AI, Governance & Cybersecurity Culture: Why People and Process Still Matter Most

Aaron Crow (0:1.024): Awesome. Thank you again for joining me on another episode of the protected all podcast today. have Sue with me here today. So thank you so much Sue for taking time as it happens. A lot of the time with these is we have to worry about schedules and we both have jobs and everybody has life and all the things and travel. So thank you so much for being, kind with me and rescheduling. We were supposed to do this earlier this week and you, you were very gracious and rescheduling this. And, and, thank you so much for being here.

Aaron Crow (0:29.994): With that, why don't you go ahead and introduce yourself? Tell us who you are. Tell the audience your background, all the fun things that we need to know about you.

Sue McTaggart (0:36.836): Yes, thank you, Erin. I'm glad to be here and I'm honored and humbled to be here. So thank you for having me. It is something that I'm having the same background as you. I'm passionate to educate people and to get them awareness about specifically in my field, in cybersecurity field. Yeah, my background, you know, I've been developer before prior

Sue McTaggart (1:5.476): my career in cybersecurity, I'm always, as a person, I'm always curious. And that lend me the job into cybersecurity because of my curiosity. When I was a developer back in early 2000, I was already developer prior entering the workforce because I'm specialized in developing application when I went to college. So I develop different languages.

Sue McTaggart (1:34.170): Back then Java is a more prominent language that we do. Even in the early days, I was developing Fortran and COBOL, all the old stuff. But the logic, developing application, the method, the algorithm, all the same, pretty much other languages that they're using today.

Sue McTaggart (2:1.800): I've been in cybersecurity for 15 years prior that I was a developer. Through 15 years of my career, I've seen the landscape, the trend, back in early 2000, maybe 2010. There is nobody actually understand.

Sue McTaggart (2:23.546): what cybersecurity is, you know. And a lot of time when I was trying to present my case, it doesn't matter if it's related or credential related to the data and the production data being loaded in a lower environment where all the unnecessary access need to be protected back then in 2000, not really existed, you know, people like foreign.

Aaron Crow (2:24.737): Right? Yeah.

Sue McTaggart (2:53.856): Now that I've been in cybersecurity for 15 years, I see the threat landscape is more evil, it's more advanced. That's why we need to have a cybersecurity skill that aligns with not only protecting the information, but also understanding what is coming in the horizon. We need to be able to do that.

Aaron Crow (3:20.236): Yeah.

Sue McTaggart (3:22.580): curiosity is something that anybody, doesn't matter to me or other cyber professional that can get them ahead of the game if they have that mentality mindset. yeah, I've been in a different company doing mainly architecture, leadership, some engineering activity and also culture.

Sue McTaggart (3:52.684): transformation because everything that we do in cybersecurity is impacting not only the technical side of it, the processes, the people, the culture. the big problem that I see so far is, you can have the most advanced technology, but if your company is not really adapting mindset of cybersecurity on the culture, it's not

Sue McTaggart (4:20.924): enable cyber security, then technology alone is not allowing you to protect your company. You need to have a workforce that enables you to protect it in a not only short-term, but long-term project. That is something that is my background throughout these 15 years.

Aaron Crow (4:29.578): Absolutely.

Aaron Crow (4:40.834): Mm-hmm. Yeah.

Sue McTaggart (4:50.190): in cybersecurity.

Aaron Crow (4:52.022): I love that. you're 100 % right. talk, I've said that many times in different ways, but you you've got people processing technology. It's really easy. The things that are in the news, the things that people focus on when you go to conferences, the things that people are showcasing, it's all technology. It's all the newest capabilities and technology and all the things. But the irony is as a consultant or, you know, when I'm brought in because of an incident, you know, most of the time the things that were

Aaron Crow (5:19.746): were wrong or the things that are wrong are not fancy, sexy craziness. It's because they weren't doing basic things. They didn't have basic processes. They didn't train their people, right? Their people didn't have cybersecurity as part of their process or thought, you know, thinking about they didn't do tech, like all of these types of things. It wouldn't have helped them if they'd had the newest fanciest technology, you know, if their people aren't using it and the processes don't support it. It's just sitting in the corner collecting dust.

Sue McTaggart (5:27.992): is second.

Aaron Crow (5:49.198): You

Sue McTaggart (5:49.666): Exactly, exactly. And then they don't take action, right? So taking action out of the detection, out of the data that we are collecting from the tool, from the detection is more important than just detecting it. So sometimes organization, we have a good tool. We will be good. No, you have to.

Aaron Crow (5:53.292): Yeah. Yeah.

Sue McTaggart (6:15.420): to your point, you need to train your people, you need to get the mindset that certain thing that they do is impacting the cybersecurity risk. if they don't like the process itself, if they don't define it, if they don't have a documentation so that people can follow, it doesn't matter is configuration, it doesn't matter of a skill set.

Aaron Crow (6:25.528): Yep.

Sue McTaggart (6:44.432): to train people if they don't have it in place or programmed then a tool itself is not going to get them anywhere.

