Quantum Readiness: The Cybersecurity Threat Most Organizations Aren’t Prepared For

Intro and guest introduction

Aaron Crow (00:01): Thank you for joining me on another episode of PrOTect IT All Podcast. Man, I love getting these conversations. I say this all the time, but I do. I get the opportunity to meet people that I've spoken to and I've known for years, but also new people that I've never met. We do a little bit of prep call right before this, and I can always just tell the energy of the conversation, so I'm really excited about this one. Jim, thank you for joining me today, sir. Why don't you introduce yourself? Tell us who you are, a little bit about you.

Jim Sortino (00:28): Hi, Aaron. I'm Jim Sortino. I'm the CRO and a board member for the US entity for ISARA Corporation. I've been in the industry for 20-plus years. CISSP, marketed over 33 different technologies into the marketplace. Three exits. Coming into ISARA, which is a brand new market, this whole idea of quantum readiness, came on board about a year and a half ago. So I'm very excited. Quantum.

RSA, AI noise, and the elevator pitch on quantum

Aaron Crow (01:00): Quantum. The funny thing is, I just got back from RSA. We were talking about RSA before because you live in that area. Everything at RSA was AI, AI, AI. Everything had AI bolted on. That's all they talked about. Then there's some people the last couple of years that I've seen quantum this, quantum that. People are starting to talk about it more. It's such a big thing that people are not necessarily grasping it. How does this impact me? How do I do anything about it? Give us the elevator pitch. Like I told you before, my audience is everywhere from a student to a C-suite. What is quantum? Why should we care? How does it impact us? What do we do about it? Give us the elevator pitch.

Jim Sortino (01:40): Yeah. So let's step back a second. With cryptography in general, when I ask you, Aaron, how long has encryption been around, you'd probably say a few years, the whole bit. Do you know the tech stack hasn't really changed much for 24 years? Can you imagine an EDR company not changing their product for 24 years, or a SIEM? You'd be unheard of, right? But in reality, yes, there's been some changes. Organizations are looking at 24 years of technology debt. When you look at this, there are basically three facts.

The first fact is 85% of CISOs and security people don't have a quantum readiness strategy. That's understandable because it's brand new. But more importantly, 50% of organizations have certificates that are self-signed, rogue, or invalid. And the most alarming, 30% of the organization's infrastructure, and I'm talking worldwide, they're still using deprecated protocols, weak algorithms, and broken modes of transportation. In the last two elements, did I say anything about quantum? This is about current risk.

If you want me to give you the elevator pitch on ISARA, basically we have an autonomous cryptographic posture management solution that does three things. It addresses your crypto agility. It helps with quantum readiness. But it also provides architectural validation to address your current risk as well as your future risk. I'll get into architectural validation in a little bit if need be, but it's really about the communication protocol. What's my server's accepting? What are my servers using from a protocol, from a cipher suite standpoint?

So we basically create an enterprise-wide inventory of all your crypto primitives, the protocols, the keys, the certificates in the cloud, in the network, down to the database level, your applications that you're developing, your files, folders, and libraries. And also, very important, third-party access. Being able to go in there and see what they're connected. You'd be amazed how many security companies are connected to enterprises that are using TLS 1.0, 1.1. It's mind-boggling. We're a responsible shop, so I'll tell the security vendor, I'll go to the CISO and say, this is what you're using, just to let you know. There's one company that really went and changed it, like, within 24 hours. But most of them, we don't hear back. We're a responsible shop. So that's what we do. I don't know if that was too long-winded, but that's it.

Technical debt and the false sense of security in "we're encrypted"

Aaron Crow (05:01): No, it's great. It just goes to show, and I have these conversations so often, many times to enhance security, I usually have to start with just the basics. It's usually not sexy. To your point, all of that you talked about, like only this much of it, 5%, 10%, whatever, was actually quantum. The rest of it was just basic. It was technical debt. It was, we're still using TLS 1.0 because we built the product 100 years ago and we've never, and it's too difficult to go back in and change that. I self-signed that certificate, and Bob who designed that part of the product is no longer here, and nobody else knows how it functions. So we just keep it working because it's too difficult to crowbar that thing out to make it work again.

