Meet the experts who power Synack’s strategic security testing platform. Our Synack Red Team unites over 1,500 of the world’s most skilled and trusted security researchers, who work with patented technology to deliver best-in-class offensive security testing on a continuous basis.
Former FBI Cyber Exec Cynthia Kaiser gives an in-depth look at the evolving ransomware threat landscape, the interplay between government and private sector in cybersecurity, and the challenges and opportunities presented by AI.
Listen to the episode
S4 E5 · Cynthia Kaiser is Out to Stop Ransomware ThreatsWE'RE IN! Podcast · 33 min
Key takeaways
Victim focus changed intelligence sharing Kaiser says the shift to public advisories came from culture change across the FBI, NSA, and others, helped by adversaries using disposable infrastructure and by recreating sensitive findings in unclassified form.
Ask why you need attribution Individual attribution matters for charges, country level for public warnings and policy options, but defenders mostly need to know how activity is technically similar so they can block it.
Use phishing-resistant MFA Her top advice is phishing-resistant multifactor authentication, because ransomware actors are hijacking push-based MFA and abusing single sign-on and identity systems.
Paying a ransom raises your risk Affiliates work for multiple ransomware groups and may return once they know a victim pays, and decryptors restore on average only about 65 percent of data, according to Kaiser.
Defenders hold a fragile AI advantage Kaiser believes AI currently favors defenders through behavioral analytics, but she is watching for polymorphic malware that changes itself on a network without a human involved.
Notable quotes
…it doesn't matter if it's China, Russia, Iran, aliens. It's going to affect your network no matter what.
LLMs were made for this. So being able now to take a lot off of the network but use an LLM to figure out what the crown jewels are.
Fragile advantage is what I would say.
If I could give advice to any company right now, would be to have phishing resistant multifactor authentication.
Questions this episode answers
How are ransomware groups using AI?
Kaiser says they use it for more believable phishing and deepfakes, to learn network patterns and hide activity, and to sift exfiltrated data with LLMs to find the crown jewels. She is watching for polymorphic malware next. Read this section
How do ransomware attackers get initial access today?
The main vectors she sees are compromised identity and authentication, including weak MFA and single sign-on, zero-day vulnerabilities such as the on-premises SharePoint flaw, and third parties like outsourced call centers where insiders are coerced or paid. Read this section
Should companies pay a ransomware demand?
Kaiser says it is not black and white; the FBI did not recommend paying but saw it as a business decision. Her role is to explain the risks, including repeat attacks and decryptors that do not restore all data. Read this section
Does attribution matter to a ransomware victim?
Functionally it often does not, since victims want to stop the activity whoever is behind it. She notes that naming a nation state sometimes made organizations take a threat more seriously, which she sees as the wrong perspective. Read this section
Does the FBI have enough resources to fight cybercrime?
Kaiser says more resources mean more investigations, but the FBI is not hampered in countering the most impactful crimes. She urges policymakers to fund the whole system, including state and local cybersecurity grants. Read this section
About the guest
Cynthia Kaiser is, at the time of recording, senior vice president at anti-ransomware platform provider Halcyon, where she leads the company's Ransomware Research Center. She previously served as Deputy Assistant Director in the FBI Cyber Division's Cyber Policy, Intelligence, and Engagement Branch, after joining the Cyber Division in 2017. Earlier in her career she worked as a weapons of mass destruction analyst focused on North Korea.
What the heck is a PTaaS? There's a lot of confusion around penetration testing as a service or PTaaS. Let's start with what it's not. PTaaS is not just a new name for traditional pentesting with its clunky dot PDF reports. PTaaS offers more. It's a modern approach to pentesting that continuously clears up vulnerabilities. Synack's PTaaS platform is powered by hundreds of global security researchers ready to test your most critical assets for software flaws. Learn more about how PTaaS is helping defenders keep up with AI enabled threats at synack.com. That's synack.com.
Hello, and welcome to WE'RE IN, a podcast that gets inside the brightest minds in cybersecurity. I'm your host, Blake Thompson-Heuer. And today, I'm joined by Cynthia Kaiser, senior vice president at anti ransomware platform provider Halcyon and a former FBI cybersecurity official. Cynthia, thanks so much for joining me.
Now you head up Halcyon's Ransomware Research Center, and that's got an eye toward sharing and aggregating critical information on the nature of this threat. What can you tell me about your work there? What's that effort like?
