AI in OT: Why Humans Stay in the Loop and the Junior Problem with Jori VanAntwerp

Intro: Welcome Back, Jori (Return Guest)

Aaron Crow (0:1.410): Hey, thank you for joining me on another episode of Protect It All Podcast. I am with my friend Jori. I've had him on the podcast before. if you haven't, I'll put the links in the show notes of previous episode where you can go hear all that. Jori is man, we we've we've done a lot of things and had a lot of fun conversations at conferences and all the different things. But for those those folks who don't know you, why don't you give us your your dime tour of who you are, what you do, all that kind of stuff.

Jori VanAntwerp (0:31.838): Yeah, absolutely. Thanks for having me on, man. It's it's great to be back. I have no idea why you keep inviting me back, but thank you. so I'm I'm Jori VanAntwerp. I am the CEO and founder of EmberOT, which is a a cybersecurity company focused in the OT space. I have a long and sorted past that came, you know, through the technical side, and I would say I'm I'm now a reform geek. where I sit a little bit more on on the business side than I used to. I I still like to say that I'm dangerous though.

Aaron Crow (1:0.782): Sure. Awesome. Well, you know, I think we all are that, you know, geek. I obviously I don't get to play I still play a lot of hands on stuff. And, you know, obviously you know all the the stuff. If you're watching on the video, then there's, you know, all my lab stuff, everything from an old school Mac to an Atari twenty six hundred and you know, my sensors back there and and labs that I'm building for ICS Village. And so I I try to keep keep current.

Why OT Cannot Ignore AI

Aaron Crow (1:28.680): which which really leads to one of the things that I wanted to bring up and we wanted to talk about. I don't I don't always and and we didn't script any of this. There's no set questions or anything, but you know, AI is all anybody's talking about, whether it's IT, OT, what is security gonna do? How do I manage this? How do I use it? And and it's one of those things that I can't pretend it's not here. OT is really bad in the past about we're just not gonna do that here. Like we're not gonna do

Aaron Crow (1:58.658): virtualization or we're not going to use the cloud or we're not going to do whatever the things are. And that just doesn't work. because it's coming, the the the bad guys, bad actors, nation states, adversaries, all of those folks are looking at this. And even your own people, like your own people are using AI, like it or not, and they're not doing it maliciously, but they are using it. So how do you make sure that you're protecting those things and you know, so all all the AI is a superhuman

Aaron Crow (2:27.170): You know, it finds bugs, it can it can help you magically fix things, it can help you with scripting. There's all sorts of good things that it can do. But the yin and yang of things, on the flip side of that, there's a lot of bad that it can do. It's the, you know, a hammer's not an evil thing, but you give a a a hammer to a builder and he builds you a house, you give it to a bad actor and he hits you over the head with it, right? It the hammer is not the problem. AI is not the problem.

Aaron Crow (2:53.760): It's how I'm using it and and how I'm protecting against it. Right. So all that to say is an intro. That's kind of the guidelines and things that we could take this wherever we want to go. But how are you feeling? What are you, what are your thoughts? I know you have some some hot sports opinions around AI mythos and all this type of stuff. So let's just dive in, man. Get a drink and let's go.

AI Is a Consensus Engine

Jori VanAntwerp (3:13.556): Yeah, absolutely. Let's let's kick this off. I'm glad I had some coffee this morning. I the first the first place to start, honestly, is that this is a fantastic tool. And I think that it gets both too much good press and too much bad bad press. There doesn't seem to be a lot in the middle. And like any press, we end up in a situation where things are missed, context is missed, you know, the media is is spinning things in one direction or the other.

Aaron Crow (3:18.573): Yeah.

Jori VanAntwerp (3:43.476): And so I think really important that folks understand AI as a whole and try to kind of look past the the headlines and the articles that you're seeing about what AI is doing and and statements that are being made on social media. first and foremost, AI is a consensus engine. That's what it is. These large models, especially, are going out and they're looking at at all sorts of information, whether it's, you know, arguably or

Jori VanAntwerp (4:10.858): taken off the internet or it's it's from a local directory. It doesn't matter. They're pulling in all this information. What we know about consensus, especially on the internet, is a lot of times it's not it's hard to find. And even if you do find it, it may be completely wrong. I know it's crazy to think there's bad information on the internet. I it's important to keep that in mind when you're when you're actually utilizing these tools. as a as a starting point, I think looking past a lot of the

Not Ready for Full Autonomy: Foundations First

Jori VanAntwerp (4:39.678): the FUD that we see or that's negative to AI and also the misunderstandings that are coming through AI is is really important to get to. you know, I'm sure I'm gonna be completely just lambasted in the in the comments for this, but AI is not yet ready to be fully autonomous. it really does need a human in the loop man in many cases. it's not in our jobs, it's not going to be replacing humans per se.

Aaron Crow (4:59.224): Mm-hmm.

Jori VanAntwerp (5:9.032): What it will do is make humans even better at what they're doing. and this this enters into kind of like a segue around my my my view on AI, which is you need to know how to use it. But what's even more important to that is the foundations on on which your career is built. So if you're in cybersecurity, heck, if you're in healthcare, it doesn't matter. Your foundation should come first. Understanding the foundation is incredibly important because you're you're dealing with that consensus engine.

Jori VanAntwerp (5:36.874): But you also need to be almost cross-trained in how to use AI. And those two tools together can make you much more productive, much more efficient, your output absolutely amazing. But if you don't have that foundation, there's real risk in kind of misshaping data. So you can you know, we hear things like you can take a junior a junior engineer and you can make them a senior engineer or an analyst. That's not really true.

Aaron Crow (5:41.026): Mm-hmm.

Aaron Crow (5:57.422): Mm-hmm.

Jori VanAntwerp (6:5.694): What you're doing is you're taking a junior's abilities and you're shaping it as if it is senior. And that can be very dangerous because it looks like a senior's output, but does not have the context or understanding. Having that foundation first allows you to be able to, for lack of a better term, interrogate, right? And work with your your AI. Be like, well, that doesn't sound quite right to me. And here's why I don't think that that's right. And having those conversations is where you get to.

Jori VanAntwerp (6:35.078): actual truth in your output. But the automation side of AI, I mean just even in my I I I'm sure you're in the the same boat, just even in my own own life around using using models and even agents myself, it is incredible what you can do as an individual contributor. I think it is definitely a force multiplier, but human in the loop is incredibly important. So I think that's the base

Aaron's Workflow: Four or Five AI Juniors

Aaron Crow (6:59.276): Man, that that's huge. And and you're exactly right. And I think people look at this wrong, and and I agree. I can I can up level my work, but the AI is not going to be able to trump the knowledge that I have because I have to be able to say that looks good or not. Now, the way I look at it is a little bit I coin it a little differently. not than you, but than other people in the market are saying, I say that instead of like

Aaron Crow (7:26.122): I look at it because I, it's, it's like I have four or five juniors working with me. So I can give small tasks that a junior level person would, I would normally have to go have a person do. I can assign those tasks to my AI, have it go do a lot of that type of, you know, thought, and then come together, like let's say building a PowerPoint.

Aaron Crow (7:48.471): I don't need it to understand the data that's in it. I just need here's the things that I want to say. Here's how I want to look. Here's the template. I want you to put it in there. But it's right now, it's only doing it at a junior level. I still have to finalize it. I'm still like, yeah, that doesn't work. This doesn't fit. There's too many words on this page, not enough words on that page. Bring like so there's a lot of iteration, but it's still faster than me having to manually create.