That's the type of thing we see all the time as SBOMs have gotten released and we really truly understand what's going on in our products. We have to have a better understanding both in our contract terms and language as we bring in third party, as we bring in vendors, as we bring in products, but also, especially now with AI and so many folks are developing their own products and use cases and capabilities in-house. These are all things that they need to consider. You need to be a standard around how they're going to produce this thing and where it's going to touch and who owns it and how does it get checked and what is that minimum baseline of things.

Jim Sortino (06:30): No, absolutely. You're absolutely right. There's this false sense of security. When I talk to organizations around the world, oh, no, we got encrypted. We're encrypted. We're fine. We're great. Well, yeah, I know you are. You've been at it for 24 years. I would hope so. But what encryption methodology are you using? What protocols are you using? What's the cipher suite that supports that?

That's what these organizations don't realize. So I think a lot of people focus on what we do and say, oh, quantum readiness, ah, that's 10 years out. Well, it really isn't 10 years out. But think about your current risk. Because there are exploits happening right now with the current encryption methodologies, with your modes of operation that we're seeing. And that number is not unrealistic, that 30%, 30% of the infrastructure, because we could see that and we show that to customers, and they're shocked, and shocked for the right reasons. They're assuming everything is good. Oh, I'm using TLS protocol. Great. Well, which one?

This false sense of security that just because you're encrypted, but I've got GRC products, I got that. Well, yeah, they'll tell you if you're encrypted. That's about the extent of it. Or these vulnerability management tools that are fabulous out there. The major ones, they're great. But they're not looking at 571 crypto primitives and going through that. That's not what they were built to do. They're looking at named CVEs and those types of things. We're going down much deeper into that, the cipher suites, the certificates, the keys across the enterprise, taking a look at that.

Aaron Crow (08:26): Well, it's the foundation that everything is built on. Everything is a software product now. Even hardware companies have software built in them. My car has freaking software and operating system, CAN bus, all that kind of stuff. You can't get around it. How many people understand end to end that protection and how that thing is layered on top of each other and where all those interdependencies are? As we know, it's the old tale of, a chain's only as strong as its weakest link. You can have every place using the latest encryption and all the things, but you've got one little dependency that's buried down deep in that thing that is TLS 1.0, self-signed, and is expired, and the whole thing crumbles down around it.

Jim Sortino (09:14): Yep, absolutely. I've gone to organizations where we put our product in two hours. We're looking at 100,000 plain-text protocol connections. Why? Many of them will say, well, PCI DSS basically says we have to have everything encrypted outside, but inside our firewalls, we don't have to. Well, really? Is that really where you want to be? You've got to protect that inside as well. It's a little bit of a learning experience. That's why we have these CISO dinners, to educate the market on what's going on. Not to do any product pitch. It's really to educate.

Banks, governments, and the real timeline

Aaron Crow (10:04): So how are you seeing the response from that? Are people's eyes opening? Are they angry about it? Are they frustrated? Is it something that they knew? Obviously, I'm sure it's kind of a mix of all of those things, but what are the bigger outliers, the things that stand out to you?

Jim Sortino (10:22): From the CISO dinner specifically? I think it's having their peers talk about things that they're thinking about, but they're not sure if everybody else is thinking about the same way. Most of them really truly realize what's happening. If I were to consolidate it into three areas, banks in general look at quantum two years down the road. That's how they're looking at it. Government agencies, looking at it three years down the road. Everybody else thinks it's a 10-year deal. They got plenty of time, and they don't.

Google just went and announced 2029. Let's look at it. For RSA and ECC algorithms to be broken, you need 500,000 qubits. Right now, IBM and these other companies have had 20 million qubits, and they brought it down to a million qubits. That's a 20-fold decrease in a very short period of time. When do you think they're going to get to a half million qubits? Six months? A year? We're not talking, and this isn't something you can take and say, well, yeah, it's far off. I can wait. This is a project that's going to take at least two years to develop, to really move this technology. Now, if you're a big financial organization like Visa, I was talking to somebody from Visa and they said, listen, we've got a thousand analysts here. We have the money, we've got the resources, we can do this thing in a year. I'm sure that's not everybody. So it's going to take a two-to-three-year project, and they need to start now.

