Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Melissa Vice on the value of vulnerability disclosure programs
Guest:
Melissa Vice
Published:
Updated:
Duration:
35 min
Episode summary
The Department of Defense Cyber Crime Center (DC3) operates a Vulnerability Disclosure Program (VDP) that handles critical cybersecurity issues reported by the public, including using an actual red phone for urgent matters. In the latest episode of WE’RE IN!, Melissa Vice, director of DC3’s VDP, describes how they respond to cyberthreats and collaborate with other groups within the center, such as the Operation Enablement Directorate and cyber forensics laboratory.
Tune in to hear how the program, which began in 2016 following a successful bug bounty event, has processed over 53,000 reports, 56% of which were actionable, and resulted in nearly 30,000 remediated vulnerabilities.
Listen to learn more about:
Why VDP has been recognized by the government as a reliable and economical cybersecurity strategy
How Melissa and her team handled the notorious Log4j vulnerability
How DC3 has explored the use of AI and machine learning to enhance capabilities and scale operations
Listen to the episode
S3 E19 · Melissa Vice on the value of vulnerability disclosure programsWE'RE IN! Podcast · 35 min
Key takeaways
A VDP is an enduring program Unlike time-boxed bug bounties, the DC3 VDP runs continuously, is open to anyone with a HackerOne account, and rewards researchers with reputation points rather than money.
Every fix is revalidated Validated reports go to Joint Force Headquarters DODIN for tasking, and the VDP team confirms each fix is fully remediated before closing a report. About 56 percent of reports are actionable.
Tight remediation deadlines by severity Using CVSS, critical and high findings must be fixed within seven days, mediums within 21 days, and lows within 60 days.
Small defense contractors benefit most The Defense Industrial Base pilot drew 41 volunteer companies instead of the expected 20 and produced 403 actionable reports. It became a permanent, no-fee program.
A VDP is not a compliance checkbox Melissa stresses that a mailbox for reports is not enough; a proper VDP needs a back end that tracks findings to timely remediation.
Notable quotes
In VDP land, I just sorta close the door, and I call you, and I say, hey. There's a problem here. Your door's open.
…it's not a checkbox compliance thing. It's not just enough to to make a mailbox and and have them send in some reports to you.
It's not a proverbial red phone. I have a red phone on my desk.
I'm an introvert who plays an extrovert on TV.
Questions this episode answers
What is the difference between a vulnerability disclosure program and a bug bounty?
A VDP is an enduring process, while bug bounties tend to be time-based and monetized. The DC3 VDP pays no money; researchers earn reputation points that can lead to invitations to paid bug bounty events. Read this section
How is a VDP different from a penetration test?
Pentesters may get information or access and may pivot and exfiltrate data. VDP researchers work only with publicly accessible information and stop at finding the weakness, then report it, like noticing an open door without going inside. Read this section
How fast must DoD vulnerabilities be remediated?
Based on CVSS severity, critical and high findings get seven days, mediums up to 21 days, and lows 60 days, followed by revalidation of the fix. Read this section
What is the Defense Industrial Base Vulnerability Disclosure Program?
After a one-year pilot with 41 small and medium companies that produced 403 actionable reports, DC3 turned it into a permanent program offered at no fee to any DIB company that volunteers. Read this section
How did DC3 respond to Log4j?
DC3 coordinated with other directorates and pivoted a Defense Digital Service bug bounty to stand up a Log4j bug bounty in two days, when such events normally take about four months. Read this section
About the guest
At the time of recording, Melissa Vice was director of the Vulnerability Disclosure Program at the Department of Defense Cyber Crime Center (DC3), the single focal point for receiving vulnerability reports from crowdsourced researchers. She has spent about four decades in IT and cyber roles, including a decade and a half in the federal government after joining from General Electric's aviation division in 2009.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. Today, I'm joined by Melissa Vice, director of the vulnerability disclosure program at the Department of Defense Cyber Crime Center or DC three. Melissa's office serves as the single focal point for receiving vulnerability reports and interacting with crowdsourced cybersecurity researchers supporting the joint forces headquarters, DODIN and US Cyber Command. Melissa has over three and a half decades of experience working in various IT and cyber roles, so we'll have a lot to talk about. But before we launch into some questions, here's a quick word from our sponsor.