Aaron Crow (8:14.899): a PowerPoint deck or manually create a Visio diagram. Like I can do a lot of those types of things using AI. It's not perfect yet, but man, it saves me hours of time by doing a lot of those things. So, you know, I'm not taking a prime example. I'm not taking client data and dropping it into the cloud. But I can take a dummy set of data. Like if I go get data from a client, let's say that I'm running.

Aaron Crow (8:43.593): Assets and detections and you know switch configurations and MAC addresses and all that kind of stuff. I can give it a format and say, hey, this is the type of data, this is the format that I have it in. I want to consolidate data from this asset list with these firewall rules, which which this blah blah blah blah blah blah blah. And I want you to build me a parser that can take all these things, consolidate them, and give me an output. So

Aaron Crow (9:12.715): AI is building the tool. Then I execute the tool locally and it it actually crunches the data. And then when it works or doesn't work, then I'm going back to AI. All I'm giving AI is, yeah, the script failed here. Like the tool failed here. And I'm giving it that feedback. And I'm, you know, you know, obfuscating, you know, customer proprietary data, and I'm giving it a tamp, a sample or a template, et cetera. But man, it's super powerful. It's amazing how much I can do and how much faster.

Aaron Crow (9:42.475): I can do the work of five or six people because I can do that level of development, you know, from a devsecops type perspective. I can process a firewall, I could process hundreds of switch configs, thousands of PCAPs, like all this type of data that would have taken me days, weeks, sometimes months to to process with a lot of people doing it. And now I can use AI. So

The Bad-Actor Flip Side

Aaron Crow (10:10.637): The flip side of that, and that's me as a good guy wearing a white hat. You put on a bad actor, they can do the same thing, right? They can get in and say, Hey, what is this device? It's got this stuff. How can I how can I break into these things? you know, everything from, you know, I've got

Aaron Crow (10:29.581): Devices back here, like a you know, ESP32. Like you don't have to have experience programming hardware. I can literally just say, hey, this is the device that I have. And if you're not looking, if you're not watching this, you're just listening, I'm showing just an ESP two 32 basic box and a and a little little board that it's on that has inputs that you can wire into all the different spots. Right. I can literally say, I want to do, I want to create a

Aaron Crow (10:59.459): thing that turns a light on and I can literally give it to AI and it'll will create all of the logic, all of the things to control this, buy a Raspberry Pi, set up the wireless, like whatever those things are, it can do all those things for me without me have ever touched having touched one of these before in my life. And that's powerful and it's also scary.

AI-Found Vulnerabilities, and Why Exploits Matter Less in OT

Jori VanAntwerp (11:21.537): It is. It it is. And but this this is a a great kind of there's a little bit of a segue here to talk about vulnerabilities. because a lot of the the stuff that you're seeing is around two areas. It's it's attack and defense, or it's it's vulnerability research. And I I think it's really important to start classifying

Jori VanAntwerp (11:45.950): The vulnerabilities that you're seeing AI find, in some cases are not valid, right? They have to be validated by at least to date, they they are being validated by actual researchers. And what we're finding is not all of those ex vulnerabilities are even exploitable. So they're not really they're not really a vuln, if that makes sense. and especially in OT, and this is one that that you and I could harp on for a long time.

Jori VanAntwerp (12:10.488): Vulnerability, I won't say that vulnerabilities don't matter. Vulnerabilities do matter in understanding the risk in your environment, what the posture is, where you might have a problem. But as you and I both know, it can be very difficult to patch. But the other thing is, is if you're in the environment, if you're at the point where you could exploit that vulnerability on an HMI or a PLC, you don't need to exploit anything. You can make the changes.

Jori VanAntwerp (12:39.570): in that environment that you need to make device to device. You don't need it to have an exploit. So I think it's really important to understand that exploits are not as important day to day in executing a a a threat in an OT environment, especially with the types of devices you're you know you're showing right now, Dinrail mounted mounted devices that are running you know ladder logic, don't have any authentication, are not encrypted. So the the things that we need to be defending against change a little.

Jori VanAntwerp (13:9.460): Or the methodology for defense. In IT, we would we would patch. We want to make it as strong as humanly possible. That just may not be possible in an OT environment. But again, what is the risk mitigation there? Are you actually mitigating any risk by patching this particular device? Because if someone actually had access to you have a properly segmented environment, somebody had access to that segment, they they're already in. You're you're past the point. And they're not pivoting from that device. They're coming in, you know, over the network. So I I think

Aaron Crow (13:9.903): Mm-hmm.

Jori VanAntwerp (13:38.612): That's important to understand, especially when when we hear about, I mean, we're we're getting a little dated now, but when Mythos originally came out, we had Project Glasswing, et cetera. And something that's really important for those that are OT or OT interested, Project Glasswing had no industrial companies in it. That it was complete considered a wholly separate thing. So when we heard about all these different vulnerabilities and how it was gonna, you know, change the outlook, that didn't even include OT. We haven't gone there yet.

Aaron Crow (14:7.001): Right. Yeah.

Content Acceleration: 40-Hour Reports in 4

Jori VanAntwerp (14:8.946): because of the difference, right? It it's its own mentality around around patching. but I to to back up a little bit, I think you're absolutely right. That the amount of things that we can do, it's a it's a game changer and it's a time saver. I know for for myself and my team, especially around producing content. Like if my team is is finishing up a a proof of concept, they want to provide a report, what used to take anywhere from 20 to 40 hours to produce

Jori VanAntwerp (14:38.226): is now they're able to produce in four, six hours and the quality is there. But just as as you're doing engagement reports for your clients, they're focused on bringing the data in. So they get they have an outline, using a template, all these things exist today, and then going through and checking the work, right? Changing things, tweaking things, et cetera. And I think that this is where learning the tools is really important.

Aaron Crow (14:43.022): Yeah.

Jori VanAntwerp (15:6.132): You mentioned Visio diagrams or diagrams in general. Man, they are getting so good at producing those. A little shortcut for those who are using the tool. A lot of times you can spend a lot of time, effort, and tokens, depending on which platform you're on, generating like SVG images or PNGs or or whatever you know image source you have. Well, this is my little tweak. And I think I actually learned this from close friend of mine. his name is George Doss.

Aaron Crow (15:9.081): Yeah.

Aaron Crow (15:11.972): Mm-hmm.

Jori VanAntwerp (15:36.714): Have it create your layouts and your diagrams as a web page. Then screenshot the web page. The reason being is you it doesn't have to generate everything over again. All it has to do is modify, I don't I don't want that switch in this place, or I don't like that that you know the icon you've generated for this switch. let's change that. It's changing one component and a little bit of of HTML on the back end, and then you can screenshot it again.

Aaron Crow (16:3.267): Right.

Jori VanAntwerp (16:4.798): So iteration becomes much, much, much faster and less cost to you like computationally less cost.

Aaron Crow (16:12.173): Yep. No, that that's huge. And and I've I've done that as well. And I use it the same for c creating like a PowerPoint presentation or a presentation. because if you do PowerPoint, it's still not great. It's t it's finicky creating the boxes, but it can create beautiful presentation in an HTML. And the cool thing with HTML, like you said, it's really easy to tweak and it can be dynamic. I can have it be moved, it can be a live thing. So in theory.

Aaron Crow (16:42.519): It's almost like PowerPoint can go away. I could see a path where PowerPoint doesn't exist anymore. And every presentation is just a live HTML that you launch in a web browser and you click through. And and the the the irony of this is I did this for DEF CON Singapore. So I had a talk, me and and Dylan and and Tom Van Norman all had speaking engagements at at DEF CON Singapore.

