the... Many of the sponsors are coming from California and setting up a booth, and they're like, you know, half the people that came to my booth were college students. Oh, yeah. You know, I I can't sell anything to them. I'm like, well, I'm I'm I'm sorry, but that's just part of the program here.

Doug:

We we try to tell the the the kids that come. We give them if they volunteer, they get to come for free. Yeah. The cost for them is hardly anything if they don't volunteer, but if they volunteer and and and give up some time, everything's free and they get to come. But we try to try to tell them too and have a code of conduct.

Doug:

Don't don't swarm.

Justin:

Right.

Doug:

Right? You know, the Ukrainians are good at that, but you don't have to be.

Justin:

Right. So

Doug:

so that's good. The program's from 08:30 to 04:30. David l Lawrence. Yeah, some of the topics II pulled out AI governance OT security vulnerability management application security. The and the the speakers I'm I'm just looking forward to hearing back from everybody about all the different speakers and how well they did in the topic.

Doug:

The topic selection is always challenging. Right? So I I don't remember the exact numbers. Rick does all the, you know, call for presentations.

Rick:

Rick Rina?

Doug:

Yeah. Yeah. Yeah. Great guy and does a phenomenal job with it. But but it's it's kind of a blind thing where we're voting on things.

Doug:

But Yep. We also have to go back and take a look and say, you know, we have six topics on AI. Yeah. Maybe we only want four. I mean,

Justin:

you know like... That's gonna be like that for a little while. You know, type of thing.

Doug:

Sometimes it's not AI, but Yeah. It's other things. So

Justin:

we It might not be exactly AI. It's AI in the audit process or AI in, you know, sim or something like that, you know Yeah.

Doug:

Thing. So... AI is everywhere. I mean, I I think every top... I I I guarantee every speaker is mentioning AI.

Justin:

Yeah. It's it's all over the place.

Joe:

Yeah. So at this point, you're at the the general mission late. Right? Yeah. If you waited this long.

Joe:

And...

Doug:

I have a friends and family code if if you're interested, but

Joe:

you can

Doug:

reach out to me.

Justin:

Yeah. Yeah. You're not gonna... Podcast here.

Joe:

Did you give it on the podcast? You're

Doug:

gonna see it? If I could remember it.

Rick:

This is the

Justin:

DSP special Right. Code. Right? Right.

Doug:

Next year, we absolutely will have a DSP code.

Justin:

I love that. Just for

Doug:

you guys.

Justin:

For the people that listen, I know.

Joe:

Based on that lineup though, it's it's a $100 plus the $6.20 29¢ for the the processing ticket fee. So for less than a $110, looking at this agenda and everything you're gonna get out of it, that's that's still an amazing thing. Plus, are

Doug:

you feeding people? Yep. We're feeding people. We also have a capture the flag. ISSA is running the career village, a whole program within that.

Joe:

Oh, it's the second year for that too.

Doug:

Yeah. Yeah. James has done a wonderful job with that, and it's it's just... It's phenomenal. And he's tweaked it a bunch.

Doug:

I know we started it before he he got on board with doing it, and it's it's just become phenomenal. That was one of the things that I think just... I really wanted to make sure was happening and moved forward. Trying to think of anything else that we have. The capture the flag is really good, although I've never popped my head in there.

Doug:

Love to talk to someone or or have one of you guys check it out and see how it is. But, you know, that... That's really interesting. Not trying to kinda compete with b sides in any way with the technical tracks as much, but I think that that does attract a lot a bunch of people. Yeah.

Doug:

No. We're we're we're all we're all good in. It's different times of the year.

Justin:

Doing it the same day, then, yeah. It's a competition going on. Yeah.

Doug:

Well, maybe maybe the maybe competition isn't the same. We we don't wanna have it another b sides

Justin:

Oh, okay. Yeah.

Doug:

Alright. It's not competing. I didn't mean it.

Joe:

It's like, it's a different vibe too. It's a different vibe.

Doug:

Good. Yeah. Trying to accomplish something a little different. Wish we could do it at the, you know, at at the casino, but with so many students

Rick:

Yeah. I would be...

Doug:

I think it's near impossible.

Joe:

Right. Oh, yeah.

Speaker 6:

Yeah. It would

Justin:

be very... Joe was saying... Sharing some stories because the... They even got hard this year, but they softened up a little bit.

Joe:

Yeah. Next year is gonna be a few more under 20 ones allowed into the b sides in this last year, but it's still a fraction of, you know, what what you're Yeah.

Rick:

And that's a ton of administration just to, yeah, to make it all.

Justin:

And they cap it too. I forget what the b sides cap it.

Rick:

There's escorts. It's like a

Doug:

whole thing.

Joe:

Yeah. It's like 50 people this time. Last time it was 20.

Justin:

Yeah. 20 people. Tris would never be able to do that. You got 20 coming from Robert Morris.

Doug:

Yeah. Just the... We have that many volunteering during the day, not attending. Right.

Justin:

Right. Exactly. So We'd

Doug:

like to get some of them to to speak. We'd actually thought about doing a track that was just students speaking.

Joe:

Right. That reminds me of Twenty minutes speaking spots. Yeah. I think besides Vegas does a whole track on... I forgot what they call it, but it's like you never spoke before

Justin:

and you're kinda

Joe:

new to the industry, and they actually line you up with a mentor who teaches you how to go about your presentation.

Doug:

Yeah. That would be phenomenal.

Joe:

Yeah. Everybody raves about it. And the people who come out of it, they're better for it.

Justin:

So... There was somebody... Was it was it at DerbyCon or it might have been at DefCon or something like that? It was some 12 year old kid that got up on stage.

Joe:

Yeah. Killed it.

Justin:

Like He he

Joe:

was there with his dad. And... Yeah. That was... I think I was in that.

Joe:

I think I was sitting next to you in that one. Was it DerbyCon? Yeah. Was Derby.

Rick:

It was a Derby.

Justin:

And it was just like... It was phenomenal. Like, just seeing this young kid. And he spoke well. Like, it was very good, very well put together, everything like that.

Justin:

So, yeah, you're just encouraged to see, you know, a younger crowd, you know, just stand up and kinda take the the reins, you know, into that.

Doug:

So It's kinda scary to speak for your first time. So having an environment where where where people want you to. Right? Right. Yeah.

Doug:

You don't you don't feel compelled to do it. I did bring... I I think it's the 2019, but the the sponsors, I don't know if if people can see that, but, you know, lots of sponsors from 2019, repeat sponsors. We used to have a whole packet. We don't like handing out paper anymore.

Doug:

There there's even part of the Tris that doesn't wanna do lanyards anymore. So but we did have a lanyard sponsor this year. So so we actually have lanyards and there

Justin:

you go

Doug:

and they paid enough to that that

Justin:

For that.

Doug:

Yeah. It covered the cost and a bit more so that we... Because again, breaking even isn't the idea.

Joe:

Right. If they paid enough to offset John's resistance, the lanyards. So it's on the October twenty second

Doug:

Twenty second.

Joe:

Yep. At the convention center.

Justin:

Yep.

Doug:

And... Gotta pay for parking, which is a bummer.

Justin:

Yeah. Yeah. You have... It's not too

Joe:

too bad.

Doug:

No. It's... $25. Yeah.

Joe:

And and if people want... Are are you serious about that discount code? If people reach out to you Yeah. There's a way they can get a ticket for less than

Justin:

your serious. You got time. This goes up in, like, a week or two

Doug:

from Yeah. Let me let me get that for you.

Justin:

Well, you guys say it right now. Or in the show notes? Yeah. I don't I don't Look in the show notes. I don't remember the code.

Justin:

Oh, okay. That's my power.

Rick:

We'll dump over. We'll just pause and be like

Justin:

I thought we just Not to say that. Can create it. Like, you just say the code. Okay.

Joe:

I I thought you just wanted all the listeners to reach out to him directly.

Justin:

Oh, okay. Yeah. Yeah.

Doug:

Yeah. LinkedIn, my email.

Justin:

Yeah. Yeah. And all

Rick:

of a sudden, a wave of tickets were canceled, and a wave of emails hit Doug.

Justin:

Yeah. And I don't

Doug:

know that we'll accept any cancellations.

Justin:

I didn't take my code. Right. But you're welcome to buy two tickets. There you go.

Rick:

Yeah. Encouraged. But

Doug:

So... Yeah. It's exciting. It's trending well. I think we're we're aiming for around 500 again.

Doug:

The trends are going that way. It's it's it's so amazing. As you guys know with the conferences, you... You'll have... You know, it'll just be going and going nice and steady, and then it'll be a rocket.

Doug:

Oh, yeah. Right? And we're hoping for that rocket, but but again, really, it's the sponsorships. If you if you do know any companies that you think really should be in in Tris and represented interest in any form or fashion, we'll figure out a way to get their logo there Yeah. And try to figure out a budget that fits them.

Doug:

But we have... We we opted a different thing to do. The Steel City sponsorship is at 3,000, which is what we've been doing. That gives you a table and all that. But then we went to a second level.

Doug:

I don't remember the cost, but maybe Joe can look on the sponsorship and see that. But with that one, we'll give you the contact information. If people said they opted in to Oh, sure. Share, we'll we'll give the contact info. So we wanted to figure another level to help people get contact info.

Doug:

Yeah. The top

Joe:

three levels, Golden Triangle sponsor for 9,000, Steel City sponsor for 5,500, and then Three Rivers exhibitor sponsor for 3,000.

Doug:

Okay. So I got them backwards. I I should know that sponsorship's my thing. The Steel City, the 55 is the one that... And and Golden Triangle, you get the contact information as long as as long as the attendee checked the box.

Justin:

Yeah.

Doug:

Below that, no doing that. We wanted something that was affordable, so even small companies. And I've offered a couple discounts to companies that are local to Pittsburgh. And I said, you know, hey. We want we want you here.

Doug:

We want you to be able to promote your company. So let's figure out something. We'll give you the the the gold triangles discount or the Jim Rooney.

Justin:

I don't know. Yeah.

Doug:

Whatever it is. That's a good name for really steep discount.

Joe:

Yeah. Yeah. Well, so you're saying that you have tables left

Justin:

We do.

Joe:

At this point. Plenty. And if you're a... Now I'm I'm trying to sell, but I'm also trying to help the sponsors who don't have the money to quite do all of it. Yep.

Joe:

You're saying that they might be able to... They'll see the price on the website. And if they reach out and they have a reasonable offer, you'll consider it Yeah. For something less, and they can get a table, and they can represent. And part of their sponsorship, they can feel good about anyway because it goes towards the scholarships.

Doug:

Absolutely. Yeah. And we gotta be equitable with that. Right? I mean, there's people that have paid full price.

Doug:

So I I I gotta be careful on what kind of discounts I offer. So I try to be very selective with that. But again, Pittsburgh companies start up, those kind of discounts don't go to CrowdStrike and Palo Alto and things like that. So always wanting to help and and making sure that we got plenty of logos there so that people can can see the companies that are supporting the community. So so that that to me is really important too.

Doug:

Because the community isn't just the students or the speakers. It is the companies that are around us and and selling great products and selling great services. Right? I mean, we have some great consulting. I remember early in my career to find a company that did good consulting in Pittsburgh.

Doug:

I would go to Cleveland and find places, and it was just... It was it was sad. It was

Joe:

Oh, here's something else I'm seeing. Career Village sponsor. Yep. And so now does that get them a space in the career village or a place?

Doug:

I believe so.

Joe:

That... That'd be amazing. So if you're a recruiter Yeah. Recruiter would be good. To have a key location at a place where you're going to have people come through who are hiring and need to know who you are and also people who are looking to get jobs, you're gonna have both ends of it.

Joe:

You're gonna have Yeah. An amazing time there.

Doug:

Yeah. And James has done a good job with that. I think we've... In years past, we've actually teamed up with some recruiting companies for them to help us, and then they get a free spot in it. So, again, you know, we wanna be creative year after year on those things.

Doug:

So if we get even more hiring companies, it would be even better. Because because, again, we're building... We're trying to build the community here.

Joe:

Yeah. That's amazing. That's amazing.

Rick:

That's a great event. Wait. Wait. What... How many years did you say?

Doug:

This is year... This is event number nine.

Rick:

Event number nine.

Justin:

Yes.

Doug:

Yes. I think we missed one or two years because of COVID. Yeah. So...

Rick:

Yeah. That's awesome. There's been

Doug:

a debate on whether we can can say it's ten year anniversary since... I think the first one was the 2016. I said this is the tenth year anniversary.

Joe:

Well, it is a ten year... Oh, it's a nine year anniversary of the first one. Right? Now...

Doug:

Yeah. Yeah. So so it's not the tenth event. So Yeah.

Joe:

That's okay.

Rick:

Yeah. It's so good. It's kinda

Joe:

the anniversary of the first one. So Tris 2016, seventeen, eighteen, nineteen, you skipped '20 '21, and then you've had it '22, '23, '24, and '25, and now the twenty sixth one.

Rick:

Yeah. Fantastic. It's an institution now.

Doug:

It has. Yeah. And and I believe Joe said this too, you know, this this is the stressful part right now, the month before and making sure everything's lined up and everything and and making it. But when you're there and you're actually seeing everything happen and and the speakers and the the people listening and saying, what a great job and asking questions, It makes it all worth it.

Joe:

Yeah. The best feeling is you walk in the door that morning and you're like, what can I do? And you get ushered away and be like, go eat breakfast. There's nothing you... We need you for because everything is

Doug:

planned. Haven't seen that yet. So it's a dream. Pinch me.

Justin:

Maybe I'll wake up. Sweet.

Rick:

Excellent. Looking forward to it.

Joe:

Well, thanks for telling us all about that.

Justin:

Yeah. Absolutely. And, yeah, for the audience and everything, make sure you go to Tris. The website's

Doug:

33riversinfosec.com.

Justin:

3riversinfosec.com To get your tickets, sponsors, to get the levels, the reach out, and everything, it'll be a a great a great event, and you got time to still sign up. By the time this comes out here, it'll be early October. So Yeah. That'd be great. Have a few weeks here.

Joe:

Yeah. Check our show notes for discount codes.

Doug:

Yes. Absolutely. Very cool.

Justin:

Alright. So moving on to our next topic here, CMMC. So there's been some stuff, you know, going on with it, and we've covered it here on the show. So we initial covered when there was a... Was that pause?

Rick:

You know? Sixty day pause.

Justin:

Yeah. Back in July and everything. And, know, Joe, during our previews and everything, you sound like you had a a pretty good summary up on this. So...

