AI at Work: Jobs, Agent Security and Codebreaking

Hey everybody, happy Friday. We have survived another week and, well, there's the usual assortment of crazy things happening in the world. But we've got the right people to talk about it on a Friday, for sure.

John, good to see you as always, my friend. How are you doing? I'm doing well.

I'm very happy. The Dodgers got swept. They're out of the playoffs, so nothing could be finer on a fine Friday day.

Yeah. New York, and the Yankees and the Dodgers are both out, so get them. What are you going to do?

All right. Chris Glass, good to see you, my friend. How are you doing?

I've been good ever since the Blue Jays didn't make it, so I'm good. So we're all watching football now. There we go.

And Jeff Rich, how are you, my friend? Jeff, I know it's some sort of day, and those appear to be wine glasses, or what is- You're close. It's National Liquor Day.

Ooh. So it doesn't matter what team wins. I don't care.

We all win, yeah. Yes. So you're the guy at the party who's just here for the beer, right?

There we go. You now know me, Mike. All right.

Well, it's Friday, and we all did a full week of work, most of us anyway, and there's a conversation going on out there. And John was at a Workday conference this week, but the conversation is, well, just what is the future of work going to look like? Because I think we're moving past this notion that suddenly everybody's going to be replaced by AI, but that doesn't appear to be happening anytime in the immediate future, but there's still folks talking about that, I'm sure.

But what was interesting to me, John, with the Workday stuff is they're embedding a lot of automation into a platform that's normally used by HR folks. And one of the things that caught my eye was there's now over, I think it was 145, or I can't remember the exact number, of skills or AI skills that they have put into this platform. And these AI skills are essentially job functions or job roles that people perform, and these are the things you invoke to accomplish a task.

So I feel like we're trying to capture some of the knowledge of the average worker, and maybe this is tribal knowledge that companies had and lost when somebody left the company, and it was always a pain in the a*s. But how far does this go, and what were they talking about? Well, as you mentioned, Workday had a conference called Rising, and they introduced a ton, dozens and dozens, of AI agentic features.

They also announced this partnership with Anthropic to automate corporate tasks. And one of the things that was interesting, so I talked to a couple of the executives, and they were preaching to me two things. They were talking about this idea, this place and time for specialized AI agents, especially in hiring and talent acquisition.

And one of the weird takeaways I got, and I'm not sure if it was intentional on the part of the executive, but I asked him how effective the AI agents were in terms of hiring and retaining people, and basically in terms of hiring the right person for the job. And he said it was significantly better, which made me come to the realization that the people who do the hiring at a lot of these places, and including some of the customers that they mentioned, like 7-Eleven, are going to probably go down that path where eventually that person will lose their job as somebody in hiring or in talent acquisition and retaining people. So in talking about the specifics of what they're doing, they, in a sense, led me to believe that they are going to eliminate these jobs.

Now, they also, I'm not going to betray this guy, but he accidentally told me another major customer of theirs that is in the fast food industry, so you can probably guess who it is, that was really ramping this up because this company believes more in the idea of hiring and the background HR stuff than they are in terms of replacing people at the counter. Now, that said, we also had a story that we did about a Danish supermarket that's trying humanoid robots to handle repetitive tasks like restocking shelves, but they're finding that sometimes they're not as accurate as humans. So I think it's a race in time.

I think for now, all these agents are being deployed and being tested and being groomed to a certain extent, and once they're refined, I think people should worry. But I don't think they should worry for a few years. I don't know.

There's a lot to unpack there, but let's just go on with the HR stuff for two seconds. In my experience, most of the people I've met in HR are quite lovely and generally suck at hiring anybody. And the reason for that is they don't know anything about the job at hand.

And so they go and they start looking for people based on keywords and resumes, and then they sort for people that kind of fit some sort of profile in their mind, and then you are handed a bunch of resumes of folks that either are an imperfect fit or are just mediocre. And so what I find- Yeah. In a sense, they're saying they're refining the ability of the agents to do a better job of matching people with jobs, and they're almost kind of building this knowledge base into the agents so they become much smarter than humans in terms of finding the ideal candidate.

I'm just saying that bar is pretty low from my perspective. Yeah. That's why, immediately they're seeing a significant increase in effectiveness in finding the right person and retaining that person.