It looks like a lot of building right now. I'm really excited to be here and be able to build a Ransomware Research Center the way that I think it needs to be. After, you know, my many years in the FBI and working with industry, identifying exactly what we can do to make a difference in the lives of everyone is going to be really fun. The ability to then build out partnerships from that. When I was at the FBI, I was there pre cybersecurity advisories. So if your listeners know what those are, they're the documents you get that come out of the US government that say this is a threat. But before kind of that 2019, twenty eighteen ish period, each agency was doing them separately. FBI was doing its own. DHS was doing its own.
And I think NSA was somewhere out there thinking about doing things public too. And so it took a lot to bring the agencies together to say like, it's much better for one voice. Hey, we have information that we can all help each other with. And now it seems like just matter of course. Right? Of course, like why would we do anything else? But it wasn't that way. And so I'm thinking about that and I have a lot of feelings. Like, it feels very similar now that I'm at Halcyon thinking about like, okay, how do we approach and get other companies or defenders, experts together and understand and figure out those right lines between competitive and collaboration because we have to fix the gaps that are still present. We've gone and come a long way. We have a long way to go.
For listeners unfamiliar, I think most recently before joining Halcyon, were Deputy Assistant Director in FBI's Cyber Policy Intelligence and Engagement Branch. What you mentioned about the various agencies kind of stovepiped almost at a certain point in in in the, you know, maybe late twenty tens. How did you go about kind of trying to concentrate that or get the best, most single source information into the hands of the private sector while you were with FBI, especially when you're talking about intelligence that might not be easy to, you know, declassify or separate from the signals intelligence that it that it came from. How did you get that into the hands of private sector folks to actually, you know, who could actually act on it?
I remember the first time I had to review and approve something that was going to go out on the Internet in public. It was about when Scary I came to It was. It was, you know, when I came to Cyber Division in 2017 and and just being so seized up like, what if we get certain things wrong? Like, there's so much risk here. I don't know how to do this. And we went from ahead of those moments where they were few and far between to almost a 100 from the FBI lab in 2024. And it took a lot of conversations, a lot of successes, like see... Having people see, like, how much of an impact you could have, And a lot of culture change across NSA, across FBI, across some of our other IC colleagues to know that the information that they collected from a more exquisite source might then all of a sudden be needed to go out publicly.
And I think at first everyone was kind of weighted on the, hey, we have to protect sources at all costs. What'll we do? But I think some of the changing nature of the cyber threat also helped us change along with it. So much infrastructure that's used now is disposable by the adversaries. They're not using it for very long. And so that started to change our calculus and when we could put things out sooner. It's not like we were going to be able to collect on something for years and years. We were able to put it out now and that's what was important. And we also got to a point where even if we had maybe more exquisite collection, we could figure out a way then to recreate it in a unclassified way so that we could put it out more publicly. We got really creative and really collaborative.
But I think a lot of this was getting people's minds victim focused. And it sounds... Becomes easy once you're victim focused. Once you're really thinking about what do people need? What do we need to stop the adversary at the source? That then becomes a different conversation that people really welcome. And it... And it's interesting. It almost kind of started swinging some of the other way. You start having these different battles. Battles is the wrong word, right, for friendly conversations. But I remember a time where the FBI had seen some nation state adversaries using a vulnerability to get onto some critical infrastructure, operational technology networks. But they weren't getting onto great parts of it. Right? It was a lot of this kind of more showing you can get onto them or defacement type effort.
But we had a lot of conversations across the government. We've already published this vulnerability. So now do we put this out and just say, hey, Iran's doing it? And there were two camps. Right? Like, we've already said that this is a problem. I'm in the camp of... But people take it more seriously when you find out a nation state's doing it. And so I think, you know, we still had these conversations. They still weren't done because the nature of the threat changed. But really, you just see everybody from China analysts to Iran analysts to CyberCribe now thinking, oh, next we have to do an advisory, which is amazing and really much better for national Thinking about,
you know, we laugh about it now, your comment about pushing out the first kind of public piece of information that was maybe sourced from some of these more sensitive previously classified environments. Is it is a really serious step and a really intense thing to do, you know, for those not coming from the national security space or unfamiliar, you know, the sources and methods, the intelligence collection, this is all really high stakes stuff. And there are real people involved. There are real, you know, channels of intelligence that can be super valuable tracing to some of these nation states, some of these nasty ransomware actors. So, you know, it's no small thing and no small feat. I am glad you mentioned the attribution piece too, though, of, you know, whether to link it to Iran or or China because I have noticed in the last couple years, you know, ever since that... Well, last decade plus ever since the release of Mandiant's, you know, landmark APT one report, it has become this kind of parlor game among among cybersecurity companies in particular to try to name and shame, right, and tie particular countries or even sometimes individuals behind the keyboard to these to these, you know, ransomware campaigns and whatnot.
