AI & Cybersecurity: Why People, Accountability & Resilience Still Matter

Cold Open & Brian's Path: Bowling Center to the Air Force

Aaron Crow (0:1.142) All right, it looks like I'm looking in a mirror. Thank you for joining me today on the Protect It All podcast. Brian and I were just talking before we joined that that there there's a lot of us that have this look and he's gonna change his look. So I don't have to. So Brian, thank you for joining me today. And why don't you tell the audience who you are, your background, whatever you want to share with that.

Brian "SchleiF" Schleifer (0:19.618) Yeah, sure. So Brian Schleifer, I go by Schleif. there was a lot of Brian's growing up. So Schleif started in high school, went through my whole military career, and then afterwards, the I guess I'll I'll do not so much where I'm like, I remember the lights coming from the hospital for my parents' birth. so I I went I lived, grew up in Texas. My parents owned a bowling center. So I grew up around entrepreneurship and a lot of different people and doing a lot of public speaking. There would be like Friday night, you know, they'd have the the headpin and you'd be like, okay.

Brian "SchleiF" Schleifer (0:49.654) Lane ten, everybody watched, they can win friend free ten games and all that stuff. So growing up around that and a lot of different walks of life, which was really cool. and then you know, I did a short stint in college, very short stint, and it didn't quite work out. And I said, you know what, I'm gonna go in the military. So I did twenty years in the air force, very exciting, very cool. Traveled the world, lived in Germany for three and a half years, where I played rugby for a local German team, lived in England for three years, and then of course deployed to all the fun, you know, the places Iraq, Afghanistan, Africa, Korea.

Aaron Crow (0:54.123) Yeah.

Twenty Years USAF: Desktops to Cyber-Physical Systems

Brian "SchleiF" Schleifer (1:19.846) and then yeah, just got to do a lot of traveling. The cool part was that I was very fortunate in not being in a niche area during my Air Force career. So through my bases, I got to work all the way from like desktops to servers to enterprise level. And then eventually towards the end, getting into cyber physical systems, which had to do with like basically munitions and aircraft. So once I retired, I sort of fell into working for a company called MTSI, Modern Technology Solutions Incorporated, great company.

Brian "SchleiF" Schleifer (1:49.406) did the DO now W contract career for about almost seven years, six years. So I worked on like some really cool like hypersonic cruise missiles and stuff as a system security engineering lead and other other kind of fun missiles and munitions, along with the testing on the MC 130 and AC 130, got to do a little bit of that. What I mean by that is facilitating pen testers coming out, also looking at cyber hygiene and building that up. So it's a very interesting thing as as I started to really research into that.

Brian "SchleiF" Schleifer (2:19.349) I noticed that there was a lot of cross flow and sectors. So I'm doing some formal education and so that that helps right a lot in that time. So I'm looking, I'm like, an FPGA, right? Field programma gate array. wow, there's some in aircraft. well, there's also some in manufacturing plants and water treatment plants and SCADA and PLC devices and ASICs. And that's the same thing across the board. So I furthered I'm I'm trying to complete my doctorate and graduate in December. but it led into to looking across the sectors and finding out lesson learned.

MTSI, the Doctorate & Landing at SecurityWeek

Brian "SchleiF" Schleifer (2:46.903) So I started going to conferences like the ICS Cybersecurity Conference, AI RIS Summit to look at these things across the board and look at the similarities and differences and where we could help and add value and where I get value and bring it back to the customers I was supporting in the DOW. After that, most recently, I decided to part ways with MTSI on good terms. and now I am a 1099 kind of guy. I have my company called Pave Consulting, People Had Value Experience.

Brian "SchleiF" Schleifer (3:13.389) One of my main customers I work with, I'm the director of content for events for Security Week, which is an amazing, amazing, amazing company. we do two big conferences, the AI Risk Summit and the ICS Cybersecurity Conference, twice a year. The reason that's important is really the people. And I even got some testimonials about that, and that helps. So, no matter what my technical background is, the root for everything is communication. So being able to effectively communicate through all those walks of life.

Aaron Crow (3:38.048) Yeah.

Brian "SchleiF" Schleifer (3:42.254) through all those industry partners that stemmed back from the bowling center day has helped and been, you know, helped create, I would consider a mining a minor success for me helping others grow. and so now that's what I do. I do podcasts and webinars like yourself and help, you know, research call for papers and hopefully, you know, do some consulting and my own my own podcasts on the side as well. So that's a little bit about me.

Disparate Careers & the Leadership Circle: Why Soft Skills Won

Aaron Crow (4:3.562) That that's awesome. And and man, it it it just goes to show. And and I I get I'm fortunate enough to be able to have awesome conversations with folks like you. And and and it and it's amazing how many of us have this disparate you know, traverse through different careers and and and different seats and all these things. Like I've I've been a real estate agent, I have my real estate license since 2006. I ran a real estate office.

Aaron Crow (4:28.424) And did bank own foreclosures and I did, you know, remodels and flips and and managed all the construction side of of house flipping and and all that stuff from a corporate side, you know, dealing with banks as a customer and you know, they foreclose on a house and then I have to get it, you know, in in ready shape but to sell and do, you know, marketing and and broker price opinions for for those types of things. All at the same time, I had a consulting company that I was doing technology stuff. So I was running, you know, small, medium sized business stuff.

Aaron Crow (4:57.354) back in, you know, the Microsoft days where they had that that one server, the Microsoft Small Business Server that had exchange and Active Directory and all the things in the one box. but you know, you'd install that box and and and you didn't know that, you know, you needed to protect it and secure it. And, you know, who's sending who's getting my emails and if you get malware, like all of those types of things, right? So and then I I I worked at a at a power company and and I was in this OT role, right? I was doing OT cybersecurity stuff and

Aaron Crow (5:26.484) And one of my leaders, my boss, they they brought in this third party company to come in and it was a consultant and and it was all about they built this thing called leadership circle. And I talk about this before, but I think it it it aligns exactly with what you're talking about, right? I was focused up until that point in my career, I was focused on being the smartest technical person in the room or whatever, right? And and those things are still valid. I still, you know, I

Aaron Crow (5:53.863) See all the tech stuff behind me. I'm still, I still tinker, I still play, like that's still who I am. But I realized going through that process, because they made us do public speaking, they made us do write business proposals, they made us do, you know, you case studies and all this different type of stuff. We were doing book reports and and all this different type of stuff. And at first I hated it. I absolutely hated it. I'm like, I'm not in college anymore. I don't want, I don't have time for this crap. This doesn't help me. And come to find out, again, looking back now, that was.

Brian "SchleiF" Schleifer (5:55.191) Yeah.

Aaron Crow (6:23.286) Probably 2012. so you know, it was it was a number of years ago. But looking back, that thing, that time, that that focus of me focusing on all of those soft, quote unquote, soft skills is why I can have this conversation with you. It's why I have a podcast, it's why I get on stage and talk at conferences. And and am I nervous? Sure, everybody gets nervous.