So that to me was a major red alert that if you're a human being in hiring within these companies, you might start looking for another job of your own. Who knows? Well, and Mike, you said it, right.

It's a perfect example for the topic because HR, all of us on executive positions understand that HR is an unhealthy profession. But as you say, wonderful people doing the jobs, but I won't reflect it back as well as you said it, but they intrinsically can't actually understand the job because they're doing their own job, which is HR. So they don't really understand the job they're hiring for.

Now you couple that with AI, and John, it sounds like there's some good results there. It may not be that surprising, but knowing what I know of how AI is being deployed, though, getting the context appropriate even for that, given that the HR systems we have are kind of awful. Well, the reason why the results are encouraging to the people that work in it are better because the results they had pre-AI were so bad, right?

I see. And I think we're just getting it right. If the bar is, as Mike said, and Chris, if the bar is that low, if you can do something even nominally competent, it's significantly better.

So these companies are going to be rushing to use this tool, right? Maybe. Jeff, jump in.

Well, yeah. Let me join the choir, if I may, because I've dealt with internal talent acquisition people for a long time. " I said, "The job description means nothing.

I can give you a list of words. That's all it is. It really doesn't directly correlate, unless it's an assembly line job or something where there's eight tasks that you must do.

" And I said, "Let me just do this. " Because they're not going to, to all of your point, I can give them a list of keywords, and someone can engineer a resume to have all those keywords in here, and bingo, here's a great candidate. But that doesn't mean they're the right person, and even though they may be hiring people, they're hiring the right people to a job description, they're not hiring the right people to a job.

And John, you said that the hiring and retention is up. To everyone's point, the hiring efficiency has to be better. I really question the retention, though.

I really question the retention. Yeah. One of the weird things, too, is that they were mentioning it.

So the interview process, what is it like? It's like, well, there is no interview. Exactly.

Right? You don't even talk to a disembodied voice. They just choose you.

They pluck you based on the algorithms or whatever they're looking for through the agents or the bots. Sure. So you're just hired without ever meeting anyone.

So I do want to move beyond kicking the HR people, because it's a time-honored sport. But Chris, what does the future of an employee look like to you when we have all these AI skills that are kind of embedded in the platforms that we're using, and those skills are everything from, "Here's how to design a website," to, "Here's how to create some marketing literature," or whatever it may be. In my experience so far with these things, they are better in the hands of people who know that job in the first place.

Because what I have seen is people who are dilettantes or who are not experts in that space, when they invoke those AI skills, they invariably seem to come up with something that is 80% of whatever we need, but is generally suboptimal. So I've got a metric, for our purposes, when we're developing things, is human attention recovered, right? Because I live this world.

I live so deep in the AI world, it's ridiculous, and I can generate and create at scale that's silly. But there's no point if I'm just pressing the button all the time. What are humans actually good for?

And what you just said is exactly right. The fascinating thing about AI, and maybe what we were talking about a minute ago is an example of any idiot can do something relatively coherent. But someone who actually knows something, there's a musician, a young lady, Kelly something, but she's getting awards working with AI because she's a musician and she makes amazing stuff.

Now I can sit down with Suno and make sounds. That's not the same bloody thing. And I think that as we get past this transition, we find people at every type of job, you're valued for your time and attention because you know something, right?

And because I'm hiring somebody and I know what I want, I know that, and I know it when I see it. That slice in between, I think HR people who are actually really good at relationships, you said get off the HR, and I promise I can. But you scale a company past a certain size, you can't interview everyone yourself.

You need someone who focuses on that. But I think we've focused the human attention on the wrong things. There's still a human needed there as a relational person, not a resume sorting person.

Right. So Jeff, you were talking about hiring people that have a certain attitude, essentially. But as you see these AI skills get embedded into these workflow platforms, what are you looking for?

What should people be looking for in their next hire? Because I don't think it's necessarily somebody who just happens to have a lot of AI expertise or experience. There's another intangible still missing.

Of course there is. And I'm going to go back to the two words I used in my earlier statement, creative thinking. Without demonstration of creative thinking, then you can read the manual and recognize every single dial in a 747 jet or a 787 now, or whatever current one, an A319, whatever it's going to be.