How much does that sort of who don't attribution information really matter in your experience? And, you know, if an organization just doesn't wanna be the next ransomware victim, do they really care if it's, you know, China or Iran?
It matters more on the government and cybersecurity company defender sides for a few different reasons. And I think people get wrapped around the axle even in those areas of we need to get down to we don't have attribution and you find out that what they meant was we don't know the exact individual. Okay. Did we need to know that? You do if you're going to charge an individual, but you may only need country level attribution if you're going to be talking and putting this out publicly and just warning really quickly. Or you may just need a, say, service level attribution. By that, I mean, this was the Chinese military or something along those lines. Attribution's really important in the government because it helps the government hold actors accountable.
And I don't just mean individuals being charged or even sanctions, but policymakers cannot even discuss potential options for response if they don't have at least some sort of fidelity on who is behind it. And that matters for the long term deterrence of cyber operations, especially, you know, malicious cyber attacks against The US. When you get down to the... A company like Halcyon where we're, you know, trying to help organizations defend against some of these actors or even down to the NetDefender itself. What we really need to know is how is all of this technically similar? Because then it helps us defend better. And so sometimes that does mean it's easier if we know it was a certain group versus another.
Sometimes, I mean, functionally it doesn't matter to the customer. It doesn't matter to the victim. They wanna defend. They wanna stop activity. And they could really care less if it's China, Russia, Iran, or ransomware. Or maybe I should say they should care less. What we found in the FBI sometimes is you needed to say, hey, this is... No. Seriously, this is being used by the adversary. This is being used by China. It's being used by Iran for sometimes people to sit up and take that seriously, which isn't the right perspective because it doesn't matter if it's China, Russia, Iran, aliens. It's going to affect your network no matter what. And just because a nefarious military adversary, it also doesn't mean that criminals aren't the most important or or effective or likely attacker on your network.
So attribution, I think there's changing nature of it. But what we really have to get down to an industry and government is in the exact moment why. And if we can do why, if we can answer why, is it for understanding TTP? Is it understanding our policy options and giving policymakers the ability to do things? Those are completely kind of different tracks and might require different levels of effort.
Right. I feel like if I were a CISO, I don't know if I would want to know if it was a nation state because then I'd worry my insurer, my cyber insurer might cancel the payout from the ransomware damages if they think it's an active or exclusion or whatnot. But that's a different conversation. Now Yes. That's a that's a whole another can of worms. We don't need to go down the cyber insurance path. But I I I did wanna ask, of course, you know, it was only gonna be a matter of time before we brought up AI, so I'll just drip off the Band Aid now and and ask. I guess from the threat perspective, because I've spoken with a lot of, you know, cybersecurity experts on this podcast, and many have been, you know, generous enough to share their insight and expertise. And the prevailing thinking is that seems to be that AI is going to help the offense side, at least in the short term, more than it will defenders who are gonna catch up and try to leverage AI themselves. What are you noticing on the ransomware threat front? How are they leveraging AI, you know, building AI tools maliciously to to be more effective at scaling up attacks?
So I think where we've seen AI being used, and and I said this when I was back at the FBI as well, is if you kind of look across, you identify the kill chain, all the potential uses, the most frequent adopters and users, or even people who are just kind of playing around with it were China and cybercriminals. And so on the cybercrime side in particular, we see a few things now and are watching for a few things in the future. One which a lot of your listeners are probably well aware of is it makes their lives more believable. Whether that's a phishing campaign that now has a lot better language, it maybe is more tailored to something that would be more effective at having you click on it, the ability to do that more rapidly.