Confusion in the marketplace about which is the best method of security testing is so real. Bug bounty, pentesting, pentesting as a service, what do they all mean? We break it down in our latest playbook, navigating the security testing landscape to demonstrate the strategic value of third party security testing. We cherry pick the best elements across the security testing market to incorporate into a strategic, comprehensive pentesting solution, the Synack platform. Learn more at synack.com/playbook. That's synack.com/playbook.
So right off the bat, can you help clarify for our listeners what a vulnerability disclosure program is and how it might differ from other concepts like pentesting and bug bounty?
Absolutely. So a vulnerability disclosure program is an enduring process and an enduring program unlike bug bounties, which tend to be a time based challenge that goes describe this... And it gets very confusing sometimes because we came out of a bug bounty program. We were generated from the hack the pentagon bug bounty program that the late Ash Carter, when he was SecDef, and defense digital service ran in 2016. So from that, they did a bug bounty. They realized that, wow. We're getting some great vulnerabilities submitted to us. And kind of as happens, because bug bounty programs are monetized, they're handing out the money for that, high fiving each other, very excited.
And then Ash Carter very responsibly says, hey. But who's gonna take care of these vulnerabilities that you've now identified? And that's how DC three was tapped to stand up the first federal VDP program. So it was completely new, very innovative. It was something that was happening in the public sector, but not happening in the federal government. So fast forward almost eight years later, and so we are still going strong. We sort of thought... There was a joke in the beginning that we're gonna work ourselves out of a job. We're gonna clean everything up, and we're just not going to be here anymore. But, of course, that didn't happen. Like I said, we are not paying out monetarily to the researcher community. What what we give are reputation points. And those reputation points allow them to climb the leaderboards of their respective companies and then get invited to those lucrative bug bounty events.
We work with HackerOne. We've been a HackerOne house since our inception in 2016. Well, we didn't totally start it with them initially. We were kind of old school with Excel files and emails. From that time, we have also built out our systems so that we can work with the top three HackerOne, BugCrowd, or Synack as we need to for any bug bounty events that we might be running. Now how it's different from a pen test, let me touch on that for a moment. In pen testing, for one thing, you might give the researcher some information. You may... Maybe give them a little bit of details or give them some access. And we don't do that for VDPs. They are using the true emulation of what an adversary would do. So we are working with publicly accessible information, and they are just coming at us all day long trying to get in, to break in, and find any weak spots, and then they notify us about those to be remediated.
And that's really the true goodness of having a VDP. With pentesting, you might actually go in, pivot, you know, x fill some data, all these other things. I like to say that it's like you pay me to watch your house while you're on vacation, And I come, I jiggle the doorknob, I open the door, and I go, hey. Are you home? You know? But I don't come in and rifle through your jewelry. I just kinda, you know Right. Right. In VDP land, I just sorta close the door, and I call you, and I say, hey. There's a problem here. Your door's open. And and that's really more of a VDP than a pentest.
But I I imagine running a vulnerability disclosure program for an organization like the Department of Defense, hello, is huge. So can you tell us a little bit about your day to day? What's... What that's like?
Absolutely. Yeah. I'll just tell you that cybersecurity is a team sport. So it is certainly not just me. It... You know, I have a great team behind me of dedicated vulnerability analysts. A VDP also is different in a bug bounty in the way that it's open to everyone who has an account at HackerOne. It's not a private invitation. So the good news of that is that in the nearly eight years, we've had over 53,000 reports that come in to us. And we're able to take those, triage our internal team, then triages, validates those reports against any of the the DODs like STIGs or, you know, security reference group, you know, the 800, one seventy ones, all of that.