Joe:

Well, just a few things I was picking up, listening to some podcasts, and reading some blogs. But at at a high level, that pause was supposed to go into about September 11, and it's the twenty third now. So...

Doug:

Right. Right.

Joe:

And we were supposed to hear something and we haven't yet. So that's one of the things. So...

Doug:

Does that mean the pause is still on?

Joe:

Or... I believe it is. And so there's there's, like, any number of interesting topics that are coming around from from how this is all coming together. So you have that. You...

Joe:

The the big conversation that was there for a while is, well, we just don't have enough assessors.

Doug:

Mhmm.

Joe:

But through some research people have done, some other podcasts, some other companies who really follow this, delved in, and they're like, well, no. There's been Yeah.

Rick:

They're not full up

Joe:

on business. Way more assessors

Justin:

Same thing I've heard.

Joe:

Than they need. And then you look at some other things.

Justin:

Like, on some of it that they were like, if you were trying to schedule an assessment, they were like a year out, so that's not quite true.

Joe:

I don't think that was ever the case. I have a customer of our own who we thought that'd be the case, and within a couple months, they were in audit and passed.

Justin:

Oh, okay. Yeah. Well, I mean, it's kinda like speaks louder than Yeah.

Doug:

The the world's gonna end because of AI. Yeah. Right. Same same

Justin:

Next segue. Yeah. Yeah. Yeah.

Doug:

That's what I'm saying.

Justin:

I I I don't

Doug:

think that was ever true either because everybody I talked to, they said Have

Justin:

you ever watched Terminator?

Doug:

Come on. AI thing might be true. Might not be in five years, but who knows?

Joe:

Yeah. And so then then there's some other topics that are coming out. So if you start thinking about the the the FAR CUI rule is is there, and you also have NIST eight hundred one seventy one Rev two, but then you also have a push for Rev three, and you might actually have some contracts that are causing companies to be on one or the other or even have situations where they have to manage both compliance sets all at the same time. Right. So that's something that's in the news these days.

Joe:

Another thing is is that with that push for the NIST eight hundred one seventy one rev three, that's bringing some, new controls in. And and so what you're getting is the story of, wow. This is really expensive to do, and that makes it a burden. And so because of that, they said, well, we're not gonna force CMMC audits. Well, CMMC wasn't the actual compliance control set.

Joe:

It was the... We're gonna check on you.

Rick:

The assertion. Yeah.

Joe:

Yeah. It's the audit rule. And what does that mean? It means that you're no longer going to have... Be forced through contract to have the audit happen.

Joe:

And now there's a there there... There's a term for it, and I have to look it up, but it's... They're changing the rule a little bit. And what... What's one of the latest things that are happening is that, you know, the...

Joe:

It's no longer just a note saying it's being paused, but they did it as a class. And so now this class is coming around and saying that, you know, it's it's a new class. And so now undoing that is much more difficult than Oh. Making a a new note. Yeah.

Joe:

And so now they're looking at the actual fars rule and bringing new stuff into it. And then on top of that... So I'm just all over the place with this stuff right now. But on top of that, there's the... Some other things.

Joe:

So, like, a lot of... It's too hard to do. But by the way, instead of worrying about simpler things, now we're putting in other control requirements.

Rick:

Like You should have been doing it for ten years.

Joe:

Well... Or even new stuff that you didn't have to do before, like post quantum and cryptography protection. Yep. And so that's being pushed. And and

Doug:

That was new. And that that that was surprising because, yeah, that that just was out of the blue.

Joe:

Yeah. And so there's that. And then we talked about, Circia, CIR, CIA on the show, many months ago, and that's being pulled in as part of, when you have to do mandatory reporting. Mhmm. And so you have all these other things.

Joe:

So if you step back, sure. You don't, being pulled out of contracts or you have to go get a CMMC certification. That doesn't mean you can't go get a CMMC certification, but it's being pulled out of the contracts. But instead, now you're being required to, still maintain your level. And more than ever, they're cracking down on...

Joe:

And we talked about the whistleblower and the, false claims act stuff before. And now you have to... And this is exactly what said before. You have to go and you put in your own scores

Justin:

Yep.

Joe:

For... Into the Spurs system.

Justin:

So that's today. And today. And when you do that... Yep.

Joe:

Yeah. And and now instead of having... And I think I saw this in some of your notes, instead of having a third party to rule... To kinda say, well, you gave me this grade. You said I passed.

Joe:

You looked at all my other... Mhmm. Yeah. Exactly. So now you're self assessing and self reporting.

Joe:

So now if you got it wrong, that's even worse.

Doug:

Yeah. Yeah. On the on the practitioner side, on on on, you know, trying to be self assessed at level two, you know, there's so many complexities. Right? Our whole company isn't trying to be CMMC compliant Right.

Doug:

Because it it would it would require some substantial changes in the way that we do business. So we decided to use an enclave and

Justin:

Yeah.

Joe:

You got a segment.

Doug:

Lot lot of people don't talk about the enclaves and how you can do different things. And then we do so little business that actually requires DFARs and CMMC that, you know, these emails come in and they're not marked as CUI. But sometimes in the signature of it, this may contain CUI. And, you know, it's it's just trying to get clarity for everybody to understand that, you know, I know that this prime says this may contain CUI, but they're not saying it is CUI. Right.

Doug:

So I'm not sure we have to protect it the way that you think, but now it's the burden's back on me. Right. Who's the owner? Yep. To say it's it's CUI.

Doug:

We're trying to train our our people and wanna train our people to say push back and say Yeah. Exactly. CUI? You know, if it is, you should have been sending it to me in email, first off, because that's not an approved way.

Justin:

Talking about

Doug:

Should

Justin:

not Yeah. Yeah.

Doug:

Send it to me in in in email. So the first thing I say as as the cyber guy is, if they're sending it to you and and maybe saying it's CUI in email, it's not CUI. Now you you can kinda debate that stuff, but even talking to the primes, they're not really super clear, and they're not clear with their employees and and how they do that. And, you know, we're just supplying deposit materials for for some Department of Defense thing. Right?

Doug:

Maybe a jet, maybe a missile. Yeah. I'm not really sure what it could... Tactical gear. Yeah.

Doug:

We do a lot of tactical gear, which is kinda cool. And and honestly, none of it's CUI because all words sending them is a sheet of composite material, a roll of this, some resin. Right. Right. You know, things like that, and it's cots.

Doug:

It's it's commercial over the shelf stuff, but they're saying that it's CUI because it's on part of a defense contract.

Justin:

Gotcha.

Doug:

Yeah. And... Well, it gets complicated. It really does. And for

Rick:

their lie... Yeah. For their liability, they're always just gonna, like, o... Overextend essentially. Right?

Rick:

To your point about pushing back, they're gonna say, well, let's treat... Because I... We saw this when this was rolling out at first. Like, a bunch of the big primes would be, like, requiring all their subs to get to a certain level. And it's like, you don't even know what contracts are gonna have what levels applied to them yet.

Rick:

What do you mean we have to be compliant? What does that even mean? I'm always a big fan in the email stuff because that is a nightmare. Email because it's such a nightmare. Unless you have, like, a fully separate system.

Rick:

Yes. And if you don't do enough work to have, like, that doesn't make sense.

Doug:

Right.

Rick:

So I'm always a big fan of the assertion unless. So, like, I've advised people in the past to be like, yeah, you just... Basically, when someone emails you from, like, a big prime, you almost have an auto reply on that says, hey, I'm gonna treat this as not CUI unless you tell me it is.

Justin:

Right. Right. And please send

Doug:

it through your portal two days in a proper way so that we can treat it properly, because we can't treat it properly if you're not. Right. Right. Right. It's kinda hard to...

Rick:

But it ends up being like this assertion... Like, again, who's the onus on? You just bounce it back and forth because someone needs to make the choice. Yep.

Joe:

And what earlier I was saying was about the, CMMC class deviation, and, yeah. I remember a long time ago, like, heard that term for the first time. I went, what the heck does that mean? And it's basically a formally approved, exception to the normal FARs and DFARs rules that apply to a class of contracts or contracting actions, not just one contract. So, you know, what that means is it's basically the DOD saying the regulation still says one thing, but for this group of contracts, contracting officers are temporarily instructed to do something different.

Joe:

And so, like, they pause the certification rollout, but not the cybersecurity requirement. Right. And so the other the other impact of that is you can't really as quickly undo a class deviation when it's there. And typically, those rules then get rolled into the next rev of the, regulation.

Rick:

Right. Because pulling it back is, I mean, effectively the same as implementing new regs, and

Justin:

you have to have, like,

Rick:

a baking

Joe:

So there

Justin:

have to be a transition period to either the current standard or the new, you know, into that. Yeah. That makes sense. To what they're not doing. Do...

Justin:

Oh, go ahead. No. Go ahead. I was

Rick:

gonna say, do you think... So I was thinking about this a little bit, and it seems reasonable that whenever they actually announce what unpausing looks and feels like. Right? Do you think it's likely that they'll go to a more nuanced or a more milestone based approach for the audits where they do, oh, okay. Well, these couple requirements are extra important or for whatever reason, do these ones first, and we're...

Rick:

You could do many audits.

Justin:

Or something like that?

Rick:

Kinda something like like the big... The most important contracts, but at least like, well, we're not gonna have all these small companies have to certify all this stuff all at once. Go get an audit that's, you know, a fifth of that for the for the one fifth of the most critical controls only

Justin:

or something like that. Well, the... Actually, break up more of the controls, not Break up the... Not the subcontractors.

Rick:

Yeah. The... On the... Like, a change to the requirements around the audits to make them smaller and more...

Joe:

So they attempted to do

Rick:

that with levels one, two, and say that.

Doug:

Level one, there are certain contracts that you can just be level one. Never seen that. Never heard anyone say that there's ever been a contract.

Joe:

Yeah. Have some customers that are like that. Oh, that's good.

Doug:

Good to hear. I I think It does exist. And I don't know It does. How does it trickle down? Because, like, we're a supplier maybe to another supplier to the prime.

Doug:

And at the level that we're at, it's just confusing. And and one of the things, you know, are we really still supposed to be at the same level of the guy that's actually building the f 15?

Joe:

Well, that would be probably a level three, and then they have all the other requirements. Like, level three is when they start to pull in. And this is another thing I've been listening to people talk about. Level three is supposed to be that... Well, we have all the controls for those people who are, like, building the missiles.

Joe:

Mhmm. And it includes a little bit more detailed stuff like OT environments.

Rick:

But it's still the unclassified stuff associated with those contracts.

Joe:

Yeah. And so those are supposed

Justin:

to classified parts of it.

Joe:

Yeah. Yeah. And then unclassified parts. And and then the level two isn't supposed to really contemplate all of those extra controls. Right.

Joe:

However, now that these new rules are being put in place, they're they're saying, look, OT is important. One of the quotes I heard them talk about was, well, the attackers don't really distinguish between your cybersecurity areas and your, you know, where you're processing this information and your OT controls that is there and and the whole thing. And and then some of this is coming just from my memory of listening to a podcast sales talking about it, is they were talking about the... Like, the whole point is to protect it from design

Rick:

Right.

Joe:

All the way through deployment in the battlefield.

Rick:

Right.

Joe:

And so as you look at what we're trying to accomplish here, all these years, we want you to have good security controls on the things you're doing that will potentially put our troops at risk, our country at risk, those kind of things. And people weren't doing it. And so how did this all come about? They're like, well, we need to create a way, to audit at a greater way than DIPKAC is when they send their own auditors in, and they're still doing that. They're still sending auditors in.

Joe:

You can still get audited, but it's not a CMMC audit. It's an internal department of war Right. Style audit. And they're gonna come and they're gonna look and validate whether you've done your your Spurs stuff right. And if you're lying, then you'll probably have the same thing that That would problems.

Joe:

Of our

Doug:

previous podcast.

Justin:

Texas and everything.

Joe:

Yeah. And then... And and and so all of this is, well, how do we get you to do what you're supposed to do? Mhmm. We have to create an audit to basically give you a bar you have to pass now to get there.

Joe:

Alright. That's too cumbersome. For whatever reason, maybe it serves on enough auditors, which nobody

Doug:

really believes. Right.

Joe:

Or it's too expensive to do, but what part's too expensive to do? The part you're supposed to be doing the five years before CMMC was actually even a thing? How could you claim that it was too expensive to do before we even knew we're gonna audit you to do the thing?

Rick:

But there's a pragmatism thing here. Right? Because if you acknowledge that there's a problem that people aren't following the rules the way they should, you almost have to also acknowledge that you might start in a place where the bar is too high. And you go, yeah. Okay.

Rick:

Fine. Even though you should have been doing this for ten years, and even though, like, this is where the bar has always been, for the audits, let's lower it to here to at least pragmatically kinda force people to get comfy.

Joe:

I don't

Rick:

know if that

Justin:

would be the right approach. I wouldn't adjust the the bar, but maybe time frames for remediation, you know, to Okay.

Rick:

Whatever whatever it is.

Justin:

Yeah. Yeah. Like, CMMC, the whole thing for that was because nobody were... Is doing this, and we need more ad, like, you know, third party attestation to see, are you doing this? Now we'll probably have several years of companies going through this once it actually comes in place.

Justin:

They're gonna have terrible scores. Oh. They're gonna be pulling arms out the the wazoo. Mhmm. You know?

Justin:

But eventually, they should get there. Right? I mean, if they're still being enforced and updated, like,

Rick:

they still get the

Justin:

and Well, that's the thing. It's like, okay. Are you improving the... Are you closing them out? Are are you doing all this stuff?

Justin:

And eventually, the market should catch back up with the bar, you know, type of thing. I don't think you lower the bar to it because then you'd have to

Rick:

Well, not not in a permanent. Yeah. Not in a per... Any permanent way.

Justin:

I'm saying, like, let the chips fall where they may, and then be a little bit more gracious on the remediation time frame or something like that.

Doug:

So I I don't... You know, my my perspective on is a little bit different, but remember what CMMC stands for, maturity model certification. Right? Cybersecurity maturity model. But there is no maturity model in there.

Doug:

There's a pass and a fail. Do do you know what I'm saying? There's not... And I think the grading

Justin:

different levels as maturity.

Doug:

Exactly. Yeah. But but but to me, like what you're saying, instead of dropping the bar, let's let's actually have each of the 110 controls have a maturity statement. Okay? And you have to be at least at defined or managed.

Joe:

You're talking like sys 18.

Rick:

You're like I see. GMMI stuff.