Just because you can recognize every dial and you know what every control does, that doesn't mean you can fly a plane. You have to demonstrate history of knowing what an aileron does and what a rudder will do, and what the effect's going to be, and that you've done it. And without that, knowing all of those items is worth more than nothing, but not a whole bunch.

Yeah. John, what was the mood at this event at the end of the day? What was your sense there?

Surprisingly, it was a massive event. I don't know if you're familiar at all with the Venetian, and the layout. There were like four floors.

It was packed. They used all four floors. So there were a number of employers there who were really interested because they're thinking about, "Here's a way I can save money.

" They weren't just talking about HR, they were thinking about things like robotics and the idea of manual labor. And I think it's interesting, the Danish supermarket, I'm not going to dwell on it, but I think the appeal of something like that is once they perfect the ability of the bots, robots, to use their fingers and sort by-- That's going to save companies not only time, but a lot of money in terms of insurance, because anyone who knows anyone who's ever worked at a supermarket in stocking shelves, those people invariably have neck, knee, back injuries, it's missed a lot of time at work. So there was a great deal of enthusiasm about what this could mean, and I think it also kind of hits home to me that these companies really are ramping up their hiring and their use of AI.

They're all systems go, but I don't think they're going to get rid of their employees overnight. Maybe like a Kroger will, but they are thinking longer term about return on investment and efficiency. The most fun job I think I ever had, at least on a daily basis, because I was 17 at the time, was stocking shelves in an Associated Supermarket in the Bronx.

Boy, good times. Lots of fun. At 17, your body is the right body to do that, too.

Yes. Yeah, I don't think I could do that today. I would probably hurt myself at some point, but- It's worth noting, there's a good opportunity for a case study out there with Amazon.

They've been doing AI-based robots for years, and they're quietly taking- Yeah, they're on two. Yeah. That's one company I keep hearing from, by the way, AWS and Amazon.

They keep just hammering this whole robotics push into manufacturing. I think they've got a million bots that they've installed in some sort of manner. So, yeah, they are the future, so to speak.

All right. So my take on all this at the end of the day is there's still hope in this equation for the mere mortal humans. And you need to know how to use AI, but at the end of the day, increasingly, you just have to be able to express your intent coherently, and then the AI will get you most of the way there.

But if you're just going to copy and paste whatever the AI generates, eh, it's probably going to suck. So you might want to think about it more like the first draft of something and make it better. There you go.

All right. Shifting gears, there is a massive amount of conversation about AI agent safety, and we've seen it all week long, and there's additional reports now of AI bots and agents going rogue, and I think this is just going to become a recurring thing. And what I really want to get at, though, and I was at a conference in Austin this week hosted by Qualys, and their CEO was talking about this, is at the end of the day, there is a way to at least do this more safely.

Maybe we'll never get it perfect, but right now it seems like we don't have a set of best practices for deploying AI agents. And as a result, you're seeing AI agents that are not, shall we say, segmented on a network, and you're seeing them not maybe put in something that looks like an isolated container or something, and maybe we're just being stupid. So, Chris, is there a way to think about this, to deploy AI agents in a way where they don't wreak as much havoc as we are currently seeing?

Well, I will just say yes. The alternative is that, again, for the rest of human futures, we can't have nice things. So we'll probably work this one out.

And as anybody working in the industry has been part of this conversation for the last year, year and a half, two years particularly, anybody involved in standards work can be part of that conversation. And you view Mike, right, Qualys is a significant company. Their executives are thinking through this in person, in public with you there this week.

So where are we, right? And what have we said on this show every week for the last year or so? And security hasn't been deployed before the AI era to the level that security fanatics like me would like.

We've been skipping things over because heck, it's good enough. The speed of AI has, from a security perspective, blown the doors off that. So if you're not doing things fundamentally right, if you're not really welding the pipes, but just sticking them together because the pressure never gets that high usually, well, you're going to have to weld the pipes.

So it's primitives, right? As I look at it, when I build AI agents, you'll be really clear about this, a goal isn't permission. You're going out to do this, that's great.

But just because you have a tool doesn't mean you have the authority. A prompt isn't a security boundary. It's, I know right here every week, twice this week and twice last week, I'm saying the same things over and over again.

So trying to find a way not to repeat myself, but there are basic primitives we haven't built in. And just because a person has access to a system doesn't mean they have the authority to actually go into it. We need to write that down for AIs or they will take us at our word.