Aaron Crow (17:10.125): And then we also had the ICS Village there. And and so I I on the fly, because I didn't know what we were gonna have when we got there, I had my my OT wall, and then there was we had like three screens, and we're like, what do we want to put on these screens? Well, I threw together a presentation based upon all three of our talks with diagrams and all that kind of stuff using HTML and it created with a with a AI, it created this amazing HTML program or PowerPoint like presentation.

Aaron Crow (17:39.927): And then I just had it rotate. So it would automatically go between the different slides. so when people were walking up and we're talking to people, those things were up on the screen and it was just rolling through and it showed the network diagram of what my OT wall was. We were showing EmberOT, we were showing, you know, secure mode access. We were showing what an OT environment looks like. Cause a lot of those people aren't OT folks. And I was able to create that in like 30 minutes. Now I still had to understand it and be able to tell it what.

Aaron Crow (18:8.545): It should what good looks like, and I have to know what the output is there. But I was able to put that together very quickly and it it it was amazing how well it worked. So that I've started doing that for a lot of things. I will build an HTML first and then I will turn it into a report or a PowerPoint or a diagram because that's the easy path. An MD file or an HTML is the easy path for it. Like don't create same thing for a doc. Don't create a Word document.

Aaron Crow (18:37.327): Create an MD file. It does that very easily. It's very good at it. Once you get the content, the form, like the the flow working, then you can import it into your template as the last step. That way it's not taking as many credentials or the as many tokens, et cetera. And it does it so, so fast. And we all are used to dealing with MD files, but most, you know, business folks are not usually using MD files. So they don't exactly have the openers to do it. And

Jori VanAntwerp (19:3.923): No.

Aaron Crow (19:6.178): Which file do you open it in a text editor? Do I open it at Word? You open it at Word, you got to answer some questions before it knows how to format it. Like, yeah, it's it's it's it's always fun.

Primers: Giving AI Your Voice and Brand

Jori VanAntwerp (19:16.896): Yeah, and for and for for the listeners, if you're not familiar, MD is Markdown. It's a it's actually a a s a format of file that most of the AI tools actually work most heavily in Markdown. So it's it's really good for that as well. It's faster. And I agree with you, it's much easier to to go through that. the the the power is is amazing. If if I was to pivot to, you know, put on my my CEO hat and start talking about, you know, how how how do I want my team

Jori VanAntwerp (19:45.898): To utilize AI and how how do we protect ourselves and and frankly make things specific to EmberOT? This is this is something that I think is incredibly important. So speaking of markdown files, that is the way before before I go into the corporate side of things, that's the way that you actually make AI specific to you.

Jori VanAntwerp (20:13.536): Because one of the risks that you can have, if everybody's going out to their, you know, insert, you know, Gemini, insert Chat GPT, whatever tool you're using, even some of the specialized tools for presentations, et cetera, you if you're just using the stock stuff and you are not working on your voice and your colors, all of it looks the same. If you're in cybersecurity, it is all dark colors.

Aaron Crow (20:34.392): Yeah.

Jori VanAntwerp (20:37.748): the the AI images that are generated, all the like everything I could I could go look at a presentation from company A and company B and not know they're different because you're not you're not giving your model any personality. So it's really important to use markdown files can be actually used to do that. you can refer to them as primers. but switching that's good for you as an individual you should have a primer that talks about how you write, what's your voice is what colors you use.

Jori VanAntwerp (21:7.242): How you you know, are you more of a I'm gonna get a little, you know, nerdy here, but are you more of a blade runner person? Are you are you more Miami Vice? Like what what's your color palette? What do you like? How do you like images to look? Are you a Miyazaki fan? Do you want it to look like Ghibli? Like what what do you want it to do? I think it's really important to to set those things up and you can do that along with tone and context around how you speak, and and how you deliver things and

Aaron Crow (21:14.574): Right.

Aaron Crow (21:18.297): Wait.

Jori VanAntwerp (21:35.698): it it's very helpful. The same thing actually needs to exist for corporations, but in a little bit more structured environment. So you end up with there's tons of tools. You can do it with Git, you could do it with Confluence, you know, Atlassians Confluence, tons of different tools where you can set the rules for the context of what you're doing. If if your marketing team is wanting to use this to help with content creation or even just content review, tagging,

Jori VanAntwerp (22:4.746): You know, all the things that we think of, SEO, AEO, all all these things, having that centralized area where you have a bunch of different MD files that are specifying here's my brand, here's my colors, here's here's the do's and don'ts, here's you know, another will give directions on where to find specific things. If you're working on a blog, look here, if you're working on this, look there. But having that sh as a almost shared intelligence, it's the brain behind it, having that shared context for every marketer.

Jori VanAntwerp (22:34.438): or every engineer to be able to when they run their commands, their tool is going and looking at all those different markdowns. That's how you you frankly start making it safer, but you also have a an identity to your corporation, whether it's branding or it's even you're using it for code, you need it to conform to how your coding process works. If you use agile, it needs to conform to agile. What does that process look like?

Jori VanAntwerp (22:59.720): etc. But setting that up, that it's it's almost like putting together a brain, right? These are the the core operating instructions. Actually it makes me think of Robocop and his three his three rules, right? Yep. but that's that's the first place to start.

Aaron Crow (23:9.487): Core objectives, yeah.

Aaron Crow (23:12.846): Well and

Aaron's Automated Podcast Pipeline

Aaron Crow (23:15.659): It it's it's a ma and and and I wanna dive back into the the the cyber side of things, but but this is a very interesting and and for me, obviously I I I have a podcast. I have you know other things that that I have on on the thing, you know. I help ICS Village, you know, I I have a friend that's a realtor and I help them build their website and it it anyways, I I do other things and it's been amazing how well AI has helped me. I again I

Aaron Crow (23:43.191): My podcasts I do on my own time. you know, it's not a sponsor of my employer. it's separate, separate things. So because of that, I have to be really mindful of how much time I spend on it. Because I have a full-time job that I have to dedicate my time to. I can't be spending eight hours a day editing podcasts because that my my employer would not like that. No employer would like that because it's not part of my job description.

Aaron Crow (24:9.539): So, anyways, all that to say, I've automated almost everything in my process, right? So I have, you know, automated campaigns that go out. And if I want to get joy on the podcast, I add you to one of my I want joy on the podcast lists, and then it it drops you into a campaign that goes out and starts having conversations with you. And my AIs are responding to you, but I have trained it and I have the benefit of a hundred and fifteen episodes of how Aaron Talks.

Aaron Crow (24:38.595): So I use that as my this is how Aaron talks. Aaron doesn't use big words. Aaron says curse words. Aaron, this is how I talk. So I have automated that process almost end to end. So that most of the time, and you you obviously filled out the forms to get to here. you know, there's all of these forms and process, and there's a reason for those because every one of those things triggers something in the background. When this episode is done, I will hit a I will move us in the pipeline.

Aaron Crow (25:8.271): Because I use this like a sales pipeline. even though I'm not charging you or anybody to be on my podcast, but I still run it like a sales pipeline. I will move us from booked to recorded. And when I moved it to recorded, there's a whole bunch of actions and automations that kick off. It creates a Google Drive. It grabs the transcript from from Riverside and drops it into my Google Drive episode for this thing. And then it it does a an entry-level pass at hey, here's the templates and this is the show notes. And

Aaron Crow (25:36.345): pull out the talking points that we say today so that the editing team says, hey, at this timestamp and this timestamp, Aaron talks about this or Jori talks about that. That would be a good short to use as a promotional item. All of these things are done using AI and and automations. You know, one step is AI, the other step is, you know, automations and scripts and all those things combined, it makes me be able to do all of this work.