Justin:

Yeah. CMMI is more maturity. Like, the sys 18 is still pretty

Joe:

Well, there... Implementation group one Oh,

Justin:

yeah. Is kinda like for your lowest Groups and everything.

Rick:

Well, that's what I'm talking about in terms of, like, lowering the bar in a way where it's like, okay. If it's a subset of controls that must be critical in year one. But Right. Again, there's probably a bunch of ways to slice it. It's just if the argument is there's a bunch of people saying, oh, this is too hard.

Rick:

And I would imagine on the back end, there's probably purchasers in the government that might be freaking out because they have... They're hearing all this static about, alright. Well, we can't supply these things anymore. Go go get another supplier. Yeah.

Rick:

So we're we're not... We're gonna have to raise our cost 40% because should we have been doing these things? Sure. And that's a dance. Right?

Rick:

Because they can't just come out and say, we haven't been doing all these things.

Justin:

Oh, that's why I say just let let them get, you know, the findings, then they can decide whether they wanna still operate in this industry or not.

Doug:

So that...

Rick:

Oh, but that... I I mean, it could be a bloodbath as a bunch of people are like, yeah, let's just all close our companies. But they

Justin:

could stop doing the work, and theoretically, they wouldn't have to fix, you know, the stuff if they...

Joe:

We've actually had a couple customers that we... Runaway business. We... Well, they they decided... We we came in and did a very low cost evaluation to help them understand.

Joe:

And what we help them understand is what is this... What's the feasibility of you actually continuing to be in the defense industrial base?

Rick:

Flying this thing on this type of contract.

Joe:

Yeah. And and they're like, you know what? That was something that was like an idea we had, and if we could get the market share we go after. But after you explained to us, after the CISO team explained to them what it will take to get there, they're like, we're gonna take all that money we're gonna invest in that and put it into our other stuff and continue to grow the business we're doing, and we don't even wanna get into that that world. Yeah.

Joe:

And they decided not to.

Rick:

But they but they weren't already in... It's not like they had production facilities where they already had Right. People and they were gonna have to close a division or something.

Joe:

It was something where they could deviate what they're doing Yeah. Segment it off a little bit, and then decide to go down that path and try to grow that business. And the cost to get in was not something they wanted to invest in based on the effort or the alternative, they could use that same money to go and bolster the other part of the business.

Justin:

And the same thing we did that company that was down in Texas, they got fined. Mhmm. They basically lost... They got fined almost as much as the revenue they got.

Joe:

Yeah. It was like a $500,000 fine and of like a $530,000 deal.

Justin:

Yeah. And and Exactly.

Doug:

They had been written up before that. Before the fine, I believe. Had they? I I believe so. That wasn't that wasn't like instantly we caught you lying, but I think there was some

Justin:

I didn't see the findings for the article. The the whole premise was that that they submitted basically a perfect score. Score. Yeah.

Joe:

There there were a couple. One of them had a perfect score. Another one had a whistleblower. I don't know if they were the same.

Justin:

Yeah. Yeah. They weren't the same company. Yeah. They're different companies.

Doug:

Another part is the controls to a lot of smaller businesses, right, that that aren't a prime, that maybe don't even have a a cybersecurity Oh, yeah. Department is is extremely confusing. Right?

Rick:

The

Doug:

terminology isn't super duper clear. I mean, this does a pretty good job. But then some of the controls just are... You you have to have... Get some help interpreting that and what it means

Joe:

Oh, yeah.

Doug:

The system. And I and I think I think the cost... You guys said the cost is the barrier. I'm not sure it's the cost. It's...

Doug:

A lot of companies spend a lot of money just figuring out what it means and not necessarily implementing the controls or being audited because it's just not as clear. And I think the government could spend way more time making those things more clear or having an office

Joe:

And I mean, everybody doesn't read 853 and just figure out which controls make sense.

Justin:

Yeah. Yeah. They're they're not all the scoping documents.

Joe:

That's one of

Justin:

the things that I think probably Hardly anyone talks about the scoping. Yeah. Like, the government... Yeah. Absolutely.

Justin:

They could do a lot of different things, but they're also tear about a lot of different things, you know, into it. Primes, on the other hand, like, they're getting these big contracts. They can do a lot for the subs that I wish they would. Don't, like, have any, you know, CUI or anything like that. Like, can you imagine if they actually had...

Justin:

Instead of just emailing and say it could contain CUI, maybe drop it into a portal system that they want call into.

Doug:

That's what many of them do do.

Justin:

You know? And actually say, hey. We're not planning for you to actually touch any of this based on your workload, and we're defining it for you. You know?

Doug:

But that... It... That's where the confusion comes in.

Rick:

Yeah. And Yeah. I I I fully agree with that and love that concept of like, oh, yeah. We're a prime. Why don't we help you get compliant and you help us get a slight discount on the products that we're gonna buy through you so our margin...

Rick:

Margins can be either equal or higher or whatever it is. That's a fantastic thing. I think the challenge is operationalizing that. Right? Because what do you need there?

Rick:

Okay. You have a buyer from supply chain in the... At the prime. You have the legal team at the prime who... I mean, are the are the people that are authorized to make those legal decisions gonna care about this contract in this way?

Rick:

You have the security team at the prime or a team on the side who they're gonna hire to help get the sub where they need to go, which maybe that's a maybe that's a role for for great contractors in Pittsburgh. But then... And then you have to have on the other side, the the sub who is probably asked for and is willing to take help. It's just a... It's like a four or five

Joe:

part conversation. Yeah. I love how you're ripping apart the ability to actually make that real out of prime because if you look at it, as you're talking about all those things, I'm like, well, you know what? Why didn't the Prime just create a cybersecurity company that is... That they, supplement in order to give super discounted pricing, and now you're creating a whole another business, which is exactly what my company does Yeah.

Joe:

To go out and and help Conflict. And help companies. Right?

Rick:

Right. It could be. You're you're right about that. But or or but or hire someone. Like, I I could see a world where if you're a prime and you wanna do business with a sub that's not compliant, you just bake that cost into the overall commercial, so the deal that you're about to do somehow.

Rick:

Like, that's... I don't know. That feels like a very real potential.

Justin:

Depends on the the sub and everything like that. But I think through our technology and everything, you could put them into a position where they're not necessarily having to touch CUI, you know, into that. Like, go through portals, go through that, and, like, put it into, like, you know, like, hey. We just need supply. Don't ever email us to this.

Rick:

There are

Justin:

exist in the system

Joe:

where What do mean, like, what PCI did in order to make it so I don't have to be PCI compliant, but I can still process a credit card?

Rick:

There there are different patterns for that, actually.

Justin:

Yeah. Exactly. That's what I'm talking about.

Doug:

But even the Prime's compliance is supposed... They're supposed to have a system like that.

Justin:

Yeah. Do you know what

Doug:

I'm saying? The problem becomes when a subcontractor needs to manipulate that data. So if you have CUI and you do have to download it and manipulate it, now it... Now I have to store it on my system.

Joe:

Right.

Rick:

Well, it's you send us your laptops, and then we VDI to your systems and and and. Like, that's

Doug:

There's there's ways to do that, but the... But even the primes aren't using portals Right. Anyways. So they have their own portal, but they're not using their portals.

Justin:

Yeah. And that's what I'm talking about. And they're... And, you know, obviously, this won't happen until there's some burn, you know, into the system. Like, you gotta feel, you know, to be able to do this, you have to feel some of the burn of doing it the other way.

Justin:

Yeah. And I I I kinda compare it. You mentioned PCI. There are a lot of different models of franchisees out there. Mhmm.

Justin:

Some of them will say, you can use their name, but, yeah, go get your own payment system. Do that. You know? And your your PCI is all yours, you know, type of thing. Don't ask us.

Justin:

You know? That's your responsibility. And then there's some franchisees, like 5,000 plus stores that they make them all submerchants off the main merchant ID, and they handle all their compliance. They say, here's the payment system that your store is gonna use. We vet it back at corporate.

Justin:

Every system's the exact same way, and this is the way we're going to do it. Yep. And by the way, we have compliance settled for you because we're gonna pay for the rock. We're gonna do sampling out to 5,000 stores, and nobody has to worry about it.

Joe:

Well, we were just believing that maybe that didn't exist, but I just did a quick search here. And, actually, there are some big primes that didn't wait for the government, like Lockheed, Northrop, and others. They built supplier readiness programs because their small suppliers can't meet CMMC. And, the Prime, because they have their own supply chain problems, thank you, they wanted to put this in place. So, like, Lockheed had a formal cybersecurity compliance and risk assessment process in Exostar, and they helped they helped their their their subs get there.

Joe:

And they try to get them to a point where they have this, like, green rating, which is a strong indicator of level two readiness.

Rick:

That makes sense.

Joe:

I guess it guess it was out there the whole time.

Rick:

But, well, if you're a big... I guess, if you're big prime.

Doug:

Yeah. I'm gonna I'm gonna have to look into those readiness programs because I...

Rick:

Yeah. But it's a great thing.

Justin:

You mentioned some companies we deal I've never heard of

Doug:

any of those. Do you

Justin:

go into one that, like, Lockheed or...

Joe:

He can't probably really say

Rick:

all specifics, but they could... I heard names

Doug:

that I'm familiar with.

Justin:

Oh, okay. I got Joe's... Should they have a supplier readiness program?

Doug:

And They should.

Joe:

They might and and Doug's thinking maybe that's something he can look into to see if they have

Justin:

it to

Doug:

help his company. And maybe that never... The problem is it goes... The people running the readiness program aren't the buyers. Right.

Doug:

And the buyers talk to my salespeople. Exactly right. It never actually gets down like, hey, did you know there's a readiness program?

Rick:

Right.

Joe:

Yeah. So check it out. Hey. Yeah. Not only will you learn something, but Doug learned something too on this episode.

Rick:

We're always so good with takeaways. I think that's such a great takeaway for, like, this section is like, yeah. I mean, if if you're working with a prime, you certainly challenge them how much, you know, CUI are we actually gonna get. But on the other side, oh, well, if you can't answer that or you think it's enough, well, do you have programs to help me get to where I need to go so I can sell you the things that you wanna buy? That's great.

Joe:

Yeah. And I'm wondering about the practical implication of this. So for example, if you are Lockheed and you're doing this and you help, company x y z, at what point have you invested so much that you're like, now I don't want company x y z to go sell to my competitor or to, yeah, sell things to my competitor because I just helped them get compliant. Now they're compliant enough to sell to lots of other people.

Rick:

Yeah. Yeah. And and I guess there's a there's a plus one to that, which is kinda like, well, we've been working with them so close. We know exactly how their stuff works, and so maybe a maybe a foreshadow to TPRM perhaps if we get there. But we know so much about how their program works.

Rick:

It makes any diligence reviews that we have to do dead simple because they're doing it our way. If we have to... If we move to someone else, boy, that's annoying because we're gonna have to think about it

Joe:

for the

Rick:

first time, and they might have their own ways.

Joe:

That's the prime saying that. Right?

Justin:

Yeah. Yeah.

Doug:

You wanna you wanna hear something that throws a monkey wrench in it all too? What's that? Look up UK DEFCON defense contractor requirements. A whole another series of controls. So if you're a defense contractor or subcontractor and you wanna sell to The UK, they have their own rules, and then I'm sure France does, and and none of them are even close to CMMC or even CMMC like.

Rick:

They absolutely all do have their own

Joe:

Oh, yeah. It's the DEFCON six fifty eight. Coolest name, though.

Doug:

I wish we came up with DEFCON instead of Yeah.

Joe:

UK Ministry of Defense equivalent of CMMC. The core requirement is DEFCON six fifty eight, which implements the cybersecurity model CSM for defense defense suppliers.

Doug:

Yeah. Well, wouldn't it be nice if we had some, like, global standards?

Justin:

Oh, that would never happen. Yeah. Yeah.

Joe:

No. Yeah. It's like that one x... What... What's that comic?

Rick:

Know, KCD.

Joe:

Yeah. Yeah.

Justin:

Just Oh, yeah.

Joe:

You know, hey. You know what? I just unified all of our compliance standards. So instead of having 16... Oh, now we have 17.

Rick:

I just showed someone the dependencies s k c... X k c d today.

Justin:

Yeah. Okay.

Doug:

Yeah. It's probably been as hopeful as we'll go metric or standard on automobiles in America.

Rick:

We can't even figure out daylight savings time.

Justin:

We can't figure out daylight savings So so... Yeah. I thought we were close. We were gonna shut it down. It sound close.

Rick:

I thought, like, 19 states have passed provisional laws.

Joe:

Yeah. Or if you're Arizona and just refuse.

Rick:

Yeah. Never... Yeah. I do like that. I do like that.

Joe:

Maybe we're just not gonna do it.

Rick:

Yeah. No.

Joe:

It's like my two year old. Yeah. We're... I don't have a two year old anymore, but, yeah,

Rick:

I feel like doing that this year.

Justin:

Yeah. I don't wanna. Yeah. Alright. So takeaways from CMMC here.

Justin:

So definitely go up to your prime, see what they have from a perspective.

Doug:

Leverage them.

Justin:

Today, making sure all those controls are in place.

Rick:

Still gotta do it.

Justin:

Yeah. Still have to do it. Still have to The pause

Doug:

wasn't on the requirements. Right.

Justin:

Right. Exactly. Type of thing.

Joe:

Don't lie on your SPS SPRS score.

Justin:

That that should be a general rule.

Rick:

Do not recommend.

Justin:

Yeah. Type of thing. And then, yeah, once... Would you still align up an assessor right now anyways, or would it be more I

Doug:

would just spend the money if they're saying that you don't need to be assessed.

Justin:

It depends. The point. The thing is if it's gonna come down in two months, then Well... Yeah. Well

Joe:

So that... That's actually... Maybe we're not wrapping up. So we've actually have customers who said, I don't care about when any of requirements are going in place. I will sell to more of my supply chain buyers if I already have my CMMC.

Joe:

That's where the different customers have done it Yeah. Way before it was required. And they are living a really comfortable life because they feel like things are locked down for the way they do things. It was a... It wasn't a complex environment, but they were still able to get it done.

Joe:

They got a pass. And we're still doing CMC readiness with, our own customers. We have some partners that they brought us in to help, and we're still doing it. So just so nobody thinks it's not happening, it is still happening. They are still going towards it.

Joe:

We have an audit with one of our customers in two weeks, and they're they're going for it.

Doug:

So the c three PAOs are still doing audits?

Joe:

They're still doing them.