Aaron Crow (6:47.580) but you just push through and you you you go back, you know, it's it's like you hear military talk and you fail to the level of your of your training. talked about the same thing in baseball or football or whatever experience that you have. You're going to fall back to the level of your training and the things that you've done. And this me having these skill sets, you having those skill sets makes you better at the technical stuff. Because, you know, one of my mentors told me a long time ago, and I'll shut up for a second, but you know, all business is a people business. Like,

Aaron Crow (7:16.424) You are, doesn't matter what your title is, you're a salesman. You have to be a salesman. You have to convince your boss, your peers, your clients, your you know, your leadership, whomever. You have to convince them of whatever your idea is. So, yeah, you have a great technical idea, but how do you get people buy in? How do you get people to agree with it? How do you get people to want to implement it and do it or pay for your services or whatever those things are? It all comes back to the people skills of things, which is

Aaron Crow (7:42.963) unfortunately in the technical world not always focused on they they want to see what certi certificates you have and what skill sets you have and how much can you program and all those are great things to have but if you can't tell me and explain to it and sell it like that person is is super valuable to me. If you can do both of those things, like you're you're a superhero.

Humble, Hungry, Smart: System Security Engineering Across Silos

Brian "SchleiF" Schleifer (8:3.893) Yeah. Yeah. I have a buddy who owns a a big business and we've talked a lot about that, you know, and being hungry, humble and hungry, humble, smart, right? Right basically having the aptitude. And that's the kind of things that a lot of companies and organizations should if they're not looking for, because if they have the aptitude, you can train them up. But like you said, that cross flow or cross functional skill set is huge. one of the I I was for a couple of of systems that I supported, I was a system security engineer.

Brian "SchleiF" Schleifer (8:30.193) And so that's more of a term, it's almost like product security engineering in the like the commercial world. And you have to like have a good skill set because there's different components and subcomponents and integration and compatibility. So you can live in your own little silo. But if you're not talking to like, hey, there's the guidance, right? And like an aircraft, right? There's the main computer, but there's also the other things like has the propulsion and all these other areas. You need to go be able to speak with these experts and go, do you have a logic bearing device?

Brian "SchleiF" Schleifer (8:59.253) can you tell me about it? Because we all know about the you know, entry attack path and it could be anywhere. And so they're gonna look for the the least the the least difficult area to enter from. And so you need to know because these are people like, yeah, I have this, and you're like, wow, I I can get in through an antenna or I can get in through something else. And they're like, Yeah, I guess I never thought about like that. And that's why it's so important. So it's interesting to see, even in like the OT side from the manufacturing extent, when they do tabletop exercises.

Aaron Crow (9:3.382) Yeah. Yeah.

Brian "SchleiF" Schleifer (9:27.989) And it's eye-opening. There's a bunch of different methods, but it's super eye-opening. And you have to communicate around the table. And sometimes the skill set is not even you speaking, it's the questions you ask to draw things out because it's an awareness factor. And they're like, no, no, that can never happen. It's engineered like this. And you're like, by definition of hacking, is it's going to change that what you think and how it's supposed to operate, converting it to something else. And so being able to establish that rapport, not come across like, hey, I want to do pen testing. No, no, no.

Aaron Crow (9:48.394) Mm-hmm.

Brian "SchleiF" Schleifer (9:56.706) Don't touch my baby. No, I don't you know, like, hey, no, no. We're trying to make all of us better and eventually this system or system of systems better at the end of the day.

Two Ears, One Mouth: Walking Into OT With a Questioning Attitude

Aaron Crow (10:5.130) Yeah. Well, it's always gotta be this dialogue, right? And and it it's you know, that's the other piece I learned along my my career as I as I've gotten more grays in in my beard, right? you know, I used to walk in a room and you know, try to explain to everybody how smart I was and and how I know the way. when I when I, you know, my dad used to tell me, God gave you two ears and one mouth for a reason. you know, if I walk into a room and I'm listening first.

Aaron Crow (10:33.578) Before I start speaking and telling the person how wrong their ideas are or why they're doing everything wrong. Anytime you walk into a room and you just immediately go off on all the things that you see wrong, that person's gonna be defensive. Even if you're right, it doesn't matter. Right. You have to understand I think this happens a lot in OT. It's easy to walk in and and you know.

Aaron Crow (10:56.950) Grade the paper and have red all over the paper and find all of the things. It's got old devices, it's Windows XP, you're not patching, you don't have a backup solution, your firewall has too many, too many holes in it, like all the things. Like it's easy to find a checklist of problems. But all of those checklists or problems are not something you necessarily need to solve by rip and replace. Like I'm not replacing the XP machine with a brand new machine just because it's XP.

Aaron Crow (11:20.736) Like I need to understand the why. Like why are we in this place? Is there a something that makes it where it has to be that way? and and lead with those questions with a questioning attitude before you just start going in and accusing.

Steve Jobs, Chris Brown & Inserting Security Into Their Culture

Brian "SchleiF" Schleifer (11:34.347) Yeah. Yeah. So I want to touch on a couple of things. So one, I I wanted to pull this up because I have it on my LinkedIn. I used to have it memorized, but you know, the penguins jump off the iceberg. So it's by Steve Jobs. So technology is nothing. What's important is that you have a faith in people and that they're basically good and smart. And if you give them the tools, they'll do wonderful things with them. Right. So it's very much along the basis of what we're talking about. the other thing is too that I find very fascinating is

Brian "SchleiF" Schleifer (12:0.715) You know, right now there's a lot going on, right? AI is prevalent across the board and there's still some pushback. and you really, as as you know, with the cybersecurity person, you know, we we do a lot of educating. one of the things I thought was really interesting, and it goes along with the culture, is I was talking to a guy named Chris Brown. He's an executive coach, career coach. He's amazing, amazing, amazing. If you have an opportunity, great dude to to connect with. He was like, I was chatting with him about something, some potential thing, and he's like, Hey, listen.

Brian "SchleiF" Schleifer (12:29.537) When you go in, you're not trying to get them to be part of the security culture. That's not how you should do it. That's not how you're going to get buy-in. You have to understand their culture and insert the security aspect into it, right? How do we fit in? How can we collaborate and again make each other better? Because if you're trying to pull them to security, no one likes security, man. I get it, right? I like I tell people, it's the insurance, right? You don't really like care for it until you need it.

Brian "SchleiF" Schleifer (12:57.797) and some people are willing to sort of just punt that off and say, we're gonna we're gonna talk about that later. We don't need a budget. Functionality is key. You know, where's my return on investment? doing with whatever it is, making whatever widget that's out there at the time. And so it's always an interesting concept to hear that that story. But at the end of the day, right now with the advent of AI, a lot of people are pushing it and it's it's concerning. And I use the analogy that if you're not in it, like you said, continuing to grow and understand all those books behind you.

Radio Shack or Blockbuster: AI Adoption Without a Plan

Brian "SchleiF" Schleifer (13:26.711) You're gonna turn into Radio Shack or Blockbuster or BlackBerry. And the important factor is you don't have to like go in and smash this into your organization. I was at a conference and everyone's like, our boss has said we have to use AI. We don't know what we're gonna do with it, but we have to use it. We don't even know. Like, and I'm like, wow, that's crazy. Like, seriously, it was last year at the AI Rest summit. I was like, wow, that's that's crazy that people are just having that shoved in because they understand the importance of this technology as a human evolution that we're going through right now, but everyone's like, What do we do?

