Enterprise AI Trust: Value, Security Fixes and the Outlook

Hey everyone, happy Monday and welcome to Techstrong gang. I can't tell you how good that feels. I've been unfortunately away.

Well, fortunately or unfortunately, I guess it depends who you ask. But I've been away. I haven't been able to be on the gang much.

I think it's my second gang appearance in three weeks, and I was jonesing. I was jonesing really hard to be here. I'm happy to be here, and I couldn't think of a better gang lineup to start my week with than we have right here today.

Let me introduce you to Stephen Foskett, Yvette Schmitter, Guy Currier, Tom Hollingsworth, and of course, holding down the fort the whole time I was away, the man in the high castle, Mike Vizard. Gang, welcome. I hope you all had a great weekend and things have been going well.

Happy Halloweens and all of that. Ghosts and goblins and all that good stuff. It looks like though, it wasn't just Halloween kids that got scared.

It looks like a lot of the Wall Street investor community has gotten a little scared about the risk of AI here. " We'll start with that. " Right?

Yeah. And I remember in the dotcom bust, I thought it was a momentary blip. " Is that how that goes?

Okay. Something like that. All right.

Well, let's dive into this because I guess trillions of dollars of valuation disappeared inside of a few days. And I'm not saying there's correlation here, but Alan was missing from Techstrong gang, so maybe there is some causation here between Alan not appearing on the gang and the stock market suddenly losing confidence in AI. Stranger things have happened.

But at the same time, Sam Altman is also saying some strange things, and he's suggesting that running any kind of AI locally is a waste of RAM on your own local machine. And I can't help but wonder if that was because the stock price was tanking, and so he decided to say something crazy. I don't know if there's any correlation there, but maybe there's smoke with this fire and all that good stuff.

But Guy Currier, can you make any sense of this? What's going on? I think it's easy to make sense of.

The guy wants all possible constraints on his future state as replacement trillionaire or whatever to just melt away. " It's worth a shot. You can't blame a guy for trying.

So I think it's just as simple as that. I think I'm more commented on Elon Musk's constant BS, saying whatever the heck he wants because a lot of people just believe him. But it's not true only of him.

And the reason everyone takes it seriously is because this is a celebrity world we live in, and these rich people are celebrities, and they're entertainment, and they're eyeballs and all that sort of stuff. So that's Altman. As far as market moves and-- He is pointing out or referring to a serious problem.

What's the serious problem in AI right now? I think a lot of folks are talking about memory. Before that, but they're still talking about data centers.

Not enough data centers, not enough capacity, et cetera. There's just so many potential blocks and real blocks in the supply chain. One foundry, just one, blows up in Israel, and man, it's like it's a disaster or something like that, but it really is.

It's destructive and so on. I don't want to make light of something so terrible and dangerous that happened. I think that I just am continuously convinced over and over again now that AI being the same as all of these market technological trends and changes and surges, just more extreme and quicker.

And so, not all of them have been bubbles that have burst, but I think it's a riskier idea to think that this is not a bubble that will burst than to think that it is. You should assume it's a bubble that will burst, and the main problem is when. Did it just happen?

Maybe, maybe not. " And so I'm trying to figure out if this is that moment, or are people just going to wind up buying the dip per se, and then we'll see all these prices go back up again? I don't think it's the moment right now.

But I'll just say this. We live in a capitalist society, right? And so everyone's looking at the money.

And so it's a fact, folks, if the seven companies are over 35% of S&P and everybody and their mother is investing in that company, right? One of those goes down. That means your 401 , the food in the supermarkets, your mortgage, it all has impacts.

And no one's thinking about that, right? " It will become like a dust bunny, right? Because every single one of them are all tied together.

One goes, everybody is impacted, and no one's thinking about that. And I think when that begins to happen, and when that happens, it'll be literally too late because everyone is looking at their portfolio now. It looks great.