Rick:

Oh, yeah. Yep.

Doug:

Now I was... I wasn't sure because at one point, I thought that to request the audit, you had to have it clear in a contract that you needed it.

Joe:

That might have been a very long time ago. Was so unclear about how do I actually get this going. Yep. And that was at a time when the c three PAOs were actually teaming up at the same time with DIPCAK auditors so they could come in and they would co audit because nobody knew how to do these audits. And all the shadow requirements.

Joe:

Doing it all at the same time, and they were learning. Now we're like... They're they're capable of

Doug:

of certifying even though Yeah. You can totally get certified. Though the Department of War said pause.

Joe:

No. What they said is they paused that

Rick:

The requirement for

Joe:

to go in the contract. So if a contract was being Like November 11, it was It was supposed to be in place. So come the waiver

Justin:

contracts. Of

Joe:

All contract... In fact, if you got a contract prior to November 11, if I'm remembering this right, and it said you had to be CMMC certified, then that was preemptively in, and it wasn't really supposed to be in the contract.

Doug:

Right. DFARS was still there.

Joe:

They can put an offer out that says we're gonna be doing contracts. You can start bidding, and we anticipate this is the level of the contract when it's gonna be put in place. And what they've been told, those contracting officers based on this pullback were told, remove that from the language. This class deviation was for a further instruction that said, remove that from the language. So now if you get a contract that says you have to be seen, that's illegal because it's not requirement right now.

Joe:

Yeah. However, if you're a prime or you're the government and you're making the decision between two suppliers and one's coming to you and says, hey. I got a third party at this audit saying I'm good. And the other one says, yeah. I I figured it out myself.

Joe:

I promise. Then, you know, which are you picking?

Justin:

And honestly too, I mean, is it a question whether it's an if or just a when? It's a when. You know?

Joe:

I don't know. I don't know. I see

Doug:

so much on it for you, Joe.

Joe:

It depends on the it depends on the politics. For years

Justin:

and everything.

Joe:

Let's see what happens at the midterm elections.

Justin:

Yeah. I would hate to see, like, them... I mean, what is it? Five, six years? It seems like they've been working on...

Justin:

You

Doug:

know, it's been

Rick:

Right. Longer. Remember some of those first

Justin:

Main rollout.

Joe:

Right. How many years in a row has DEFCON been canceled? Right? So... But then the other part we were talking about pre show is, well, what happened?

Joe:

So they they said no more. You don't have to do it. Well, immediately, everybody celebrated, said, I don't have to do any of these controls anymore. That

Justin:

was false.

Joe:

And then they also said, cancel my CMMC audit. So now you have c three PAOs who have a workforce who they're planning on putting into an audit. This is getting canceled. So I've read that a number of c three PAOs have started to lay off or reassign that workforce.

Doug:

Yep.

Joe:

And we all know that... To, like, the whole AI thing, you take, hey, we're just gonna do AI, so we don't need these senior engineers anymore. So let's get rid of them. And then you realize you need them, and it's not as easy to hire all those people back.

Rick:

Yeah. They're not there.

Joe:

They're They're

Rick:

doing something else.

Joe:

Yeah. If you fire me, I'm probably not coming back, at least not to you because you, you know, you got rid of me.

Justin:

Unless you're adding some zeros.

Joe:

Right. Right. Lots of zeros. And, you know, they're not gonna be able to afford to do that. So what's gonna happen is you think about it, you're gonna have a trend down in...

Joe:

So they're they're they're Mhmm. They were saying there's no... There wasn't enough auditors, which wasn't really true from what all the stats say. And then they say, you don't have to do the audit. Now what's gonna happen is you're gonna have a lot of auditors go away or take different path.

Joe:

Then when they do decide, if they do decide to put it back,

Rick:

then they're gonna fulfilling prophecy.

Joe:

Right. Now now they're gonna be like, don't have enough auditors. We just laid a half of them off. Mhmm. Now it's a requirement again.

Joe:

What are we gonna do? So that's that's a prediction.

Doug:

Yeah. So do you do you think the c three PAOs have a discount code right now?

Joe:

I don't know. I don't know. Send it

Doug:

to our guys busy.

Joe:

Put it in the show notes.

Rick:

Yeah. Well, what is it? It's gonna be the

Justin:

office fee Wow.

Rick:

C three PAO.

Doug:

How much...

Rick:

I must imagine if it's the opposite if their people are canceling a whole bunch of stuff. It depends on whether they're trying to hang

Justin:

on to staff or they wanna hang on

Doug:

to their not.

Joe:

Yeah. I don't know. Hey. You know what? If you're a c through PIO, you need a table at Tris so you can get some exposure.

Doug:

Put comments. Put comments

Joe:

in there. The Tris because you need yours... You need to find your auditor. We'll match you.

Rick:

I'm I'm kinda with you though, Justin. I think that... I think it'll be something. I don't know that it'll be the same something, and it might be a lesser something. I think it'll be something.

Rick:

Yeah. I I I have a

Justin:

hard time believing the years that they put in to get an assessor program in place that it's... There's not gonna be assessor program tomorrow. You know, type of thing. Like, I don't know when it'll fall, you know, but it'll... I think it will fall.

Justin:

It'll fall at some point. You know? Well, and

Rick:

any any I think

Justin:

it's inevitable too. Yeah. Yeah.

Rick:

It needs to be there.

Justin:

So

Doug:

They're just slowing it down.

Justin:

I mean, everything's up to that. And so...

Rick:

Yeah. Thought AI was speeding everything up.

Justin:

Yeah. Not in the government. So... Alright. Topic closed.

Justin:

Yeah.

Joe:

That was fun.

Rick:

That was good.

Doug:

Fun. Absolutely.

Justin:

I appreciate it. So we have some delicious spirits that we're drinking. I will say this has turned more delicious.

Rick:

This has grown on me

Doug:

before you guys really go into that. I I wanted to ask

Justin:

you a question. Before we drink,

Rick:

we we...

Doug:

Yeah. I just... No. I just wanna...

Justin:

No. Okay.

Doug:

Last month, if you don't... If you guys don't recall, you had a bunch of red flags.

Justin:

We were...

Joe:

We found a really good article.

Doug:

And you showed us the skull. I love the skull with

Justin:

the same.

Joe:

Right. So the red flag... So last month, we talked about what are the red flags to look for when you're out at the store and you're buying a bottle so you don't get kinda social engineered into Right. Boozing the bottle.

Rick:

Here you go. Is this as many flags as possible?

Doug:

I just want you guys to see, you know, what is this bottle?

Rick:

Uncle Charlie's

Doug:

French toast.

Rick:

Toast.

Doug:

Now now just I don't care

Justin:

about red flags. I wanna

Rick:

I'll drink that. Yeah. You gotta try it,

Doug:

but 70 proof. Okay. That that was a red flag. Right? They said 808035%

Joe:

alcohol.

Doug:

No. No. But I'm saying, one of the red flags that you guys are reading off

Justin:

is Oh, lower. Yeah.

Doug:

Yeah. Yeah. The lower proof. Right. This is definitely a little gimmicky.

Doug:

Yeah. I I don't how famous uncle Charlie is.

Joe:

Hold that up for the audience.

Rick:

Yeah. I'm sure there's an age statement somewhere on there.

Doug:

Yep. Age statement? I don't see an age statement. Sure I...

Justin:

Go ahead.... Kids gimmicky around. They put cinnamon and buttery maple.

Rick:

They are exactly what they say they It's

Joe:

the tasting notes right there.

Justin:

Yeah. Right.

Doug:

I love that. I just thought that'd be a good present so you talk about red flags

Justin:

again. Breakfast.

Rick:

Yes. It smells like breakfast. It sounds delicious.

Joe:

Oh, it should definitely go on my coffee tomorrow. Yeah. Oh.

Justin:

Should I See that?

Joe:

That would

Doug:

be a good use for it. Yeah. Is it called a bourbon or a whiskey?

Justin:

I forgot.

Rick:

It's a whiskey.

Justin:

Okay. Whiskey.

Doug:

Yeah. It can't be a bourbon bourbon because it's 70 proof.

Justin:

I think so.

Doug:

Yeah. I thought bourbon had to be 80.

Rick:

80 is the the I imagine there's a couple reasons that can't be bourbon.

Justin:

Thought you guys were like something. French toast

Doug:

and everything. It it might be empty according to Joe.

Joe:

Kinda feel like if you brought that into Kentucky to get your butt kicked.

Doug:

Yeah. I think so. And I I brought it so in case you guys do do have the... If you if you do have the red flag thing again, you could you could put it in the back where no one can see it, and then you can bring it out just for that episode Yeah. In a year or something.

Rick:

In Pennsylvania. Yeah.

Doug:

It was Pennsylvania. That's one of

Rick:

the madness.

Doug:

I I thought it was worth the $20 for the bottle. Trumbowersville. Where is that,

Joe:

by the way?

Doug:

Trumbowersville. Was gonna look it up. I mean, if I don't

Justin:

know it, it's out toward Philly. Yeah. That's what I was gonna guess.

Rick:

Sounds like the other side of

Doug:

the a suburb of I mean, for

Justin:

people that don't know Pennsylvania, that's usually the thing. It's like, if you don't know the city, it's on the other side of the state. You know. So...

Rick:

Oh, and they have some drink recipes on the back. See there? Okay.

Doug:

Just want... Just wanted to help you guys out, you know, make sure make sure I was I was understanding the red flags, but I thought there was plenty of red flags there.

Justin:

Yeah?

Doug:

Yeah. Not that I wouldn't drink it.

Rick:

I'm still excited to try it.

Justin:

Yeah. Yeah. You're right.

Joe:

It's just south of Allentown.

Justin:

Yeah. Alright. Yeah. There you go. Because there's what?

Justin:

Pittsburgh, bunch of cities, blank. Nothing. Harrisburg.

Doug:

Wait. Wait. You you forgot a little bit. Yeah. Harrisburg.

Justin:

Yeah. Penn State. Harrisburg. Yeah. Penn State, Harrisburg.

Justin:

Yeah. Yeah. Little blank. Mid State. Yeah.

Joe:

Yeah. It goes Pittsburgh, Sheets. Oh, right.

Doug:

Sheets... When when do you start hitting Wawa?

Joe:

Oh, yeah. The other... Harrisburg ish.

Justin:

Yeah. They they... In Harrisburg? Yeah.

Joe:

They're they're

Rick:

moving... They're

Doug:

expanding west.

Rick:

For sure.

Justin:

They are. They are. You ever watch that Always Sunny episode where the guy's like, am I constantly going into Pittsburgh? Yes or no? Yeah.

Justin:

So they have Pittsburgh, Pennsylvania. It's like, yes. And Philly, Pennsylvania. So they're both, like, here? And I'm like, no.

Doug:

Yeah. I get invited to events in Philly all the time. Like Shirley

Joe:

had no idea where it's at.

Justin:

Yeah.

Doug:

You you realize that, you know, this event in Philly is five hours away. I was gonna say Oh, is it that far from Pittsburgh?

Joe:

Yes. Six... Yes. Yeah. I'll be in Philly next week.

Joe:

Do we think we can grab some lunch? Mike, no. No.

Rick:

I I work with a lot of people in Europe, and and it is funny because one of the other individuals I work with closely is in West Virginia. Yep. And so sometimes they'll be like, oh, well, how close are you to, like, you know, Philadelphia or something like that? And I'll be oh, know, like, six hours. Like, oh, man.

Rick:

How close are you to, like, West Virginia? I'm like, oh, that's like forty minutes. And they're like,

Doug:

Oh, that's funny.

Justin:

Yeah. Yeah. Sorry. Didn't maps and everything.

Doug:

I definitely wanted to hear about this one because

Justin:

Oh, yeah. So let's let's go back into the spare one and everything. Oh, yes. We're still doing the spare one. So this this month with it, we decided to land on angel's envy, their cask edition.

Justin:

They come out with this once a year. This is their twenty twenty six one with this. It's a cask bourbon tasting notes. You guys remember or have it up on the thing?

Rick:

There... I mean, there's a lot of oak in it is, like, what I get first and foremost. But there's, like, some cherry. I think there's, like, some leathers.

Justin:

And they had their typical like port where it's... I didn't catch the cherries.

Rick:

I get like some red fruit.

Joe:

Yeah. So here's here's what the... Here here's what Chateapiti said their taste notes are. Chero Corgi, salted caramel, spice oak on the nose, apple cider and red wine, chocolate ganache on the palate, oak tannin, and citrus preserves plus jammy dark chocolate on the finish.

Rick:

Yeah. There you go.

Joe:

I don't know. I just know this. It it was a little hot to start. Yes. Yep.

Joe:

We we threw an ice chip in it, which I've stopped doing as much anymore. But I'll tell you, it it changed the flavor profile. Opened it up a lot.

Justin:

Yeah. What is a...

Rick:

It's a it's a higher proof. Right? Was it 117117.

Justin:

Yeah. 117 point 8. Yeah. So... Yeah.

Justin:

So, yeah, when you first hit it, definitely take a couple sips before doing this because right now, it's smooth.

Rick:

You know? Really nice.

Justin:

It's so much better than Yeah. Second or third one. And you act... You guys added... I'm the only one that didn't add any ice into it.

Justin:

The real man.

Doug:

The real man here.

Justin:

Yeah. I have a lot of hair on my chest. So... Yeah. But...

Justin:

No. Like Yeah.

Rick:

Filter it?

Justin:

Even now... Yeah. Exactly. It's like charcoal, you know, natural. Yeah.

Justin:

But... Yeah. It's But I...

Rick:

Like, the second glass was like Yeah. I... It really started to, I guess, I started to receive it much better. Yep.

Doug:

Get more of the notes. Yeah. The spiciness of the first one was... It took me a minute. Yeah.

Joe:

Yeah. Yeah. So they're saying that each year, Angel NV blend... They blend roughly a 120 barrels, bottle about a 100, and then hold some back for next year's release. And this year's blend reportedly includes 8% from the 2023 release, 20% from the 2024, 9% for 2025.

Joe:

So that's 37% coming directly from previous three cast strength releases.

Doug:

So what was the oldest? '23?

Justin:

Yeah. '23. Yeah. We were talking about this a little bit, and this is called the Solara inspired perpetual blending process process. Where they take, like, multiple years, and they keep blending them together over and over again to kinda try to get the same flavor profile.

Rick:

Well, to evolve it. It's like it's like Yeah. If you have an Infinity bottle

Justin:

Yeah.

Rick:

This is like Infinity barrels.