Aaron Crow (26:5.401): For this podcast at a very high level without taking away from my nine to five. because I'm using tools and and scripts and AI and all that kind of stuff. Cause there's no proprietary. I'm not worried about, you know, there's nothing that you're giving in the form. You know, you're not giving me your social security number, you're not giving me your driver's license, it's just basic information. and I'm and I'm able to get, you know, authorization, sign off, like all of those types of things are able to be done in a very fast way. This is how we need to be thinking about.

Aaron Crow (26:35.001): To roll it back into corporations and cyber, this is how we roll this back into how do I use this to make my my my system better? I have click up as my project management, right? So every one of these things when you schedule, not only does it go into my CRM, but there's a clickup task that gets created. And then all of the steps that have to happen between the time that you schedule, the time that we record and the time that it's published, and then after after care.

Aaron Crow (27:3.247): Like after we after it's released, I send you an email that says, Hey, your episode. Like all of these things are done there. We should be doing this for all of our stuff. You can do it with, you know, what are your daily actions? I need to be scanning these environments. Hey, look at these logs. You can help with with statuses. There's all these little minutiae things that you can turn AI onto that aren't giving it control over your control system, but add huge value.

Aaron Crow (27:31.021): That hey, I want my person to focus on the things that only he can do. Give AI the things and the the the menial tasks that that I don't want them focused on. That's where the in my perspective, the huge value with AI and these tool sets, even in OT, even in IT. But to your point, you've got to guardrail it so that you're not giving it the keys to the kingdom and just saying go. there needs to be a human in the loop in all of these things.

Workforce: Efficiency vs. the Junior Pipeline

Jori VanAntwerp (27:55.700): Well and and I s so I completely agree and

Jori VanAntwerp (28:0.244): The one thing that I'm a little fearful on, and I am trying to in my own, you know, ventures and you know, when I advise folks, talk to is we need to be very, very careful about how we're we're thinking about this long term when it comes to manpower. I'm saying that I don't feel like AI is going to replace humans. What it is gonna do is make one human so incredibly efficient that you may not need a second one. You may not need a third one. So in a way

Aaron Crow (28:28.431): Sure. Right.

Jori VanAntwerp (28:30.238): It is it is absolutely gonna bring teams to a smaller, more efficient state. The part that I'm I'm actually concerned about, we need to keep an eye on, and both of us have said it multiple times in this, is it's like having a junior analyst, it's like having a junior marketer. What are we doing for folks that are entering into the job market? We still need to have juniors.

Aaron Crow (28:54.543): Sure. Y you don't get a senior.

Jori VanAntwerp (28:54.588): Otherwise you you never have seniors. It you know, you have to right, you gotta start somewhere. This is, you know, I I hate to to think about it in farming terms, but it is you're growing. You know, you you need to you need to sow your seeds before you can actually harvest anything. And so it's incredibly important for organizations that they understand whether or not they think AI can replace a junior and those junior roles. Juniors are incredibly important for the longevity of your company.

Jori VanAntwerp (29:23.858): Or you're going to end up in a situation where, okay, so you have you have two, let's say, sock analysts to make it security specific. You have two sock analysts that are just kicking butt. One finds a better job.

Jori VanAntwerp (29:34.896): All your tribal knowledge, the stuff that's specific to your organization, the training, that just walked out the door. And that's gonna happen. People are gonna move on, they're gonna find better things, and we should all be prepared for that. But you didn't have a junior person on the team or even another analyst, right? Not even a senior analyst that understands your organization. You have to have redundancy built in. I that sounds almost impersonal. So I I apologize for that. I don't know how else to say it, but

Jori VanAntwerp (30:1.278): You need redundancy built into your your workforce and we need to grow the next generation. The other thing is let's say you're you have the perfect company, you have a wonderful culture, you're keeping people for 30 or 40 years. What happens when they retire? Right? We have this issue in OT right now where we have an entire you know tribal knowledge and just amazing people aging out of the system and nobody else knows how to do their job. We're gonna run into the same issue inside tech, inside marketing, if we're not careful about where we apply AI.

Aaron Crow (30:12.471): Mm-hmm.

Aaron Crow (30:14.999): Hundred percent.

Jori VanAntwerp (30:30.192): and and understanding that it's it don't make this about replacing people. It's not going to be that. And we shouldn't make it that. It's about making people, empowering people, making people more efficient and doing a better job. We have to keep that eye on what's the next generation? How are we going to make this even better? And that's, you know, again, I could get lambasted. I I don't think that's AI. Not now. And I don't think it's going to be in five years. I don't think it's been in 10 years. It's going to be people. So we need to remember we need to invest in people.

Jori VanAntwerp (30:58.346): But for those that are looking at jobs, marketing, you know, sales, it doesn't really matter at this point. You need to know how to use the AI and use it correctly. You need to know how to do prompts, you need to know when a prompt's not needed and you need to use a loop. You need to know how to utilize AI and interrogate it so that the output is is you know what you would expect and it's truthful. so it's it's important for folks that are getting into the field to definitely do that, but it's important for us, you know, business owners and operators to understand.

Jori VanAntwerp (31:26.782): We really need those junior folks and we need excited to come and join join the team so that we can create those seniors, those principals, the people we really need.

Aaron Crow (31:35.843): Well, y man, that that is that is so powerful. And and we talk about it. I I posted last week the last guest I had or week before last, I can't they all run together. But we talked about how OT a lot of the times is not an entry level job. OT cybersecurity is not an entry level job. and and and I agree

Jori VanAntwerp (31:54.932): Heck, cybersecurity isn't an entry-level job, right?

Aaron Crow (31:58.171): Very true. But we still need those entry-level people, right? So that to your point, like it's almost like going back to the the the you know, the whole mentor and and you know, like the apprenticeship and you know, environment, right? Where you have to you have to be looking as a business owner and and a leader in an organization, you have to be looking long term to say, yes, Aaron can do the work with AI, Aaron.

Aaron Crow (32:27.435): Insert person's name. I'm not saying Aaron is awesome, but insert person's name, Bob. Bob can do the work of 10 people. I don't have to hire a junior because Bob can do it all. A, you're gonna burn Bob out. B, you may lose Bob because if he gets hit by a bus or he wins the lottery, or he gets another job, or he just decides he wants to go be a Walmart greeter. Whatever the reason, Bob is a person, and there is a finite amount of time that Bob is going to be in that role.

Aaron Crow (32:56.569): For any number of reasons, you have to be contingency planning on those things. How are you planning for Bob being replaced, Bob not being able to do it? There's any number of things. And if to your point, if we're not training people today, in 20 years, we're gonna be standing there with a bunch of AIs and no human that it really understands how they were working. And we s we have seen this time and time and time again, especially in OT, where

Aaron Crow (33:26.049): you know, this old crotchety guy built the control system and has been supporting it for the last 20 years. He leaves and nobody below him understands how it works. So they just they they still log in using his credentials because they don't understand how everything works. They don't want to touch anything because they're afraid it's going to break. And and the only way would be to go in and have and a full blown assessment end to end, looking at all the logic and the ladder and everything around.

Aaron Crow (33:52.889): To be able to almost re-reverse engineer what they've put together, that's going to take a lot of time and effort, which means you're going to probably pay a really high-end consultant or hire a really expensive person. But if the whole time he had been training someone, even if they're nowhere near his level, his or her level, then you would have at least somebody that could pick up. Maybe they don't know all, obviously, all the same levels of that person that left, but they know some.