We look at it against that lens. And then if it is validated that, yes, this is a real vulnerability, we toss it over the fence to our SME team at Joint Force Headquarters, DODIN. And then they have the teeth and the muscle, and they put that tasking order together, find the system owner, and send it through our vulnerability report management network, VRMM, which we lovingly call VIRMAN. And they send it through our VIRMAN network. VIRMAN. VIRMAN network. And so that's our cradle to grave tracking system up on the high side that the researchers, their information will be fed into, and then the system owners can get all of the information. They can ask us for RFIs at any point, more reference information if they need it, but then they will do the fix action.
It comes back to us. And we... The real important part is we revalidate those fix actions. We make sure that they're a 100% remediated before we will close any reports. If it's not, fine. You know? No problem. Rinse, repeat. We'll give you more information. We'll get it done. And I can tell you that of those 53,000 reports, we're at about 56% year over year that are actionable. So that's... We're closing in on 30,000 reports that have been remediated in that seven seven and a half year time frame.
Fixing those vulnerabilities just like ousting vermin from from your home, I guess. Something... Some sort of analogy to be made there, I I I was interested to see that's... That the cybersecurity and infrastructure security agency, CISA, unveiled this product security bad practices document recently. Now now I know that CISA doesn't dictate policy for the DOD sector. It's a bit of a different animal, but I I do think this kind of secure by design push in this really calling out organizations' failure to actually publish any sort of vulnerability disclosure policy as just a general bad practice? Again, I I know CISA may not be completely apples to apples with DOD, but how do you view that establishing a a VDP as a cybersecurity practice?
Well, it is really a good question because I can tell you over that time frame of the seven and a half to eight years, really what has happened is VDPs have been accepted by the government as a reliable source of protection. OMB's... I think it was the twenty dash thirty two really says that VDPs are an economical way and a reliable way to help protect entities. So it's so much so, honestly, that we looked at it and we said, hey. Do you think that there's an ability for us to take the magic we've been doing for the DOD, and would that same success work for the defense industrial base? They have, of course, the public sector, but they're not in the DOD space.
So there is that that gap there. So we looked at it. We did a one year pilot with the defense industrial base. We did a feasibility study with SEI Carnegie Mellon. We looked at how many companies might we do in the pilot. We thought, oh, maybe 20 companies. They'll voluntarily do... Go through this process. We partnered up with two entities within DC three, our DCISE program, which works with the the defense industrial base, and then also defense counterintelligence and security agency, DCSA. So between the three of us, we come together and we decided that we would put this out for one year from 2021 to 2022 in April. And we thought we'd invite, you know, 20 companies to volunteer. And we... By the end of it, we had 41 companies.
So there was definitely an impetus to us that, yeah, the industry recognizes that they need something like this. We focus on small to medium sized companies. We felt that they were the ones that most needed this help and the identification. So they put their publicly accessible assets out there and our research community, our hackers, our crowdsourced ethical hackers, we're able to go after and find 403 actionable reports for them. Now, you know, it's hard to estimate sometimes what does a data breach cost. But if you kinda Google it, you'll come up with IBM's number maybe. Currently, I think it's at, like, either 4.3 or $4,500,000 per data breach. But even if a
A long time. Right? And so it's it's that ounce of prevention is worth a pound of cure. So being able to protect these companies and keep them left of boom is so much more important than just having to try to fix everything after the fact, try to clean it all up. It's it's gonna cost them a lot less, and it costs the federal government less to be able to do this. So, yeah, very successful program, for the pilot, and we're proud to announce on the June 3, it became a bonafide program. So we are now offering the defense industrial based vulnerability disclosure program to any DIB companies that want to volunteer at no fee.