Workflows First: Automation and AI Are Not Synonymous

Brian "SchleiF" Schleifer (13:56.491) And that's the big thing I I just I want to pass this along is we've talked about this before, but really looking at workflows and processes with the experts and understanding those minor processes in the workflow that can be improved through automation andor AI, because those are not synonymous. So and that's the important factor. And it's like, okay, I'm doing this. This takes me two hours. I have to do rework on this Excel spreadsheet once it's done.

Brian "SchleiF" Schleifer (14:25.674) That's the kind of stuff you can leverage like LLMs on. There's other things that are looking at trend analysis. Hey, this machine breaks every once in a while. I think it's like between these two months. Cool. Put that in, do some actually machine learning, right? Have some algorithms that are going to kick that off. And that's what that's been along a lot around a lot longer than LLMs has been like the trend analysis for supply chains and all that stuff. But that's the big thing, is everyone's just trying to like shove and force this in. It's like, okay, hold on, take a step back. We can make that happen.

Brian "SchleiF" Schleifer (14:52.214) But do spend some time up front, right? We already have that, you know, planning up front. Planning up front saves a lot in the long run instead of just shoving it in all the time. but I don't know if that's what you've seen and had conversations with your people on. But I think asking the right questions, and this is what we're going back to from those experts. Hey, what what do you need help on? What do you see rework? What kind of tickets can we aggregate? What can we do? Then you go, okay, cool. Because when you go talk to the board, everyone's like, Hey, I have these six different LLMs and tools and things I want to. And you go, hold on.

Brian "SchleiF" Schleifer (15:20.510) I know two of those that can do all the things that we need. And that's the part people are not looking at change boards across, you know what I mean? Like they're they're just shoving stuff in. They're not looking at you talked about earlier, like the incident response and coming back because how are you looking at your LLMs by day backup, by version backup? Because they do get trained. They won't learn anymore, but they're still getting trained. So Bob's been doing this cool stuff. He has a chat going, really learning, putting stuff in. Something happens. Bob goes back, he's like,

Aaron Crow (15:36.235) Right.

Aaron Crow (15:42.816) Right.

Brian "SchleiF" Schleifer (15:50.689) What what happened? None of my stuff. Well, we had to res well, you reset now, but I lost everything. So now he has to rework. So now you're losing that efficiency and that ROI by implementing it in the first place.

Aaron Crow (15:55.690) Yeah.

The TI-92 Problem: Checking AI's Work

Aaron Crow (16:1.878) Hundred percent. And and then, you know, bl the funny thing or not funny, is people to your point, they're they're they're going after AI because they see the value, but they don't go into it with, hey, this is my end goal. Like I a and the how, right? You know, we know that we shouldn't be putting per you know private information, you shouldn't be putting your social security number in in AI, you shouldn't be putting customer data in AI because all that stuff can leak.

Aaron Crow (16:32.470) But you also need to be intentional about checking the work. So when I took calculus in college, right, I had a really fancy TI 92 calculator, you know, looks like a a brick now because you can do more than that on your phone. But you could put calculus formulas in that equ in that calculator, right? So I could know what the answer was.

Aaron Crow (16:55.976) At the like I could look at a problem, I could enter it into the right, assuming that I knew which formula to put it into. I could put it into the calculator and it'd give me the answer five, twelve, whatever the number is. But that that's not enough. That the calculus, I needed to be able to show the work and understand how I get from point A to the answer, right? And that's the piece that so many people miss out on in this AI thing is I you still need a an intelligent human that can tr check the work.

Aaron Crow (17:23.052) Because how many times have you heard about or seen things? You put in a math problem and it gives you the wrong answer. But if you don't know that it's wrong, you just assume that it's right. And that was step four. And now you're 175 steps down the road, but step four was wrong, which means every step after that was wrong, but you didn't know that because the person that is running it is not in not that they're not intelligent enough, they just don't know that it was right or wrong at that point. So that goes back to.

Aaron Crow (17:49.355) How do you govern this? How do you run this in an organization and make sure that you're putting the right processes in a place? You have the human checking the work at the same time. It's like the way I look at it, and I want your perspective because I know you've been doing a lot of work and focus on these things. I look at AI as almost like a junior or or you know, almost an intern that I can give tasks to, but I still need to check the work when it comes back. I'm not just going to take the work that they do and publish it. I'm going to have to.

AI as the Junior Intern & How Aaron Used AI on the Book

Aaron Crow (18:19.026) Read through it. I'm gonna have to look. I just released a book this week and and it went through all of my podcast episodes and the transcripts. And I've been working on this for about year and a half, two years. And and the hard part is as I've got hour-long conversations with folks like you, there's just so much words there. I'm trying to say, Hey, I want to talk about this topic. Where are all the time the things that I talked about this in the in my in my episodes? Because I want to pull those things in. So I

Aaron Crow (18:47.464) I'd go through and read transcripts and go through all those things. The last time I did this, so I've I've my this is my third edit on the on the book. I was able to feed all of my transcripts to an AI because I gave it a very particular task. I want you to map out the conversations that I had in these things, show me which episode, show me the point where it talks about it, so then I can pull those stories out and put them into my book. So everybody asks when I wrote a book and everybody's like, did you use AI? Yes, I did.

Brian "SchleiF" Schleifer (19:1.484) Mm-hmm.

Aaron Crow (19:17.046) Did AI write my book? No. But AI is absolutely a tool that I used in my process. But the funny thing is, so many people use that question almost as an insult. Did you use AI in the work that you did? Well, yes. It's like you built a bookshelf. Did you use a power tool? Yeah, I did. I still built the fucking thing, but I used a power tool because it's a it's the best tool for the use case.

Aaron Crow (19:44.353) Did I just tell ChatGPT to write my book? No, that's not what I did. But absolutely I used AI to help me. And everybody should be using AI, but you have to be intentional. So how are you seeing what are you recommending for organizations, OT, IT, whatever, to start using these tools and do it in a way that is not going to, you know, screw you up before you know, you could be a mile down the road before you realize you made a wrong turn and now you got to turn back around. And what is the implications of all of those things that you've been running?

After On: AI as Infant, Human Accountability as Paramount

Brian "SchleiF" Schleifer (20:14.154) Yeah, yeah, that's a it's a ton to unpack. it's a ton. So, so there's a really good book called After On that I read, I don't know, it's probably over a decade ago. And after on means after AI gets turned on, like after it becomes like, you know, conscious, if you will. And it's interesting. I just talked about this yesterday, is it's it's like an infant, right? And people like you saw OpenAI just started like a big ethical safety board with all these different companies.

Aaron Crow (20:17.174) Ha ha.