Aaron Crow (6:53.570): Well, and also we go back to, you we've seen tools that have failed. We see processes fail. Internet goes down like all sorts of things happen. And so I've got I've got kids and my oldest is 16. And, you know, he was going he was at a friend's house a couple of weeks ago and he had to call us because he was running. He was running late getting back for curfew.

Aaron Crow (7:16.268): Right. He had a, he had a certain curfew and he would have made it on time, but his phone, which he was using, you know, his phone for GPS, to get, get from this friend's house, which it was the first time he'd been to this friend's house. And he was using his phone as a GPS, you know, using ways or whatever to get home and the internet or the GPS stopped working. And he didn't know how to get home from where he was back to where we were.

Sue McTaggart (7:24.645): Yeah.

Aaron Crow (7:40.557): So he just kind of pulled over on the side of the road until his phone started working again. And he called us like his cell phone was working, but the GPS wasn't. So he called us. So that's an example of he had the amazing tool, but he didn't have the basic understanding of navigation of where he was and how to get home. you know, back in my day, I'd have pulled out the, you know, the map or I'd have probably known where I was anyways, but I'd have pulled out a physical map and I'd have had the map with me or I'd have gone to a gas station and asked somebody how to get home type of thing. Right. I wouldn't have been.

Sue McTaggart (7:41.264): Yeah.

Sue McTaggart (8:7.857): Yeah.

Aaron Crow (8:8.748): I didn't have a cell phone. I wouldn't have been able to call my parents on the side of the road, right? I just had to figure it out.

Sue McTaggart (8:13.199): Right, right.

Sue McTaggart (8:16.346): I know that scenario is resonate with my daughter. I have a 24 year old daughter. When she was 10 years old, we ran some truck because we didn't have any truck. And the truck that we ran is old enough that you can, you don't do the button, but you just crank it to the window. for her it's like, wow, this is amazing. You know, for me it's like,

Aaron Crow (8:38.082): Yeah, yeah.

Sue McTaggart (8:45.564): we don't have a technology to push the button and pulling out. So to your point, to get this day doesn't really so dependent on technology and so dependent on information. That's why we need to, to the point, need to call it too. So on that, on the minor across on the globe that is not only

Aaron Crow (8:51.522): Yeah.

Sue McTaggart (9:14.192): consuming the correct information, but also being protected from harm. Because to your point, the moment that GPS went to side road, give you a wrong direction, it happened. it happened. So those things, need to be validated. It need to be having a good use case now, especially in the era of AI, agentic AI.

Aaron Crow (9:27.372): Yeah. Yeah. Yeah.

Sue McTaggart (9:43.408): where everything is being streamlined, we need to be careful on that too. That's why security needs to be embedded into those AI era because now we're trying to catch the business one and security is always trying to put behind. But now that all the business know hacking, ransomware,

Aaron Crow (9:48.685): Yeah.

Sue McTaggart (10:12.944): happen, they have some idea that they want security to be far away, which is a good thing. Back into 20 years ago, if I asked the business, hey, this is important. We don't have a budget for that. Always excuse. But now I'm glad to see more and more organizations understanding that we need to put the security.

Aaron Crow (10:28.204): Yep. Yep.

Sue McTaggart (10:40.966): part of our development doesn't matter is we're a standing up agent for AI, do we have a zero trust on the environment? How can we consume information that is not garbage information from external network to the point that we have a result and use case and data to do all the, you know, basically.

Aaron Crow (10:46.690): Yep. Right. Yeah.

Sue McTaggart (11:8.060): how to get the correct information so it's not biased, it's not hallucinated. And all those things are very important because otherwise we are in a high speed now and we need to be in high speed in cybersecurity too. It's not only just AI development, but how we can get it to align with the velocity in our developing era.

Aaron Crow (11:21.336): Yeah.

Sue McTaggart (11:35.760): AI work right now, everybody want to embed it, but we're still kind of early trying to understand where is a good thing to implement, which type of data that can be really autonomous in AI, you know, because AI can be a self prediction compared to all this when I develop application, everything is

Aaron Crow (11:52.877): Yeah.

Sue McTaggart (12:1.690): deterministic, you know, what you put in, what you come out. But now the machine, the agent kind of, you know, know by itself how to basically predict certain things, which is we need to be cautious about.

Aaron Crow (12:20.098): Yeah, you hit something there. It's really interesting that I hadn't thought about or hadn't voiced or talked about before. you know, same as you, like I've been working in this industry a long time, you know, and a lot of the time cyber and even technology beyond cyber, but technology has, has many times been the no, right? No, you can't do it that way. No, we need to slow down. No, we need to take this through.

Aaron Crow (12:45.462): architecture review boards and we need to test this and we need to pilot this. And a lot of times I have noticed either myself and or other organizations within the business, know, slowing down the process. And many times the business gets frustrated. Many times the business goes around you. And that has been a problem up until now. It's just gotten, you know, exponentially worse because to your point, AI and a lot of these newer

Aaron Crow (13:14.764): you know, technologies really enable us to go so much faster. Right. So if we try to go at the speed we have in the past where, know, it takes six months to do something and before you can onboard something, they're going to have already piloted and tested it and implemented it before you've ever even got it to the first architecture review board. And then it's too late because then it's part of the process and they're not going to take it out.