I remember when I joined Amazon. Oh my god, my stock options, I was checking my s**t like on the regular. I was like, "Oh, look at the zeros.

" And then that s**t split. You know what I'm like? O*, f**k.

You know what I mean? So we don't have an opportunity to rebound from that when most of the Americans living in this country are living check to check. Like- Without you vote tomorrow.

Alan, look, I'm trying to keep the level of excitement to a minimum. No, but I'm serious. There are people- Yvette, you're trying to keep the level of excitement to a minimum?

Wow. I'm trying. We get it.

I'm trying. It's like vote. There's data centers, there's your stock portfolio, there's the grocery stores.

There's all these things are tied. And look up from your phones, folks. You can't scroll through this and not be impacted.

So Al, let me ask you this then, since you brought it up. A lot of folks have been looking at their 401 now for the last few years and those tech stocks and going, "Well, this is great. This is my cushion against all the other things in the world that might be going south, including the price of gasoline," which is all maybe headed north.

But is that going to play out tomorrow? Do you think that this downturn is going to impact the elections tomorrow? Not as much as the present state of our economy is.

Mm-hmm. Or that maybe we're just getting a little bit fed up between the corruption and the tech bro billionaires buying things. Yeah.

But I don't want to turn this into an election segment. We'll do that tomorrow, I'm sure, Mike. I want to return to what Yvette and Guy were talking about.

Guys, plural, not just Guy, right? Guys, this isn't about scarcity. Guy, you're talking about scarcity.

We don't have enough memory. We don't have enough data centers. We don't have enough bandwidth.

We don't have enough all of these. We don't have enough AI, basically. Scarcity.

Well, scarcity, of course, is going to drive that market up, right? That's the nature of market scarcity, supply and demand. I think there's something more fundamental going on here, though.

What happens when scarcity isn't the issue? We're betting $8 trillion that when scarcity goes away, AI is going to transform the world into some fairyland. And I think there are a lot of investors, there's a lot of smart money sitting here saying, "You know what?

I don't know if eight trillion is going to be enough," because these guys just keep asking for more. And more fundamentally, where's the return? How much am I going to have to sell of AI to get a decent return on $8 trillion?

Yep. Because I don't see people buying. Excuse my hand gesture.

They can't afford RAM, Alan. Look, RAM- No, but even if RAM wasn't scarce and you had enough RAM, fundamentally, what am I doing with AI that's going to be worth a decent return on $8 trillion? Yep.

And can I get 80% of that return running my AI on my M6? I'd be poor. Alan, so we talked about that last week, and just to give you some numbers and just some sense here, the total enterprise SaaS market globally is only maybe $300 or $400 billion at most.

Look, Gartner's put numbers on it. The total- Go ahead. Yeah.

5 trillion for AI. That goes beyond IT, beyond SaaS. Yeah.

5 trillion on an $8 trillion investment. You don't have to be Wall Street. Yeah, and that's optimistic.

That's the crazy thing. Yeah. 3 trillion.

If every IT person, everyone listening to this podcast, lost their job tomorrow, that would not be enough for Anthropic alone to meet its projections for 2027. And that's the thing. Guys, I think that's what's driving this market, is the realization that even if we take scarcity out of the equation, you're not going to get the return you need.

The only way we get return is if there's economic growth, and so far we're not seeing that. In fact, if you look at Google's results, it's pretty clear that the reason that Google had its worst day in history is because advertising revenue lost because of AI-based searching. It wasn't met, even remotely, by any kind of revenue related to AI.

So essentially- They in fact had negative cash flow ... it has destroyed revenue, not created revenue. And look at- The greatest companies in the history of the world have negative cash flow from this build-down.

Yep. Let me bring Tom in here since he hasn't jumped in just yet. But Tom did we all just- I'm free to disagree, Tom ...

suspend disbelief to get to this mess? Because when you look at the numbers, they're not unexpected. This has been coming for months, maybe years.