Aaron Crow (34:19.597): Right. It's not they're coming in cold turkey and they don't have a clue and you're starting from scratch. And the irony is I've literally walked into four or five of those types of environments in the last month. And all of them like, hey, that Bob ran this place for 30 years. He left. And we don't like I'm asking questions like, how does this work? How does this work? I don't know. I don't know. We still log in as as Bob because I don't know if I disable his account, if it's gonna break anything. I don't know what is re

Aaron Crow (34:49.261): dependent upon his account, his his his login. I don't know what processes are running. It all just works, but it's a it's a it's it's a you know straw house that I don't know how I pull the wrong straw string or or straw and it's gonna fall down. And that's unfortunately it's going to be that way in IT. It's gonna be that way in marketing. It's gonna be that way in any of these places if we don't do this level of training and AI can be a great tool for that as well.

Aaron Crow (35:18.873): But you've got to be intentional and and have that as part of your operating process of my procedure is is I'm going to train people to have that contingency.

Keeping Skills Sharp: The Vibe-Coding Problem

Jori VanAntwerp (35:28.212): My and pivoting off of that, there's a risk that honestly I hadn't even super considered until just now, which is we need to make sure that skills stay sharp. Meaning i it vibe coding is really popular right now. So I'll I'll pick on that. It's great that you can vibe code, you know how to use the tool. If you don't know how to code on your own, that's a skill that

Jori VanAntwerp (35:50.662): is really needed. So we we're gonna have to not only lean on on us as organizations and and corporations as a whole to really push people to learn their trade outside of AI.

Jori VanAntwerp (36:4.404): But also we're gonna need to start leaning on edu educational institutions to do the same thing. Because I I know again, good good another good friend of mine is you know teaching at a at a university teaching coding, and and they have had to fail so many students because they have completely vibe coded their way through a class. And what they've started doing now is random code reviews. So they'll bring up the code, they'll bring up section, they go, what is this and what is it doing?

Jori VanAntwerp (36:32.688): And nine times out of ten, this is just six months ago, a student couldn't answer that. I think we're gonna see the same thing in marketing and so on and so forth, where people are using the tools so much it becomes a crutch. You you also need the skill in order to do the thing. And I think balancing that is gonna be it's gonna be tough. but also pivoting on that again, we know they're gonna be using AI.

Aaron Crow (36:46.233): Yeah.

Shadow AI and the Corporate Toolset

Jori VanAntwerp (36:58.986): You don't want them, I'm going back to the old days of shadow IT. Remember, we used to always talk about shadow IT. it's you don't want shadow AI. You don't want them going off and using Chat GPT on their own or or anthropic or whatever it may be. You want them to use the the corporate one. So providing them with the tool in the context is incredibly important. because you don't want to say, I don't want you to use AI. They're probably going to use it anyways. Right? You want to say, here's the AI, yeah, yeah. They're gonna use AI 100%.

Aaron Crow (37:2.488): Yeah.

Aaron Crow (37:6.414): Right.

Aaron Crow (37:23.567): Probably they are going to use it anyways.

Jori VanAntwerp (37:28.328): So that you're gonna want to say, here's our AI tool set. Have at. Here's some guidelines around how we want you to use it, and so on and so forth, I think is is really important. and pivoting back, and this is actually more of a question for you, is securing those models, securing that AI.

Securing the Models: Sandboxes and Segmentation

Jori VanAntwerp (37:51.270): That starts to get tough. I've thought about it and how I would approach some of it, but since this is it's cloud, it it's mostly cloud-based you know, models, unless you've built something local. you know, how are we protecting these? How is anthropic? How is how's open AI? how's Google protecting these these you know giant cloud, they're almost like compendiums of human knowledge at this point.

Aaron Crow (38:15.405): Yeah. Well, and and then, you know, the bigger question in addition to that, right? It is, you know, how do I and most most people that are not cyber people may not be thinking about this, but I'm very intentional about putting my stuff in a box. Like I I put like if I'm gonna do coding and I'm gonna do anything with AI, I create a folder, I give it access to that folder, I put the things that I want to have access to in that folder.

Aaron Crow (38:43.469): And it doesn't have access to anything else. So I'm very much segmenting what it has access to. I'm not giving it access to my freaking general email or my all of my Google Drive and all of my knowledge. I'm only putting things in there that I want it to have access to. and that's because in the back end, how do you know what AI is doing when you give it a command? And if you give it the keys to the kingdom.

Aaron Crow (39:9.987): There's there's multiple documented evidence of folks where they have tracked it down and you tell it, hey, don't do this, don't do that, it does its own thing because it wants to be successful. So it goes around and it finds a way. It's very intuitive. It's good at some of those things. So if you're not super intentional about how you set up and your listener, if you're not a cyber person or you're new to this or you're getting into AI or whatever.

Aaron Crow (39:38.649): Like you have to be really careful. Like you don't put anything into AI that you wouldn't just publish on the internet. Cause that's really what you're doing. And you don't know what it's doing in the background. Like it's not like you're looking at the command. And to your point, so many people are vibe coding and they don't have any experience or knowledge. Like I've I have a lot of experience in coding and programming and scripting and all that kind of stuff. Am I a programmer? No.

Aaron Crow (40:7.043): But I've been a CTO and I've reviewed code and I understand how it works. So if you did that to me, I could do a lot of the vibe coding stuff that I've built. I understand it enough to know why it's doing what it's doing in a section. So like I understand it enough to say, I don't like that. This is not how we're going to do it and me to direct it. But to your point, if you don't know what you're doing, then how can you tell it what to do? Right. It's one of those things like the blind leading the blind.

Build vs. Buy: The MVP Trap

Aaron Crow (40:33.015): Like you have to understand what good looks like so that I can do it. If you're not at the level that you can build something, it's not going to work. All these folks are saying, you know, I've got this MVP, you know, MVP is minimal viable, minimum viable product. It it's really a a a term that we use in in in software or hardware or any product where you're saying, Hey, what is the the least amount of work that I could get it up, stand up a straw man to showcase.

Aaron Crow (41:3.051): what what this thing could do. I can do an MVP in a few hours for most things. Like I'm building this this application for my my cause I have like four cars because I have a big family. so I I've never had a the right tool that tracks mileage and has an ODB2 scanner and and has all stuff. So I just decide I'm gonna build an app.

Aaron Crow (41:27.097): But there's nothing in that app that is proprietary. I'm not putting my PII up there, anything like that. But dude, I was able to instead of buying like it took me less time to build the app exactly what I wanted it to be, instead of going and finding and reviewing 15 apps. The problem that I also see, and this is where I want your perspective on too. I have a lot of clients now that are saying, hey, product A, product B, product C.

Aaron Crow (41:54.361): They're all fine. They're really expensive. I think we're just going to build it in-house. And I've seen that in the past where, you know, whether it's like like an ERM, like a Maximo type thing that's doing work work management and all that kind of stuff, where you start customizing it so much, but then you're locked into it. Think mainframe, think custom applications. Again, when Bob leaves, how do I support that application? That's part of the problem.

Aaron Crow (42:23.171): When you buy commercially up cots, commercially off-the-shelf products, you're paying for the support, the ability to upgrade, the ability to patch. If you're building things in-house, who's testing it? Who's doing bug fixes? Who's making sure that there's no security risks and vulnerabilities? Who's doing all of those things? If you are a power company, do you want to be a software development company? Because that's basically what you're doing. And there's not a problem with that.