Sue McTaggart (13:35.224): Exactly. And then that is funny you say that because I heard a story some like, so when we detect something that they develop brand new without including the security, the security team is like, yeah, we're gonna employ you. We're just doing POC right now. A month later, POC in a production. To your point, you know, like.

Aaron Crow (13:59.576): Right.

Sue McTaggart (14:2.148): I'm trying to create the story that, look, I'm here to be aligned with your philosophy. Something that we can automate in a process-wise, or how we do the remediation for certain vulnerability. Even a lot of our vendors, they're trying to keep up with that, know, in a cybersecurity vendor.

Aaron Crow (14:16.760): Mm-hmm.

Sue McTaggart (14:29.932): I always try to frame the story to the development team or to the business team. We understand your urgency, but if you take extra seconds or extra minutes to embed security into your solution, you're going to be thankful later because we're trying to make sure that there is a clear rail. We are experts. We are professionals.

Sue McTaggart (14:57.860): understand the need, but also we need to have a balance between, know, carreling your solution with AI, having security and keep your CEO sleep well at night. Yeah.

Aaron Crow (15:12.472): Yeah, exactly, exactly. Yeah, and it's to your point as well, like security and cybersecurity has become a critical path on all things, right? It doesn't matter what the product is, the capability is, whether it's the security cameras, the door badge readers, the endpoint protection, the laptops, your web servers, your one-off custom process that runs in

Aaron Crow (15:41.697): in the manufacturing facility, the aviation system and the airplanes, like whatever those things are, cyber has to be part of that conversation. Sometimes it's just to say, yeah, everything looks good, but the other times it's gonna be pushing back saying, hey, we can't do it that way because of X, Y, and Z. This can be a problem, this can be an issue. The analogy I give all the time with like patching, I come from OT, critical infrastructure, things like that, it's like.

Sue McTaggart (16:8.112): Right.

Aaron Crow (16:8.642): You know, IT people, they want to patch the machine as soon as they have a problem with it or whatever. I'm like, imagine that you, there's a system on an airplane and you're 30,000 feet in the air. Do you want to patch that while it's flying and you got 300 people in the airplane? No, you want to wait until it lands, get everybody off the plane, then you patch the system. Cause right now it's working, right now it's flying. Let's keep it that way. Land the plane, make it safe, then update the system. It's a different way that you handle things.

Sue McTaggart (16:38.213): absolutely. there is across aviation, there are a struggle on securing OTs and stuff because we have so many, if not thousands, a million devices connected to the system. And it only take one device to exploit, right? So everything you need to be thoughtful and architect.

Aaron Crow (16:53.794): Yeah. Yeah. Yep.

Sue McTaggart (17:7.469): correctly to my point earlier, make sure that your architecture is having zero trust boundary because we trust people who we want to verify to make sure that what they're doing is within the guardrail, within the risk that we can tolerate for the business because if the risk itself

Sue McTaggart (17:34.160): can disrupt operation to your point, then we need to speak up. Are you going to be able to take this risk? In the end of the day, I'll normally put the responsibility back to the business. If they really want to do it after we did the review, after we do the assessment, whatever they're trying to enable using AI or using technology,

Sue McTaggart (18:3.728): to automate their process, if we identify the gap and it's really critical issue to the point that exploitable with the zero day or maybe in the LLN is vulnerable for injection and something like that, if they keep going what they're doing and I usually put them back to, are you accepting this risk? And most of the time they don't.

Sue McTaggart (18:32.300): Even if you don't, then give us more time to have a time to put the car rail in place. Because we need to fix this. We need to have processes to enable patches not only just one time, continuously. Because the vulnerability is a fault of time. Whatever we identified six months ago, might not be vulnerable.

Sue McTaggart (19:3.028): until now. those things, sometimes we have to create the story to make sure that they understand in the simplest way because business doesn't really understand what is behind the scene, right? So it is really something that we need to collaborate to work together.

Aaron Crow (19:18.849): Absolutely.

Aaron Crow (19:25.262): I love that so much and I've learned that over my career. You know, it's all about, know, one of my mentors and I say this a lot. I just wrote it in an article and the editor wanted to change the words because it's not correct grammar. And I'm like, no, we're keeping that in because I say this all the time. So I just wrote an article on NERC SIP and, but anyways, the saying, and again, it came from one of my mentors and it was like, all business is the people business.

Aaron Crow (19:54.359): And what they meant by that is it doesn't matter if you're the janitor, if you're the engineer, if you're the CEO, it's all about relationships. It's all about, you know, doing things, people, right? And it's all about, we're all salespeople. Like we don't think about ourselves in that way. We are selling our ideas to whomever we're trying to talk to, right? So all of this is as a cyber professional, as, as I can be an engineer, can be a developer. Like you said,

Sue McTaggart (20:4.934): people.

Sue McTaggart (20:10.716): Mm-hmm.

Sue McTaggart (20:15.022): is second. Yeah.