So why is it we all suddenly wake up and smell the coffee all at once? Because the chickens have come home to roost. If the shot was watching Corsair shut their RAM production down because there's no money in consumer RAM, then the chaser was watching Intel tank, not because their AI division wasn't growing.

It absolutely was. But that pesky system development sector, the thing that Intel's made forever, tanked because nobody wants to buy a PC right now. Last week, we saw the introduction of a MacBook that quite literally everybody had been asking for forever.

Now, granted, Steve Jobs is probably rolling around in his grave right now because we'll never make a touchscreen MacBook, but we did. But that wasn't even the story because while we're at Security Field Day, for fun, we configured both a new MacBook and we configured a new Mac Studio and we maxed the RAM in it, and the RAM was half the cost of the system. I configured a system with 512 gigs of RAM that cost, and I'm not joking, $15,500 for the RAM.

Granted, that was the Apple tax on top of some of it. But I think that the scarcity argument is hard to convince people of, right? "Oh, well, we're running out of water.

We're running out of sunshine. " I don't care. That doesn't affect me.

Oh, I need a new MacBook. Oh my God, how much does it cost for one of these things? That's insane.

It always happens when people get the itch to buy something, that all of the decisions that we got up to that point are coming home to roost. It's warping- Ask the people who are going to have to start logging into Reddit because Google admitted that that little AI box at the top of their search results has not only cratered their revenues for ads, but it is also effectively killing off Reddit because nobody wants to go to Reddit to look stuff up and make pithy comments anymore when they can get the answer from the beginning. And now Reddit's making you register and do more because they've got to get less people.

Guys, this is distorting. I mean, let me tell you a couple quick stories here, then we'll be done, right? Back in the dotcom, I remember sitting in the airport seeing two hayseeds in denim overalls sitting at the seats next to me, and they were talking about buying and selling Yahoo, and Priceline, and these other shares of dotcom stocks.

" Right? When these guys are trading stocks like they're day trading, something's wrong. In 2008, I was in New Jersey and I pulled in for gas, and if anyone's ever been in New Jersey for gas, you know you can't pump that gas yourself.

" He puts it in and he starts talking to me about a three-family house he was buying, no money down, and they were actually going to give him money at closing, and he'd be able to flip it in six months and make a couple of hundred grand or something. And I said to myself, "Alan, you've seen this story before. " Now, how many of you remember the sneakers?

What were they? Oh, shoot. They're like knit- Air Jordans?

No, the knit sneakers. Allbirds. Allbirds.

Allbirds. That company sold the sneaker business. And now they're data centers.

They're becoming an AI data center. I got another one for you. The company that was going to make the supersonic airplanes that United was boom- Yes, Boom.

Boom. Did you see what Boom did? They're delaying their supersonic jet in order to make- They're never going to make a supersonic jet ...

gas turbines. Gas turbines for data centers. No more supersonic jets.

Guys, you don't got to get hit over the head, do you? You don't have to get hit. These are clearly marked signs.

Well, how about SpaceX getting out of space launch entirely? They don't want to work with NASA anymore. They got other things to do.

Guys- What are we driving at, Alan? What's the- What am I trying to say? Because I'm subtle like that, Javad, you know?

The original version of that story about the selling of the boom and bust market is Joe Kennedy jumped out of the market the day before the crash, allegedly he said because some kid who was shining shoes told him what stocks to buy, and he said, "That's the bubble," and he got out just in time before the 1929 crash. That's the original story. It's glorious once again.

Well, but speaking of crash, there's a kind of a clash here, I think, in this whole discussion. Because, I mean, what are we talking about? Because all you guys are making a whole lot of sense, and this doesn't make any sense at all.

It's about vibes and feelings. I mean, that's the problem. That's the problem is, sure, Alan, you got a great point.

It's not really about supply chain, it's about demand. And I make the point from time to time lately that AI, as it's currently implemented, is extremely wasteful. Extremely wasteful.