Brian "SchleiF" Schleifer (20:41.566) And it's like it's like a toddler, right? Or an infant when you have it's like, don't touch that, that's hot. Don't, you know, that's sharp. Don't rub your finger on it, all this stuff. We're sort of going backwards. We're like, hey, go out and learn how to fix that car before I tell you like, don't, don't be under it when the jack, you know, because it could collapse and have these blocks and stuff, right? We're sort of going we're going backwards now. Now we're going like, okay, put the blocks underneath. And so people have to realize and recognize that. So human accountability will always be imperative.

Brian "SchleiF" Schleifer (21:8.832) So a couple of things from a security aspect, continuous monitoring, human accountability is paramount, right? going back to the governance side, I've done a lot of research and I'm writing a paper. again, the dissertation, I say the paper, it's dissertation. but part of it has to do with looking at a bunch of the governance, and there's a lot that are heavy, like the EU AI Act on ethical side, bias side. Then there's like the NIST side of the house, which they're coming up with profiles and other stuff, which is more and security controls, sort of. they're more the technical side.

The Governance Maze: EU AI Act, NIST, IEC 62443 & AAIRAF

Brian "SchleiF" Schleifer (21:38.635) And so as an organization, you have to go look and aggregate and do like a comparison chart, which, you know, is a considerable amount of time and resource and energy. And then not only that from the governance, now you're looking at sector specific things like IEC 62443, AWA or AWA, however you want pronounce it for water plants. So there's all these things. So you have the main like federal, even global, and then you're looking at sector specific depending on where you're at. And it could become overwhelming. Well, one of the great tools is like, hey, leverage AI, ironically enough.

Aaron Crow (22:6.688) Mm-hmm.

Brian "SchleiF" Schleifer (22:7.062) To help aggregate, find those differences, and find what's applicable. You know, mainframes changed into PCs. PCs got a long way. We have smartphones. Everyone utilizes those tools now. AI is another tool to leverage on a day-to-day basis. You use your phone, but you also make sure like I'm calling the right person. If you hear a different voice, you're like, wait a minute, right? That's human accountability and your checks in there. So as you use this new technology, of course, you should be checking and verifying things 100%. Again,

Aaron Crow (22:13.834) Mm-hmm.

Aaron Crow (22:30.218) Yeah. Right.

Brian "SchleiF" Schleifer (22:36.608) Like notebook LM, I think it's now Gemini Notebook is amazing for research. Amazing. You're taking those resources, you're reading it and making sure it's good, but it helps with the aggregation of data. And that's what helps us move forward and be more efficient. I absolutely think it's not disgusting. I will tell you this. This is really fun. It's really fun. So my cousin's a music producer in California. He actually to like teaches producers, like production. He he's he's pretty good dude. Works in really cool people. You can't say, you know, NDAs. But anyways.

Label It: AI Disclosure From Music to Deloitte to Amazon KDP

Brian "SchleiF" Schleifer (23:5.340) he's like, hey, I started to look at like teaching AI music. And he's like, I'm still getting pushback. And I go, totally get that, man. And all of a sudden he's he's post something on like Instagram. It's a guy talking about the music industry is now going to label, there's pushes from big organizations, label music AI. If AI was used, you could write the lyrics all the way yourself. Compose all the music all yourself. But as soon as you enter it into like Sonos or there's another brand, I can't remember what it's called, labeled AI.

Brian "SchleiF" Schleifer (23:32.651) And I said, I bet we're gonna see that across industry. It will be mandated, not now, because I do it, I do it too. Hey, I if I'm using it, I've done it in my research. Are you kidding me? How can I not? Right. And I'll say, hey, it was used and this is how I used it. Do that. Remember, Deloitte got hit pretty hard. I don't know if you remember that, right? I I think it was like half the amount that they end up getting paid for consulting. They had to pay back to the organization because they used AI. Disclose it. Say you used it. Absolutely. And be proud of it. And like you said, it is imperative that you learn how to use it.

Aaron Crow (23:36.096) Mm-hmm.

Aaron Crow (23:47.712) Yeah. Yep.

Aaron Crow (23:56.097) Yeah. Yeah. Yeah.

Brian "SchleiF" Schleifer (24:2.188) Because if you just throw prompts out in the air, that's that's that's not great. It's it's come a long way. Don't get me wrong, it's come a long way. But I to to go back overall, the governance is gonna change and evolve. There's very few and far between that that incorporate ethic and technical. So make sure you're paying attention to that. Again, you can Google ARF, right? A A I R F. I've I done a lot I did a lot of hard work open source to pull all that stuff together. in fact, part of my research was to look and I was like, it scored pretty high in my scoring. So going back to the the other side is like,

Shadow AI: If You Think It's Not in Your Org, You're the Problem

Brian "SchleiF" Schleifer (24:30.280) In organizations, you usually have to do computer-based training, annual training, right? Most. It's it's part of pretty much every compliance thing out there. How many people have you talked about that have started incorporating AI into that and what does that look like? Because if you think shadow AI is not in your organization, you you're so you're sorely, sorely behind the curve. You're the problem. Yeah, exactly. So

Aaron Crow (24:34.998) Yep. Yep.

Aaron Crow (24:49.620) Y you're you're the problem.

Brian "SchleiF" Schleifer (24:53.982) I again I go and and then again when you want to look at AI, find out what is the best ROI and how it can efficiently be done and you have to use your experts for that.

Aaron Crow (25:1.994) Yeah, you know, as you say that, when I published my book, so I did self publishing on on Amazon, and that was a question it asked Did you use AI for this? And then when I said yes, because I said yes, it asked how I used AI. Did AI write the whole book? Like, did AI did you use it for editing? Like, what did you like? So it got more specific in how AI was used. So I was wondering when I publish my book, is it going to have some subtitle somewhere that shows that? It it's at least there. Cause again,

Aaron Crow (25:31.703) That's why I talk about it on here. Of course I use AI. Why wouldn't I use AI? I have you know, now I think this will be I think I've got 116 episodes out this week or whatever. That's let's say it's 116 times an hour. That's a lot of transcripts to review if you're trying to include that in into you know conversations. And there's a lot of value in in that amount of thing. Why would I want to have to say,

Brian "SchleiF" Schleifer (25:42.860) Wow, congratulations.

Brian "SchleiF" Schleifer (25:46.604) Yeah.

Brian "SchleiF" Schleifer (25:49.452) For time.

Aaron Crow (25:57.909) No, Aaron, it's only valuable if you go through and read all of those things and find all those spots. I did read it. I said it. It's my words. Like I've done this, right? so this is how we need to be looking at things. And I'm I'm good with the skepticism. I'm good with the the concerns. I'm good with making sure we're being open and intentional about how we use it. And that's some of my concerns.

Sandbox Escapes & "Technically You Asked It To"

Aaron Crow (26:25.466) you know, obviously we saw the latest with you know, Hugging Face and and and Chat GPT OpenAI, where it got out of its sandbox and and all that stuff. That's going that that's obviously concerning. I know. No, I didn't.

Brian "SchleiF" Schleifer (26:36.490) Anthropic just released that too, by the way. I don't know if you saw that. Anthropic just released it. Yeah, Anthropic just released almost the same thing.