Aaron Crow (20:23.244): All those types of things you are selling your vision, your justification, your reasoning to your boss, your teammates, know, the executive leadership above you, your clients, your customers, you are selling your vision of why this way, why these needs, all those types of things to you. So to your point, when you're pitching an idea, you're pitching a product, you're pitching a change, you're saying, hey, we need to do these different things.

Aaron Crow (20:50.252): This is all sales. It's all putting it in the language that people understand. And it's not about the buzzwords and, overwhelming them with technology and how smart you are. Cause none of that helps sell the story that matters. Cause all that matters is, is will they say yes.

Sue McTaggart (20:55.664): The cycle.

Sue McTaggart (21:2.842): Yeah.

Sue McTaggart (21:8.708): Yeah, it's funny you say that. I was speaking on aviation in Europe and I was, you know, as a speaker, I also watched some other seashores pick up on there. And this is, I don't want to disclose in the company, but this big company, cybersecurity firm company, and he speak about espionage, about cybersecurity,

Sue McTaggart (21:38.662): think term that all audience are engineer and database, you know, professional like data analytic and stuff. And then they came to me, so you, you, you are in the cybersecurity professional, right? You understand what he's saying? Because I don't understand at all. All he talked about is a big password that we cannot correlate.

Sue McTaggart (22:6.508): And I do understand because I'm coming from cybersecurity. But I heard you, if I'm in your position, I will not understand what he's saying. So to your point, it doesn't matter if you're the smartest cybersecurity professional. If you cannot articulate the simplest way to the background of our audience, then might as well not speak because.

Aaron Crow (22:15.618): Right? Yeah.

Sue McTaggart (22:34.495): they just go above their head and a lot of people just doing the texting because they could not correlate what they're saying, know, what he's saying. to your point, we need to be able to articulate like a self person to make sure that other aisle can digest what cybersecurity objective you're trying to convey them, you know. So yeah.

Aaron Crow (22:58.070): Yeah, absolutely. It's, such a big thing, right? It's, you know, again, I grew up as being that engineer, you know, my career grew because I was, you know, quote unquote, the smartest person in the room for my thing at the time. you know, and that was always the way that I grew my career is like learn stuff, be the best, be the best at this thing and you'll, you'll excel your career. And I got to a place where I realized that was not enough.

Sue McTaggart (23:21.102): Mm-hmm.

Aaron Crow (23:26.806): It wasn't going to take me further. Like I was going to hit a place where I couldn't really excel anymore until I started learning these other skill sets. those are the people side. It was the sales side. was the, you know, the influence, you know, how to win friends and influence people and how to do a PowerPoint presentation and all the things that I learned and did along the way. It's why I went to, you know, Ernst & Young Big Four Consulting and, and did all those types of things. And it, it's sometimes frustrating because, you know, I've said it myself.

Aaron Crow (23:56.461): You know, I think consulting firms, they all they do is create PowerPoints. But there's a reason behind that, right? Is the reason is because those PowerPoints are the things that help people understand really complex things, right? And translate them into, I understand why Sue said we needed to do this, this and this. Now it makes sense to me. Whereas when the technical person said it, it was just, you know, you're speaking a language they don't understand. And it's just like,

Sue McTaggart (24:4.540): Yeah.

Sue McTaggart (24:8.623): Understand.

Sue McTaggart (24:19.471): Yeah.

Aaron Crow (24:26.594): You just get crickets and they're just staring at you.

Sue McTaggart (24:27.216): Yeah, it's funny you say that. It's funny you say that because it happened to me a lot. I have to put a different head when I talk to different people. When I talk to executive people, they care about, okay, what you need from me, very simple. Do you need resources? Why we need it? And what is the issue you're trying to solve? And how much money you need from me? That is their approach.

Sue McTaggart (24:56.218): And then when I talk to the developer, I need to have developer language to talk to them. Hey guys, if you use this method, if you have a top party library that you calling your first method that is vulnerable, then you need to update your top party library first to make sure before you deploy it is up to date so it's not vulnerable. So those things I have a...

Sue McTaggart (25:25.128): different head to speak. Of course, when I talk to mid-management, it's talking about resources that need to be part of the project, they need to support me to do that. And it's to your point, we need to really be cognizant to whom we talk to. Because if your objective is trying to get budget, then don't talk to

Aaron Crow (25:46.200): Mm-hmm.

Sue McTaggart (25:50.126): low level like you talk to developer or engineer because they're going to be like, okay, move on.

Aaron Crow (26:0.591): Absolutely. And that that's the thing, right? Is, is you, you hit the nail on the head and, and it's funny, we have conversations on this and we're both cybersecurity people and technologists and you're a developer and, you know, but all of those things don't matter if you can't have these simple conversations, if you can't put on the right hat of the person that you're talking to and understand the conversation you need to have with them, right? It's easy to be

Aaron Crow (26:27.874): to talk over their head and prove how smart you are or, you know, talk the latest buzzwords and, know, awesome. You're smarter than me, but I'm, you still have to make me understand why it should matter and why I, you know, why I want to spend money on it. Why I want to put people on that. Why I want to, you know, change the direction of our company or change a process or hire a person or fire a person or whatever those things are. Many times those are people conversations. Those are personal conversations. They're beyond just the tech.