In every dimension. It's going to get more efficient under pressure and all that other sort of stuff. But what's going to happen is there's going to be some kind of sentiment shift, that's what I'm calling vibes, among a pretty small group of people A million worldwide is what I mean by a small group of people.

3 trillion and everything, you're leaving out the time factor. 8 trillion of total investment, three point whatever trillion a year, that's really not a bad ratio. 8 trillion over four years, and then you got to retool.

Yeah. Fair. But it's not through sense and logic and calculation, even though- No, I've said the market doesn't move like that ...

that's going to cause the correction that I think, well, I certainly believe, and we all believe is going to happen. What's the correction? The correction is where the investment level makes sense over a period of time against the return.

And incidentally, it's not going to be a measurable productivity return. It wasn't for the PC for 20 years. It wasn't for a lot of these things.

AI is clearly and obviously useful and helpful. The metrics being used to figure out how useful it is are all wrong, and nonetheless, here we are. So, I really think logic has nothing to do with it.

We've got to jump. Before we do, I'm going to end on one thing. The other shoe's going to drop when you get another administration in charge here who starts investigating the circular financing.

This is the same kind of stuff that happened to the telecoms and the dotcom with the fiber. And I got a report out on this on Techstrong. I think it's on Techstrong IT, on the Money Go Round, because a lot of the money we've talked about in the AI market is just going from a very small set of hands around and round and round.

Yeah. There will be repercussions. We are in the grift age.

There it is. You can read about it right now. Someone should write a book about this.

All right, Mike, what else we got? Well, speaking of going to hell in a handbasket, we are trying to figure out what's going on with all these security issues and vulnerabilities that AI is discovering. And of course, we've had the PHP crisis as the latest one of these things, and we're trying to figure out if there's going to be more of these.

But at the same time, almost every other day now, there's a vendor coming out saying that they have figured out how to use AI to first create the patch, validate the patch, and test the patch, and then deploy the patch, so that they can respond to these things more timely. And in the event that the patch still isn't available, we can apply controls and other things to mitigate these threats, and we can do that in almost near real time. And so the question then becomes, well, I bet if that's the case, then at the end of the day, are we going to have this kind of major security crisis, or is this going to be another Y2K moment?

So, there's so much here. Let me just say this. At the end of the day, AI has found vulnerabilities that have been out there for a very long time.

And you can throw AI at just about everything. And the security field, the fundamentals have failed spectacularly. If you can't close an API endpoint, if you can't secure an S3 bucket, if you can't control and patch on time, what AI is going to help you, even if it's going to find it, fix it?

It's not going to fix the fundamental problem, is that we have failed at the basics. This is not like some AI that's so creative and exotic. It's just like people have failed basic cybersecurity s**t.

You know what I mean? It's just like an S3 bucket? Close it.

It should not be open up to the world. These are the things that I'm talking about, that people are thinking that AI is going to miraculously fix. " They have one job.

This is not something exotic. It is fundamentals. Failing at the fundamentals, no amount of AI is going to save your tuchus on that.

So sure, you're going to fail at the fundamentals, bring an AI that's going to find it, fix it, patch it, or whatever. And you still think there's going to be a positive outcome on that? It's not, if you're still failing at the fundamentals, because at the end of the day, somebody needs to tell the AI to go look at something.

And if you ain't securing your S3 bucket, the AI is not going to think of that for you. So, this is not going to be a silver bullet. Look.

Here's what I want you to think about. So look, all this stuff out here sounds like good design. It's still announcements, right?

And none of this stuff I read has reported measured security outcomes. Nothing. This is all vapor.

My whole thing is vapor for people who have failed at the fundamentals still is a hot mess express. Mike, I got to ask this question. I just cannot help myself.

Yvette- Yeah ... I have to ask you this. Yeah.

And in one way, this is the dumbest question I will ever ask. I doubt it. Have you ever- I second that.