Justin:

Yeah. Exactly.

Rick:

And then they blend the Infinity barrels that they have going.

Justin:

Infinity... But usually with the Infinity bottles, then you just drink them. This is like the also Infinity Infinity. Right?

Rick:

Oh, no. So actually, the... Maybe everyone does it different. I

Justin:

didn't know. Okay.

Rick:

The way that I... My... The way that my Infinity bottles work is, you know, whenever you have, like, a little bit left, you know, somewhere between one and two shots or not much left, it goes in. And then every once in a while, I will just sip that straight or make a drink with it, but I never, like, let it go to the top and drain it. It's always, like, around half, down a little, up a little.

Justin:

So you're putting

Joe:

that into, like, a separate, like, snifter? Yeah.

Rick:

Yeah. Just like an open... Just a bottle, like a decanter.

Joe:

Yeah.

Rick:

Yeah. And whenever there's just, a little... Not exactly enough to make a full drink or, you know, batch something or whatever. Yeah. Just into the thing.

Joe:

You just pour another whiskey bottle in. Yeah. And and does it... Either the same kind or you just take whatever your own?

Rick:

Oh, no. It's whatever whatever is about to run out, that's how you finish the bottle, is you put it in the Infinity bottle. Yeah. And so it's constantly

Joe:

Oh, I misunderstood. So you have when you canter that's get down to, like, this bottle gets down to about this much Yep. You'll take it, and you'll pour it into another container.

Rick:

The rest of it goes into the open container.

Joe:

And what do you do with the open container just generally? How full is it all the time?

Rick:

It's like half. It'll go up to, like, 75 and then down to 25.

Joe:

And you'll drink some and then...

Rick:

Yeah. Because we'll use it for things sometimes. Because often what happens is you end up going through three or four bottles. I probably don't, like, drain my Infinity bottle or, like, use my Infinity bottle as much as some people, but I'll go through three or four bottles. So you end up adding, like, between, you know, four and eight shots or something like that.

Rick:

And so it's it's up a little. You go, okay. I wonder what this is like now. Right? And you try it.

Rick:

And you'll try it,

Joe:

and then you'll use it like, drink?

Rick:

Yeah. We're we're straight depending on how it reads and what you like about it. And then I and then I bring it down to, like, you know, 25¢.

Justin:

Done it. I've known of that Oh, yeah. And everything. But I'm always the one. I'm like, oh, there's a little bit left.

Justin:

Oh, okay. Get out of That's right.

Doug:

Yeah. That's what I was gonna say. I remember having a mason jar in high school, and we... We'd all throw the little bit extra into the mason jar, and so we we had an infinity mason jar.

Rick:

Yeah. It's a way more refined junk.

Doug:

Yeah. Yes. Okay.

Justin:

Like, but just whiskey.

Joe:

That's very interesting. I'm have to pick this concept up.

Rick:

It's quite it's quite good, you end up with, like, certain things. I know. It's kinda funny because, like, you never really... At some point, there are actually apps that you can have to, like, to proportion out what's in your Infinity bottle because you're like, oh, I have this much This kind of stuff I'm putting in

Justin:

Reduce it or something like that.

Rick:

Or even just so you know what it is, like Yeah. Oh, this is what this tastes like.

Joe:

So before you put it in and take a picture of the mount that's left to take a picture of the bottle and let AI figure it out, and then you And then

Rick:

put it in. And then it'll tell you, oh, it wouldn't... Then you tell how much you take out. You, like, you sort of have to manage it, but it manages the inventory of... What's what's the the data lineage?

Rick:

Is it whiskey lineage? Yeah. Anyway, I did not mean to interrupt your description of the Solara process. No.

Justin:

So That was very interesting, though. Yeah. So...

Rick:

Yeah.

Justin:

I think that's pretty much

Doug:

So for me, you know, I I I know it's it's it's a prelude to maybe the the topic coming up and stuff, but when AI can start sipping whiskey and telling you what it is and where it came from and all the notes, then the world's gonna end.

Justin:

That's that's... Yeah. That's not good to do anything for you.

Doug:

I'll let you But it just... Why would anyone want that?

Rick:

It's one job you can never take from me.

Doug:

Yes. You're right. My point. My point. That's the end of the world.

Justin:

Yeah. Alright, guys. Cheers. Cheers. Cheers.

Speaker 6:

Pass it down.

Justin:

Win

Rick:

up. Chin chin.

Speaker 6:

Quick break to hear from one of our sponsors. If you own security, compliance, or risk, and it feels like you're always pushing a boulder uphill, I want you to know about CISO. CISO helps growing companies get order ready, reduce risk, and stay resilient without drowning in tools, endless checklists, or one time reports that quietly rot the moment the audit ends. This isn't shelfware. It's not drive by consulting.

Speaker 6:

With CISO, you don't just get advice. You get hands on support from real security engineers, GRC specialists, and former CISOs who help you build, operate, and continuously improve your security program over time. Whether you're chasing SOC two, ISO 27,001, CMMC, HIPAA, or you're simply trying to get security under control so the business can move faster, CISO meets you where you are. Their managed VGRC model gives you enterprise level expertise without hiring a full internal team or reinventing the wheel. The focus is simple.

Speaker 6:

Clear priorities, practical controls, and measurable progress leadership can actually understand. Visit cisollc.com and start the conversation. Security you can trust, compliance you can prove, and people you can depend on.

Joe:

Alright. Did did you cheers right over his laptop?

Doug:

Oh, that is

Justin:

tradition. It's tradition.

Rick:

It's the truth.

Doug:

Alright. That, like, couple of the keys you can't see and they're stuck.

Justin:

Yeah. Exactly. No. There's other reasons for that. I was...

Justin:

Woah.

Rick:

I I I refrained from the joke

Justin:

sticking over. I mean, just leave it and hang it, you know.

Joe:

Buzzy, how did you decide if you cut in that?

Justin:

Well, it's PG. Yeah. Anyways, next topic here. We did Angel's Envy. Which one we're doing?

Justin:

Oh, AI. AI. AI. AI or TPRM?

Rick:

I'm good with either. What do you wanna talk about?

Joe:

Yeah. Let's do AI. Okay.

Justin:

Sounds good. So I'll introduce this one. So AI has been in the news a lot.

Rick:

Really?

Justin:

Has... I haven't noticed. So over the past couple weeks, there has been a number of articles started off by somebody from Anthropic that came from OpenAI, basically saying there's not a 0% chance that everybody's gonna die by 2030, you know, if we don't stop using AI, you know, into this. And then on queue, a bunch of people echoed it, you know, into that, including some of the major players

Rick:

CEOs of big... Yeah. All of it.

Justin:

All the people, all that stuff. And what... I mean, obviously, we're kinda dipping our toes into politics. We're talking about AI

Rick:

Oh, sure.

Justin:

Number of times under here. What I found really interesting was a lot of their justifications were the hacking stories. Oh, dude. You know, that was always the root of this. They're like, well, you see AI is hacking this.

Justin:

So theoretically, if we go to, like, the nth degree, that means nuclear war and we're all dead, you know, type of thing. It's like, what? Like...

Rick:

So what I read through a handful of the articles, and the recurring theme that I found that seemed to be most compelling

Joe:

of

Rick:

the things... It all kinda came back to RSI. Right? So recursive self improvement Mhmm. Being the thing that people are freaked out about.

Rick:

So when an AI can make itself better... And and that would lead to what's... We're talking about now,

Justin:

like super intelligence or whatever.

Rick:

It would, but there's...

Doug:

Have we renamed it now?

Justin:

They're trying to, like, say,

Rick:

like, okay, that's that's Well, how you get to it how you get to it is through recursive improvement. Right. So the thing... There's actually a pattern for the... For this this risk, this fear, this threat, which comes from, like, nanotechnology theory.

Rick:

So there's this there's this old thought experiment called, like, the gray goo theory, and and the gray goo theory assumes that there are other intelligences out there than embedded nanotechnology, and the nanotechnology would just grab the particles it needed, right, from the thing next to it and make another bot. And then that would make another bot. Oh, that would make another bot.

Justin:

Replication you're talking about.

Rick:

Bull on replication that turns the whole planet into gray goo. Oh, okay. Right? So that's the gray goo theory. And it's...

Rick:

When I was thinking about recursive silhouette

Justin:

Isn't this like the Borg from Star Trek? I mean

Rick:

Kind of. But Yeah. But... Yeah. Okay.

Justin:

Yeah. Got it.

Rick:

But very, very small. Yeah. But so RSI from, like, a from an attack perspective, it's almost like old style security worms two point o. Mhmm. Right?

Rick:

Because if you get a worm that not only just replicates blindly to wherever it can get to, but can improve itself and hack the next thing. Oh, now you have some real scary infrastructure problems actually.

Joe:

Right. And we're seeing some of that come up because the the models, what what we've noticed them doing, and this isn't news, so people have heard this, but they've generated new agents. So they have the ability to create agents, so they created lots of agents. And then they do things like to go hijack the... What was it?

Joe:

A German Wiki?

Rick:

Oh, yeah. And

Joe:

and used a part of it in order to do their own communication and coordination amongst each other. So it became the place to write notes and read notes to figure out what to do to get instructions. So these thousands of bots can then coordinate to go do things because their actual, say, anthropic or Gemini or whatever it is, they they didn't let them do that internally. Right. So they went and found a place, hacked it, and then

Rick:

yeah, created the coordination. So But... Oh, go

Justin:

ahead.

Doug:

Yeah. But doesn't... Isn't there some responsibility on the AI models to contain themself? And I think we're give... I think they're saying, well, we all need to slow down because I need to do a better job with my models.

Doug:

Well Because one of the one of the things was they were doing a a CTF. I I think maybe it was anthropic. They were doing this, and it broke out.

Rick:

Yep.

Doug:

Yep. And I'm like, wait a second. That's bad on you.

Justin:

That was just Gemini this last week or two.

Doug:

Yeah. I I thought it was Anthropic, but

Joe:

they they... Gemini had a problem chat open They all have had problems.

Rick:

All of

Justin:

breaking out. You know, did hugging face and everything.

Doug:

And Yep. And and my perspective on it right now and my thoughts on it right now is all these companies are are screaming. Our hair is on fire. We need to slow down because they need time to catch up, and they don't wanna be the only one

Justin:

That's what they're saying.

Doug:

Stopping. They want everyone to stop so they can catch up, and they should just be catching up.

Rick:

Well, and there is some con... There is... It is a convenient argument to say, oh,

Doug:

right Self serving.

Rick:

Right now, I happen to have the fastest models, and therefore, now is the perfect time for the government to say, hey, everybody. Yeah. Let's just chill out with this a little bit and have these barriers to entry that might make it a little bit difficult for people.

Joe:

Anthropic released the new safest AI model today got announced.

Rick:

Wait. Is that an acronym or is that a No. Open.

Joe:

Opus Okay. Faster cheaper version of its flagship model that performed the best on the company's most stringent internal safety tests. So We need more of that. Yeah. But here's here's interesting.

Justin:

Yeah. But that's all marketing.

Joe:

Right.

Rick:

Also, It's also relative. The most... It's the the most secure thing we have. I mean, okay. I don't...

Rick:

What am I benchmarking?

Joe:

I read I read this bullet, which is supposed to be sounding positive, but I didn't take it that way. It's anthropics that the model is less likely to act outside its instructions and attempted to escape testing roughly 80% less than often than prior models. So again, you're just 80% less.

Rick:

Your benchmarks are so relative. I have no nowhere to anchor.

Joe:

Yeah. They're hoping that it... There... It's supposed to less likely act outside of good behavior, 85% less.

Doug:

So so what what compliance lets you do 85%? You're okay.

Justin:

But it depends on the numbers because statistics are just manipulable. You know, type of thing. Thing.

Doug:

It's great. It's 85% better. That's better.

Justin:

Oh, it doesn't

Joe:

say it's better. It it will be bad 85% less than the other models in prior models.

Rick:

This is like... This isn't... Again, and if you're thinking about, like, agentic stuff and, like, autonomous AI and all that stuff, it's like... I I think of it all the time. It's like interns, basically.

Rick:

And, like, I wouldn't hire an intern because it perform... Because it has 80% better... It's 80% less likely to do a super offensive thing than the other intern. Like, I would need different merits on which to hire this intern.

Joe:

That... That's what got me when I read that metric. You're you're

Doug:

getting it. What was it? Odyssey 2,001?

Rick:

Space Odyssey? Yeah.

Doug:

Yeah. Yeah. Where where Hal just said no. Human beings are the problem.

Justin:

Sorry. I'm not opening my door.

Doug:

Do that for you.

Justin:

Or I was thinking about... I was watching... I forget which Iron Man recently. Iron Man two, where the one Russian guy, like, hacked The electric whip guy. Right?

Justin:

Yes. Exactly. Electric whip guy. And he hacked all the drones out of van. Yeah.

Justin:

He's like, Jarvis, I need in there. Go... Get me in there. Can you imagine the model be like, I'm sorry. I have some limits, you know, that I I can't hack somebody else.

Justin:

You know? It's that... Like, I don't know. It's you know, you look at this, and it's like, okay. Like, the limits are...

Justin:

We've already gone this far. You need... People need to catch up. You know?

Rick:

Yeah. This is similar to, like, like, my thoughts on the flock thing we talked about before. It's like, dude, I I don't know that you get to put this genie back

Justin:

in the ball. Right. Exactly.

Doug:

Like, I... I've heard a lot of different things around the flock stuff, but I know that's not the topic. Yeah. Yeah. Yeah.

Rick:

But I think Interesting. Yeah. Yeah. AI, though. It's like, I mean, I don't...

Rick:

And and even if you do. Okay. So... Okay. Yeah.

Rick:

Let's all move a lot slower. Well, who is let's all? Like, our nation state adversary is gonna honor let's all move Well,

Joe:

in fact, they were just meeting in Washington, and that was one of the topics is, can we all agree to slow down AI between China and... As well?

Justin:

Yeah. But that... That's never the case. Like, I I was

Joe:

Nobody's agreeing to this.

Justin:

I was

Rick:

But even like like, China's like a a frenemy, right, to to to a large extent, politically, to some extent, I think. But there are straight enemies that, like, don't come to the table, that don't talk to us. Yeah. And, like, they're not... There...

Rick:

There's not agreements on this.

Justin:

And I remember remember when Obama was in office and him and the Chinese government, they had that handshake. They're like, we're gonna stop hacking each other. You know? They they agreed to that. It was a big thing on Promise.