Aaron Crow (42:51.683): But only do it if you're going to put all of the resources and time and and exp, you know, capabilities that need to go into that. Cause you need to have somebody that's doing that testing, that's doing that QAQC, that understands UIUX, that understands all of those types of things. And most people are just thinking, well, I can just spin this up because Aaron's really good at what he does. We'll have an he's already showed me an MVP. We'll just turn it on, we'll host it in our in our cloud, and that'll be our product. And boom, we're good.

Jori VanAntwerp (43:19.668): Yeah. Yeah, not that easy. It's ne it's never that easy. Especially when you you start thinking about those custom softwares. I think back to the early two thousands, which unfortunately both of us are getting gray on our beard. Me more than you, but we're we're at a point now where we're we all it's always cyclical, right? We're always re repeating the the issues of the past. In the late nineties and early two thousands, we had a lot of of folks that were actually building custom software in-house because it was what they needed at the time. And

Aaron Crow (43:31.279): Mm-hmm.

Jori VanAntwerp (43:48.688): You know, a lot of the developers that I know from back then and and folks that I've worked with, they you get stuck and people don't realize you're most likely not going to be coding everything in there. So you're gonna let's let's talk security. You want you you are CrowdStrike shop, you're using Falcon. Great tool. What if Falcon is no longer sold? Or in two years you decide to start using Sentinel One or some other platform? you now have to.

Jori VanAntwerp (44:17.706): completely recode that integration. You may even need to change things under the hood. It is a constant, constant thing. And especially like finance, the like financial and healthcare were really, really into that, that custom app side. And I know plenty of folks that really got burned by that. And like you said, it's mainframe. It's AS400. We have people that are still using AS400 today because they literally can't get off of it because they have custom software that's built for that. It's not

Aaron Crow (44:36.857): Yep. Yep.

Jori VanAntwerp (44:45.566): I don't think it's the best solution. And you do have to have an entire in-house staff of devs. I mean, I run a software company, and I can tell you that's not an easy thing to do. you know, keeping that up up to date, I I think you're you're absolutely right. It's something we're we're gonna have to be really careful of because that vibe coding does make it easy. You can absolutely have an application that does exactly what you want it to do in that minimum viable product, but again, who's defending that?

Jori VanAntwerp (45:16.242): Is it just a bunch of open source tools? Is it a bunch of open libraries? You know, who's updating that when those libraries inevitably have issues? You get into the whole conver conversation around SBOM, who's monitoring, you know, what's in there and what needs to be updated, third party software. I mean, it is mu much more complicated than I think folks are making it out to be. and I would

Aaron Crow (45:36.429): Well, and and and that that leads me down to to interject there, man. You just you made me think about something. As a buyer, I have to be asking those questions of my vendors from now on as well. Because if if if they're a shop that just spun up or maybe they're doing, you know, whatever, are they just vibe coding and do they have are they doing these? Like you need to be asking these questions when you're when you're evaluating a product and a company is is that, right? especially when it's like a software product.

Jori VanAntwerp (45:48.754): yeah.

Aaron Crow (46:6.846): it's it's like do you do you have the support staff and how are you going to maintain it and what does that look like? because all of those things matter. And and and I think we know we know it probably because I've been in this industry so long and maybe I'm I'm a a little, you know, whatever, jaded by it. you know, I I'm not looking necessarily for the product with the the best

Jori VanAntwerp (46:16.852): Yep, they all matter.

Why OT Does Not Change: Switching Costs and Legacy

Aaron Crow (46:31.978): Always I'm not it's not only about who has the best product and who has the best output. So like if I'm comparing, let's say firewalls, you know, there's and I don't want to name you got Palo and you got Cisco and you got checkpoint, you got all these kind of things. I am not only considering who has the best features. I'm also considering price and support and usability. And if I have, let's say that I have Palo or Cisco or or Sonic Wall or whatever the thing is.

Aaron Crow (47:1.080): For me to change from one vendor to another, even if that other vendor, let's say that other vendor is way better, I'm gonna have to go change all my processes. I'm gonna have to go change all of my alerting, all the logs that are going into my sock, my backup and recovery is gonna change. Like there's that one change changing from a vendor to something else is huge. And this is why in OT, we talk about it all the time. That's why things don't change that often in OT.

Aaron Crow (47:30.710): I'll have a control system that was installed 40 years ago and it's still running. And then, you know, technology people and cyber people are like, my God, why do you have this old stuff? It's such a risk. There's vulnerabilities. Yes, there are, but it's been running for 40 years. It's not on the internet. It doesn't have the latest things. I'm protecting it by segmenting it off, having firewalls. We can do monitoring.

Aaron Crow (47:56.067): To upgrade it to a new thing, if I were going to go replace that control system and put in a new one, that's a huge capital cost. And then I've got to retrain all of my people that have been running this power plant or whatever manufacturing facility, you know, water treatment plant, whatever. Everybody knows how to use this thing. I've got 15 people in reserve that know how to do this. When I rip all that stuff out and put in the new one, all of my experience went out the window. If it breaks, I don't know how to fix it.

Aaron Crow (48:24.035): I don't know how to troubleshoot it. I have no experience doing these things. We're calling the vendor, hoping the vendor has a person they can get on a plane and come out here fast enough. Like, those are all the factors that we're thinking about. And I can't tell you how many times I have these conversations at at at conferences, DEF CON, whatever. And they're like, these cyber people just can't get beyond their mind that there's a Windows XP machine running in this system. I'm like, yes, I get it. We should upgrade Windows XP. It should be end of life, all the things. But sometimes it is actually.

Aaron Crow (48:53.757): more risky to remove it than it is to leave it alone.

Jori VanAntwerp (48:57.374): Mm-hmm. Absolutely. Yeah.

Aaron Crow (48:58.775): And it just boggles their mind when I say that. And they completely disagree with me. And that's okay. But that's because I've been in those places and I've understand it and I see it from the operational side, not just the cyber side. From a cyber side, it makes no sense. It'll never make sense. But from a business and operations and availability side and financial, the capital side, the money side of that. If my plant is barely making money and and I have to spend 20 million or five million or a million or five hundred thousand dollars to to

Aaron Crow (49:27.787): Upgrade the system, but then that makes me not profitable anymore. What's the point? I'm not going to do it because then I'm in the then I'm no longer profitable. So if the only way for me to do this upgrade is for me to not make money anymore, then the business should just shut down. Or I continue to run it and protect it in other ways. And if it breaks, I can run it down the road. But if I do this thing, I'm no longer profitable. And again, cyber people forget that part. I have to do all these things. You know,

Aaron Crow (49:57.579): It's revenue is not profit. All the operating costs in the middle matter.

The Submarine Principle: Modular Monoliths

Jori VanAntwerp (50:4.532): Yeah, it has it has to match the business. And throughout my career, there's there's two things that I kind of fall back on. It's gross oversimplifications, but it's it's something that has really helped me in every solution that I've ever built is understanding two things. I think of every organization or piece of software as a submarine.

Jori VanAntwerp (50:27.186): with compartments. I can close those compartments off, right? Water, you we've got a breach, water's coming in this. I can close that compartment off and the rest of the sub will keep running, right? There's critical areas that we need to make sure we defend and are redundant inside that. But we we have a way to seal that off. And frankly we're in the middle of the ocean. So nobody's nobody's walking up to that door and unsealing it to get get to what we need to, you know, what's behind it. But the other way that I think about that in the same same piece is that that submarine is is the monolith.