Yeah. Have you ever, Alan, you can answer this question too, have you ever told somebody, let's say a spouse or a significant other or a child or parent, the same thing 10, 20, 30, 100 times over and over again, and they never took your advice or did what you told them to? And then one day, they came to you and said, "Hey, my friend," or, "this stranger," or, "my colleague said that I should do this.

" And it's what you told them to do dozens or hundreds of times. Has that ever happened to you, ever? Well, of course.

Yes, and- Constantly ... of course. So like men say this all the time.

I drop these wisdoms, it gets passed over, but someone who looks like one of y'all says it, and he's a freaking visionary. Oh, so God, you've mansplained it. Okay.

Here we go. Here's why that's a dumb question. So like, you poke the bear.

So bear claws coming out. No, but here's the thing. Now you get AI to say the exact same thing that these security people have been saying for years, and now the executives believe it.

So AI's mansplaining. Well, let me tell you. So before I did whatever the heck it is I do now, I used to be a consultant, an IT consultant.

And my job fundamentally was to parachute in to, I don't know, Rochester, New York, and sit down at a table with a bunch of junior IT folks, and they would tell me exactly what was wrong and exactly how to fix it. " Steven, you're not- And then I would leave ... that's a trade secret.

Oh, I'm sorry. Oh, s**t. Do you think you're dumb because AI is so wrong?

AI is so wrong so often, and yet people are going to believe the AI when they didn't believe you five years ago. Yep. Let me give you Shimmy's take on this.

All right, Shimmy. Give us Shimmy. Shimmy- Shimmy's take ...

go ahead. Here's the fundamental problem. You guys are assuming that AI caused this problem.

No. This has been a problem in security from the day I got involved in 1997 or '98. We have never got our s**t together.

Yes. We have never- Yes ... been able to fix all the vulnerabilities we found, even when we didn't scan for vulnerabilities very often.

If we scanned once a year, it was a lot. We've never been able to just on purpose say, "This is a garden variety frigging intrusion. " No, we can't block it.

The CEO, it might be the porn he's watching. We can't block the CEO's porn. You can't do that.

We have never, in security, been able To do the obvious basic stuff that we know. And part of it is because we're not in security. We're not the guys patching it.

The help desk guys are, the IT department is. We're not the guys getting to make that decision about what level of risk we're willing to live to. That's the CFO's department.

" It's like the devil. You think you had it bad then? You just wait.

Boom. Let me give you 100 times more of these vulnerabilities and bad things, and let me empower the bad guys to stop wire writing like the prince in Nigeria and write like someone who lives down the block from you. And now what you going to do?

This is the security dilemma we find ourselves in. Tom, do you want to step up here and defend cybersecurity people on any level? Because they're just taking it on the chin.

Well, they got lazy because they didn't have to move very fast. That's one of the things that we learned last week was that AI has accelerated the gap between discovery and exploitation. Yeah.

That is what has really changed more than anything else. Yeah. We've known about this stuff forever.

What changed was AI has reduced the time from days or weeks to hours or minutes, and it has introduced the ability to do complicated things at the same time. I've always said that Mythos was just too good at exploit training. A good example is egress control.

Show of hands for everybody in the audience, not here, but everybody out there listening, how many of you have egress controls on your firewall? Meaning you know which traffic is going out of your environment, not just the stuff that's coming in. It does not count if you still have a permit IP any any at the bottom of a whole bunch of other rules.

I would be willing to bet that a lot of people don't have that control, because what's going out has never bothered them that much. " Tom, I got to call b******t. Okay.

Why? Because I'm going to tell you something. There was a whole industry in security called DLP that was supposed to take care of the egress thing, and that was before there was an AI, and it didn't work then, and that's why all those companies went out of business and had to sell for fire sales to the bigger guys.

Why didn't it work, Alan? Because we never got it right. Why didn't it work?