Aaron Crow (12:11): Right. And like we said, we already are talking about so many programs and products and things that are already technical debt of the past 20 years that you've never fixed and you've band-aided or pretended it wasn't there, or maybe you didn't even know it was there. Now we're talking about something that you can't do that anymore. It's the same as with myths and AI and vulnerabilities. Patching doesn't fix you anymore. It's not enough to kick that can down the road. Are you going to disconnect from the internet? That only removes one attack vector. This is exponentially changing the way that we do business and how we protect our business from these attacks and how high on that risk register these risks actually register, as opposed to, yeah, it's fear of selling FUD. As you start seeing things drop off because people are attacked and hit and impacted, it's going to be more and more common space. Unfortunately, it's going to be the right of bang instead of left of bang after something happens and reacting to that.

Harvest-now-decrypt-later vs. trust-now-forge-later

Jim Sortino (13:19): You make a good point, Aaron, in terms of threats. I kind of wanted to talk about this whole idea, harvest-now-decrypt-later. You've heard it. Everybody's heard it. I don't think the enterprise market should even be worried about harvest-now-decrypt-later. I know that's completely the antithesis of what every marketing person is saying in these vendors. Let's take a look at harvest-now-decrypt-later and what's got to take place.

The harvest-now-decrypt-later will require them to first steal your data. Okay, fine. Then they've got to decrypt file by file. Let's say it's three years from now, quantum comes out. Let's just draw a line in the sand there. Three years now. So now I'm going to go down and look at every single file. Now I've got to determine, is this three-year-old data sensitive anymore?

It kind of reminds me of that movie, and you'll probably know, the Dirty Harry movies. I wish I had this line right on that. Remember when he had that Magnum and he said, do you feel lucky, punk? That's the kind of scenario. You're going to have to be really lucky to find that. What I contend is, forget harvest-now-decrypt-later. Look at trust-now-forge-later attacks.

I argue that quantum risk will threaten the integrity of our trusted systems. Once these large machines come out, they're going to be able not just to read old data, but you're going to be able to forge signatures and impersonate trusted services, undermine the authenticity of software identities and transactions that enterprises rely on. Harvest-now-decrypt-later is a slow burn. They're going to go through it.

The trust-now-forge-later attacks really attack current and future trust. Let's face it, digital signatures are the root of our form of trust. Q-Day one is going to be, okay, I've stolen these digital signatures, now I can decrypt it, now I can start using them day one, versus sifting through thousands of files trying to find that needle in the haystack. This is what organizations need to be worried about, not this harvest-now-decrypt-later. It drives me out of my mind, Aaron. It really does.

Aaron Crow (15:46): Yeah, I agree. The biggest thing on the data side, obviously the CIA and all the government side, the reason they're trying to keep protected information, that kind of thing. Sure. The product for Coke, the recipe, things like that. There are certain things that are valuable IP. But to your point, the biggest impact is going to be now. What my customer information was two years ago doesn't exactly matter to me. It's going to be, how do I do this encryption now? How am I trusting? How am I authenticating into this system? How am I allowing people to authenticate into me? How do people trust, and how do you verify? It's always supposed to be trust but verify. Once they have that quantum and I've broken the encryption model, how do I verify that Aaron is Aaron? Now we have AI, we have deep fakes, and now I've broken the digital side of that trust as well. How do I validate that Aaron is who he says he is, and he's not some bad actor that's just trying to take over Aaron's account?

Jim Sortino (16:59): That's exactly right. They're going to do this with impunity. There's going to be no way to know that Aaron is Aaron when you have a forged digital signature. That's what people need to be worried about. Forget harvest-now-decrypt-later. I'm not saying it's not an attack. It's just marketing hype. I'm not into marketing hype. I'm into reality and what's really most important.

Aaron Crow (17:29): I can see China wanting to go after the US, our secret widgets that we are inventing, our undercover agents and all that kind of stuff. There's a play for it for sure. They're going to want to release dirt on us and have political capital. All of those things are real. But to your point, for a corporation, it's more important now. Not that the other stuff doesn't matter, because sure, of course it matters, but not to the same level as now. You're going to have multiple things burning. It's the analogy I give in the OT world. I've got two devices and they both have the same CVE score. They're the same risk to the device itself. They run the same firmware. They're the same type of product. One is controlling the ice machine in the break room. The other one's controlling the turbine on the power plant. Which one's more risky to my business? The ice machine goes down and you got warm water. The turbine goes down, there's no electricity. Those are two different risks to my business, but the CVE score is the same.