Aaron Crow (26:43.702) Great. So we already see AIs are going outside of their sandboxes and doing things that we're not asking them to do to try to solve because they you know th they want to be good good AIs.

Brian "SchleiF" Schleifer (26:45.312) Ha ha ha.

Brian "SchleiF" Schleifer (26:53.366) Well technically technically you're asking them to do it. Technically. You're you're setting a goal and they're accomplishing it however they feel fit. So technically you're asking them to do it. That's right. They're the infant and toddler.

Aaron Crow (26:58.123) Right.

Aaron Crow (27:5.376) Because they wanna they wanna please you. They wanna they wanna get the answer correctly, right? And they're finding Yeah, they're they're going at well, I'll he he didn't tell me not to go out there or he did, but yeah, maybe I'll get out there and do it anyways.

The Data Center Forecast: Boom, Efficiency & What Comes After

Brian "SchleiF" Schleifer (27:15.980) That's right. Don't touch it. That's right. That's right. Yeah, it's interesting you talk about value, Aaron. I just want to say this. I I am going to write a paper on it, just a mini like article, but I have a a forecasted thought. So data centers are going up left and right. There's a lot of security concern about that. I am looking at it from a investor and maybe you hit home a real estate perspective. I think just like mainframes, right? And they're talking about this too, like.

Aaron Crow (27:38.806) Mm-hmm.

Brian "SchleiF" Schleifer (27:42.820) The LLMs are starting to get tapped out. The benchmarks are starting to even out now. So now they're looking for efficiency, right? And fine tuning and pruning and all that. Well, you have these big buildings with a bunch of power and water that are gonna start shrinking. We're gonna not need it. We've boomed out. We've boomed out. It's crazy. All these are getting built. So it's like, okay, what can these be used for once we don't need that hundred percent of space any longer or the space at all?

Aaron Crow (28:7.040) Yep. Yeah.

Brian "SchleiF" Schleifer (28:8.296) Everything's moved to space, everything's at the atom level at this point, whatever else it may be. it'll be interesting. So I've already thought, like, man, how could people invest in that or at least go, hey, they're gonna sell it for pennies on the dollar at some point and it has all this infrastructure built in, or invest in them now knowing that's gonna happen and what the next plan is. So you can architect it a certain way so that when it does only need a third of it, that other two thirds can be leveraged for whatever's gonna happen in the future.

Aaron Crow (28:39.296) Dude, it it it is so much. I mean, we know this. How are we not learning from our past? Computers are the size of, you know, the our cell phones are bigger than the computers that launched this the space shuttle, right? You know, we went to the moon on less compute power than what we have in our pockets. And now we're building these giant data centers all around the country, around the world, because right now we need compute. We need tons of graphic cards and lots of power and lots of cooling. And to your point, that's what we need now.

Brian "SchleiF" Schleifer (28:45.046) Mm-hmm.

Aaron Crow (29:9.258) Because the technology is where it is. In five years, how much space are we going to need? In 10 years. And that's not even that's traditional you know, silicone. What about quantum? We start thinking about quantum. What does that look like? And and how much, to your point, how much are we not going to need all this space in compute in the same way that we do today? And what do we do with all those spaces when when we don't use them that way anymore?

Brian "SchleiF" Schleifer (29:19.712) Yeah. Yeah.

Brian "SchleiF" Schleifer (29:32.012) That's right.

The Triad: AI, Quantum & Blockchain (and Legacy OT Can't Sleep)

Brian "SchleiF" Schleifer (29:34.560) Yeah, there's a there's a triad of technology that I'm really excited to see complement each other. Cause even if you ask AI, it'll tell you it's compliment. It's not a competing thing with quantum computing. so and quantum computing is good at some things and not great at other things. For for the OT environment, it'll be the algorithm, like the aggregation of sensor data is where it'll be like amazing. but if you take quantum computing, like LLM generative AI, and then blockchain technology.

Brian "SchleiF" Schleifer (30:2.387) And having those combined, it's gonna be fascinating to see how that works out in the future. Because that's that's huge. A lot of people because how do I trust something? Right. That's the big question right now, especially with agentic AI and identities and who's accountable for that. At the end of the day, who's accountable for risk? Who's accountable for the security? Blockchain technology helps that. So as that's growing and it's gonna start, you know, being tagged, if you will, like I was talking about before, the provenance, where did this come from, the pedigree? So leveraging that, but enhanced with again.

Brian "SchleiF" Schleifer (30:31.853) LLM and the quantum computing, I I'm like I said, it's gonna be fascinating. I can't see the future. I can just see you see these building blocks getting somewhere. Right. And so from that strategic vision standpoint, it's like, ooh, man, it's really, it's really interesting to see those tied together. And again, the efficiency and shrinking, they're putting light, light on chips. You know this, right? Instead of just copper talking, it's light. So nuclear reactors to power, lights on chips to make them more efficient, going to space

Brian "SchleiF" Schleifer (30:58.591) Which also helps the cooling issue with quantum computing, right? I know there's degradation a lot to be environmental, but you combine those. So now you look, and this is the the big thing, and I just talked about this yesterday is okay, you have OT systems, their legacy. You cannot sleep on this. Leverage AI to aggregate the data to look at behaviors more. there's a lot of you just saw, right? Accenture Dragos combo. I mean, there's a lot going on, and companies are recognizing this and how they can complement each other.

Brian "SchleiF" Schleifer (31:26.965) Please don't sit there and go, I have a legacy system. I'm not worried about it. Because system thinking is so much different than human thinking. And you're like, that's impossible. It's here, here. And you're like, no, man. It like you just said, it's proven to get out of its own sandbox. It can escalate privileges, all these small things. a historian account. I never thought about it leveraging a historian account or a backup account, a service account, all these small things. I mean, this port was closed on a firewall. It can absolutely open that port and get through it. Like,

Brian "SchleiF" Schleifer (31:55.146) So you really need to leverage on the other side of that. And it's just it's it's a fascinating time that we're living in right now.

Aaron Crow (31:55.168) Mm-hmm.

Aaron Crow (32:1.642) Well it it dude, there's so much there. And and first of all, like y you told me you could read the future, that's why I brought you here. So now that you can, I'm a little upset about that.

Brian "SchleiF" Schleifer (32:8.917) That's pretty good.

Left of Boom vs. Right of Boom

Aaron Crow (32:14.621) But but you know, it's it's in the in the industry, especially in OT, we have been focused in my perspective, because I've been a vendor, I've seen all the stuff, I've been an asset owner. It's all been left of boom. You know, I I wrote an article yesterday about the the the the Minnesota water water utility incident and and all that that happened, which, you know, not saying that's AI, but still it's it's a problem.

Aaron Crow (32:39.774) And and we we focus so much on left of boom. We've got, you know, Dragos and Nazomie and all these things, which are great things. I love those products. I love the capabilities. I love the companies, Robli, you know, Edgard, like Nazomie, all these things are great. And and and I act in a space where I'm doing assessments and I'm trying to find and architect things and make recommendations on how do I prevent, how do I, how do I detect and prevent these things from before they happen? Like again, left of boom.