But yeah, we will get to the point. I would argue that it's possible now, and some people, some of us, are out there deploying things that won't hack the grid just because they can. Yeah.

Jeff, you've been at this as long as anybody. Are we reaching a point where because of AI agents that we finally, to Chris's point, are going to go back in and do security right, and maybe this is a good thing? Wow.

You know how many times I've been asked that question over the decades for every new technology that's out there? The difference with AI though is speed and scale, without question. That's the difference between that and cloud or distributed computing or client server, go back as far as you want, any of those, the difference now is speed and scale.

So I think the answer is, Jack's not here this week, so I'll be the stand-in cynic. No, we're not going to get this done right. We never do.

Because most people that run a business don't look at an upfront security investment as a right way of spending capital, or even OpEx for that matter. So no, we're not going to get it done right this time, but we will end up getting it right just like we did with cloud computing. I remember in 2007 when I was at a cloud provider, and no one, no large enterprise would deal with us.

They said cloud isn't safe. " I think we're in the same condition now. The challenge we have though is speed and scale.

So we need to learn our lessons more quickly than we have with every other technology in the past. And by the way, this is simply a rehearsal for quantum, because that's exponentially going to be scale and speed, more so than we are with AI. Yeah.

So man, let's learn our lesson here. " Well- No. Oh, sorry to interrupt, Mike.

Yeah. So that, it's interesting what Jeff just said because in a sense, at the conference, again, at this Workday conference, I was talking to a guy who runs DevOps, kind of a liaison between Workday and their customers, and he has a panel, a CIO panel, that he convenes every few months for feedback. And that's the takeaway he got was that they are actually looking or considering security much earlier in the process than they have before, even through every iteration.

So, and the reason why is because unless they do, they're worried about eventually some sort of lawsuit and investigation because there are no laws governing this stuff. And in a sense, they're trying to get ahead of the problem because they're seeing all this chaos going around us every week. So it's interesting though, under the heading of "Obi-Wan Kenobi, you're my only hope," the insurance industry may be the one that forces this conversation at the end of the day because they're already starting to exclude AI agents from policies.

And so unless there's some standard way of showing and proving that you've implemented some reasonable controls, they will not issue you business insurance or cybersecurity insurance. So maybe that becomes the thing that is the tail that wags the rest of the dog. What do you think, Chris?

I'm glad you said that because decades ago I had a lot of fun saying that in the end, the insurance industry goes all cybersecurity, because they do. Lloyds of London will maintain their market share and these are big, long, multi-century industries. They don't mess around.

And we've seen in the last decade, cyber insurance and, we could spend a whole show talking about that. But I hadn't really been thinking about this. There was a group, CDOG, a public-private thing around Washington about 10 years ago.

We never got hats, I think it was the best acronym ever. But you sit there with the big insurance companies and have these frank conversations. They will find a way to measure risk.

Guaranteed, doesn't matter, we can all sit here and argue about what's possible or not, Lloyds doesn't fool around. And you put these things together, and I think the pressures, like I actually in this area have not advised any insurance companies, but you're out there, you want my thoughts, give me a ring. I think you should be using AI tools right now, coherent systems where you can look at your risks and make demands of the insured, because they will comply.

If all the insurance companies on earth tell me, you, them, us, we now have to do XYZ, guess what? We're going to do XYZ. So now might be the time.

I've thought about that in a couple years. I think you're right. Could be the moment.

Jeff, what do you think? Is that how this is going to play out? " To Chris's point, we do that now, making sure they're getting the right data.

By the way, we just were, and I'm not selling services of Chris or me necessarily in particular, but that's what we do is, are these the right data to be using? " And that's how Lloyds and every other insurance company, each other, everyone else, that's how they make their decisions. And it has nothing to do with whether they like you.

They can talk a bit about you can mitigate something with a mitigating control, but bottom line, if you're not hitting the numbers, they're not going to insure you. Or you can be insured, but your premiums are going to be 10 times what they should be. Yeah, I'm going to throw out something for the future to come back and check me on, because I will bet in, say, 10 years, people will look back and the insurance companies, the ones who capture this first, who understand the risk, manage their finances based on this first best, they'll get a measurable gain, sustainable gain against their competitors.