Jori VanAntwerp (50:56.498): Everything in it is modular. And when we build software or we build solutions, we take that approach, which is frankly the way that O OT environments work, right? They're very complex, amazing processes, running a dam, right? But they're made up of simple, ro like simple tooling and simple devices that make it robust. So all these simple things are robust in themselves. They come together as a whole that's more complex.

Jori VanAntwerp (51:26.334): And I I think it's it's a great way to look at things long term, you know, to pivot a little from what we were discussing is is understanding the that protection and how to make things modular. And to circle back to what we were talking about, if you have a tool that you're putting in for monitoring, right? You should you should, as part of that project, make yourself as modular as you can be.

Jori VanAntwerp (51:53.694): You know, I'll talk from a network monitoring standpoint. It'd be great for you to either use some type of R-span or ER span to bring everything back to a centralized location, or even better, have a tap or spanning infrastructure or packet broker that's out there pulling information in. If you want to monitor in the environment, you have all that brought back to a centralized point. You have you insert tool A, tool B, tool C. You use those for monitoring, defense, etc. Inside that. If you have an issue, you can swap out tool A with tool D.

Aaron Crow (52:24.143): Uh-huh.

Jori VanAntwerp (52:24.190): without much fanfare. If you are monitoring in those environments and you go out and say, you know, we're betting on tool X and you deploy tool X everywhere in your environment, guess what? The next time you you have a change of heart or if that company no longer exists or stop supporting the tool that you like, you now have to you now have to actually rip it out and replace it. And it's incredibly painful. So I always encourage folks to take that like modular monolithic approach to anything they do.

Aaron Crow (52:53.123): Yeah. Well, that that that's what we do. Like you you look at a you look at an OT, it it's not the XP box. It that XP box or that PLC or that HMI or that that switch, it's all part of a larger system. And in OT especially, we usually have redundancy built in and because it matters. So we have redundant PLCs, we have redundant switches, we have redundancy built into the system so that if one of those things goes down, then I'm not, I don't exactly not that I don't care.

Aaron Crow (53:22.947): But it doesn't bring down my process, right? That that's the reason how critical my process depends on how much redundancy I have in my system. On one side, we need to make sure we're considering cyber as one of those attack vectors and risks in these environments. And also that, you know, backup and recovery and and and and switching and and routing and and all of that. Like obviously, if a bad actor gets in my network and it's completely flat and I'm not monitoring it, then they can take down everything, not just one of them, right? So

Redundancy, Analog Fallbacks, and Manual Mode

Aaron Crow (53:52.877): obviously those are things to consider. But to your point, if we're building these things as a secure and and and viable system with availability in mind, and I'm segmenting these things, like you said, then some of these things I don't have to solve with a cyber tool. Some of these things I can solve with basic foundational, you know, how do I run a pro a system and how do I protect an environment? Like you look at a nuclear power plant.

Aaron Crow (54:20.985): They have tertiary systems for everything. They have a digital system, they have a second digital system, and then they have an analog system. So if everything fails, they have a physical analog, you know, relay that fails over and closes the system for obvious reasons. The risk is really high. I want to control that that reaction at all costs. I can't allow a misconfiguration or a power supply failure to bring down my.

Aaron Crow (54:50.169): power plant or specifically in a in a in a nuclear reaction, obviously that's where I have to have those tertiary systems. So you walk into a control room in a in a nuclear power plant, it looks like the 70s, because that's when it was designed and it's going to stay that way. Now there's other things that are added on that get more into the into the current world, but you want it to have that old stuff because you want it to to fail back. It's just like a brand new car. The difference between my, you know, 20

Aaron Crow (55:16.035): 15 Lexus GX and my 1991 Land Cruiser is night and day difference. There's no electronics almost in the in the Land Cruiser. It's just mechanical. There's no computer. It has it kind of has a computer, I guess, but you know, for for ignition, but there's really nothing there. Like it, there's no infotainment system. There's no CAN bus. There's there's nothing. It it's basically something that's controlling spark and ignition. And that's it.

Aaron Crow (55:44.311): And I could literally and it's got a distributor. So there's no ignition coils. There's none of that. It's literally advanced timing by moving a distributor. And and I mean it it's that simple, right? And and you want that analog capability in some of these processes, which seems archaic. And yeah, you know, a fuel efficient a fuel injection system in a modern car is way more efficient. Okay. How which is more reliable? My 1991 Land Cruiser or a brand new 2026 Toyota or a

Aaron Crow (56:14.691): Chevy Tahoe.

Jori VanAntwerp (56:16.702): And that mentality inside OT is has saved our bacon like so many times. We can pick on crash override is is you know something that gets talked about all the time. It was a successful breach, and I'll say a successful, I'll air quote this for those that aren't watching, exploit. But the reality is it didn't actually harm the operation because the operator saw the issue and switched to manual mode. Problem solved.

Aaron Crow (56:20.202): Yep.

Aaron Crow (56:44.899): Right. Yep. Yep.

Jori VanAntwerp (56:46.514): It was that quick. So you know, operators save our bacon on a regular basis, but it is I I agree, having especially in our OT environments.

Jori VanAntwerp (56:56.668): making sure that we can go manual is incredibly important. And there's a lot of folks in in Europe, different organizations and such that are starting to build out energy, for example, that is mostly autonomous and has no no physical backup. And I'm just wa I personally I'm I'm cringing and I'm waiting for a threat to actually make it through in that particular instance and them not to be able to send a truck out.

Jori VanAntwerp (57:19.612): and you know, flip a couple of of s switches, maybe bring things over to manual and get it back up and running. It's gonna be the difference between someone having a you know a a no power for thirty minutes to an hour and a half to someone having no power for who knows? Two weeks.

Jori VanAntwerp (57:35.934): so I I think it's important to definitely keep those manual things and to keep remember that we can defend things in a more manual process. And that goes back to the AI things that we've been talking about. You know, don't give them access to everything. Just as you said, it should be segmented. You should be thinking of that as your submarine. Here's what it should have access to, and it definitely shouldn't have access to the engine room. It shouldn't have access to the bridge. This, you know, these are where we need to keep things separate. And honestly, I I don't know if you've seen it.

Aaron Crow (57:55.075): Mm mm.

The Hugging Face Autonomous Breach

Jori VanAntwerp (58:1.816): Aaron, the the one that comes to mind is the hugging face, the autonomous hugging face breach, where open AI no n there was no ill intentions, right? OpenAI of its own accord actually breached hugging face on its own. You know, and everyone's acknowledged this.

Jori VanAntwerp (58:22.590): so it wasn't a bad actor, but can you imagine having a tool that you're using in-house and you have not given it enough guardrails, literally accidentally breaching your entire your entire environment? Like that's that's proper sci-fi scary, I guess. I'm just waiting I'm just waiting for Skynet, man. That's that's where I'm I'm just waiting for Skynet.

Aaron Crow (58:39.095): It is. Well, we know that the autonomous drones are here and and they're doing all those types of things, but hopefully we do keep the the the fail safes and the human in the loop thing thing in there, right? you know, and it and it really comes back to if you don't understand your process, turning on AI is not the answer, right? You have to really be understand your process, whether you're building code, whether you're a a a plant operator.

Jori VanAntwerp (58:47.349): Yeah.

Experience vs. Time: The One-Day Assessment

Aaron Crow (59:9.059): Like there's a reason why, you know, I I literally I went in and I'm doing an assessment and and I had a power one of my clients, I walked in and they wanted us to be there for four days. So I go in, it's a pretty small facility. I walk in, we place a sensor, we do the walk down, I've got spans going to the thing. you know, and we end of the day, we've walked through, we've asked all the questions.