So phishing attacks are up just, you know, an incredibly high amount compared to the year before. If you're looking at all of that, it just means that the adversaries can try to find new ways to target you. And I'm especially worried about deepfakes and how cybercriminals are using those to try to compromise networks. I think we were also worried as we were looking at the election in 2024, like what what are what are people gonna use deepfakes for? Are they gonna try to influence the electorate? And we had all this swirl around this. And I remember I was part of these conversations. And what really happened is is financial fraudsters are using it a lot more. So for example, wire
Yes. Exactly. You know? Yeah. Your CEO calls you. Behind him is the vacation home that you've seen him call from before. He normally calls you on whatever messaging app you're talking through and says, hey, I need you to join this meeting on the other line. It's urgent. Here's the link. A lot of us would click on that. That feels normal. And so being able to get onto networks in that way. That's the kind of initial access. Once they're on, this is where I start worrying a little more. They're able to identify patterns across a network and behavior that helps them obscure their activity more. So knowing which times there's downtime on a network which times there's higher level of activity allows them to be more active during those times. Being able to find the areas that would help them blind endpoint detection, identify some of those vulnerabilities that might be already on a system.
We see them doing that as well. And it really kind of just helps them obscure more what they're doing. And then finally on what we're seeing them do, and then I'll get to what I'm most worried about, is think about how much information is normally taken from a network when data is exfiltrated. A lot. And people, there used to have to be somebody in the back end and maybe they're developing some scripts to go through it, keyword searching it. But a lot of times it was really hard too. PDFs are hard to search it like mass. There's a lot of complications. LLMs were made for this. So being able now to take a lot off of the network but use an LLM to figure out what the crown jewels are.
They can. They can. So I think what we're watching for and, you know, we see some groups claim but don't necessarily have a lot of proof on is polymorphic malware. So malware that changes when it's on a network because it sees that it's being detected in some way or makes it more nefarious once it's already there. So you don't have a human involved in changing that. It's just changing naturally. That's what keeps me up at night kind of worry, because that's gonna make a lot more difficult to defend. But I I do think that AI right now is the advantage to the defender. There's so many cool things you can do with AI from a defensive perspective. You know, Halcyon does that. We do we do like behavioral analytics, and I've just thought that like a lot of different companies do. But like, it's so cool to be able to think about like not just signatures, but behavior.
And and then there's always other AI based tools that will also really help defenders as long as they're also putting a lot of security around the in house AI tools that they might be building. Because they're also pulling all their good data together to build some of these AI tools, and it requires a lot of more security around it. You know, there is this defender advantage, which I do think is true right now. As long as we continue to, how good we do, we don't... We're not satisfied.
Well, I may just have to kind of recalculate my response there because I'm gonna give your response a little extra weight having been with the FBI quite recently, now with literally an anti ransomware platform company, that defenders have the advantage. Okay. Tally won for the defenders. I can definitely see that being the case with some of the exciting technologies and tools coming out.
So we've won is what you're saying is what I mean. No. Just kidding. Problem solved. No. I I I would be curious to hear, speaking of problems, exactly how these ransomware actors are getting in. You you mentioned the more realistic phishing emails. I feel like that's kind of everybody's mind's eye image of a breach or most people's of like, okay, you get the phishing email, you get them to click the link, you're in. What what other vectors of, you know, initial breach are you seeing? Are are these ransomware attackers taking advantage of known vulnerabilities? Are they, you know, getting in through supply chain attacks? What what what sort of vectors are most prominent nowadays?
So the ones that I have us most worried and we see really frequently are being able to abuse or compromise identity or authentication mechanisms. So being able to gain access to not just kind of credentials that you might buy, right? That somebody's selling on the dark web, but also being able to exploit single sign ons, weaker multi factor authentication. If I could give advice to any company right now, would be to have phishing resistant multifactor authentication. So we see the Ransomware Actors able to hijack the multifactor authentication processes where it just is a push text or push call. It's not necessarily good enough anymore. So being able to put that in.
Second is while we still see entities and organizations trying to use commonly known vulnerabilities, there's also a huge marketplace for zero days. And these can go for millions and millions of dollars on the dark web if you find them. And you saw in the recent case with the SharePoint vulnerability, the on premise SharePoint vulnerability.
It does. And it and it seems obvious to me that when the nation state actors appeared like they were gonna be caught, they got it quickly to their cyber criminal friends, whether they sold that or not. But they were able then then have... Conduct ransomware attacks against some of the same entities. And then finally, it's a little bit supply chain, a little bit just third party entities. So a lot of companies will outsource different types of activities to call centers. While we've seen some actors like Scattered Spider actually doing the research on individuals in some of these outsourcing companies, finding weaknesses vulnerabilities and either coercing or paying an individual in that company to provide them with access.
It's kind of like a whole new level of like spy meets cybercrime that Yeah. It just seems... Still seems a little crazy to me. And so... Because you can make...
