They Deserve to Be Defended: OT Defense, Transitioning Vets and Weaponized Sneaker Net

Cold Open: Introducing Erin Burns

Aaron Crow (0:1.094) Awesome. Thank you for joining me on another episode of the Protect It All Podcast, where I get the opportunity to sit down with some awesome folks and have, you know, fun conversations, learn things, give them opportunity to to share the things that they've learned, they've grown, their experiences, all that kind of stuff. Today is no exception. dude, introduce yourself. Who are you? Background, what do you want to share? What do you want people to know about you?

Nineteen Years, Alphabetical Order, and CPT 1-5-6

Burns (0:24.674) Yeah, so I'm Aaron Burns. I'm transitioning out of the army right now. I I did about I meant like 19 years, and most of that time, say half that time was special forces support. and I did early, early days of cyber in the military. I I did some like Wi-Fi stuff and then went and did the cool guy jumping out of airplanes, shooting gun stuff, and then

Burns (0:51.116) figured I needed a it was financially irresponsible to stay enlisted. So I became a warrant officer. And because I had that cyber experience, I went cyber warrant. and the army just said, Hey, we've got these spots. I didn't know anything about so I put them in alphabetical order because that's what made the most sense to me. And I landed on CPT one five six.

Burns (1:15.020) that was the o the only well there was two at the time, but it was the best OT cybersecurity team in the army. and I really cut my teeth there and now I'm transitioning out and setting up my own thing on the outside and look forward to talking.

The Question Every Transitioning Vet Asks

Aaron Crow (1:30.044) Awesome. Yeah, you know, man, we we have the up I have the opportunity to really talk with folks. I'm at conferences and and and folks reach out on LinkedIn. And you know, a lot of the conversations that I have on here is talking about how do you get into OT, how do you get into cyber, not just OT, but IT, OT, that kind of thing. Lots of vets reaching out, transitioning. What is what do I do next? That's a very important question, very near and dear to my heart. My 17-year-old's about to enlist. He he wants to go to the Marine Corps.

Aaron Crow (1:57.299) apparently I I hang out with too many Marines that love crayons and and that's where he's going. So but but yeah, so you know, I I I love that path. And and the the the amazing thing is is there's so many, there's so much training and and OT is so hard to get that experience. And and you either have to, for the most part, to get that experience, you either have to come from the military or you have to come from manufacturing or

Burns (2:1.959) Or the diversity.

Aaron Crow (2:22.888) you know, some kind of industry where you came up in as an operations or an electrician or or some other kind of trade that's kind of gotten you into that space. So so how how was yours? And and and you kind of talked through it a little bit, but dive in a little bit more about how you got your experience and and and what you liked about it and what you've learned along the way.

Hard Hats, Factory Floors, and Five Years on the Team

Burns (2:41.071) man, it was it was you got to wear hard hats and walk factory floors, so that was great. yeah, you know, they dropped us on the team, and the army has huge turnover. Like you'll be on a team if l if you're lucky for two years. I was super lucky, I was on that team for like five years. So I got to take the team from

Aaron Crow (2:46.025) Yeah.

Burns (3:0.701) As I matured as an OT cybersecurity professional, I got to mature the team and get it to the level where, you know, we're coordinating multiple hunts at multiple sites, looking in placing centers, doing all that jazz. So really it was it was just a great place to problem solve because an IT, I mean, every IT place is the same. And

Burns (3:23.873) There was nobody really to ask questions unless I reached out to the guys at Sands, like Tim Conway and and those guys and they they have always been super supportive of the military and you know, Rob Lee as well. And they were definitely helpful in those early days of I think one time we did an exercise and the army had told Tim that to expect twenty cyber like OT professionals and he got five dudes who didn't know OT. And after about twenty minutes I was like, Hey man,

Burns (3:52.803) Can we just learn stuff? Because like we don't know what's happening. And they were super awesome. And and we did like they would attack stuff and we would watch and defend it. And it was a much, much better learning experience. Like we definitely weren't up to the snuff that the army had pitched that was going to be there. But yeah, did that. now I'm over and Tampa, so I'm more in a strategic level. And I was like, this

Tampa, Strategy, and the Decision to Go Solve OT

Burns (4:21.364) isn't as fulfilling because it's not as technical. So I decided, you know, how do I stay technical? So then I was like, well I love OT, so I'm gonna go back into that and and maybe do some consulting. And then I just looked at all of the problems of OT and I was like

Burns (4:40.086) I think that if I put enough effort to and time to this, I could solve it. And then I just kept having guys reaching out that were transitioning as well from my unit. And they're like, tell me more about this OT stuff. I want to help. I want to help. And then we started a company and we started cranking out products and and coming up with solutions. But more to your talk for like transitioning into OT, we identified it's it's really hard to get into.