Jim Sortino (18:34): Absolutely. The CVE scores don't really matter in the whole realm of cryptography. It doesn't really relate to it at all.

Discovery, prioritization, and the plan

Aaron Crow (18:45): So how are you seeing people, we talked about how they're starting to see it and have the conversations realizing that this is real, it's coming. I don't have 10 years necessarily. But what is the impact? How are people starting to prepare for this? How are they starting to, obviously again, I've got all this technical debt, especially if I'm a big company. Visa or any of these big companies, you name the company, insert here, they've got this stuff spread out everywhere. How can they get a grasp on it to understand what to do and how to start fixing those things before it's too late?

Jim Sortino (19:20): You've got to start with a plan. But how do you get to that plan? You start with a plan by, you can't fix what you can't see. You've got to start with discovery. You've got to be able to discover all of your particular assets. From there, you're going to assess the strength of those. The third part is the prioritization.

Prioritization comes into a unique play here because prioritization really requires someone to go in and say, I want to look at my most critical applications, and I want to see the communication posture through those critical apps. I want to see what those workloads are emanating out into the marketplace. I want to have a complete heat map in terms of where that is. That's the prioritization. We're not trying to boil the ocean here. Let's focus the enterprise on what's our most critical asset. I've got 50,000 servers. Yeah. Okay, great. I understand that. We want to get to all that. Wonderful. But the bottom line is, there might be 10,000 servers or 5,000 servers that are really critical, and what's going to and from those particular assets. That's what we really need to uncover going forward and being able to really prioritize. So now once you've got the prioritization, now you're going to have the plan. Here's the most critical assets, here's what you're using, here's why it's an issue, and here's how to remediate it. That's where people really need to start. They need to start with the plan. Don't worry about remediation yet. That's the second phase. You've got to start with the discovery, because there are so many blind spots.

Aaron Crow (21:16): Well, it's no different than how we approach any problem. It's how I implemented firewalls, how I do segmentation, how I did disaster recovery, whatever, insert reasoning here. You have to start with where am I, where do I need to get to, what are the hurdles that are going to be between here and there. Then it's people, process, and technology. It's not just buying a product. Products are great. You're going to need some products. But you also need people to implement, and you need a process that they're going to follow. Who's going to implement it? Who's going to own it after the fact? How are you going to maintain it? Some of the things may be too old. Am I going to rebuild? Am I going to accept risk and put something in a corner and isolate it? There's going to be all of these types of things. It's not just going to be a clear A plus B equals C. It's going to be this jagged line, like all projects are, of, we thought we were going here and now we're going here, and it's up and down and left and right and making those adjustments along the way. But we can't put our heads in the sand and think it's not coming.

Modes of operation, alert fatigue, and SBOMs

Jim Sortino (22:20): Right. And I can't emphasize enough, it's not just about quantum, it's current risk. It's current risk. And they have it. One of the biggest culprits I've seen in enterprises all the time is there's a mode of operation. It's a procedure to use the block cipher suites, decrypt messages larger than a single block. It's important. The CBC mode, they use CBC mode all the time. That's broken. It's been deprecated. So you have two forms of attacks. You have bit-flipping attacks and you have Oracle padding attacks. They can get into your network pretty quickly. Someone could get in there, but they still use it. They're like, no, we're using GCM. But no, you're still using CBC. Consequently, you're now going through a downgrade attack, and you're going to be able to get into the network. So you're allowing it. You've got to stop that.

Those are the kinds of things that, listen, analysts in the enterprise network, I feel bad for them. A typical enterprise has 10,000 alerts a day, of which they can manage the best ones, about 4,000. So that's a 60% delta.

Aaron Crow (23:35): That's a big snowball that's getting out of control ahead of you that you can never catch up with.

Jim Sortino (23:39): That's exactly right. So it's not about creating this and people talking, talk about one other thing, which is SBOMs. Everybody talks, oh, God, I have an SBOM. I'm like, okay, so you have a list of all your cryptography. It's a snapshot of one time. Well, among many. Okay. What you going to do with that? Why are we as the industry yet again imposing more work on our enterprises by giving them lots of noise that's irrelevant to a degree? Now there are some cases for SBOM, I get it. There's some value to it. But I start seeing RFPs saying, like, I want an SBOM. You want to know what's in use and what's at rest at your key management systems, at your database side. But you don't need to have just a laundry list of everything that you have. You want to take a look at, prioritize. I always try to say to my customers, focus. It's too big. Focus on making those little steps. They always say, like, goal management, you start with little steps, you achieve little steps, it makes you feel gratified. That's what I always try to say, even with my deployment team. Take the little steps. We deploy, show the customer what they've got, help them remediate, and then move forward in that. It's the little steps that will get you to the ultimate goal, not trying to boil the ocean all at one time.