Sue McTaggart (26:35.748): He said it.

Sue McTaggart (26:52.358): Mm-hmm. Yeah.

Aaron Crow (26:57.706): stuff. You need to have the technical stuff to back it up. But many times it's that it's that it's that other level conversation that is the more powerful.

Sue McTaggart (27:1.211): Yeah.

Sue McTaggart (27:6.714): Yeah, sometimes I also mentor a lot of young workforce in cybersecurity. I went to different platforms to mentor them. One thing that I always tell them is like, you need to be able to think out of the box. Because if you cannot do that, then you're going to be stuck.

Sue McTaggart (27:34.620): in your career. So what is the trajectory of your career five years from now? What do want? Are you going to be an analyst for five years from now or do want to move to a different field where you want more challenges for your career? I'm always trying to encourage them to be curious because like the reason I'm at where I'm at is because I'm always curious about

Sue McTaggart (28:4.132): What is after this, after AI? How can we make sure that we are aligned with the trend now? even though currently I'm not working on it, I'm always thinking ahead to what is next. Even when I was growing up, I lived in very remote village where there is no electricity, nothing. And then I'm always curious, with my mom, I'm like,

Aaron Crow (28:28.767): wow. Yeah.

Sue McTaggart (28:34.107): what is outside this village? Is it either a city that is more vibrant than what we live now? Same thing. And throughout my career, I moved here back 33 years ago. And always that curiosity when I was little carry on over time. And it's really benefiting me. And I always tell my mentor, be curious.

Aaron Crow (28:41.336): Sure, yeah.

Sue McTaggart (29:3.950): It'll take you so far.

Aaron Crow (29:7.020): Yeah, 100%. I was also a curious kid. My dad would bring home old electronics, like old phones, like the old rotary phones. And I would take them apart and take all the components out and figure out what they were and put them into buckets. And he had this whole box. think his work upgraded their phones and he just took them all home because he knew I would just play with them. So I was just tearing them apart and looking at them and not being destructive, just...

Sue McTaggart (29:17.275): Yes.

Aaron Crow (29:33.089): I was really interested to figure out why do all these things work together and what is making this foam do the thing like what is all in here that makes it do it. And I did the same thing with computers along the way. And I was always just able to tinker and figure out things. And it led to working on cars and it, you know, working on engines or not that I was ever a mechanic, but I've always been able to kind of figure things out and build a wall or do plumbing or do electrical work or whatever that type of stuff. I've always dabbled in those things.

Sue McTaggart (29:40.838): Yeah.

Sue McTaggart (29:47.310): Yeah, tinkerer, yeah. Yeah.

Aaron Crow (30:1.602): to your point because I had a curious mind and I was just like, well, I can figure that out. And now with YouTube and AI, like, you know, it's, simple, right? It should be like, it's, you can basically walk through. Yeah.

Sue McTaggart (30:9.254): Yeah.

Sue McTaggart (30:12.028): everything is accessible to your fingertips. But how you leverage the information to enable your aspiration, your desire to basically improve yourself through learning, right? So I always tell my kids, it's up to you.

Sue McTaggart (30:39.320): we have all the avenues out there compared to back then before you were born, it's not widely available. But you say to focus on your personal development. Don't do something crazy and harm. mean, you will waste your time, but you have to be cognizant and thoughtful about what objective that you want to learn from.

Aaron Crow (30:47.117): Right.

Sue McTaggart (31:7.884): on the avenue that we have from, you know, even a lot of LMS now learning system is online. You don't have to be physically in a person, which is, you know, awesome. It can be accessible everywhere. Yeah.

Aaron Crow (31:22.018): Yeah, absolutely. Yeah, it's, amazing. What the irony though is that we, I see it in again, I've got three kids at various ages, the oldest being 16. I see it in, it also can make you lazy. Lazy is not exactly the right word. Complacent may be a better word. right. Because it's so easy to get that information, you don't have to think about it.

Sue McTaggart (31:45.540): Yeah.

Aaron Crow (31:51.707): Again, using the analogy of my son driving home without the GPS, like he has no idea how to navigate without GPS, right? You know, they've never lived in a time without the Internet. Like they've never lived in a time without streaming TV. Like we had to watch commercials. If we had TV, you had commercials on a good day. And like there was only cartoons on Saturday morning or like you literally talked about. You didn't have electricity sometimes like there's there's.

Sue McTaggart (31:59.225): Right.

Sue McTaggart (32:3.130): Red.

Sue McTaggart (32:14.767): Yeah!

Aaron Crow (32:19.308): Your kid probably never experienced that in their lives. I know mine never experienced the things that I grew up with.

Sue McTaggart (32:22.704): No, no, I'm worried and at the same time I'm trying to learn from them what has gone through in their head, right? To your point, they're not lazy. When they desire to do something, they go for it and they execute it. And you know, like my daughter applying for a job is like, mom, don't teach me anything. I want to prove myself.

Aaron Crow (32:40.248): Yes.

Sue McTaggart (32:52.494): I can do it without your help. I was wrong thinking about her, that everything, she can depend on me and all the information out there. But no, she wants to do it herself. She wants to execute it herself to the point that, OK, I guess they're not lazy, even though sometimes I think they are. But they want to.