Aaron Crow (33:6.834) In my perspective and all the places I've seen and all the all the you know places you know all the all the dirty, dirty, nasty places I've been in in in OT spaces in the last, you know, decade and a half, very few are focused enough in my perspective on right of boom and and when something happens, whether that's an AI gets out or my process is failed, or I get ransomware, colonial pipeline, any number of examples of these things.

Schrodinger's Backup: The Controls Engineer Story

Aaron Crow (33:33.845) What am I going to do? And how do I know that it's going to recover? I was literally talking to a controls engineer this week and we were having this conversation. I'm like, you really need to have better DR, disaster recovery. What happened like backups of your PLCs, backups of your logic? And you talked about it before. And he's like, Well, I've got a backup on my on my laptop. I'm like, okay, let's walk through that. Have you ever tested it? Well, no, we run 20 99% of the time. So when when can I test it? I'm like, so you don't have a backup. Well, yeah, I do. No, you don't.

Brian "SchleiF" Schleifer (33:48.224) Yes.

Aaron Crow (34:3.274) You don't know that you do. So you have to assume it's, you know, Schrodinger's a cat, right? It's if you don't look in the box, you can pretend that it's a good backup. But as soon as you go to restore that, it may get be good, it may not be good. You don't know. Right. So we have to assume from my perspective, I have to assume that your backup is non-existent because it's not going to work when you need it to, which means what are you going to do?

Brian "SchleiF" Schleifer (34:24.755) Yeah, and I would tell that, yeah, I would tell that person. So one of the things I built out because I was working on a product, it's called like the Gordian knot. It's pretty neat. Leveraging some of the technologies I said earlier. But you know, leverage I I use Google anti gravity IDE. That's what I use. You can build a virtual environment. It's actually really good. You can build a water treatment one, a power one, so you don't have to pay. Well, I mean you're paying, but you're not going out and buying like a three hundred dollar product or a subscription.

Brian "SchleiF" Schleifer (34:50.773) Build it out. Say I have this product, blah, blah, blah. It'll go out and looked at the data flows coming out and then build your own little virtual lab or environment. Because that's what I said. I was like, hey, go out and find one. I want to test my product, this idea, blah, blah. It's like, no need. We'll build it for you. And it'll be active and it'll send streams like of data. And then I was, like I said, I was tagging it. And anyways, I could I was doing it where you could do a snapshot IEC six two four four three with like its sign. So you knew it had a good pedigree. Anyways, the point being is you could build that out and test your backup.

Brian "SchleiF" Schleifer (35:19.773) I'm not saying it's not going to be a hundred percent like you said, an operational environment, but it's better than just sitting on your laptop not knowing at all. It can find the errors. So why not do that and go, shoot, I didn't realize X, Y, and Z, these two systems weren't backed up. That's the thing I hit on. I was talking to somebody other days, is like you might think your whole backup's good, but there may be two systems that are either reporting or are failing backups and you don't even know about it. That's the scary part, right? And I will tell you something else, and it's this is unfortunate for all of us in this field.

Aaron Crow (35:26.380) Correct.

Aaron Crow (35:43.180) Correct.

Not If but When: MTTR and Recovery as the Priority

Brian "SchleiF" Schleifer (35:48.874) Career field, if you will, is that prevention and detection is sort of slipping. It's it's no, and if you don't know, it's it's not a if, it's a win. And so the response sign, you know, the MTTR side is probably the most important side at this point. And also, that is like, this is tough. This is very tough. How did it happen? This is where you really need to leverage AI, especially with agentic AI.

Brian "SchleiF" Schleifer (36:17.269) How did it happen? Because if you recover, it can happen right again if you don't mitigate what's going on. And so with systems thinking is you think as a person, you've run tools or whatever else. And if if it's again not using the system's brain, you're not going to find it. You turn it on, boom, it shuts off again. It's R ransom or whatever it may be. And so it's it's a very eye-opening and different culture and mentality to think through. But yeah, it's and I know I I had a pot in my call come, can't you know him very well, like I do.

Aaron Crow (36:47.265) Mm-hmm.

Budgeting Past Moore's Law: AI Engineers & Disconnected Backups

Brian "SchleiF" Schleifer (36:47.391) he came on and he was very much like it's they gotta go back to basics. Got and I I go, Yeah, dude, but listen, when you go before the board and they call it palming in the government, but you look at the next couple of years, and this is hard too, and I actually asked Sizzos and people about this, how do you start budgeting the next year or the next year or the next year? Because Moore's law is out the gate. So you can't do three year tech refresh anymore. How do you and you can't forecast how much

Brian "SchleiF" Schleifer (37:13.019) LLMs, now they're getting costly, right? It was sort of out there, Wild West. Now things are coming up, whether that's token certificates or whatever. How can you forecast it? So that's the part you have to look at right a boom, is because you need to start budgeting the resource and allocating whether that's technical skills, like the people. I need to get someone in that's an AI engineer. I need to bring those that technical training in for my people to start having them gain a better understanding. That's the conversations that are pivotal. And again,

Brian "SchleiF" Schleifer (37:39.808) Hey, our incident response and our backups are like, they're a little archaic. And we need to make sure that we have like micro segmentation and that don't keep your backups connected. that's 101. I was talking to somebody, they're like, Yeah, we do this automated thing. It's a product, cool. And I'm like, does it automatically disconnect when it's done? Like logically at least. And they're like, no. I'm like, so what good does that do if I get hit with ransomware or some other kind of encryption, malicious attack? Like,

Brian "SchleiF" Schleifer (38:6.015) That's all gonna get encrypted. So you've sort of taken away the purpose of having a backup in the first place. So again, going back, really, you know, prevention, that's tough. Detection should be highlighted. And they're going away from system anomalies to like individu individual behavior. And that could be system or people or both. And then being able to figure out how to correct that and making sure that you have that continuous monitoring because patches are still are patches even a thing. Right. You're seeing that come out. That's that latest and greatest. it's the recovery side.

Aaron Crow (38:30.049) Yeah.

Brian "SchleiF" Schleifer (38:35.317) That recovery side's paramount, honestly.

Does Patching Even Make Sense? TTP-Driven Priorities & MITRE Atlas

Aaron Crow (38:38.656) Well, dude, you hit something right there too. I mean, so many things, but let's talk patching real quick. We already didn't patch an OT, right? We already weren't patching anywhere near that. Mythos comes along and AI comes along. And does it ever make sense to patch again? Because there's could be a zero day tomorrow. And I'm patching for known bad things, but zero days by intention, by design, by the definition, look it up, but means that no it's something that has never been detected before, meaning

Aaron Crow (39:7.966) No patch is going to cover it. So I could, I could can I could walk down this path and patch everything that comes out from Microsoft and Fortigate and Cisco and Palo and Rockwell and et cetera, et cetera, et cetera, and always be chasing my tail. I'm not saying that we should never patch, but I also I think what we're both saying is is like that should be part of your program. But I think before where the the focus has been left of boom, most of my energy and effort has been focused.