Aaron Crow (25:33): Get some quick wins. That means a lot. Getting those quick wins, seeing some progress, knocking some things off the board, the factor of just walking up to the board and marking through it and high-fiving, hey, we did this. There's a lot to that. It's beyond just trivial. It really matters to start making progress, see that you're making progress. Dave Ramsey and debt snowballs and all the things, it's the same mental idea. We know we have all this debt. We've got all these old antiquated systems. We've got all this stuff that we have to fix. And we know this. You're never done. We're never done. You're never secure. It's never like, okay, hang up the keys, we're done, go home. No more security requirements. No more analysts. Turn the logs off. We're all good. We've protected everything. We've plugged every hole. We've solved every problem. The attackers can never get to us. We're secure. It's just never going to happen. Ever. Never.

Jim Sortino (26:37): No, that's exactly right. I always try to make it easier. Take it in steps. Because it's too overwhelming to look at everything as a whole.

Budget, mandates, and where the market actually is

Aaron Crow (26:49): What are you seeing from a budgetary perspective? With boards, with CISOs, how are they starting to see and quantify? When we talk about any of these risks, it all comes down to business risk. How are businesses starting to see and justify this as part of their plan and their roadmaps? You talked about some folks putting it in in three years, others two, and others at 10. How are you starting to see businesses quantify this risk in their roadmap?

Jim Sortino (27:21): From a quantification, I think it's really more of, they know it's a necessity, especially the financial services. They realize it's a necessity. They're going to need to budget. They need to budget now for these types of events. They cannot wait. Their integrity is on the line at this point. When you look at encryption, when you look at all security tools in general, what's really the most important? Encryption, the data. That's what everybody's trying to get at. So if that's weak, then there's a problem. From the board perspective, this is a new market. So it's really just starting to come into shape. I talked about this with you, Aaron, before the show started. When I came on board to ISARA, we had seven companies hitting our website on a monthly basis. We were setting the world on fire. Now we almost have 2,000. And it's just, what, a year and a half later? So there is this groundswell. Then you also have Gartner and Forrester, and you've got Google and IBM and all these companies basically hammering their fist saying, you've got to start now. Look at the mandates that have just come out with our federal government. Department of War memorandum starting to go up. The OMB issued mandates. What do they say in those mandates? You must start a discovery of your inventory by October of 2026. Discovery. Not boil the ocean, not get everything remediated. Start your discovery. Get this underway. That's great that what President Trump has done in terms of really pushing that mandate and his administration.

Aaron Crow (29:16): As we said, it's so frequent. We see this and you name the vertical, you name the problem, but we put our head in the sand. We've done this for 40 years. We've never had a problem with it. Whatever the insert excuse here. We just continue to redline that thing as long as we can. Until the engine's not going to blow, we're good. Until we blow the engine. I don't want to be standing there holding the bag when that happens. The smarter organizations are going to be forward thinking. Luckily, a lot of the financial side, I think they understand their reputation and their risk. Their entire business is aligned with this. If they don't do this, they're going to get left behind and out of work. I'm more concerned on those mid caps, the ones that are not, they don't think this is involved or it's as needed for them. Those are the ones that I'm most concerned. Like you said, I'm sure Visa will take care of it. I'm sure American Express, I'm sure Chase and Citi and all of the big names and the big companies will do those things. But what about the credit union around the corner? What about all the little guys that don't have thousands of analysts? They don't have big budgets for these things. They may not have as much awareness on this. Not as much minutia around cyber and all these kinds of things, even though they necessarily should be. But as there's no regulation forcing them to do something, they're going to have a hard time finding the budget to get it done even if they wanted to.