Exactly. Like the new kind of managed service provider attack. Mhmm. So those are the three areas that I'd really highlight for any listeners to know and be able to take measures to try to defend against.
Well, I know Halcyon and and also the sponsor of this podcast, Synack, are both in the kinda more proactive side, like, hopefully hopefully avoid a breach kind of kind of cybersecurity company. That being said, obviously, the when the badness does happen and ransomware attackers get in, I know the official stance is don't pay. Right? And and especially at FBI, you know, you don't wanna be seen kind of bankrolling cybercriminal groups or supporting that. But that being said, when you have certain really critical functions or critical organizations that have been breached, I remember, you know, back in my journalism days when I was reporting on some of these critical infrastructure cybersecurity issues, you'd hear some chatter of, you know, even US officials telling, like, utilities, hey. Just pay the ransom. You know, get back what you need to continue operating. We'll try to investigate blah blah blah, maybe clump...
Closs them back. Where do you fall on these ransomware payments? Is it a black and white issue? Are there some shades of gray there? And and and what are your thoughts?
You're definitely not black and white like most things in cyber aren't. I think the FBI's official stance was we didn't recommend it, but we also understood it was a business decision. Because, like, businesses have to make their own calculus themselves for what is best for them in that time period. But I think where we saw our role, and I still see my role now, is to educate about what it means when you do pay and to educate about the risk of paying. So things that aren't evident is that if you pay, you may get attacked again. You're known then as an organization that's paid or ransom. And so these affiliates that are in the Ransomware ecosystem, the ones who are basically purchasing or leasing the malware to then attack various organizations with.
They work for more than one ransomware group. And so they've gained access already and they know that you've paid, they might come back and attack you again. There's a lot of instances really in the last few years of ransomware groups, of organizations, victim organizations being hit. Sometimes two different variants, three different variants in the same few weeks. And so if you're known as somebody who pays, are upping your risk of potentially being targeted again. Decryptors don't always work. A corporation might pay and then they receive the decryptor back. And I think the average is maybe about 65% of data is restored. It's not 100%. And so that can be like really frustrating for an entity that didn't think they were going to pay and get it all back.
And they ended up not receiving what they needed. I mean it shouldn't come as a shock to anybody. The rights from actors are putting a lot more effort into things that break your systems than into what fixes it.
Yeah. The customer service doesn't strike me as top notch when you have somebody shaking you down. That's probably... If you're counting on that, you're already in a little bit of trouble. You did tell CyberScoop once actually last November that, quote, to be the good partner that we need to be, we need to ensure that FBI is also funded to be able to address this expanded attack surface, end quote. And, obviously, that was back when you were still with the FBI, and that was before the latest, you know, Department of Government Efficiency Era and all the latest focus on that. Would you say now, especially, you know, looking at it from a private sector post, does does FBI have the resources it needs to keep America safe?
I think that the more resources that the FBI has, the more crimes they're going to be able to investigate. But that doesn't necessarily mean that they're hampered from, like, doing the work to counter the crimes that are the most impactful in The US. And I think you've seen that through just announcement after announcement of various takedowns and charges and operations that have come... Continue to come. It feels like once every few weeks or once a week even. And so there's a lot of great work still being done. They're not hampered in their ability to do that. And being able then to, like like, have those internal conversations about where money needs to go. I mean, I think that the FBI is well positioned to have hard, difficult conversations about if they have less as a bureau.
What's the most important thing to do for national security? And I think there's a lot of awareness that cyber is incredibly important to continue to do, to continue to be worked. And so from my end, I would not anticipate, there being a falling off of of what the FBI can do. But I do think that it's important for policymakers to remember that the more threats increase, you you do have to look at, like, how do you continue to increase the budgets of all of the organizations that are doing this work? How do you continue to ensure you give money through state and local grants for their cybersecurity to defend against as well and bring it all together because it's a system. Like not one agency can be funded against the rest and that's fine. Like we have to make sure that it's a priority for funding policy making efforts across industry and government.
No. That's a that's a good point. I'm glad you also mentioned the state and local angle because I feel like they get left out of the conversation too much when, you know, maybe they can't afford the shiny new cybersecurity tool. But, hey, they're, you know, providing critical services for for real people, for Americans, and and absolutely need to be protected too and get some of this intel. Is that something that you'll be looking at with Halcyon, with the Ransomware Research Center? Is some of this some of your findings, are these gonna be available? Like, what will that level of coordination with some of these sled or smaller organizations look like?