I think you're right. But I think part of the problem right now is we are so far ahead of our skis. We're rolling out these AI agents.

We don't have any defined set of best practices for doing it safely. In the absence of that framework, it's not possible for the insurance company to assess some risk because they got nothing to compare it against. And, Jeff, I know you've been around these programs for a while, but it seems like we're a little slow off the mark when it comes to creating best practices and standards in any given space.

I think we were doing the cloud for a good five or six years before anybody said, "Yeah, you know what? " So is this maybe something that we should start rushing because, well, it's a bit of an emergency. Well, a rushed standard is maybe suboptimal too.

So you need to be careful what you're asking for. Mm-hmm. However, there are data out there.

" There are enough data out there that, and I'm going back to this, actuaries will normalize that data for us and say, "Here's the sort of thing. You do these sort of things? " That's very simple language for an insurance company.

"You do any of these things? That's an exclusion. " All right.

So John, what we're really saying is this is no longer an IT conversation, it's a business conversation. No. Ironically, right, insurance companies are going to save us.

What's just aggravating to me is that the companies themselves who are responsible for these agents have almost irresponsibly in their pursuit of grabbing market share are just like, "Let's just throw everything against the wall and see what happens," right? And in some cases, they've created this mess of their own making, and their solution is to self-regulate or to have us trust them. And that clearly hasn't worked.

It's not going to work. So there needs to be some sort of outside force, maybe the insurance industry, to push their hand, because I don't see anyone in terms of legislation coming up with anything similar to this. Not as if a legislation's going to pass.

Or being enforcement. We're just going down this rabbit hole, and we're breaking more glasses than we imagined trying to fix things. And we need somebody to step in.

We need some adult supervision, basically, is what I'm trying to say. Jon, I disagree with you on one thing. First of all, don't break glasses.

That's going to spill all over me back here. Yeah. But when you said that they're almost irresponsible, I completely disagree.

They are responsible. Oh, yeah. You know what?

I'm trying to be diplomatic, but you know what, Jeff? Given the tenor of Friday's show, I should just let it rip. Yeah.

Because we can make things real on this day of the week, but I actually think they not only don't give a damn, I was going to say something else, but- So the other side of what you're saying, though, is the people who are going to make the most amount of money when it comes to AI are liability lawyers, because they're the ones who are going to be suing everybody. They always are. Look at all these lawsuits and settlements.

This is only going to escalate. This is going to become... I can't even keep track this week, Mike, of how many.

There's the FTC subpoenas. There was the state attorney general's action against OpenAI and Anthropic. There was a federal lawsuit in San Francisco, and these all happened within 72 hours.

So Mike, if I may. I'm doing a presentation next week at a local association on hiring in the cyber world. Hiring and looking for work.

I know it goes back to the first segment. But you know what the number one in-demand job in cyber is right now? Close.

Cybersecurity attorney. There you go. Number one in-demand job.

So you hit the nail on the head, Mike. It makes sense. This is true.

At the end of the day, there's a trend that goes on. It's been going on for centuries. The people who make the most amount of money anytime there's conflict are lawyers.

All right. Going to shift the gear to something a little unusual, but hey, it's Friday, and we always like to end the show with something that is off the beaten trail a little bit. So, it turns out that somebody applied AI to the encrypted messages that the Nazi regime was using back in the day, and most of those were cracked back in the day by Turing and his folks in England.

But there was a few they were unable to crack. And so somebody turned the latest model from, I think it was OpenAI, against these and was able to crack it. And it was interesting in the sense that here's some weird things from the past that we could do.

But Jeff, here's my question to you. Are there other things that this may play out for? Because we have other things that are encrypted, and if people can gain access to that, and with a little help from AI, even before I have a quantum computer, might we see more of these interesting little projects that might decrypt stuff that's a little more current?

Oh, I think we're definitely there. Alan Turing was a genius. I'm not going to diss him in any way, but he still needed a tool and process to accomplish what he accomplished.

So now we have new tools and processes which can get us there, and the requirement to be a genius doesn't have to be spread throughout every user. It just usually will be on whoever's creating the tool or the process. So yes, and once again, I'm going to do a call back to earlier in the show.