Sue McTaggart (33:21.274): be better, they, generation Gen Z, normally they tend to like looking at us like, you work too hard, but you don't have life. So, and then, and at first when she said, mom, I don't want to be like you. What you mean? I have a good career. I'm like, you staring computer.

Aaron Crow (33:26.786): Mm-hmm.

Aaron Crow (33:45.058): Hahaha

Sue McTaggart (33:49.976): all day long and then if something really happened even on the weekend you end up having like doesn't matter if incident or something like that you end up you know leaving a family and I don't want to be that way I mean in a way I respect their opinion because we want to be consumed by like entire 24-7 consumed by technology right we we are human we're not

Aaron Crow (33:59.715): Yeah.

Aaron Crow (34:7.694): Sure. Sure.

Aaron Crow (34:17.699): Yeah.

Sue McTaggart (34:19.620): robot to the point that can auto scale. We only have 24 hours, we only have one brain, right? So it is not like in cloud that you, if we have so many requests that you can auto scale it. It's not that way. But I think it's interesting to see our new generation doing that thing. And we need to be

Aaron Crow (34:23.768): Yeah. Yeah.

Aaron Crow (34:27.086): That's right.

Aaron Crow (34:38.017): Right, exactly.

Sue McTaggart (34:48.526): open-minded as a parent, right? Because, you know, they are smart kids, but we need to make sure that they understand the risks they're taking, you know, so, but yeah, it's interesting.

Aaron Crow (34:56.270): Mm-hmm.

Aaron Crow (35:2.378): Mm-hmm. Yeah.

Aaron Crow (35:6.438): Yeah, that's very true. And I think, you know, the newer mindset, the newer, they're going to change, like AI and all the technology, as well as the way our kids are interacting with it, they're going to do things differently than we did. That's just inevitable, right? That doesn't make it right or wrong, it just makes it different, right? And I assume there'll be a lot of things that they're going to figure out how to do a lot more effectively and better than we did. There'll still be some ways that we did things and grew up learning things. It'll probably be

Sue McTaggart (35:21.648): for sure.

Aaron Crow (35:35.202): good, better, different, whatever. But it's not a comparison. It just means that they're different, right? Different doesn't mean bad. Does it mean good? It's just different.

Sue McTaggart (35:37.775): Yeah.

Sue McTaggart (35:40.860): It is different, yeah.

Sue McTaggart (35:44.476): It's just different. It's because the era of when she was born 24 years ago, know, a lot of changing in the world after 9-11, cybersecurity, ransomware, know, keep being exploited in social media. Even they have some cases of story that horrific that people committed suicide because of the work that they put in.

Aaron Crow (35:57.100): Yep. Yep.

Sue McTaggart (36:14.000): social media and stuff like that. And we as a parent, need to, how can we protect this young generation? Because this is our future, right? So as much as we know so much in the past, how can we make sure that this kid equipped with what is coming faster than we anticipated like AI, you know, how can they be okay dealing with the new trend?

Aaron Crow (36:36.952): Yeah. Yeah.

Sue McTaggart (36:44.088): so that they don't get harmed from it. So it's always in the top of my mind about these young children. How can we make sure that they have awareness of the danger?

Aaron Crow (36:59.416): So what are some of the big things that you see coming as far as like, you talked about AI coming and kind of awareness of things that are coming. What are some of the struggles that you're seeing in the industry today? I know 20 years, it's been a long career of seeing things, but the trends are different and they're happening faster from my perspective. Like it seems to be way more frequent, way more impactful. So what are some of the things that you're seeing and noticing?

Sue McTaggart (37:11.305): Okay.

Sue McTaggart (37:27.332): Yeah, I'm more like, how can we govern AI? know, it's like, there is so many benefits, but it's also, there is harming too, if we're not having a government around it. So I think a lot of people trying to keep up with, you know, having AI in Ebbler, but how can we govern it?

Aaron Crow (37:31.714): Yep. Right.

Sue McTaggart (37:54.063): If we're not engaging like cybersecurity governance on AI, so to make sure that AI is not biased, to make sure that AI is provide us good result as expected, we need to have some governance around it. And governance doesn't matter if we need to have some access.

Aaron Crow (38:9.282): Mm-hmm.

Sue McTaggart (38:21.636): properly not consuming information from the internet that can generate some bias where it's not having use case or data attribute that has already been tested and used in lower environment first. We don't want to deploy something that has no GAREL in it.

Sue McTaggart (38:51.072): what I am projecting in the future is the same thing. What I don't want, AI is worse, like everybody clapping. Because part of it is AI has been the top mind of, I've been in a conference talking to CTO, COO, or CEO, CISO, they're trying to keep up with it.

Sue McTaggart (39:20.762): But at the same time, they're worrying that we don't have enough skill even to implement a cut rail to it. So I always encourage whoever the objective or the goal or the project that they are trying to do AI, make sure that there is a governance. It doesn't matter if it's being scanned, the code being scanned, being tested.

Aaron Crow (39:20.877): Mm-hmm.