Aaron Crow (39:37.761) To try to prevent things from happening, I still want to do those because it's not like I just want to leave my front door wide open and let my, you know, the bad guy walk in the front door. But I also know that my door is not gonna stop them. So, what am I going to do? How am I going to cover? How am I going to react and respond when those bad things happen? And I think that's where more and more organizations are going to have to focus. And that's going to be not all technology. It's just like with anything. There's no silver bullet. It's going to be people, process, and technology. And and yeah, there's some tech you can buy out in those spaces.

Aaron Crow (40:7.028) You're gonna have to do some training. You're gonna have to hire some people. You're gonna have to build some process around it. So you make sure it's used and it's followed in your path and all those types of things. It's not sexy. It is getting to the foundation and the basics, the things that we should have been doing. And we do it well in OT on the operational side. We just haven't been doing it on this side. Or we need to roll this into being part of the business.

Brian "SchleiF" Schleifer (40:26.089) Yeah. And I think a couple of mindset changes. one is so OT and IT sh it gotta stop using those terms separately, right? They've they've become one, literally technology across the board. I was talking to Blake Gibson, the excellent guy about that before. I said, you know, that's the part is we keep separating. They it needs to become it's technology across the board. The other thing is, and I wrote I wrote this in the ARF and it's it's imperative is okay, and I again I'm saying ARF, it just helps like

Aaron Crow (40:38.860) Correct.

Brian "SchleiF" Schleifer (40:55.253) Just do a single word to what I'm talking about. Again, Google it. It's out there. There's three different documents. Tying it to threats, controls to threats. That helps you really look at what you should be patching, right? Don't patch everything. If there's an active TTP that someone is using, that is a threat that you should recognize and look at. And specifically in your area, right? MITRE Atlas. If you haven't heard of MITRE Atlas, it's like miter attack, but for AI.

Aaron Crow (41:13.364) Okay.

Brian "SchleiF" Schleifer (41:22.719) So you can go out there and look, okay, reconnaissance. Here's the TTPs they're using and the real case scenarios that people can read. And that's fascinating to go out and be able to do that. That helps. So again, that's why I wrote that was I was looking at the controls, right? We I think it was gosh darn, I can't remember 100 that we did that were specifically right honed into AI and and cyber physical systems. but like looking at the threat for each of those, and here's the big thing that was a very big differentiator, the assurance and evidence.

Aaron Crow (41:49.652) Mm-hmm.

Brian "SchleiF" Schleifer (41:50.486) For those controls, specifically for AI. That didn't exist. So the specific security controls, the evidence, and then tying that into threats, that helps you prioritize your mitigation techniques, right? And your resource allocation, which I told you before is so imperative with everybody having six and seven hats on. That's huge. Then you can use the measurements. I need to see how effective, and that's the RCEI thing that I was telling about that has all these formulas. but basically, how effective are my controls?

Aaron Crow (42:14.528) Mm-hmm.

Measuring What Works: Control Effectiveness, SLAs & True Risk

Brian "SchleiF" Schleifer (42:17.813) How effective are my backups and time to backup, my detection, my patching? How effective is that just in general, right? Because that's different than controls. How effective, how effective is my SLA? Do I have it written in with my contract with Rockwell or whomever else that they're gonna be part of my incident response? Or am I just sort of guessing at what they're gonna say? What else are my third-party cloud environments gonna be involved in from an incident response? Is that written in my SLA? So taking that information too. So again, you aggregating this and seeing like, what's my true score?

Brian "SchleiF" Schleifer (42:47.611) overarching for my risk, including controls. That's going to tell you how effective and how your ROI is that all your, you know, because people just shove it in. Cybersecurity, you're like, okay. There's way more that are involved in that. And having that live data, you know, stream come in, if you will, with the continuous monitoring, with all the other contractual documentation will really highlight your true risk picture. And that's the part I think that's missing for a lot of people and not having the conversation enough about.

The Tsunami: Overwhelm, Parking-Lot WiFi & 13 Water Utilities

Aaron Crow (43:14.868) It it it's almost like we're in this spot where it's overwhelming. and so many organizations are sitting there and and they see this like, you know, I don't know, tsunami coming at them and they're like, I I don't know what to do. They they literally throw their hands up in the air and and they're like, Well, I I'm just gonna go back to what I know. Like I haven't been hit yet. It's never happened. I'm just gonna almost do this. And and unfortunately I see that. And and I I think we both agree that's not the right course of action.

Aaron Crow (43:43.035) it then it's it's just a matter, unfortunately, we're at a spot in the world where it's not a matter of if, it's a matter of when. Right. There's no longer it's not gonna happen to me. There's no longer, you know, my environment is air gapped, it's disconnected. That's not gonna stop it, right? It's going to get in somehow. You have to assume that is gonna be true. And unfortunately, it's probably sooner rather than later. Like I the days of, you know, unfortunately, I'm still going to sites where.

Aaron Crow (44:10.272) They have, you know, open wide open wireless directly to their OT that I'm accessing from the parking lot and it's directly on their OT network and they have any any rules on their firewall. Like I literally am still seeing that in the wild and it's just unacceptable. Right. And and and the bigger the the the questions of well, why would they attack me? Like I I'm I'm not that big. I'm not that important. Any of those types of things. It doesn't matter, right? You know, that those days are gone.

Aaron Crow (44:37.168) they as we see with the water utility district, it's not a s it's not a coincidence that 13 water utility districts in one state were hit. That wasn't an accident, that wasn't by happenstance, that was intentional, right? That that was a message. Like I'm I'm talking out my butt. I don't know this, I can't read the future, but there's a reason why all of those were hit at once. And this is right after.

Leave the World Behind: Resilience, Generators & Fear Setting

Brian "SchleiF" Schleifer (44:58.985) Have you have you seen I think I always forget the name of it? I want to say it's end of days or something. It has Julia Roberts in it. I forgot the the male actor. And it's it's actually and I used this when I did a a presentation at a conference last year, year before. And I said, if you haven't watched that, it's it's a great as a strategic planner, right? It's a great way to go about doing business, not necessarily good business, for those, but it had to do with like taking down critical infrastructure.

Brian "SchleiF" Schleifer (45:28.499) And then psychological warfare. They're dropping pamphlets on either side of the states in different languages. Right. So now you have the internal, I don't have critical infrastructure where am I gonna water, food, fighting, confusing the mind. They did a microwave blast, specific frequencies for the fighting ages, right? You know, eighteen to twenty four or whatever. You know, as we get older, our frequencies, I'm sure you're aware of this. That's what that do, you hear every these besides our tinnitus. I'm sure we have that together. Everybody, all the vets do. but like it has that, and then

Aaron Crow (45:48.512) Yeah. Yeah.

Aaron Crow (45:54.462) Yeah.

Brian "SchleiF" Schleifer (45:57.235) So they do non-kinetics for you know almost the whole movie, but like think about that for months, not then at the end they come in with their aircraft and start bombing the kinetics of the. I they took over Teslas and they all like piled them up. It was pretty funny in that instance. I mean, it's not that hard, I think. In the future, well, now, anyways, the the point being is people really need to look through that and go, hey, if my power goes down, my water goes down. I I literally talked about resiliency when I did a same presentation. Was like first we have to be resilient as humans.