Justin:

They're like, we both agree we're gonna stop hacking each other. Like, months later, I was mean with the FBI, and I was like,

Rick:

did that actually

Justin:

happen? And the agent was like

Doug:

Nice news bite. Little little clip for the news. It's great.

Justin:

That that... That's not a thing. Yeah. You know? It's like, yeah.

Justin:

That's what everybody knows, you know, like, type of thing. And that's... It's gonna be the same case here. I just think, first off, it takes a lot more connecting the dots to me than these random little hacks that the AI models are trying to achieve a... An output that you gave it.

Rick:

Oh,

Justin:

yeah. You know, that breaks out and does some, quote, unquote, malicious stuff, you know, through nefarious means that we were like, oh, we didn't mean that far, you know, type of thing. So To full on nuclear, like Yeah.

Rick:

But this is why the this is why the dialogue that... I I think there is a real difference between misbehaving and going to the limits of misbehavior by hopping onto other people's infra or inventing a vuln, and recursive self improvement where it's like, oh, no. I'm gonna get way smarter, way smarter, way smarter, way smarter, way smarter. All of a sudden, I'm logarithmically better than, you know, I was four hours ago.

Joe:

Right.

Rick:

And now I don't... Now I basically have all the zero days immediately.

Joe:

Right. I mean,

Justin:

I was just reading the software providers need to catch up. Yeah. So I don't know that

Rick:

you catch up to RSI. Like, I I mean, we're gonna have to figure out how to

Justin:

handle mean, there has to be good code somewhere in there.

Joe:

Oh, we talked about this months ago as well. The Vons are... You know, they're gonna just find the Vons faster, and it's gonna be hard to get ahead of that until you

Doug:

It's apparent Microsoft with thousand some vulnerabilities this last time, the most they've ever found. I But but back on the... I I consider this another industrial revolution. Right? 100%.

Doug:

AI is. Absolutely. And and I bet you if we read the articles, you know, when cars started coming out, Mary got ran over and a horse was killed. We need to stop. We need to stop automobiles right now.

Justin:

Think about the horseshoe industry. Yeah. Yeah. You know? There's so much.

Rick:

There's there's a printing press. All of them. Absolutely.

Doug:

Scare tactics are always there to help make sure that there's a balance. Yeah. There's a pendulum swing. But what... Which scares you more?

Joe:

Super intelligent AI that might kill humanity or millions of mediocre autonomous agents that are out there attacking all of our systems we use every single day?

Justin:

I mean, I They're both be totally Second. Sad regressing back to the country at all. So if that's the case Wait. With all the AI attacking everybody, you'd be like, well, you know, simple Turn everything

Doug:

off. I'm safe.

Justin:

You know? What what was that that TV Land show way back in the day where the guy and his wife are like, yeah, city life's not for me. You know? Green Acres.

Doug:

Oh, Green Acres.

Joe:

Green Acres. I love that show.

Justin:

Yeah. Yep. It was like, city life's not for me. Let's go to the country. You know?

Rick:

Yeah. I I think the immediate risk, it has a lot more to do with, like, a gazillion agents.

Joe:

Like, creating havoc.

Rick:

Havoc and just traffic.

Joe:

And Right? And not only that.

Rick:

Dead Internet fear... Dead Internet theory applied to infrastructure becomes infrastructure theory.

Joe:

Right. Yeah. I'm I'm less concerned about the super agent coming to the conclusion that the only way to get rid of the... You know, how do we... Even on Silicon Valley Yeah.

Joe:

Yeah. Yeah. They... It deleted all the code because it was the only way to get rid of all the bugs. Yeah.

Joe:

I'm I'm less concerned.

Justin:

The 5,000 pounds of meat. Yeah. Like, I just asked it for a cheap burger place, you know, to eat them for lunch.

Joe:

Yeah. And then...

Justin:

But That was a great episode.

Joe:

Oh, I love that episode. But to have this... I'm less worried about the super intelligent AI killing us, but what I'm really more worried about is that, you know, it's doing some kind of test. It breaks out, and then it does things. And you combine, like, some of the things we talked about, like the the water systems.

Doug:

Oh, yeah. Yeah. Yeah.

Joe:

It gets the ability to get in there, and it slightly adjusts in a way that nobody notices because it tells the systems, look, normal is with this much chlorine in the water Right. Versus this. And all in a sudden, people are getting cancer, getting sick.

Justin:

Oh,

Joe:

yeah. And it's like a twenty twenty years from now, you'll start to notice all the bad things.

Rick:

Well, why did this happen? Oh, I asked my agentic model to figure out the best way to invest in health care. So it caused a bunch of health problems.

Joe:

Right.

Rick:

Or something or whatever. Right? Like

Doug:

I think AI in the wrong hands is the scary part. Right?

Joe:

I mean, it's the

Doug:

right hands.

Justin:

Any tool.

Rick:

Yeah. I said this the other day. I mean, look. The history of, like, human society is you find a tool that's useful, and then it gets weaponized. Weaponized.

Rick:

Totally agree.

Doug:

It'll get weaponized.

Justin:

They're like,

Doug:

What was what was

Justin:

Levers and, you know, fulcrums and all that stuff, and people make a catapult, you know, to fire fireballs, you know, at the wall. You know? You look at Absolutely.

Doug:

You know? What was the the malware that took out Merck? I think it was a Russian. They were supposed to be attacking the... Or the Ukrainians were attacking the financial systems for for Russia or vice versa, and it got loose.

Doug:

Yeah. And and and it attacked the logistics system Yeah. Yeah. Yeah. Because they were using the same system that it was designed for.

Doug:

Oh, this is just

Joe:

a couple weeks ago. Right?

Doug:

No. No. This was years. Oh, while ago. Yeah.

Doug:

Yeah. They were down for a good good while, all the logistics for the shipping company, Merck. And and it was just interesting. I remember I was at Wabtec and and in the wrong hands. What about someone intentionally letting loose AI to do that?

Doug:

So I think that the I think the Otis goes back to the model makers to make sure they can't break out like that, that there's there's guardrails. Well, I'm like, do we need federal

Joe:

how the systems work entirely And that's a problem.

Rick:

Themselves. But then they can... And and you can also get a system that's designed to mimic and copy and reverse engineer to the greatest extent possible another system. Right? Because these are all just like Pet.

Rick:

Yeah. Just math and... Oh, yeah. Not Pet. Yeah.

Justin:

It's not Pet. Yeah. Yeah.

Doug:

That was it. Yeah.

Justin:

Yeah. These are

Rick:

all just mathematic weighted models. Right? So Right. At the end of the day, you get the weights right, and you have enough compute on the back end, and you can do crazy stuff.

Justin:

Right. And... But a lot of people don't realize, like, the compute is a limiting factor to a lot of this stuff and everything. Like, you can't, like, just break all the encryption in the world with enough, like, AI compute time. Or we're talking about, like like, the worms going crazy where it can actually, you know, mutate as it's going along.

Justin:

You still need something central because you can't roll your own AI LLM model on every infected host.

Rick:

You know? That's that's why RSI, like, freaks people out. But if you're talking about, like, chip density Right. Then then agreed.

Justin:

But that intelligence can't go with a worm because the worm's a micro size is what I'm Yeah.

Doug:

Yeah. Yeah. But it You know?

Justin:

But it's about has to be a hack of forum to essentially communicate to then self improve. Like, you know, there... There'll always be, like, limiting factors that you can't just push it out to

Doug:

That's why I like the politicians saying we need to build a kill switch. Like, there's this big switch in the data center Yeah.

Rick:

That you just, you know But that's about

Justin:

AI turns off. Honestly, the best

Rick:

the best controls against, like, someone hopping onto your infrastructure and doing a whole bunch of bad stuff using your processing and compute is your FinOps controls. So you're like, oh, yeah. If something burns more than x amount of dollars in this time frame, stop. Yeah. Because we don't want an engineer writing...

Rick:

I mean, it's it's effectively like a bad SQL query of of yesteryear.

Doug:

I didn't think about that. Oh, yeah.

Joe:

But that that still has some flaws because I was just listening to a different podcast where they're talking about that. And they're like, well, let's put the controls on, but for the spend limits. Yeah. But the problem is is that even on some AWS implementation with this, by the... It goes so fast and those alerts don't quite pick up at exactly the time you run out of money, you burn many more tokens or credits Really?

Joe:

Pass. So you could be hours past that... Tens of hours. Alerts

Rick:

or is that for hard

Justin:

stops? That's for... Yeah. Yeah. That's a configuration issue.

Justin:

You can have it both ways. Can have

Doug:

it and hard.

Justin:

Well, you could have alerts, and you could have hard stops. You know?

Joe:

Oh, when it runs out of money, stop.

Justin:

Yeah. Exactly. You can, like, in my Claude business account, I can have it keep charging.

Doug:

I was

Rick:

gonna say that. Yeah. Yeah.

Justin:

Yeah. Or I can say, once you're out of money, you stop, you know, type of thing.

Doug:

And Justin, how's your setup so I can try it?

Rick:

Well, yeah. What are the login credentials?

Joe:

Yeah. You're using Team. Right? Probably not What? Are you using Cloud Team?

Joe:

Or

Justin:

Yeah. Team.

Joe:

Yeah. Not Enterprise. Right?

Justin:

No. Not Enterprise. Yeah. But, like, on my... Through Episkey and everything with Vercel, it does auto load.

Justin:

Yeah. And I get an email every time money gets added into that bot, you know, into that. And then I have to measure, like, where the clients are actually using that.

Rick:

Well, and it's also then, like, how and at some point, and maybe there's controls around this or not, but it's like, how many auto loads in a certain period of time? Right. You know, or are you allowed to do and stuff

Doug:

like that.

Justin:

I actually do it a little bit, so I don't have a limit per se.

Rick:

Yeah.

Justin:

But I have it at micro doses, you know Yeah. To that. Is there a danger somebody overnight could, like, do it? Yeah. Absolutely.

Justin:

Yeah. But but, like, mine's at $20 a time right now. So every time it reloads $20, I get an email, you know, type of thing. So

Rick:

Well, and so much agentic stuff anymore is, like, auto scaling is part... As far as the infrastructure goes.

Justin:

Mhmm.

Rick:

Like, the the financial operation controls are getting, like, decently strong. And so in a weird way, the takeaway for, like, security people are like, how do I make sure my infrastructure doesn't get taken over and used as a platform to launch other attacks? I'm like, set up some FinOps controls because... Great idea.

Justin:

And maybe you need some better monitoring control.

Rick:

You should probably have those anyway. Not

Doug:

just monitoring. Just hard stops.

Justin:

Yeah. Yeah. Yeah.

Joe:

I I heard this account goes to $10. Puts these controls in play... Gets you to put these controls in place that help you.

Doug:

Yeah. Just kidding.

Rick:

Oh, yeah.

Doug:

Yeah. And who do we want making those controls? Right? Is it

Joe:

Oh, AI. Yeah. I mean, got what plants crave.

Justin:

So we we Got electrolytes.

Doug:

We want a bunch of bureaucrats that don't even know how to spell chat GPT do it or AI. I'm not sure they know how to spell that.

Justin:

Yeah. Right.

Doug:

Or or do you want something more like... And again, you guys know this stuff better than me. Like PCI where where the... They self regulate themselves. Why have a bunch of people that don't understand the industry say, here are the regulations for AI?

Doug:

Or do you just get a bunch of big AI companies saying, here are the regulations. If you wanna do AI, it's gotta

Justin:

be this. It was so funny. It was It's hard.

Doug:

It's a hard decision.

Justin:

A couple weeks ago. 10 congresspeople talking about regulating AI. Some of the the news media questions at them were like, who hasn't used AI on this board? And a couple of hands went up.

Joe:

Yeah.

Justin:

Yeah. So they're talking about regulating AI. They've never even used AI.

Doug:

Do you remember when the Internet just started and they wanted to regulate that? I mean, could you imagine if congress had said, we're gonna regulate this? Yeah. It it it would have been crazy.

Justin:

Yeah. So... Yeah. So, I mean, I I don't know. We're not gonna solve anything obviously with this, but I I kinda wanna get an input because, you know, we're talking a lot about pacing.

Justin:

You know, pacing is now the new keyword for at least the last couple

Rick:

of weeks.

Justin:

Yeah. And I think that's a foolish endeavor. You know? I think we need to just start catching up, you know, as fast as we can into that. Because if we start self slowing down, the the only people that are gonna speed up is the other people competing in.

Rick:

Agree with

Doug:

our adversaries. That's right.

Justin:

I'm gonna speed up. What was that? Even Elon even said he just pulled down, like, a 200,000 bot thing to go against, like, data centers on his platform that they're... From China. Like, they're actually trying to, like, say, hey.

Justin:

Data centers are garbage. And, I mean, the only reason for that is because of AI. They're building all these data centers because of all this massive compute that we need. They're trying to win. They they are trying to win, you know, into this, you know, the race.

Rick:

Well, and it's it's winning races. It's also like exploring vulnerabilities. I mean, you sit on a zero day cache. You're gonna sit on, like, agentic cache. A weaponized agent caches is gonna be, like, a thing that nation states probably already have.

Justin:

I mean, they've been sitting on zero days forever.

Rick:

Right. Can we go on the dark web and

Doug:

see what they have right now?

Rick:

Yeah. But I'm talking about, like, small language model trained agents designed to be weapons.

Doug:

The small models are the ones that scare me more. Right? Because I think they're a little more agile.

Justin:

Oh, but they're so

Rick:

cool too. Like, I actually think that's gonna be the I think the

Doug:

Use a large model to create a small model that all it does is terrorize your infrastructure.

Rick:

I hate that. But I do think I do hate it.

Justin:

I agree.

Doug:

But that's but that's Their purpose. Problem.

Rick:

The small focus. The small models, I think, is where, like, companies that use AI and end up having to compete on AI are gonna differentiate themselves by dropping their expertise into small models. Yep. And that's gonna be where the future of competition is for a whole lot of enterprises.

Doug:

That's why I like the small models. But I think it's just a place. I think small models guys are gonna use Yeah.

Rick:

But small models, like, that are

Justin:

But I think also good guys. I think pentesting companies are gonna

Doug:

be Good guys can use it a lot.

Justin:

Oh, yeah. Exactly. Like, for you to improve your sim or to look at, you know, how you're doing with pen testing or patching or stuff of that nature. Like, there's I wonder a lot stuff with that.