I think AI will definitely make long strides getting us there. That will be the warm-up, and then once we get to quantum, and at some point, we need to start having a quantum discussion every Friday as well. Once we get to quantum, then they aren't long strides, we start running.

We are running at cheetah speed once we're at quantum, compared to where we are now. So absolutely, you're going to see previously unbreakable codes, encryption, whatever it's going to be, be broken because that's just a programming language as well, written by humans, and new tools and processes will get us there. So you can determine whether that's...

I think it's both good news. It's good news and scary news. It's not necessarily bad, but it's good and scary.

Jon. Yeah. Business people.

This is the point in the show where I lay out a future where you can get scared. So think about it. Every communication that you as a business executive or you as a person that you think is encrypted might be decrypted sometime between now and something called Q Day in 2029.

It might arrive in 2028. And are you going to think twice about anything that you write down or send in an email or a message, and are we all just going to go back to the phone because, well, at least maybe we think there's no record of that conversation somewhere? I was thinking about, was it Harry Truman was the only president between FDR and Nixon who didn't have secretly taped conversations?

He was ahead of the game. He probably had an idea. Don't leave any physical evidence.

Don't leave any evidence whatsoever. It almost creates this scenario where, yes, everything is open. Unless you do it only face-to-face in an unbugged room.

This is like, talk about paranoid. You're making me feel paranoid, Mike. So I'm going to go down a weird path, and forgive me, but I do this.

We talked about the Nazis and decoding this AI element. I was wondering about criminal investigations, and I'm thinking about the famous Zodiac case where they couldn't break some of the codes or some of the messages. Mm-hmm.

And what we could do with AI now to, not apprehend Zodiac, so to speak, but apprehend other people, and we could use this for good to protect ourselves. But again, AI can never help itself. It never stops.

Yeah. So no one's safe. Everyone's open secrets.

Nothing is forboden, everything's open. Yeah. In the article, they pointed out that they had used AI to figure out who was responsible for a particular incident during the Holocaust, and they're also using it to track down the provenance of stolen paintings.

It's kind of interesting. But Chris, what are you going to say? Well, I was going to say something else, but I have to say first, I think the Indus River Valley Civilization will get deciphered by this, in this era and so forth.

And that's a better use case for it. But one of the first things I learned working in security that's really transportable that everybody can understand is that if you buy a safe, like those would be classic Wile E. Coyote bank vault you can walk into, and you look at the ratings, it's not measured in kilonewtons, it's measured in minutes.

Every type of security is about buying time. If someone has your physical safe, they will open it. It's just a question of whether it'll take them three hours or three days or three weeks, but they're opening it.

So in this case, we're talking about encrypting private things. " Not yet. " Because of copyright issues or risk or anything else.

But if your whole security paradigm is that no one will ever be able to break the... Then you should probably hire somebody else. And again, in the security world, it's cliché.

" You try to set-- What does that mean to you? And if the answer is, "No, secure. We want to encrypt things that no one will ever see," it's like, okay, I'm leaving.

That's not a goal. And I referenced "Liar, Liar," the Jim Carrey movie, in one of the articles in the last couple of weeks, and I just love that he's forced to tell the truth. " If your encrypted stuff is...

Look, if it's important to you, and you want to keep it safe, that's one thing. If you want to break the law and be safe because you're encrypting it, you're probably better not to break the law. Imagine, Mike, if you're at OpenAI, you're being spied upon with a USB port inside of a toilet paper.

You talk about this encrypted possibility of everything being left open to the public. How would these executives communicate? You almost have to go off into a park, sit on a bench, like out of the movie "JFK," and then whisper to somebody what you're planning to do.

There's nothing that's going to stay there. Yeah, and I'm sorry, the fun stuff in security is always beyond that anyway. So I can just assume the bad guys are actually worth worrying about, and they're actually listening to me.

I will make them listen to things that I'm actually saying and believe things that I don't believe. That's the fun stuff. " It's like, I will create a world where you can think you're seeing what I'm doing, and you're acting on that, but they're wrong.

That's the pretty part. You know what? Apple used to do that.

Back in the day, years ago, they used to put out multiple press releases. Some of them were fake, and they would try to find out who was leaking some of the data from within the company, because that company was like a sieve in terms of in the '80s and '90s. So they would have the fake announcements, and that's how they would track down the leakers.