Jim Sortino (30:58): Yeah, and that really comes down to the vendor basically doing a pricing model where we look at it based on per server. So a credit union's got far less servers than a Visa. Just slightly. But I want to get back to another point. I just talked about the United States and what that administration is doing. But Canada is really leading this charge. You know who's really going after this charge, probably the number one market for us, is Europe, because of the DORA regulations. They are way ahead of the United States. If I were to look at it, Europe and the Middle East are far, I think, farther ahead than the United States. That's the first time in my career. It's always been North America's dominated. Not here. Europe's been thinking about this last year, and probably even before that. I talked to people in Brazil and in Nigeria who have been thinking about this in 2024. I'm like, wow. They have been very forward thinking when it comes to PQC and going through this. The second biggest market is Canada, doing a great job of that. That administration is doing a great job of really imposing. Asia third. US is number four in terms of the market.

Aaron Crow (32:28): It doesn't surprise me, honestly. I just got back from DEF CON Singapore.

Jim Sortino (32:30): It surprised the heck out of me. You're thinking everything is in here. But it isn't. They are really actively pursuing this and putting budgets toward that. Not to say that we're not, but the US is a little bit behind on that. But I'm glad. We're going to get there. They've got the, but it's just very interesting for us to say that Europe is absolutely number one and Middle East number one in terms of really going after this market.

When regulation actually helps, and the "insecure option" story

Aaron Crow (33:02): This is just a great example of a way and a place that regulation really helps. It helps justify, it helps push, it helps boards understand the risk and the needs. It takes that, well, we don't want to do this, or it's not optional. You have to do this. It helps to justify the costs, the resources, the people, process, the technology around these things, instead of a debate or a dialogue around, well, is it really needed in our business and do we have to do it everywhere? That hemming and hawing that you get sometimes in those boards, which for right reasons, they're making the right financial decisions, or they're trying to make the right financial decisions for their entity. But sometimes there's things that they probably don't understand and that need to be, you can't.

I remember a very, very side note. I did a control system at a power plant, and this was, I don't know, 15 years ago. This was at the beginning before anybody called anything OT. We were rolling out, and it was around NERC CIP, which is a compliance around OT stuff in power regulation side here in the States. We were sitting there with the vendor, and the vendor presented a proposal to do the control system upgrade at this power plant, multimillion-dollar thing. They gave us two options. It was literally the top of the proposal, the secure option or the insecure option. The insecure option, obviously, was cheaper because it didn't have any of the security tools and things like that. The plant manager was sitting there looking at it. He's like, well, I think I'll go with the insecure model. I'm like, yeah, you can't do that. He's like, what do you mean? You can't choose that one. The reason behind it, obviously, there was this compliance regulation that was behind me. I'm like, it's not me. You can't yell at me. I'm just telling you, that's not an option. You cannot choose that option, because then you're going to get way more than that in fines and regulation and shutting down the power plant and all that kind of stuff. Then I had a conversation with the vendor after that. I'm like, why do you even have an insecure option? Even if there is an option with no security, you shouldn't call it the insecure option.

Jim Sortino (35:17): Perfect.

Aaron Crow (35:21): It's just the ways of the time. Hopefully it's so different. It's the same as folks that have TLS 1.0 or they've got self-signed certificates, and they've got things that have been, no expiration dates on them. They've been in there since the '90s. Those things exist. I've seen them in these places, in really important critical systems, and they are securing our environment using those things. We see all this awesome, we see GUIs and all the things that it's doing. But actually, the crux of it comes down to a token that's perpetually signed and self-signed and is TLS 1.0 and is 128k encryption. It's just like, what the hell is going on? But obviously, they're not advertising it. It's not on the front page of their website as a feature of their product.

Compensating controls and visibility

Jim Sortino (36:16): More importantly, it's somewhat complex, and they can't know everything. These guys have got a hard job. They've got so many other things that they're worrying about on a daily basis. I was talking to one bank and I think they said they had 7,000 attacks a day. Attacks a day. That's mind-boggling. So I completely understand where they're coming from. On the other hand, we're not trying to sit there and say you're bad if you have TLS 1.0 in there, because sometimes a custom application that they've developed, maybe it's a legacy, maybe can't support 1.2, 1.3. As long as you've got the compensating controls associated, you're good. But at least we want to give that visibility. You have this. Is this a potential issue? If it isn't, you have the ability to ignore it and say, we're good there, and we move on.

So then the solution will reprioritize what assets you need to address first. But it's that visibility, at least having that knowledge of what's going on, is really, I think, very important to enterprise accounts.