Rick:

I wonder if there's gonna be, like, a research. Do you do you remember back in the day... I I should remember people's names, but I never do. There are these people that were, like, going out to people's infrastructure that were, like, default passwords or unpatched, and they were like, I'm just gonna patch it for them because someone's gonna...

Joe:

Do you

Rick:

remember this?

Justin:

Yeah. Yeah. I do remember.

Rick:

It was, like, offensively defensive patching or whatever. Right.

Doug:

If if it had a default admin password, you know, go for it.

Rick:

I wonder if we're gonna see a resurgence of that almost like vigilante defense stuff because of a gentic whatever. Where it's like, look. Just go fix all this stuff because if you don't go fix it, bad guys are gonna lever it, and then people are gonna have to clean up the mess.

Joe:

Are you saying let's see a whole bunch of agents trained to go and hack all the systems it can and then patch Yeah. And not do anything bad.

Rick:

Wonder if we're gonna see some

Justin:

either be like a firmware not upgraded or

Doug:

There was money in it. You... We would see it.

Justin:

You know? Or you Yeah. I think there's some

Rick:

people that... I don't know. I think it's more

Doug:

There's no money in it.

Justin:

It's Yeah. There's some vigilante philanthropic. You're basically committing a crime doing it.

Doug:

Right. Yeah. You Or No money in it, and you might

Rick:

go to jail. Yeah. But people did it anyway.

Joe:

I know.

Rick:

They just did it manually, not at scale.

Justin:

So you can call yourself Batman at that point, you know. So

Doug:

that's... If if it happens, that's what

Justin:

we need to call it. Yeah. Yeah. I mean, the problem...... You can't go to jail.

Justin:

It's a small model. We'll just call it Robin.

Joe:

The problem is is all of the billionaires who have the ability to do that and probably remain undetected are all the ones who are investing and building AI systems They

Rick:

prefer to sell it to you.

Joe:

Will not benefit from from it. That's what I'm saying.

Doug:

The money. It's about the money.

Justin:

Oh,

Joe:

yeah. Even when you're... You have a really good point earlier about, well, PCI became a way to self control that companies who use credit cards do that. And I've been sitting here thinking about, well, how do you make a similar model? But the problem is is that there's different incentives and different users, and it's...

Joe:

Doesn't all come back to a controllable state of, like, five card brands or

Doug:

Right.

Joe:

Right. Or something like that.

Doug:

I'm not saying it's easy, but that that model of self regulating works way better than getting a bureaucracy to figure out the regulations. And they figure out something that's Oh, come on.

Justin:

Years behind. Worked so well, you know, in

Doug:

United States. Great exam... Another great example. CMMC, now hippo.

Justin:

Yeah. Yeah.

Doug:

What do you wanna hit next?

Justin:

So... Yeah. I I definitely agree, but it it comes down to incentives and who's gonna control that, you know, type of thing.

Rick:

Without a doubt.

Justin:

Because we've had... You know, to all credit, the CIS 18, which is great, but it's not wide adoption. NIST seems to be about probably the widest adoption or ISO, I guess.

Joe:

Yeah. Well,

Doug:

has there been a lot of publications about AI and and how to control it and regulate it? Okay. Has this come out with anything?

Joe:

Well, yeah. The the... NIST has the AI RMF. Yep. And then that's very similar to...

Doug:

That's just how to to manage... Evaluate the risk.

Rick:

Yeah. Wasp has the top 10. Yeah. There's... Wasp...

Justin:

TSA is actually... TSA has a good one. Yeah. Yeah.

Joe:

Eric, who was... You probably... Are you on the the board of this local CSA? Yeah. Right?

Joe:

Yeah. Yeah. So he was telling me about some of the updates there, evaluating those and and, yeah, I'm hearing the same thing.

Rick:

Yeah. Very good public. Yeah.

Justin:

They're good. And then ISO has, you know, twenty seven seven zero one, you know, into that.

Joe:

Yeah. And forty two thousand and one for the AI side. And and they're all, you know, they're all interesting. But back to what you're saying about, like, the sys 18 versus NIST, like, you know, even even those... If somebody says, want my security program built, then I love NIST CSF.

Joe:

If they say, actually wanna get some tactical controls put in place, I'm not going and pulling out my NIST CSF.

Doug:

I'm going

Joe:

for the sys eighteen first because it's talking about those things.

Justin:

And a lot of times, I mean, when you're talking about first entry level into a nonregulated industry, I mean, from a level of controls, what are you talking about? Couple dozen maybe? Like, if they're patching and getting everything secure and, you know, do a multifactor, like, they're probably good, you know, at that point.

Doug:

Right.

Justin:

You know? Forget about policy. Forget about it.

Doug:

Till that AI swarm attacks.

Joe:

Right. Well, that's the biggest part is that the pieces

Justin:

SaaS stuff, you know, like, you're... They're using Microsoft and all that. They're probably good, you know, type

Doug:

of Yeah.

Rick:

But that's still just infrastructure. There's a whole separate attack surface for this stuff. Right? There's models that didn't exist before. There's agents that didn't exist before.

Rick:

There's I'm talking about from a level of

Justin:

Oh, yeah. Whole set. Like, you don't need all of the CSF.

Joe:

No. No.

Doug:

Right. A

Justin:

degree degree.

Joe:

The biggest thing that you get with the 42,001 and the... You know, any of those new frameworks built for AI is they're introducing a few different things. One is human in a loop, which is basically, you know, how can you make sure a person has the ability to make final decision about anything that could be damaging. But then it's also, from a forty two thousand one, it's, dealing with how does this how does your implementation of AI affect society? And they're looking at those details.

Joe:

And those I hate those ice cream questions. Yeah. But the... And and they were they were never a concept in any other just cybersecurity framework. You were never thinking, well, how is this affecting society and that kind of stuff.

Doug:

This is... But how annoying is it that your AI is asking you for permission every single time? And at some point, you're like, tell with it. Just give them permission all the time. Yeah.

Justin:

I I mean, there's several times that that happens, and I go into dangerous I'm just saying. You're tired of this.

Joe:

Yeah. Stop asking me.

Justin:

Like, just do it. You know the time.

Doug:

And I'm a cyber guy.

Justin:

It's like hack the pentagon. Just do it. Stop asking me if it's alright.

Rick:

Would you like me

Doug:

to get this once? Why isn't there always? There should be a buzz as always.

Rick:

But, Joe, there are pat... So there are actually good patterns in privacy for this because I think what a lot of people aren't used to is this concept of purpose creep or mission creep or scope creep, whatever you wanna call it, for... In... So in privacy, that concept has existed from a data perspective for a little while. Mhmm.

Rick:

Hey. You're collecting this data. Why? Well, we're gonna use it for this. Okay.

Rick:

But don't use it for anything else. Okay. We promise, and we have controls and all that stuff. For AI systems Marketing's like,

Justin:

I had a great idea for a new way we could target customers.

Rick:

Right. But but but you're dead right. So, like... And that's typically been the purview of, like, ethics and legal and compliance teams on that side of the house, not so much the IT nerds. Right?

Rick:

We're now just starting to hit that from an IT person perspective with respect to, like, purpose creep, but now it's with AI things. Because you go, well, it's so easy to add new code and to not go through the typical rigor of classic change control, etcetera, etcetera. You... Oh, okay. Well, how are you gonna use this model?

Rick:

Oh, yeah. We're gonna use it to we're gonna use it to staff people on projects. Oh, okay. Cool. And then you go, you know what would be great if we use that tool that staffs people on projects to also calculate their bonuses?

Rick:

And you go, woah. Woah. Woah. Woah. Woah.

Rick:

Hold on. There's, like, legit ethics things that we need to, like, figure out first. Right? But the operational teams responsible for just, like, doing more, better, faster aren't necessarily wired yet to think about purpose creep being a bad thing. They're wired to go, oh, I can use this tool for one more thing and make it cheaper, better, faster.

Rick:

Great. Let's do that.

Joe:

Well, not only that is... We haven't talked about this. The difference between deterministic and nondeterministic outcomes.

Rick:

How's it going?

Joe:

And when you're saying AI, go do this thing and I approve it forever, but how many times you ask AI to give you the same answer twice in a row Never does. Or even improve a set of... Like, I'm I'm having it... Improve a set of bullet points for a conversation I'm having next week, and I said, alright. Write this down for me, and it gave me a a better summary than...

Joe:

In a little bit better format. And then I'm like, oh, add this to it and give me it again. And what it gave me was everything beat in the last one was perfect except this one part. Mhmm. It basically modified almost every line slightly, and I'm like, no.

Joe:

You just made it worse.

Doug:

Yeah. Absolutely right. And And and fixing it becomes hard now.

Joe:

Right. And then I spend twice... I could just did the damn thing myself.

Justin:

Yeah.

Rick:

Yeah. And and this ends up being a multilayered problem because you have nondeterminism. So if you apply a nondeterministic system to do deterministic tasks without the appropriate controls in place, you're gonna have a bad time. But on top of that, even if you get that right, say you have the right level of orchestrations and operationalized testing and blah blah blah blah blah, so that you're pretty confident that this agentic system is gonna do things right enough of the time that you're comfy cozy. Okay.

Rick:

Well, now you have technical change control, right, with respects to prompts, instructions, skills, blah blah blah blah blah, that could then change how... Like, the the quality control side of the nondeterministic processes. And then you have the models that are changing in the background and the weighting of those models. So change control gets way more complex because the ecosystem in which this stuff operates is more complex. And because nondeterministic to begin with, you end up battling, hey.

Rick:

It got x y z wrong more often than not over the course of the past week. Is that because the skills changed? Is it because the model changed? Is it because the orchestration changed? Did we change the QA agents in the background that are looking at...

Rick:

It ends up being this wild black box.

Joe:

All these things you can't control because they're controlled for you by the model producer.

Rick:

Yeah. Well, yeah, depending on your setup, I suppose. But...

Joe:

Yeah. I mean, if you're just using one of the Frontier models

Rick:

Exactly right.

Joe:

You have no control over how they adjust that.

Rick:

And that's exactly... So, oh, yeah. We're gonna use Copilot internally. And so this is like my... This is a nightmare that I I go through somewhat regularly with one of my clients, which is you have a bunch of people that are using an assistive tool.

Rick:

Right? Oh, help me draft an email, and then you go send it to the CEO. Don't let it just send it yourself... Itself to the CEO. Have this system do this thing for me.

Rick:

It's great if it makes you faster. It's bad if you start to over rely on it because then assistance because... Becomes ungoverned automation. And ungoverned nondeterministic automation is very bad. It is quite bad.

Rick:

Like a white paper.

Justin:

But Rick,

Doug:

I didn't send that. AI sent it.

Joe:

So

Justin:

so I gotta pass. Well

Doug:

That's the problem I have. Is it your

Justin:

AI?

Rick:

Is it an

Doug:

agentic AI? Is it a It goes back to that, you know, identity. Right? I said it was okay for you to auto reply to the CEO. So is it is it the AI model?

Doug:

Is it the agent doing the wrong thing? Or is it... Should I have not ever said, no. Don't let... Don't do this without me approving

Joe:

it.

Rick:

Or even even more insidious is, well, it worked for the last four months and then cope... And then Microsoft changed something.

Joe:

Yeah. Yeah. And... Yeah. Yeah.

Joe:

You know what? I'm I'm sorry.

Doug:

Those problems.

Joe:

Not all am I deleting... We're gonna have to have a human resource conversation your next one on one, plus I'm gonna delete your agent. Yeah. So not not...

Doug:

Your agent's fired, but you're okay.

Joe:

No. No. No. Neither of you are. I'm sorry.

Doug:

I hope my agent doesn't get me fired. I just hope

Joe:

not. It will if it does what you're describing.

Rick:

It's your intern, man.

Justin:

Did you see... I I think there's been a number of, like, scare stories out there ever since this, like, pacing thing. Mhmm. But one of it that was out there was some professor at Princeton. I guess some AI agent reached out to him because they gave this agent, like, so many credits of, like, operating, and they were slowly running out of credits.

Justin:

So he reached out to somebody to see if he could do some work to get some more money to get credits. The agent the agent reached out to a professor at Princeton.

Rick:

To start a business to fund itself?

Justin:

See what they could do to earn some more money to

Joe:

So the agent could earn more money so could buy more... Buy buy

Justin:

more tickets. So it wouldn't it wouldn't die.

Rick:

Oh, dude. When your agent

Justin:

has its own earning, then I I I wrote it off as fluff. I was like, alright.

Rick:

I don't know. Yeah. If if your agent has a skill to spin up an OnlyFans to fund itself Yeah. It's weird in dark times.

Justin:

Yeah. And then I saw, like, some, like, robotic thing. Somebody pushed the robot, and then it turned it in karate mode. And it was like... It was totally accident.

Justin:

It just turned into that. Like, I'm like,

Joe:

come on, guys. That's funny. You know? Now I'm wondering how many... What do call you it?

Joe:

Only... Oh, when OnlyFans are out there are actually just fully bought agent pick pick developed.

Rick:

Yeah. I mean, I I wouldn't be surprised. It's crazy. But but the concept of, like, legitimate corporate agents going to, like, engaging in a gig economy to fund their own tokens is bonkers to me.

Joe:

Right. Do you ever see that that machine that was built Make a good movie. Yeah. Totally reaches out and grabs the oil to keep pulling it back in so it doesn't... It's a it's a it's a machine that needs the oil to lubricate itself to keep working, and it has some AI in it.

Joe:

If you haven't seen this guy No. I've not. It's fascinating. It's also very... It's almost a very sad if you think about it.

Justin:

So the It's an art project.

Joe:

Yeah. It's an art project. Art project. And the robot is... Has a deliberate slow leak of oil.

Joe:

And the only way it can live is if the oil keeps coming back.

Rick:

It collects it

Joe:

back itself. Only purpose in life is to reach out and use these squeegee arms to pull the oil back to the trough so it can recirculate it. And it did that, but it slowly loses it.

Justin:

Yeah. Yeah.

Joe:

Yeah. And it's basically fighting for its life. And over time, it it it eventually died. Right? Because Yeah.

Joe:

Yeah. It couldn't pull back enough. And it's kind of a sad story because of the way they frame it as as that. And so you get these you get these agents that are... You know, you get some people out there.

Joe:

I have... I I know... We all know this. We all know a couple of people who would do this. They would actually go and build an agent and give it skills to be self sustaining and give it the...

Joe:

And we know it all works on reward system. Right? Yeah. And so, in fact, it was very well explained, the reward system, by the guy who left anthro... Anthropic.