Aaron Crow (39:30.082): Yeah, yeah.

Sue McTaggart (39:50.128): does have a human loop until the AI is giving us confidence to give us a result what is expected. Otherwise, human loop is still gonna need it over and over because a lot of action, they have to have solid validation and AI itself speed up.

Sue McTaggart (40:18.425): Like I read not long ago about IBM. If I plug in USB in my computer, is it good? And then the AI speed up like, yeah, it's good. And you can actually do some exploitation with using USB and stuff like that. I'm like, no, that is wrong. So we still need to have that human look until we have.

Sue McTaggart (40:46.820): are confidence level high enough. And of course, certain business, we need to be cognizant if there is involving people's safety. You might want to not use it right away. You want to make sure that your model, your use case, your data are enough to give you that confidence. Otherwise, people's safety in jeopardy.

Sue McTaggart (41:15.398): For banking, it's not necessary about people's safety, but if you're talking about medical devices and stuff like that, using AI, it's a different ballgame.

Aaron Crow (41:23.309): Yep.

Aaron Crow (41:27.478): Absolutely. Yeah. You know, obviously I've spent a lot of time in, in, in critical infrastructure, OT, that kind of thing. And we, we do things a lot slower many times in those spaces. You know, we'll, we'll implement things a lot slower, take a lot more time, really test it out, make sure we're confident in it. And usually we're going to have alternate paths. Like, you know, you're going to have a, an alpha and a Bravo, you're going have an A and a B option. So if, if the, if the primary fails, I've got a backup.

Sue McTaggart (41:54.320): Mm-hmm.

Aaron Crow (41:57.391): And that doesn't mean just like a backup device. It means a backup path, a backup process so that I can break glass in case of emergency and pull out the manual process to really be able to still do the thing and be able to get home, right? Because lives are at risk many times in these scenarios, right? So, yeah.

Sue McTaggart (41:57.660): Yeah.

Sue McTaggart (42:2.222): Exactly.

Sue McTaggart (42:10.331): Yeah.

Sue McTaggart (42:14.818): Exactly, exactly. We need to really understand the objective what you're trying to implement. Otherwise, people just plug in the AI without any consideration and it's going to be chaotic if people are not consider governing it and what type information and how they're being used. So safety is always number one. doesn't matter business or cybersecurity.

Sue McTaggart (42:44.284): If there is jeopardize people's safety, need to put really thought to it. It's not only just, okay, I want to stand up solution and then be done with it. No, this is human life you're dealing with. If impacting human life, you have to put a car rail in it.

Aaron Crow (42:59.799): Right. Yeah.

Aaron Crow (43:7.434): Absolutely. Yeah. So we've talked a lot about different things along the way. You know, what are the come up over the horizon? What is the one thing? And it's probably some of the stuff we just doubled down on, but what's one thing that you see come up over the horizon that's exciting and maybe one thing that's a little bit scary or concerning that, that you see in trends or, or that may be coming.

Sue McTaggart (43:29.776): Yeah, in cybersecurity, because I am very involved with safe life strategy, trying to implement cybersecurity in early stage instead of after thought, after being deployed. I'm always that way because my background is a developer. What is a good thing about AI in cybersecurity, as you know, if you have a function in cybersecurity function, there are always

Sue McTaggart (43:59.458): a small group of people. It's never really a match with IT workforce. Cybersecurity is either 1 to the 10. We're lucky, even 3 to the 10. So it's always limited resources. With AI, I think we can leverage so much to do the processes, the automation. For example, if we want to perform a risk assessment.

Aaron Crow (44:5.070): Sure. Sure.

Sue McTaggart (44:29.244): If we are a standing up agent to perform a risk assessment where the agent can really learn about different threat modeling, the vulnerability that tied up to API, for example, even though we're not going to be knocked down 100 % of it, even though if we have 50 % of it, that's a less burden.

Sue McTaggart (44:57.862): for cybersecurity folks, the most, I call it the low hanging fruit. If the AI can help us with the low hanging fruit, then we can focus more prominent issue that maybe we have access control that we need to focus on where it cannot be detected by system or by automation. So we, as a cybersecurity professional, we can focus what

Sue McTaggart (45:27.694): matter most with AI. That is exciting thing for me to see the even the, you know, like a threat modeling, more vendor using AI or even the detection, even the remediation, auto remediation, they have agentic AI that will call a certain.

Sue McTaggart (45:53.120): and update the library automatically without any like so many resources to do so. So that is a positive side of it. But negative side of it, if they just fully trust AI not having human loop, we're not that mature yet. So we need to be like even half of half.

Sue McTaggart (46:21.614): some of low hanging fruit vulnerability can be tackled by automation and AI, we still need to have a human loop to do some check and balance. And that is, I'm afraid that people think, we have AI, we're done with it. No, we're not done. We're not mature enough to the point that we have confidence that the AI agent can generate the result we want.

Aaron Crow (46:49.901): Right.

Sue McTaggart (46:51.216): There is a bad and good about that. So a lot of people are trying to sell the product, this is AI. But when we integrate it to the environment, that's not as good as the thing there.