Brian "SchleiF" Schleifer (46:26.834) And then what if your whole substation or water plant or manufacturing plant loses power? How long are your generators going to last? And where do you normally go get your fuel? Because everyone plans for 24 to 48 hours. When stuff goes down, I you know it's gonna go down for longer than that because and it's the whole fire cell. This was the other one I used, the diehard. You remember and they do the fire cell. It's like banking infrastructure, gas stations will go down, right? Water, electricity, all that goes down, communications.

Aaron Crow (46:35.532) Right.

Aaron Crow (46:47.168) Yep. Yep.

Brian "SchleiF" Schleifer (46:55.870) That that's hard. So again, I'm not saying like, hey, doomsday, whatever, and you know, go build a bunker, all that stuff, which I'm sure you have one or two. But it's really like being able to have that thought process. It's that whole fear sitting. I think it was Mike Carrier. it's mentioned in Dale Carnegie's book and in Tim Ferris's book. And it's fear setting going backwards, what's the worst that can happen? The worst can at least plan a couple of tiers back. I'm not saying again, everyone's dead. Well, there you go. Apocalyptic. But like going back and looking at that and of if your specialty is cybersecurity.

Brian "SchleiF" Schleifer (47:24.650) Start planning backwards and seeing what the worst can happen and you can at least plan strategically and start to creep out of that left to present and write a boom.

Who Responds When Everything Happens at Once?

Aaron Crow (47:33.857) Well, a and and and I'm gonna f wrap up with this and and and it goes back to most organizations hire a third party to do their incident response. And there's not that many incident response companies that are out there. I don't have to name them. We all know who they are. If if there's something cataclysmic, if there's something at that nation state level that happens, who's gonna respond?

Aaron Crow (48:0.427) Because if I have 10 clients, let's just say that I am doing instant response and I've got 15 clients or 10 clients or whatever, which one do I go to?

Aaron Crow (48:11.328) Do I go to A, B, C, D, you one, two, three, four, five? Like there's not 12 people behind me. I don't have one person per client. That's the whole design, is that like the intention and the design, the insurance policy is it doesn't all happen at once. So I go do one and then I'm done, and then I can go do the next one if it does happen. But the the scenario where everything happens at once, the the gasoline, like you can't refuel your generators if there's no electricity because the pumps don't run. And then

Aaron Crow (48:39.850) What happened like we saw this in North Carolina when somebody took out that substation and then the entire county was down for like a week and you had to drive two counties over to be able to fill up with gas and and the refrigeration didn't work and you couldn't pump gas and nothing worked. You look at Katrina back in Katrina, New Orleans, it was a third world country really quickly because there was no water, there was no electricity. Like it turned savage really, really, really fast. And it w it's not a pretty situation. Imagine that nationwide.

Brian "SchleiF" Schleifer (48:58.674) Yep. Yep.

Brian "SchleiF" Schleifer (49:9.802) Yeah, for sure. Yeah, scary stuff.

Where to Find Brian: SecurityWeek, the Summits & PAVE

Aaron Crow (49:13.512) It's insane. So all the things. So you talked about a lot today, Brian. Like, how do people find out about you? How do they find about ARF, about your your conferences? Like do the CTA. Obviously, we'll put all the things in the show notes as well, but give people the the elevator pitch.

Brian "SchleiF" Schleifer (49:14.985) Yeah, it is.

Brian "SchleiF" Schleifer (49:29.214) Yeah, so people add value experience consulting LLC as my company. again, main one of my main clients right now, right, if you will. the director of content for events for security week. amazing. Like I said, it's the number one I didn't realize this, right? 'Cause after the fact coming on board with with the crew is it's the number one most read cybersecurity news online.

Brian "SchleiF" Schleifer (49:50.793) So I I get the I'm very fortunate to have to do with the the digital content site and podcasts and webinars and hosting and producing that, which I also do for my my company for other folks, along with the fractional CISO stuff. But security week in a couple of weeks, August 11th through the twelfth, we actually have the AI risk summit coming up at the Ritz Carlton at Half Moon Bay in California. the best venue I've ever been to for any conference, hands down. Then following up in October.

Aaron Crow (50:11.660) Yeah.

Brian "SchleiF" Schleifer (50:16.990) We actually have the ICS Cybersecurity Conference. And this is the first year it's moving from Atlanta to Nashville. And so we'll be at the W Hotel in Nashville. I'm very, very excited about that. We have a lot of good speakers with the call for papers. We're reviewing those schedule be coming out next couple of weeks. so it's a really good time. But at the end of the day, really it's it's about being informed and being out there. I'm also on LinkedIn. Please connect with me. I I love helping people out. Hence the people add value experience is the company is because

Aaron Crow (50:23.275) Mm-hmm.

Brian "SchleiF" Schleifer (50:45.566) I really want to add that. So a YouTube channel is out there as well. We have Security Week Dash TV, along with the People Add Value Experience podcast as well. So funny enough, I did this with entrepreneurs and we talk about business and marketing, not cybersecurity, which is a really cool different flavor just with people. But I really appreciate you letting me come on and have a conversation. It's not often that I I'm on the other side here, so I am also looking at having you come on us our podcast and I think that'll be great.

Aaron Crow (51:11.816) Absolutely. Yeah. Yeah. Awesome, man. I I love having these conversations. As you know, I don't I don't it's not scripted. Like we obviously we talk a little bit beforehand, but you know, I never know where it's gonna go. And and I try to just kind of lead it wherever it's going because I I think it it's so important for us to have these conversations and for people to be able to listen and and and hear perspectives. Like for me to think that I have

Aaron Crow (51:39.114) the best knowledge out there and the things that I read. Like it's amazing how much having these conversations is going to make me go back and say, I didn't think about that. Let me look at it a different way. And and every time that we can have these conversations and other people get to listen, like if it helps one person ask one right question in those places, then this was worth my time, worth your time. And it and it helps somebody out. Like that's the way I look at this. So man, thank you for everything that you guys do. keep

Aaron Crow (52:5.206) Keep fighting the good fight and having the good conversations and and definitely looking forward to having a beer. I know we've met in person before, but you know, it's it's always it it's different when you can meet people in person and shake a hand. So definitely come see us, come see folks, say hi. that's the whole reason we do these things is is to make a difference and and we're passionate about it. What you know, I don't get paid for my podcast, I don't have sponsors. it's all about, you know,

Aaron Crow (52:31.286) brand recognition, but also getting the message out 'cause it's i I feel it a a calling to do this and and I I and I can hear in your passion that you do the same. So

Aaron Crow (52:41.256) Awesome man. Well thanks a lot and definitely go check out the all all the resources. We'll put them in the show notes. thanks again and wait until the next time the next podcast we got coming out.

Brian "SchleiF" Schleifer (52:52.235) Take care. Thanks.

Transcript lightly edited for readability.