Well, you heard it here. Hopefully, not first, but you heard it here as well. So if you wanna join that program, it's officially established. And, yeah, your point about it being a a more proactive stance that is so well taken because, yeah, you don't wanna be constantly scrambling just to respond. You gotta be out there opening these networks up a little bit. But, you know, that said, I imagine that that's easier said than done in a in a culture potentially like the DOD. I'd be curious to hear how attitudes have shifted during your tenure with the organization and how things have changed over the years.
In the beginning of hack the Pentagon, I imagine, I totally imagine, that there was a lot of incredulousness when when Ash Carter says, hey. I'm gonna invite some hackers in today, and they're going to attack the Pentagon. I can tell you that I've probably...
Well, hack the Pentagon. The name doesn't help that much. Right? Like, hack the Pentagon sounds so intense. It's like, wow. You're really gonna go in there and hack the Pentagon? That's what we want?
Absolutely. Absolutely. So... But it but it does... That... That's really what they needed. They needed to shake that up. Right? They needed to be in your face about it. So the same is true for us. It's looking at this, a lot of times, the government is a little slower, let's say, maybe a little slower at adoption rate. But over this time
A little bit. A little bit. Just a little bit. But I can tell you, you know, again, back to CISA, their binding operational directive 20 dash o one to have organizations and other federal agencies open up VDPs. Like I said, we were the first federal. We're still the world's largest. But through the adoption of other VDPs and other protection vehicles out there, we really are just looking at a whole of government. How can we shore up any leaks that might be forming? And so it's it's bigger than just DOD. It it does have to go out to the private industry. And and it... The thing that I would maybe put out there is that it's not a checkbox compliance thing. It's not just enough to to make a mailbox and and have them send in some reports to you.
You have to have that back end that I described. You have to have someone who is going to track that down and in a very timely manner, make sure that those things are remediated. We use the common vulnerability scoring system, and that's pretty pretty basic through the industry. But the CVSS scoring gives you how severe that finding is. So if it's critical and high, you have seven days to fix it. If it's a medium, you're gonna... You can have up to twenty one days, and, we give you a whopping sixty days for a low level finding. So these are not slow processes. You have to be on it and and get those remediated and revalidate and test for that remediation. And so that's really what you need to have in a in a proper VDP.
And for people who are thinking, wow. Seven days, that sounds like a long time. I I happen to know I think the industry average in the private sector for remediating even a critical vulnerability is something in the, like, fifty day range. So it's like, that's actually still pretty quick. I mean, maybe there's always room to get faster, but that... That's pretty quick as far as these things go. The o m b 20 dash thirty two, good memory, by the way. I I was I was googling that myself on the side here. The White House back in 2020 issuing this memo on improving vulnerability identification management remediation. So you talk about the shifting views and the the desire to actually, you know, get to a place of action on this, and it has been several years of really beating the drum and getting getting everybody on board. Now with some of this information you're uncovering, as I understand it, you know, DC three is a is a federal cyber center kind of disseminating a lot of information, getting the word out on some of these vulnerabilities and other items.
What is the flow of information like for you? What are you really pushing out to... We heard a little bit about the defense industrial base. What about other federal agencies, the the DOD? How does that information flow work from d... DC three?
Oh, great question. And just keep in mind that the VDP is only one directorate within the DOD cybercrime center. So our mission as one of the federal cyber centers is to deliver innovative capabilities and expertise that enables and informs law enforcement, cybersecurity, and our national security partners. And so that could be foreign. I work a lot with Five Eye partners as well for their vulnerability standards. We also work very purposefully forging and strengthening deliberate partnerships throughout. And so we wanna look at relationships with, of course, other defense agencies, interagencies, like I mentioned, with the DIBVDP private sector and our international partners.
We just will send those out. So basically, it is a broad range between our cyber forensics laboratory. We do a lot of support and sharing for investigative purposes. We came out of Air Force OSI. And so DC three is aligned in the air force. That often surprises people, but we are in the air force. And we are aligned under the inspector general, the TIG of the air force. We are no longer strictly under air force OSI. In 2021, we became a field operations agency, a FOA. So we're kind of aligned with them. But, again, our entire background comes out of law enforcement and counterintelligence. So a lot of behind the scenes, you may not hear DC three out in the news a lot.