I'm really excited to continue the work that I've done for years with state and locals. I mean, they're just some of my favorite, like, network defenders to be working with and all of these public servants who've chosen to have these jobs and these small... To protect their communities, to protect their friends and family. I... It's, yeah, it's just amazing to see what they could do, sometimes on a shoestring budget, that really make good choices. I'm really excited to be able to continue to work with them on the, you know, defensive side, like what does that defense look like, but also on the... Like, what does good policy look like at a state level. So at the Ransomware Research Center, we are going to have an element of collaboration and analysis to help create some data driven policy solutions and analysis.
And my hope is that a lot of that can be state focused because right now they will benefit just so greatly from the assistance that industry can provide on best practices and kind of where the threat is now and making sure that as some of that responsibility shifts from DC out to them, that they have the right information and are equipped to be able to address these huge problems.
Yeah. Well, just a couple more questions, and and then and then I'll let you get back to fighting ransomware. I... Of course, when you're with FBI, the justice department has the authority to bring indictments. You you mentioned them earlier, this kind of steady drumbeat of, hey. We're making it hard for ransomware actors. Even if they reside in countries that lack extradition treaties with The US, they're they're gonna feel it. They're not gonna be able to go vacation somewhere allied or, you know, and maybe they'll worry and look over their shoulder for the rest of their lives in some cases. Has there been an adjustment at Halcyon? You're not quite able to hack back or you don't really have the authority to to stop some of these actors at the source, so to speak. How... How's that been?
You know, I get asked this question a lot, including by my former colleagues at the FBI. And my answer even surprises me is that I don't feel like my job's that much different every day. Being able to identify the tactics that adversaries are using and then get that out publicly, get them to cut that to customers, that's an element of disruption that I've always felt really strongly passionate about. And I get to do that now. I think the differences are ones that show the two different sides of how you counter adversaries in the space. And that's one of the reasons I was excited to do the transition from government to industry is on the government side, you're really focused on holding actors accountable, deterrents, what you can do to ensure that these actors have less incentive to continue to target Americans.
But within that kind of focus on the actors, how do we counter them, what do we do to them, there's always been a... There's a defensive element to that. And now on industry side, I get to be on the defensive side. And I will say, I mean, there's a... Like, think a probably larger scalability on some of the defects of blocking these actors overall on an everyday basis. And that to me is also an exciting component. So I feel like the best practitioners in our industry do both. They go to industry and they do government. We understand each other better. You know what each other need. And I think the idea that now from my bench here, I'm going to be able to support, partner with the government and give them information if helpful for their own efforts and still be able to help just everyday organizations.
I... I'm excited. I'm excited. I'm excited about both. I've always loved my job at the FBI. I'm gonna... I think I'm gonna love it here too. And just... It's a great industry. It's a great mission.
Yeah, absolutely. And I think that the attitude too, and this is shared, I think, just about any organization in cyber, there's kind of a rising tide lifts all boats mentality, which I've certainly appreciated personally as well. Now last question, and it's one that we ask all of our guests on the WE'RE IN podcast, which is, what's something that we wouldn't know about you, Cynthia, just by looking at your probably fairly buttoned up link... LinkedIn profile?
You know, I actually did a lot... Spent a lot of my career not as a cyber analyst, but as a WMD analyst. So I was in kind of North Korea analyst by trade. And as North Korea analysts do, you end up, you know, somehow getting into the zone of missiles, nuclear weapons, those kind of things. And I I say that because I ended up hiring at the FBI a lot of people out of the kind of WMD work and into cyber because they made great cyber analysts. You know, they'd already taken the time to learn how to make the technical relatable. Like they were doing technical analysis and there's a lot of skills that were transferrable. And so I think we were, you know, we used to joke, you know, we might be with the only cyber team that could also build a WMD.
I Please think, you know, it's a good thought though. Like... And I I like to end the story because, you know, it's so hard sometimes to find great people in cyber and to figure out, like, how people can transition over. And it's really thinking about people who are in any technical discipline. We can, you know, bring them on board and and make them part of, you know, what really is the national security challenge of
our lifetime. Understand why the why the US government banged on that cyber deterrence drum so hard over the last couple of years. This was your team, wasn't it, talking about deterrence and weapons of mass cyber destruction? Well, thank you so much for joining me again, Cynthia. Really appreciate it. And great conversation, and good luck out there.