Aaron Crow (37:32): Yeah. The analogy I give on that is, I've got Fort Knox on my front door. It's a steel door. It's got all the things. And then my back door is a screen door. It's only as secure as its weakest link. To your point, now maybe I've got a dog and I've got monitors and I've got an armed guard sitting inside and all those kinds of things. I can't change the door, but I've put other mitigating controls around those things to protect it. To your point, you need to at least understand that it's there so that you can protect it. Maybe I can't change the door itself, but that doesn't mean I can't secure it.

Jim Sortino (38:08): No, absolutely right.

What's coming next: risk and optimism

Aaron Crow (38:10): What do you see next? Obviously, it's a shorter time. I used to say five to 10 years on this question. This is kind of my rapid question I ask everybody. I used to say five to 10 years, but things are changing so fast I've kept the years out. What is one thing you see that's concerning that's coming up that we've got to fix? It's probably quantum or AI. And what's one thing that's exciting that you're optimistic about coming up?

Jim Sortino (38:40): I think, myopically speaking, the biggest risk that I see going forward is the people thinking this is a five- or 10-year plan going out. I think they're going to be sadly mistaken, and they're going to be way behind the eight ball, especially when it comes to trust-now-forge-later attacks. I think that's going to be a big problem. We always talked about the Y2K issue. This is going to be way more significant than that, when this thing drops.

The positive side of it, worldwide, the market is really trying to embrace this whole quantum readiness. I have people in Belgium that want to talk to the Canadian government to see what they do. So there's a lot of collaboration going on amongst different countries. They see the need for this. And quite frankly, the other thing that's exciting, when we talk to a CISO, we're not talking to them about the typical security tools. This is something new to them. This is something that they've got to sit there and brace and go, yeah, this is interesting, I can learn from this. Hence the reason why we do these IT and security dinner events where there's no product pitch. It's all about just an idea of collaboration between peers of what they're going to do from a quantum readiness, crypto agility standpoint, those types of things.

Aaron Crow (40:19): We learn better together. We learn together, we grow together. I had a mentor tell me a long time ago, all business is a people business. It doesn't matter if you're the sales guy, if you're the janitor, if you're the CEO, you have to work with and through people. The faster that you build trust, the faster you move forward once you build that trust. So things like that, we break bread, we have a drink, we talk over war stories. That's how we grow as humans. That's just the way that it works. 100%.

Where to find Jim and the executive roundtable dinners

Aaron Crow (40:51): What's your call to action? How do people find you, find out more, get invited to the CISO dinners? Where are they going to be? What's the catch?

Jim Sortino (41:08): No catch. It's isara.com. You go in there, and it's the executive round tables. Like I said, we're going to be in Austin this Tuesday, May 12th. Then we're going to be in Washington, DC during the Gartner Risk and Security Summit on June the 2nd. I'm doing a European tour in September. I'm going to be going to Zurich. I'm going to be going to London. I'm going to be going to Munich, doing that, because that's a hotbed there. We're going to be doing things during the summer as well. We're going to be hitting Seattle. We've got to hit the Denver area. But we've already been to Boston, New York. No, we haven't been to Philly yet. I'm sorry. Boston, New York, Tampa, Dallas, Palo Alto, Orange County. So we've been down to a lot of these so far. But again, we're going to do 19 tours. Come out and really visit us at isara.com. Take a look at what we have and what the challenges that we're addressing in the marketplace. That's that whole idea of the automation, prioritization, and really the communication protocol, not only internally but also externally to third-party vendors. Really key point that we address.

Aaron Crow (42:36): Yeah, it sounds great. Definitely check out their website. Check out when it's coming to your town, or maybe even reach out to Jim and say, hey, I think you should have one in our town, and I've got some folks that would be interested in having that conversation.

Jim Sortino (42:49): Absolutely. Would love to do that.

Aaron Crow (42:53): Awesome. Jim, dude, I appreciate the time and the opportunity today. Thank you for sharing with us. It was a great conversation.

Jim Sortino (42:56): Aaron, great meeting you. It was great. I really enjoyed it a lot. I want you to come to our dinner on Tuesday. All right? Sounds good. Thanks, Aaron. Appreciate your time today. Thank you so much. Bye-bye now.

Aaron Crow (43:05): Absolutely. I'll be there, sir. Thanks a lot. Bye-bye.

Transcript lightly edited for readability.