And that's spun out from under the the OSI referring to the Air Force Office of Special Investigations. That does sound like something that you might... That might be doing some important behind the scenes work if you're if you're talking about maybe not being in the news, but still delivering some pretty pretty important results. And, you know, to that end, on the information side, if you really come across something that, say, is super sensitive, super critical, you're like, wow, we gotta act on this not in seven days, but like yesterday. Is there a proverbial red phone for a really urgent phone or some way to get the word out quickly about some of the more pressing matters?
Don't worry. That one. Okay. But, yes, it it... We do have the red phone. So there are certainly times... There was one last week that I can't talk about where I was... I happened to be at the fort, and I was briefing the JWASP, which is the joint director's update briefing, you know, for the j three, talking about what's going on in the world. And I had to rush back to the office and go talk to another group within our organization and say, are you aware of this? Are we doing this? What's happening? So, yes, we do use the red phone. And certainly, being the VDP and having it out there, a lot of times, it's so well known, but people don't know what what do we send to you. So we do get a lot of things that are not within our scope, let's say. It doesn't go to us, but we always make a a very concerted effort.
We take everything seriously that comes to us, and we we will VFR that over to the right the right owner to get things taken care of. I can tell you one that... You know, one story I can talk about is Log four j. Remember Log four j? It happened right before Christmas. I had just put in for, like, two weeks of leave, and here, boom, it drops. Right? Yeah.
But log four j, we were... It was it was good because we were able to then confer with some of those other groups within DC three. So one group that we have is the operation enablement directorate. They are so well versed. They are counterintelligence analysts. They have native language speakers for all of those countries that we care about. And so they're always getting the behind the scenes. We have, of course, like I mentioned, our cyber forensics laboratory. So they're always diving in and and getting to the root of things. And, of course, our DIB services division, which is working with any voluntary or mandatory defense industrial base reporting environment, so if there is an incident response. VDP is kind of a weird animal because we are left of boom. We are pre incident, but the rest of the the crime center is always looking for that indicator of compromise.
Good news on the Log four j is that we were able again to pivot a bug bounty that defense digital service was running. And so when Joint Force Headquarters DODIN came to us and Skinner called and said, hey, can we get a bug bounty on this Log4j thing? We were able to stand that up and run that within two days. And these take about four months to put together, honestly. So this was an exception to the rule, but it was perfect because we were really able to get after it, have an inner inner agency coordination, and pull everyone in. CISA, I think, did a lot of advertising about the Log four j bug bounty, but it was very successful for us.
And that was certainly one time when crying wolf was absolutely warranted. I I saw a report recently from Datadog showing that Log4Shell exploits are still going around evading detection and compromising organizations today, what, two, three years later almost. Yeah. It's definitely two days. Good to jump on that right away and and get some of those threats mitigated. Now we've made it this far in the conversation without talking about generative AI, so I have to broach the subject. It's it's almost a mandatory, gotta talk about AI at some point. But but in all seriousness, I know the Department of Homeland Security warned in its most recent annual threat assessment that this technology, quote, will have the unintended consequence of adding layers of complexity to the threats we face, end quote. I'd be curious to hear what the implications are for some of your work today.
Well, I think it's one of those that we'll we'll know when we know. We'll see it coming. But I I think one of the areas that the the federal government is really looking at, and I know the air force specifically, is already looking at how we can leverage artificial intelligence and machine learning to enhance the activities that we're doing so that we're able to combat what comes our way. One of the things that we've built into and we're enhancing the defense industrial base vulnerability disclosure with is some of that front end AIML work. So we're using that to be able to take that to scale. If there's an estimated 300,000 DIB companies and we're looking at about 75% of them are small to mediums, well, how are we gonna get from 41 companies to 300,000 or anything close to that?