Aaron Crow (59:35.939): We've we've seen all their, you know, the as built, the documents, all that kind of stuff. The next morning we come in, we validate data still flowing. And I'm like, okay, well, we've moved our flights and we're leaving today at noon. And he's like, What? What do you mean? I'm like, Well, there's nothing for us else to do. The sensors just have to grab their data. I was doing a cyber assessment, right? And I I just need those sensors to do all the data collection. And then you you send me those things back and I'll I'll do all the other stuff back in the off at home.

Aaron Crow (60:6.051): with all that thing there. And he was like, wow, I'm gonna have to explain why, you know, this this is so expensive per site. I'm doing air quotes here if you can't see me, so expensive because you didn't spend much time here. And I'm like, well, let me have a conversation with you. The reason it doesn't take me more than a day at a small facility is because I've seen a hundred facilities just like yours. You showed me where the PLCs are, I understand the process, I've talked to all the engineers, I've asked the questions I need.

Aaron Crow (60:34.403): You've given me the documentation that I need. We're running the data. So we we have all these different perspectives. If you it doesn't make sense for me to just sit in your conference room while data crunches in the background and you and I to go to lunch. Like, do you want me to spend more money on your expenses or do you want me to just go back home, stop billing you for that time? And then I'll I'll do this when it's back. And and when I was able to kind of level set that and also when I showed him the output that we're giving him, it's like,

Aaron Crow (61:4.001): Okay, I see it. Like you have the value. It's that it's that analogy of the when they hire the guy, like the system's broken and the turbine won't run or whatever. They hire the really expensive guy. Okay, it's going to cost you a million dollars. He's in there for five seconds. He takes a hammer, he hits it in the right spot, everything starts working, and he gives them the bill. And they're like, I'm not paying that. You were only in there for five minutes. And he's like, You didn't pay me for the five minutes I was in there. You pay me for the 40 years of experience that made me know where to hit that thing in that right time. It's that experience that comes in.

Aaron Crow (61:33.303): And when it relates to AI, AI doesn't have that experience, right? So it you need that experienced person. And to really bring it back around to the original, we have to be training new people to take over and have that experience as well. Or we're gonna be in a bad place in 20 years. And I I have a family, and I care about society and I care about the world. So we have got to be thinking about that now. so business owners, leaders, I I I implore you to be thinking 10 years down the road.

Aaron Crow (62:1.741): With AI as part of your strategy, but also the people side of things too, because you have to be having some kind of mentorship, some kind of apprenticeship where you're you're training people up so that they can drive the AI bots and Skynet, et cetera.

Parting: Train People, Start in IT

Jori VanAntwerp (62:19.122): I I couldn't I couldn't agree more. It's it's

Jori VanAntwerp (62:23.334): It's gonna be really up to us over the next five years to make sure that we're we're properly training people and bringing people in. and and not just l we will, we'll lose the school the skill sets and it's it's sad. I the one one parting comment, we're talking about entry level jobs into OT cybersecurity. I've said this so many times, people are probably sick of it. So I'm sorry if you've heard it before. If you wanna get into cyber security, if you wanna get into OT cybersecurity, okay, the

Jori VanAntwerp (62:53.694): Entry level job, that's IT. Go get yourself an IT job until you can get to a point where you you have you an apprenticeship style position. You could be a junior, but you can't defend systems if you don't know how they work. You learn how they work, honestly. You could start on a help desk even. You're gonna learn how systems work and how users interact with them. And that's I mean, the user interacting with them, honestly, I would say is 75% of what we try to defend against. So

Aaron Crow (63:21.519): Correct.

Jori VanAntwerp (63:23.614): how the user interacts. So d just remember that guys if you're looking for a job in in cybersecurity, get an IT job before you know if you you may not be able to land that IT sec or security job as quickly as you want. So yeah, grab grab a job in IT and keep applying.

Aaron Crow (63:38.703): Hundred percent. I agree a hundred percent, man. It it's it's it's where I came from. Like I I started on the desktop being a desktop support admin like thirty years ago, right? And and being a network admin and being a systems admin and being a server admin and you know, being an applications performance person and building products and and I've had all those roles, which is why I understand NOT systems so well. And I've worked in power plants and I've gotten the hard hats. Like it took me a a a lifetime and and and multiple careers worth of time to

Aaron Crow (64:7.545): get to the place that I'm at now. I mean it's only because I was willing to do those jobs along the way, knowing that you can't have the job if you want the job there, what what is it going to take for me to get from A to B? Right. So that that's that's a that's a great lesson. So all right, man, how what's what's called action? How do people find out more about Ember, find out about you? What do you want to know?

Where to Find Jori

Jori VanAntwerp (64:30.945): yeah, so EmberOT.com is probably the best place to go to learn more about Ember. as far as me, you know, I'm out there on LinkedIn. I occasionally, you know, get on my soapbox and give a few diatribes. but you're more more than welcome to connect with me on LinkedIn. I love having great conversations like the one I'm having with Aaron today. And if you are interested in learning more about EmberOT and our flow-based software-only approach to monitoring OT environments.

Jori VanAntwerp (64:58.814): Yeah, the website's the best place to go. EmberOT dot com.

Aaron Crow (65:2.507): Awesome. And and I'll I'll say firsthand, so I I've used it extensively a lot. you know, and it it's a great product. You know, we use a lot of products being a consultant and all the things. but being able to have that flow is a big piece to understanding what is going on in my network. Yes, I need to understand what my assets are. Yes, it's important to understand and and be able to speak protocols, all great things. but also having that so what.

Aaron Crow (65:29.741): Because when I'm going to a site, that's so what matters. So having that, yes, this is important. Yes, I have a Rockwell PLC or a Schneider or a Wine Tech or whatever the thing is. But the what the real thing from a cyber perspective is, is by the way, you have these three devices that are OT. You thought you had it segmented. Those devices are speaking to Taiwan or Google or Microsoft Azure. It's not necessarily a a problem.

Aaron Crow (65:58.369): Other than you probably didn't intentionally be have that there. So having that flow to say, I know this thing is talking to that, and that's not a good thing. That is hugely it is. Yeah, it is.

Jori VanAntwerp (66:7.486): Yeah, context is incredibly important, right? Context is incredibly important. And what we do with flow is is very different than I encourage you to come take a look, but we actually build flow for protocols that don't normally have it, broadcast and multicast. We also include in that it's a proprietary flow that we build. we actually include information about the the asset itself, actually bringing out the best of of what you would find in deep packet inspection in that flow. And it gives you that context, not only like who's talking.

Jori VanAntwerp (66:35.658): Who are they talking to? Why are they talking? And what do they do? All of that's included in in our flow. And it's it's definitely I consider it a game changer, but I have to say that. So

Aaron Crow (66:49.578): Well, I I agree with you and I don't have to say it.

Jori VanAntwerp (66:52.695): Well I thank you, sir.

Aaron Crow (66:55.203): Well, awesome, man. Hey, thanks again for your time. I'm sure we will see each other. I'm trying to get you out to to Vegas to come shoot with me at Staccato. I'm not gonna be at Black Hat, but I am gonna be at DEF CON. So I'm not sure when this will drop. May drop after that. But if you're at some of these conferences, Jori's at a lot of them. I'm in a lot of them. you know, come come hang out, come say hi to us. always willing to have conversations with everybody. It's one of the reasons why we do these things. So awesome, man. Have a good one. I appreciate the time today. good job as always.

Jori VanAntwerp (67:22.762): You too. Thank you, brother.

Transcript lightly edited for readability.