Is it a technical issue or a business issue? So there's two problems there. One, if it's a technical issue, if I have to route all my traffic through or around the DLP box, the DLP box can break.

We have a middle box problem that's all over the internet. But if it's a business reason, going back to what you talked about, if the policy is we're going to inspect everything that goes out, and it fails for some reason, what's the first thing that people do? Okay, we're not going to scan Excel spreadsheets because it doesn't know how to handle those.

We create exceptions to the policy to reduce friction. Nowhere else does that. Go to an Army base.

Just try to go onto an Army base, and they're going to check your ID, they're going to ask you why you're going to be there, they're going to ask you where you're going, they're going to ask you how long you're going to be there. It is designed to create friction to prevent people from casually causing these problems. And it's only getting worse with AI because AI gives us better reasoning behind that.

One of the things that you mentioned was using AI to draft better spam emails. Most of the spam emails that you get have bad grammar on purpose because the kinds of people who won't pay attention to grammar in an email stop paying attention to other things. What AI is allowing these attackers to do is create better answers when people are asking questions.

It's shrinking the amount of time and thinking that they have to do to pull off an exploit. I'm going to reach all the way back to the 1980s, so some of you are going to have to grab your shorts and drink your Metamucil, but it used to be that hacking was a skill. It involved actually having to know how these systems work, like John Draper with the whistle.

Blue boxing the telephone system required knowledge. He's a unit, actually. I knew this.

And what happened? We created script kiddies. We created people who could take the tools that these hackers used and leverage them without the knowledge and understanding of what was going on.

Guess what? 0. These are kids who have no clue what they're doing.

They just go in and type it into an AI, and the AI gives them the results, and they're happy about it. Yes. But basically what you're saying, Alan, you don't got to be smart.

You could be as dumb as a rock and use AI to break s**t. And my whole thing is this. If you are committed to being a nuisance on a plane, on a bus, on a subway, in the supermarket, AI is your friend because you don't got to be smart.

All you got to do is tell it to go do something, and it will wreak havoc. And that's the problem is that so many unsmart people are using AI to destroy stuff, and the people who had the one job to protect us have fallen asleep at the switch, and they expect AI to cover their six. It's not going to happen.

We dropped the ball, and the chickens have come to roost. I'm telling you, it's going to get a lot worse before it gets better. All right.

Mike, we've lost control. I'm trying to figure out what color my- We've lost control. The wheels have come off the bus.

No, I'm talking about this show, not security. I'm trying to figure out what color my hand basket should be after this. Well, no, I'm just sitting here thinking, has this been going on the whole time I'm away?

Sometimes. Sometimes. Oh, yeah.

Okay. Yeah. Yeah.

Especially if we're talking about AI, it definitely went all over the place. All right. Let's jump.

But we're going to switch gear here because while there was a tech field day event for security last week, and Tom was the host, and Alan was there, and I think Steven's involved in this, so there's three out of six are players in this thing. But Tom, what were you guys talking about in besides AI destroying the planet? Are there other issues in security that people should be paying attention to?

No, that was pretty much it. It was AI. So we talked a little bit about that exposure vulnerability gap thing.

That was one of the primary things that they were talking about, creating containment systems to prevent these agents from hacking things while you were deploying patches. A bunch of companies, Cisco especially, was talking about their Live Protect system, which is basically like an interception layer, which I think is something that we've really needed for a long time. The other thing that I thought was interesting was the fact that we've had this concept of zero trust for years.

Zero trust is built for people, not machines. We have to start thinking about agentic security in a different way because you effectively have broad-based access with lightning speed, and they don't need to go to sleep, and they're not worried about getting fired. So we have to think about that, and not only that, but attribution, like what caused this to happen?

So there's been a lot of stuff going on about how to discover these agents, and not just agents that are running in your environment, because a lot of people will say, "Oh, well, I want to discover the agents that are unauthorized," like people who are using OpenClaw when they're not supposed to. But one of the other things that stuck out was what happens if you have people who are still running agents in your network and they've been fired by HR three months ago? What does that mean ultimately?