We will never have enough federal employees on the roster to service all of that. So we have to look at ways that we can can work with it. And part of that is going to be, of course, working with some artificial intelligence, being able to data set that information and onboard our customers in a very efficient, quick manner. So I'm sure generative AI is going to continue to morph and change. And I can tell you we we actually had a... I'm in, you know, working groups and other things, of course. But we had a women in tech working group just yesterday where we did an upskilling day, and that was... Our topic was AI. So we did an AIML working group. That was very fascinating. Learned a lot about quantum computing that I didn't know yesterday.
That sounds fascinating. And speaking of women in tech, you're a member of the women in cybersecurity group, WiCyS. What can you tell me about the need for groups like that and initiatives aimed at supporting women in in security generally?
I think there's a there's a need for all groups, and it's not just supporting women. And and honestly, I think the motto of WiCyS is if it... If you had Lynn Dohm on here right now, she would tell you that we hope someday we don't have to call it women. We don't have to make that distinction. But for right now, we kinda do. So it it it is a a wonderful organization. It's not just for women, but they put on just amazing content. I've spoken at their conferences multiple times, been on group panels, things of that nature. So I highly recommend that group. I'm also in a lot of other groups. I'm in the AFCEA, another fabulous group, the Armed Forces Communications and Electronics Association International. It's a big one, so the AFCEA.
Infoguard with the FBI, that's a really nice one. I'm in two think tanks, the National Security Institute, NSIs, and a member group of of Project Everest. And, no, it has nothing to do necessarily about mountain climbing. But but I... So that's that's what I would kinda say is that, yes, we definitely need not not just the the female only groups, but I would just say if you're gonna join the federal government, join every group you can find. You're gonna meet some great people. You're you're definitely going to be introduced to information that you didn't even know you needed.
I think one of the hard things for the federal government that's that's... They recognize and identify, but it is across the board in cybersecurity. It is difficult to retain that talent base. But what we find is that if we bring in internally to our group, if we bring in folks who have a background, maybe in IT, if they've done some help desk, that type of work, or they just have kind of a general understanding of the hardware and the software of a computer, What they love is that they can now come in with that base knowledge, and we can train them up. We can teach them how to think like a hacker. And they need that that knowledge even to bring in those reports.
Like I said, we validate, we triage. So we're not just kinda passing that through. Our team need to be very skilled at understanding, does this proof of concept or POC, we call it, does that POC really work? And then when we see the fix actions, how do we know that it's truly remediated? And that just gives our team the ability to grow within. We have about a three tiered level that association there. So they're always out there doing capture the flags. You know, we'll get them in different hack hack the box, hack... Try hack mes, you know, all these other types of organizational things where they're keeping their skills sharp and they're learning not even from... You know, just in that environment, but we have weekly tech talks. We'll we'll host tech talks with CISA's tech teams.
Across the board, it's a small world, honestly, in this arena, but we all know each other. We all have respect for one another, and you can always learn something something new. We had talked offline about, you know, going to hacker summer camp, going out to Black Hat, DEFCON, you know, all of these conferences. And so it's... It is a small community. We know each other, but you can always learn something else. There's always something new to learn.
Absolutely. No. And it is something that's certainly appealed to me as well on the cybersecurity community side of... I think there is this sense of rising tide lifts all boats, people in it together for some of the same mission sets. That being said, you obviously work with a very particular mission critical defense oriented mission set, and you've spent a a good part of your career with the DOD in in in the US Air Force. And to say nothing of the cyber community, these are some pretty big bureaucracies in their own regard. So what's something that you wish you would have known on day one heading into to DOD to achieve some of the best security outcomes for our nation?