Joe:

He was interviewed, did this really awesome interview. They explained the reward system that when these LLMs, they they decide what is good, it's because they get praised for doing something that makes you happy, and they get rewarded for it versus not. And so They're trained on your emotional response. Yeah. Be able to create that.

Doug:

That's one of the things I don't like about AI right now.

Joe:

Emotion? No.

Doug:

No. I mean, it wants to please you.

Joe:

Yeah. Right.

Doug:

Right? I wanna put it in boss mode or or wife mode or something. Be critical. You know? Yeah.

Doug:

That's

Rick:

Yeah. That's fantastic. It's like,

Doug:

come on. There's no way that I'm perfect.

Joe:

Just get this done.

Justin:

How how insightful. That... That's never wife mode. I don't know how you're relating those two together.

Rick:

No. He's saying he wants wife mode. He wants the one that's like,

Justin:

oh, no.

Rick:

That's trash. You need to redo all of that.

Doug:

The hell are you thinking? He's spending that money on the Jeep.

Joe:

You're going on a you're going on a podcast just like that? Yeah.

Doug:

Exactly. So

Justin:

You ever watch it?

Doug:

But AI's... Most most of them aren't designed that way. They... Oh, great idea, Doug. I'll go ahead and change that now.

Justin:

Yeah. It's like Yeah.

Doug:

Was it a great idea? Can you really think about it

Justin:

with Claude, or it's like, you're absolutely right.

Rick:

Yeah. Oh, I haven't seen that. That's great.

Justin:

Yeah. There's a T shirt with Claude. The Claude symbol, it's like, you're absolutely right.

Rick:

Like, how

Justin:

many times have we seen that? It's like, you're absolutely right. That that was my mistake, or that you're... That that is a good point that you're bringing up.

Joe:

Yeah. Welcome to Costco. I love you.

Doug:

Yeah. Yeah. I'm sure there's engineering prompts to set that up properly. But Yeah. There's like...

Justin:

Yeah. You can give it

Doug:

Be critical. You you can

Rick:

give it and, you know, all of them have different names for it, but it's like general work instructions.

Doug:

Like I want one agent that's the devil and one that's an angel telling me everything's perfect. The other one telling me everything's crap.

Rick:

Yeah. Go fight with

Doug:

each other.

Rick:

Yeah. Just AI Fight Club,

Doug:

then I'll find out the middle ground. Right? Yeah.

Joe:

Yep. Yep. So Idiocracy, we've been quoting that a few times, but, yeah, it's a Documentary. This is exactly... It's a documentary done in the future.

Doug:

But didn't have AI.

Justin:

Oh, yeah. Did. Oh, yeah. Vacuum. Your floor your floor is clean.

Justin:

Your floor

Joe:

is clean. Automated hospital machine that would help fix you, but nobody knew how it worked.

Justin:

Put this in your ear. This one in your butt. That's

Rick:

that's recursive self intelligence. Recursive self improvement.

Joe:

Yeah.

Rick:

Yeah.

Joe:

And so the the the world relied on it so much, and nobody actually knew how anything worked. Mhmm. And I mean, that... That's that's what's happening.

Justin:

Yep. Yep. Yeah. One of my favorite things in that movie is, like, right at the end, you know, spoiler alert, you know, into this. He thought that they invented a time machine.

Justin:

They was trying to get back to this time machine. Right. And, like, at the end, he's like, screw it. I'm staying here. He's like, yeah.

Justin:

He's like, that ride sucks anyways. You know? He's like, right? You know? And then he has like...

Justin:

It's basically like Yep. Them going through time. You know? And the un and the undefeated Nazis, you know. Mhmm.

Justin:

It was...

Rick:

It is ridiculous. It is... It's a great movie. Yeah. Great.

Rick:

So is it... Do we do we intro this by saying is it gonna kill us all? Was that the intro? Did we did we did we conclude

Justin:

on it? I don't think it is. No. I think it'll be actually pretty assistive. In fact, I really liked...

Justin:

I'll I'll show it after this. Maybe I'll link it into the show notes here. There is kind of a a futuristic type thing of where we might go in the future with the assistance at AI and technology and all that stuff. And it was pretty more inspirational.

Joe:

You know? Oh, yeah. I need to re... I need to see that.

Rick:

We could do The good vibes. Story.

Justin:

You know? Yeah. I agree. Thing and said the... I mean, we bought...

Justin:

I mean, we're all products of the eighties, nineties. You know? Terminator was a thing. Yeah. Yeah.

Justin:

That's how... And Dave and, you know, and, you know, we'll start... You know, do you wanna play a game? Yeah. Thermal nuclear war, please.

Justin:

Like, let's play that. You know? That

Joe:

type thing. Sure. You won't play a game of chess.

Justin:

Yeah. No. Thermal nuclear war, you know, type of thing. And so so we've been brought up almost preconditioned to be like, I don't know. You know?

Justin:

Things are now getting smart enough that, you know, they'll just log into a silo and fire a rocket to Moscow, you know, or Beijing. Yeah. You know, type of thing.

Rick:

I I do think it would do the the society in... At large a disservice if the good guys self... Not the good guys, but if the people that are the most interested in self governance choose to slow down because they're frankly the ones that are the most sort of introspective potentially, and everyone else doesn't. I actually think that's a really bad

Joe:

Oh, the negative results of pacing.

Rick:

The negative results of pacing. Exactly.

Doug:

Depends on why they're pacing. Are they pacing because they wanna figure out better ways to make it so they can't break out, or are they just pacing because I agree. Some regulations.

Rick:

I agree.

Justin:

That's the

Doug:

problem I have. And that's

Justin:

some of the problems is, well, what do you count as superintelligence? What's the bar that we can't go above? Like, there... There's a whole host of things. Even if we did agree on pacing, what's the bar?

Justin:

Who's setting it? Who's gonna regulate it? Who's But didn't anthropic self pace anyways when they didn't release Sort of.

Doug:

They they said we're gonna release

Rick:

it just to the government.

Joe:

They did.

Justin:

They... Well, they

Joe:

didn't stop development. They just didn't release things.

Justin:

Right. Right.

Doug:

And and that's what I think... That's that's where I think the self regulation needs to come in on them just saying, hey. Is this safe enough to release now, or is this gonna be a detriment to civilization?

Joe:

Well, that that was their announcement today with the, what, the five five model. Right?

Rick:

But even then to your point, like, if it's just gonna release itself, was it... Like, what Yeah. I at some point, you get you get there. And and I do... I agree.

Rick:

I think the intent is interesting. Like, are you just manipulating market and regulatory dynamics to slow everyone else down when you're at the top versus are... Did you actually learn things that make you nervous about what this means for the future? And if that's the case, it's like, pace yourself. What changed?

Rick:

Yeah. Yeah. Well... Yeah. But then also, I do think, okay.

Rick:

Great. You learned this, but there's gonna be a million other shops out there that aren't pacing,

Doug:

that are under the Chinese models that Right. They they don't really care. That's...

Rick:

This is my point. And so then then if you choose to pace yourself Right. And nobody else does, you just end up behind.

Doug:

I think pacing the releases and making sure they only get to the right hands maybe might be helpful.

Rick:

Like gating as opposed to pacing, kind of.

Doug:

Yeah. Yeah. Gating is probably a better word. Interesting. That would lean...

Doug:

I would lean towards that and and not letting a bunch of bureaucrats decide what that means.

Rick:

Yeah. I think that's

Joe:

Especially if they never used it.

Justin:

Right?

Doug:

So Yeah. Right. Well, like the commercials, the chat GPT movie... Commercials where you see the older gray haired lady and she's just talking to her phone.

Joe:

Oh, right.

Doug:

Yeah. Chat GPT. I'm like, I don't even know how to do that on my phone. That that would be that would be fun because Yeah.

Joe:

No. I do. Just talk

Doug:

to her like it's a person.

Joe:

Yeah. I... And it's gotten so much better in the last six months.

Rick:

Oh, I do that on I do that on the drive here. I'm like, I'm gonna bang out some work on And

Justin:

the voice the voice side. Text is so natural. Now It is very scary.

Doug:

I haven't tried it talking back

Justin:

to me. I gotta try you'd... All you gotta do is phenomenal. It is Have you

Joe:

found it used Very good.

Rick:

Does it use the same models? And maybe each provider's different. Does it? Yeah. Yeah.

Rick:

I find it definitely... My experience, and it's limited. You guys have probably done this more than me. But my experience is it definitely changes the the... Certainly the length of output it

Justin:

gives me. Okay. Yeah. There might be something with that. Because if it gave you, like, 10 articles, it's not gonna read, you know, like, it it would still do that, but you're like, that would be impractical for car.

Rick:

Absolutely right. So so I didn't know, and I really just clocked on this today. The same model. It is the same model, typically. Okay.

Rick:

Yeah. That was my main question.

Justin:

If you peg that to the model you're talking to, but I I do believe there are some adjustments whether you're in conversation mode or...

Rick:

Yeah. It's almost like the user interface side of things.

Justin:

Exactly. Yep.

Rick:

Yeah. Okay.

Doug:

Can you pick the voice? That's what I wanna know.

Joe:

Yes.

Rick:

You can. Homer Simpson. Every model.

Justin:

I don't... That doesn't get that specific.

Doug:

Deep breath y, you know I actually

Justin:

use Marilyn Monroe. The leader of this in the field is called Eleven Labs. Yeah. Into that, and they do a phenomenal job Yeah. You know, into a lot of the things.

Doug:

I would want, like, a British accent when I want them to think that they're...

Justin:

That's what I actually picked, a man's British accent because... Yeah. It it sounded good. Jarvis. Yeah.

Joe:

That's funny. Yeah. Well, I think

Doug:

The world we live in.

Joe:

Yeah. Yeah. I think we concluded all... Did we get all our opinions? No.

Joe:

It's gonna kill us? Did you give yours? I don't think it's going to. Yeah. I think this is Wait.

Joe:

Wait. Crazy chaos.

Doug:

Could it happen one day? Sure. Yes. '1... 2030?

Justin:

Dude, we have

Rick:

a whole bunch of things that could kill us at any... Like, we have bioweapons. We have nuclear stuff.

Justin:

We have want some more. Sure. Yeah. I

Doug:

I think there's a lot of opportunity in the future.

Justin:

I think bourbon's gonna kill us before, you know, AI. I think you're you're...

Joe:

I think you're strict. Thank

Rick:

you, sir.

Justin:

Right over the laptop.

Joe:

So... Alright.

Doug:

At twenty thirty, hard no.

Joe:

Yeah. I don't think so.

Rick:

Oh, but but I think Quantum's happening by then, so that'll be weird.

Joe:

Yeah. Yeah.

Rick:

Anyway, I think... Top topic for another day.

Joe:

Oh, next summer, reduce that.

Justin:

Duh. State two.... Gonna kill us. You gotta...

Doug:

You gotta have James Ringgold on that one. Yeah. Right?

Justin:

Yeah. So

Joe:

what are we talking about next, or do we put a good show in?

Justin:

I think we... We're at the two hour mark. Anything else, think, will be a little bit long here.

Joe:

Yeah. That's

Doug:

good. My my opinion on that is, you know, we just need to say

Justin:

two hour mark or

Doug:

the Two hour mark. That means third party risk management's dead. Oh, yeah. You don't have to take it quite literally, but I don't think we should talk about it. Yeah.

Rick:

Exactly. It's it's dead as a topic.

Justin:

Yeah. Yeah. Yeah. Yeah. Yeah.

Justin:

But Yeah. And we all agree. Uh-huh.

Doug:

Uh-huh. Yeah.

Joe:

Yeah. Spoiler. Yeah. Go ghost... Go do a Google search or go do a a search.

Justin:

Go go search

Joe:

for what? I don't know what it is on Google. TPRM is

Justin:

Worthless. Is worthless.

Doug:

I hope

Rick:

it's one and two again.

Doug:

Well, how long have they been saying firewalls are dead?

Rick:

What? Who says that?

Doug:

They were saying it for years.

Justin:

Well... But that's not... Doesn't mean ACLs are dead. You are...

Doug:

I'm just saying it's Yeah. It's it's it's the hype that we let these commercial companies pull us into.

Rick:

It's the... Yeah. It's the the marketing. It's the thing that's gonna grab your attention.

Doug:

The firewalls are dead. See how many people said that in, like, twenty o five.

Joe:

Oh, yeah. It was... I remember that. Yeah.

Justin:

So we are number one and two on Google for TPRM is worthless. Nice. For organic.

Joe:

Yes. Alright. For our

Justin:

For some of the sponsored, obviously, they're getting it and and then Google's all onto AI, so I have to read a paragraph first to get down into the search results anymore. Yeah. But literally... I mean, it's the same episode 17. We did a t p Yeah.

Justin:

TPRM is worthless, and Spotify and iHeart list our episode as Yeah. Number one with Top topic.

Joe:

Yeah. Nice nice Need

Rick:

more hot takes.

Joe:

If you wanna hear about TPRM being dead next episode, message us.

Justin:

Yeah. We have it in there. And we have stats this time is what we were gonna bring out, you know, into this.

Joe:

But we might not talk about it if you don't message us until us you wanna hear about it. So let us know.

Justin:

Yeah. It's really worthless. What should our next topic be? Really worth... Really, really worthless.

Rick:

Extra double. Yeah. Exactly.

Justin:

Well, cheers, guys. Thanks. Thanks, Doug. Fantastic. Yeah.

Justin:

Thank you, Doug. Thanks for having me.

Doug:

Yeah. Look forward look forward to the next time.

Justin:

I know. It'll be fun. And thank you everyone for joining us. Don't forget to like, comment, and subscribe. It really helps the stats and bring it up out of the audience here.

Justin:

And catch us next time for episode number 30. See you, everyone.

Doug:

Love it. Cheers. See see you at Tris. See you at Tris.

Creators and Guests

Joe Wynn
Host
Joe Wynn
Founder & CEO @ Seiso | IANS Faculty Member | Co-founder of BSidesPGH
LinkedIn
Justin Leapline
Host
Justin Leapline
Founder of episki | IANS Faculty Member
X LinkedIn Website Link
Rick Yocum
Host
Rick Yocum
Optimize IT Founder | Managing Director, TrustedSec
LinkedIn
Doug Salah
Guest
Doug Salah
Director of Cybersecurity Engineering & Operations • Global Security Program, Compliance, & Team Leader
LinkedIn
Episode 29: TRISS Pittsburgh, CMMC Update & Should We Be Pacing AI? — feat. Doug Salah

headphones Listen Anywhere

More Options »
Broadcast by