And I think one of the last things that was interesting to me was that they are starting to build the security apparatus to operate machine first and human second. The videos will be up later this week. But HPE, they built an SRX interface that doesn't have a GUI.

It is API and MCP first, and it's operated by an agent. And you think about it, you're like, "Oh, wait, that makes sense. " It can interact through function calls and everything like that.

And I think that what we're seeing ultimately is that the way forward in security is to embrace the tools of the people that I'm fighting. " That's kind of where we're at right now. Alan, you were there hosting it for the Friday when we had AWS and AD Atrix, which those were really great presentations.

What was something you took away from this that was a little bit different than what I saw? A lot. But no, I'm just kidding.

Here's the thing. To me, the theme of all three days is we are not going to patch our way out of this. Right?

I don't care whether we're patching by hand, we're patching by AI, we're patching by caveat fiat, or any other ot. We're not ever going to patch enough to fix this problem. And so to me, I thought some of the best presentations, Tom, you mentioned the Cisco, Aviatrix ended the day, Friday afternoon, with their blast radius containment formula, where you can actually-- They reduced it to math, arithmetic of what's your blast radius from any given potential incident or vulnerability.

I do think the week before I was at Security Field Day, or two weeks before I was in Austin for the Qualys ROCCON, Risk Operations Center. I do think security has to go back to its roots a little bit. At the end of the day, we can't fix everything.

We've got to be in the risk management business. When I first joined in security, most security teams were not part of IT. They were part of risk management, answering up to the CFO.

Right? I think we almost have to go back. I don't know if we'll answer to the CFO, but the primary concern of security has to be risk management.

Mm. What are we willing-- We can't fix everything. We can't make everything go to zero.

What are we willing to live with? So that's the question, and I guess, Tom, I'm going to kick this back to you because you were at this thing. But here's the part that leaving me scratching my head.

In theory, there are tools that will make our security people better and faster, and we should be able to keep up, but they cost money. And it would seem to me that it may be a year before people have the money to go invest in those tools and things to do. So in the meantime, the bad guys have infinite resources and all the time in the world.

So is the next year just going to be exploit hell because they're going to have a decided advantage for at least 12 months, maybe more? There is an element of that uncertainty, right? But what's the Chinese curse, "Live in interesting times"?

Although I'm getting kind of tired of hearing it. Here's what I recommend for people. First of all, if you haven't done a security audit recently, boy, now is a perfect time to get off your keisters and get that done.

Look at what you are doing and what is necessary. To quote the architect from "The Matrix," there are levels of survival that we are willing to accept. If you have opened everything in the world to the internet because it just makes your life easier, that's got to be done.

" Well, what's step one? First of all, lock that sucker out. Do not have that publicly addressable on the internet.

But more importantly, you can use the tools that you have to begin to understand how these exploits are being done, and you can create mitigations for those. And it's just as simple as following basic, simple security procedures, right? If they can get a foothold, where can they go from there?

If you can limit their ability to move laterally, you're going to have a better time. If you can isolate those devices. We have tools right now that can slow things down significantly.

Can we completely eliminate risk? No. If we could, I'd be selling you a different bill of goods at a different program.

But now we have to delay and deny their ability to gain footholds. Not everybody is going to luck into getting into a developer's laptop and stealing $3 billion of crypto coins. But if you have the ability to make sure that a PHP exploit can't lead to people downloading all the emails off of your Exchange server, you're going to look like a hero until Microsoft or Google or whomever can patch that vulnerability.

And yes, it's going to cost money, and now is the time. It is November the 2nd. " Otherwise, the CEO needs to practice for what he's going to say when Bloomberg comes calling.

Oh my God. Oh my God. All right.

Helen, go ahead. I raised my hand first, Yvette, but I'm willing to cede- Go ahead ... my time to the lady from New York.