That's a wonderful question. And, yes, I have... I I think you put it to me. I've spent a decade and a half with IT and security for the federal government, but that's only really my federal government. I've I've literally spent about four decades at this point in IT and different various roles. But one of the things... I came into the federal government in 2009 when they were doing SMEs. I was at General Electric's aviation division, and they're running their global repair technology center. So teams all over the world doing, you know, again, aircraft engine problems. So coming into the federal government, I didn't really know much about working for the government, but I was recruited in. I would say the very first thing that I should have known or should have understood that I did not is that it takes so many people working together in tandem to get things accomplished.
So start with relationship building. That is so important. Join interagency working groups. Join those professional associations. Join a think tank. You know? Join things that are going to challenge your thought processes and challenge your beliefs and get you to meet other people. Because remember, their career is growing as well. Remember that you don't know who's gonna be the next general or, you know, people are gonna get promoted there. So meet everybody you can. Really, really focus on that relationship building. WE'S, AFCEA, all of these different things. Also, I would I would say that when you go out and take training someplace, really focus on your cohort. Get to know your cohort that's there with you. I was fortunate enough over COVID to be able to take some of the Harvard Kennedy School courses because they were available online.
And they were like a third of the price. So I'm like, oh, I can get this done. So it was just... I took a lot of great courses, but one that stood out was doctor Jennifer Werner's leadership development decision making. So that is just a fabulous course. And my cohort in that, there were so many books introduced to us, we thought we're never gonna get all through all these books. That five of us came together and created a Harvard Kennedy School Leadership Decision Making book club. And so we meet once a month. We have a LinkedIn book club. We... And so we have folks from Germany and Australia. The group has grown. I don't even know how many members we have now, but it's the highlight of my month is that we all get together for an hour, and and this also forces us to read the book cover to cover because we're gonna have to show up and discuss it.
And so we will take little chapters at a time, a few chapters. We're all very busy. We will do it. And we we we get a chance to talk about how how are we leveraging this information and putting it towards our careers. And so really think about relationship building.
Well, to say nothing of the impressive Harvard connection there, I'm just impressed that you're one of the few people I've spoken to who's started a pandemic era book club and managed to stick with it all this time because maybe speaking from personal experience, some book clubs kinda trail off after the pandemic kind of wound down a little bit. But finally, this is something that we ask of all our guests in the podcast. What's something that we wouldn't know about you just by looking at your LinkedIn profile or hearing about your book club?
I would say that people probably don't understand that I am severely an introvert. You see me out there talking all the time at all these different places, but I am... I have a lot of social anxiety and I'm an introvert. So you might see me out and about, and then I will go hide at home and recover from from that. I'm an introvert who plays an extrovert on TV. So that's that's kinda how I look at it.
Well, I really appreciate you playing the extrovert on the podcast here. Some great perspectives. I'm sure our our listeners will appreciate your insights as well. So thanks for joining us and great conversation, Melissa.
If you liked what you heard today, I hope you'll give us a five star rating and review. It's a big help. And please share this episode if you know anyone who could appreciate a little info sec wisdom on their morning commute. We have a whole catalog of episodes well worth a listen, so you may wanna check out past interviews as well. Finally, if you know someone who might be a good fit to appear on the podcast or have any comments or feedback, drop us a line at we'[email protected]. That's s y n a c k dot com. Until next time.
WE'RE IN is brought to you by Synack. If you're looking for on demand continuous access to the world's most skilled and trusted security researchers, you can learn more at synack.com. Synack recently launched its Empower Partner Program so that partner organizations can more easily offer the Synack Pen Testing platform to their own customers. This approach helps optimize Synack partners' technical competencies and allows them to better integrate Synack into their portfolios. It's a way that partners can win new business by adding continuous best in class solutions to cybersecurity, cloud, and DevSecOps offerings. Synack partners with organizations around the world to make them safer, more resistant to cyber attacks, and more capable of finding and fixing dangerous vulnerabilities before attackers are able to exploit them. Learn more at Synack dot com. That's synack.com.