There's a couple things to keep in mind here, so I'm just jumping in here. That from a breach perspective, social engineering wins, and from a protection perspective, PSYOPs wins. And did I mention technology at all?

Mm-hmm. So, if you're in a secure federal building, to Chris's point, it doesn't tell you how secure it is. It says you're in an eight-hour building, which means it would take eight hours of conventional attacks to break into the building, using bombs or whatever else.

So it is a matter of time. It's always measured in time. And the other thing I've learned, both in security and doing some work associated with some agencies, is the only way something is secret is when only one person knows it, period.

And I was just trying to find a way to... I can't talk about this. Let me just say, one thing as we're talking here I just loved in my career many years ago was we knew the bad guys had the information, and in fact, it was the right information.

But we'd gotten them into such a state they couldn't trust themselves to know whether it was true or not. And they did nothing. And it's just watching that play out, it's like, you actually went all the technical stuff.

You got the information, good for you. But you got them into such a psychological state that they couldn't act on it. And it just- That's good, though.

I'm not quite clear how society's going to function if we're all constantly lying to each other, but oh well. It doesn't always have to be- You live in a lying culture now these days. It's acceptable to lie all the time now.

But you don't necessarily have to lie. It doesn't have to be that bad. And when it comes to, do you really want to keep a secret from someone?

Well, as soon as you tell someone, it's not a secret anymore. Right. And that's just a fact.

And really, it doesn't matter how well you trust that individual. If the information is no longer in your control, only. That's true.

" Yes. Well, it's about creating high certainty among the trusted group, and lower certainty among adversaries. It's primitives, right?

Like Jeff rightly said, it's not about breaking codes or passwords or anything else. It's security. It's conflict.

And we literally do this every moment of our lives. We just tend not to think about it that way. And it's not about lying.

It's just if I'm part of a trusted group and we're talking about things, and someone else comes along who isn't, they can hear us, but they don't know what we're talking about. And it's that time delay and response cycles that every living creature, human, business, adversary lives in. That is security.

To the point of this segment, it's not encrypting something that no one will ever be able to decrypt. Mm-hmm. That's not even a thing.

So Jeff, should we assume that nation-states are hoarding massive amounts of encrypted data on the assumption that within the next three years, they're going to be able to decrypt it? I think you can do more than assume. I could probably pretty quickly get you some evidence that they are.

And by the way, in nation-states, the US being included. Yeah. No doubt.

So, I don't know. Chris, what's your best advice to the poor average businessperson who's looking at all this going, "Come again? " Because I think the tech people instinctively understand what's going on here, but I don't think that they've translated it for the average businessperson in a way that they're going to be able to quite comprehend what's really at risk here.

Well, what's at risk is that you stop worrying so much. Being in business is high risk at all. And just because you have an established business and your job and your role personally in your group are fine doesn't mean that's going to continue at all.

So just managing that risk is how all of you live every single day. We're a bunch of geeks talking about marginal risks that if they came to pass, well, again, anything random can happen to you and your company and your job and things can detonate. But nothing we're talking about here on the television in front of you matters as much as making sure that you keep your team around you and your partners and your suppliers and your customers personally in trusted relationships.

And think about competitors or actual adversaries as much as you bother thinking about them at all. And just listen to Jeff. Just mostly mess with their heads.

Say something in a meeting with a wink and a nod to somebody else that they understand what you mean, and anybody listening thinks that you just made grand plans and starts acting on them. Wasn't there some article or some book somewhere that once said something about how I learned how to stop worrying and love the bomb? Is it like that?

Yeah. "Dr. " Kubrick.

Yeah, we live in a Kubrick world. That's a movie for me. I think we should dedicate our shows on Friday.

There was a director in the '70s and the '80s, actually, Alan J. Pakula. I think he's from New York.

" This show would appeal so much to him. Mm-hmm. Well, there you go.

I think we're going to end it here, but I would remind everybody of one thing that is a true statement in the land of security. If you can imagine it, somebody's trying it. So here we are.

Guys, as always, thanks for sharing your insights, and thank you all for watching the latest episode of the Techstrong gang. Please stay tuned for the rerun of the Techstrong TV lineup for the day. And with that, have a great weekend, and of course, stay tuned from this word from our favorite sponsor, otherwise known as us.