What do you want to say? Okay. So he's talking about budget.

So here's the thing. I would treat all those sessions as a great way of learning what your vendors are building. Right?

So that's one. And every one of those sessions is a question that you should try to answer in your own freaking environment. And then the last thing is this.

Before you budget anything you saw there, I would ask for a customer result from someone who does not work for the vendor. Because every vendor demo is a question list, and if you have not tended your own garden, you have no business buying what they were selling. Let me pile on.

I'm about done hearing the poor old CISO begging for money with two loaves of bread under his arm. Right? When you got security companies with literally shelves full of shelf wear, of stuffed shiny trinkets they've bought.

Last year's shiny trinket, the year before's shiny trinket. And then 50% of this stuff either never gets deployed or gets deployed and then falls out of use because I want to go buy what the next shiny trinket is. I think we could get a lot done with the tools we have if we're forced to use them.

Absolutely. Can I just say that it's not the lack of money, but the lack of, I was going to say respect. Priority.

I'm not sure that's quite right. So to me, security suffers from a combination. Cybersecurity, IT security suffers from a combination of a certain level of inherent wonkiness.

Like try to explain to a business stakeholder what exactly the vulnerability is, and the poor security professional is perfectly coherent to the people who know what he or she is talking about, but just utterly unable to understand the person who actually holds the budget and the money. And- So Guy, that's the Roger Dangerfield argument, huh? Well, there's that.

There's a combination of that, yes. No respect, yes. There's a combination of that and the fact that so much of what you're protecting against is statistical probabilities, and nobody understands statistics.

Almost nobody understands statistics. " Well, I think the bigger problem is that with security, with IT security especially, honestly, most of IT, is that you're essentially trying to battle against a negative. If IT security, if InfoSec does its job- Success means nothing happens, yeah ...

nothing happens. And it's really hard to get for somebody to pay for nothing to happen. And even if InfoSec people were-- And honestly, they're the most charismatic people in IT, in my opinion.

Wireless people are right up there. But InfoSec people, they're colorful. They're crazy.

They're fun. But no matter how much fun they are, no matter how well they make their case, if they're doing their job, nothing happens. And it's really hard for somebody to convince somebody that, "Give me money and support so I can make nothing happen," is a beneficial outcome.

How did you know that nothing happened versus they just got lucky? Yeah. Well.

Well, look, that's cybersecurity. That's what I'm saying. It's statistics.

It's life as a zebra. Yeah. You don't know as the zebra whether today's the day the lion grabs you by the butt.

And if he does, is it because you're not blending in anymore? Were you at the outside of the herd, not at the middle of the herd? You're not running fast.

You don't know, but you're a zebra, and you just hope today's a good day for you, and the lion eats someone else. At the end of the day, this is all about being able to describe the value delivered to the buyer. Yep.

And most cybersecurity InfoSec people are not business people. They're technical people. So when I talk to my clients, it's not about the widgets and shiny objects, because shiny objects catch raccoons.

It doesn't have the ability to determine where your business is going to go. You need to be able to tell them what the value is delivered, not just the ones and zeros, the bits and bytes. And that's the problem.

You got tech people trying to convince businesspeople about technology that doesn't deliver for them, and that is a storytelling problem. It's a storytelling problem. Here's my prediction.

A year from now, security's going to be a lot better for many fewer companies that actually survive the next year. All right, we got to end it here because we're over. Guys, I could tell you about all the great places to watch next show on Gang, but you already know that.

I say it every day. I'm going to take these last 30 seconds to say, hey, get off your butts and go vote if you haven't voted already. You may not like what's going on in this country.

You may love what's going on in this country. But you have a say in what is going to happen in this country, and that say is by going out and voting. So get up early tomorrow if you haven't done it already, and vote.

We'll be here tomorrow, hopefully, on The Gang. Thanks for joining us.