Aaron Crow (46:53.869): Yeah.

Aaron Crow (47:4.874): It, it, yeah. I mean, it reminds me of, all the, the smart devices that showed up in the market, you know, 10 years ago, you know, you got, you got AI or you got, you know, embedded IP addresses in your toaster oven and your coffee machine. And it's just like, I don't need my coffee machine to be smart. I could just go click the button. Like I don't, yeah, I get it. Like I don't need everything to be smart. Just like, I don't need everything to have AI in it. Like everything doesn't have to have AI. You don't like.

Sue McTaggart (47:26.190): Right.

Aaron Crow (47:34.389): software developers, companies, startups, every product does not have to have AI in it. Like it doesn't. And you go to RSA, you go to Blackat, you go to these technical conferences and they all have some kind of AI flair on it because that's what every what what's your AI capability? You have a local model. Like what can you do with AI? my gosh. Like we've been doing most of them aren't even true. AI, it's just automation. It's LLM. It's it's scripting. It's whatever.

Sue McTaggart (47:46.277): Yeah.

Sue McTaggart (47:56.348): Yeah.

Aaron Crow (48:3.650): But they have AI.

Sue McTaggart (48:3.764): Exactly. Yeah, and that thing is like, unless you are in a research program, you can speak up what it is. To your point, some solution is very premature being deployed and presented to a client or customer. And they claim themselves, this isn't the best of the best.

Sue McTaggart (48:32.262): Hold on. Don't do that because you're going to have a pushback. Everything cannot be just enable AI.

Aaron Crow (48:44.862): Exactly. Why? And we already, we already established that many times it's just about doing the basics and you don't have to have the fanciest tools to necessarily do the basics. Cause you know, having good password management, know, making people use multifactor authentication. Like, know, there's just basics that you can do that don't, that don't need AI and are not fancy or expensive.

Sue McTaggart (49:4.156): Don't need AI, exactly. Yeah, I mean, a lot of hackers, I'm a white hacker too, you know, so a lot of hackers, you know, even they can identify SQL injection and SQL injection can be mitigated or can be remediated very easily. If I can exploit it with most common vulnerability, most common thing that can be exploited.

Aaron Crow (49:12.323): Yep.

Sue McTaggart (49:31.894): That means their cybersecurity hygiene is not that good. So I can go to the access control and stuff like that, to get into the database back end, if the small thing that they cannot tackle. But to your point, people don't really fix the most basic, but they want more advanced to the point

Aaron Crow (49:36.130): Right. Yeah.

Sue McTaggart (50:0.154): crashing.

Aaron Crow (50:1.399): Yeah. Yeah, absolutely. That that's so true. Well, this has been awesome. I love the conversation. I love the path that we went on. Like I told you, it's not, I never have an understanding of where we're going to go with these conversations. And I'm always, I always enjoy the, the, the, they get to and the outcome of them, because it's just, it's just an organic conversation where we go, where we naturally, where the conversation leads us. Right. And it's, it's not to, you know, take it any place we don't want to go or all that.

Aaron Crow (50:30.712): you know, thank you very much for the conversation. Thank you very much for sharing your time and your experience with me and the audience as well. So with that, is there any call to action you want anybody? How could people get ahold of you? Reach out. You talked about doing some mentoring, things like that. So anything you want to share.

Sue McTaggart (50:42.384): Yes, sure. Yeah, I'm currently standing up startup steel health company called Dark Defensive. That is something that I want to prioritize this time. And so far, it's something that I'm passionate to do so that people can focus on doing remediation, not only

Sue McTaggart (51:11.804): just internal organization, but if they can have some insight from what is being disclosed in the dark web and they can map it into their framework, into their prioritization to fix the issue, I think I believe so much on my startup that can...

Sue McTaggart (51:35.542): save the cost of doing remediation because big companies, small companies, medium companies, they have a blind spot. Sometimes they invest on so much budget to fix the internal network, but they forget that they have a blind spot. Then they need to put it into equation to prioritize, to map it, whether or not their credentials are being leaked.

Aaron Crow (52:4.034): Yep.

Sue McTaggart (52:4.514): and they're being have a ransomware ready to target their organization. Hopefully my solution can help the organization to prioritize what matter most to fix their vulnerability. And that is just something that I'm passionate about. And I want to put it into solution so that people can help to protect their organization.

Aaron Crow (52:33.024): Outstanding. We'll definitely include all the details in that in the show notes. Definitely anybody that's listening, if you're interested reaching out to Sue and learning more about that, checking the show notes, we'll have all the details there. Sue, thank you so much for your time today. It was a, it was a blessing to talk to you. was a lot of fun. I appreciate your time and, and I'm glad you're in Florida in the, in the warmth and not in, in colder places where, where, you're having to deal with snow and snow and ice.

Sue McTaggart (52:55.800): Yeah. Thank you, Erin. It's such an honor to be here. And I'm so happy to share my knowledge. And I'm honored to be here. And thank you for having me.

Aaron Crow (53:8.929): Absolutely. Thank you so much.

Sue McTaggart (53:11.290): Okay, thank you,

Transcript lightly edited for readability.