SOC Automation Is Closing the Front Door

Burns (5:8.886) And it's only gonna get harder with SOC automation. So it's gonna be hard to get anywhere into cybersecurity because those level one and maybe level two jobs are gonna quickly be automated. so we just sat there and thought about like how do we fix this problem? How do we like get people into these work roles and and and get them trained up? And I just went back to the the soft model that I learned when I was supporting ODAs and it's

Burns (5:36.205) You get a junior and a senior and you do some on-the-job training. And so our model, like as people have reached out, is been we're looking for like problem solvers, people that wanna go out on the factory floors, people that are interested in just hammering their head against a brick wall until they figure out a way through it.

Burns (5:57.621) And then, you know, we've already got a a bunch of dudes that are getting out, dudes and girls that are getting out that are have OT experience and those are gonna be our core individuals that are gonna train up the next gen if you ha if you would. Like so when I talk to people and if they don't have any cyber experience, yeah, it's gonna be a longer road to get to that senior position. But if you've got a lot of cyber experience and you just need that like that chef's kiss of OT, it's gonna be a lot shorter road to get you to that senior level. And

Building the Black Rifle Coffee of OT Cybersecurity

Burns (6:27.884) We're also very focused on identifying veterans as they exit, because we're trying to build a culture that is a little bit more in line with the military. not to say there's anything wrong with going to corporate America. I've got guys that I talk to and they're like, no, I want to wear a tie and sit in a cubicle. I I've done the army stuff. I wanna I wanna be in the professional setting. And I'm like, that's cool. Support it, go do it. But if you want a place that's a little more

Burns (6:58.018) I think of it like black rifle coffee of OT cybersecurity. Like we're trying to build a culture and build just kind of this framework to help people get into the industry.

Ignore the Job Req: Hiring Troubleshooters

Aaron Crow (7:9.384) No, I love that man. No, it it's it's I I've built this from the corporate side and and before OT was a term, and and and and a lot of the struggles I would have along the way, and this goes back to you know 20 before before Dragos existed, like before Sans had an OT class, right? You know, I was working at a power utility and you know it's it's I was hiring for folks and I I HR put a job wreck out and it was like an IT based.

Aaron Crow (7:38.762) you know, requirement that checked their boxes. And then I started reaching out to people that I knew. And every one of them were like, man, I don't have that experience. And I'm like, I don't care. Ignore the job wreck. It's got nothing to do with the actual job. And and like I I I called a buddy of mine and he came from like, you know, a law firm and was a desktop admin. But I knew him and he'd worked with me before. And he was a Marine and he was he was a mechanic. And he grew up being a mechanic. And that that troubleshooting skill set,

Aaron Crow (8:8.073) is what I needed. He was motor T in the Marine Corps, you know, you know, he he was just he was a grunt that you you put him in front of a problem and he just solved the problem. Like he didn't he didn't have to have the answer or have a book to read it from. And those are the types of people that I needed in these OT spaces. I need somebody that I can send out to the floor and just say, figure it out. Like there is no book. And that's to your point what you talked about, right? Is is IT we've been doing this so long

Burns (8:10.380) Yeah.

Aaron Crow (8:35.145) You can you can read the book, you can take the class. There's there's standards, there's all of this stuff. A hundred thousand people have done all these things. I'm not saying it's easy because it they have different problems, but a lot of times in OT, there is no nobody's ever done some of the things that we're trying to do. Right. So, so it's a first time. It's like, I don't know how to do it. Like, we're gonna figure it out together, like with the client, with with the vendor, with the site. and and we've just got to failure's not an option. We've just got to.

Burns (8:50.581) Right.

Aaron Crow (9:3.989) Put her hats on, put her big boy pants on and figure it out, right?

Purpose, Zero-Growth Budgets, and Hot Dumpster Fires

Burns (9:6.732) Yeah, and that's another reason why we're leaning into critical infrastructure and the like low the the people that are resource constrained right now is one, it's gonna give the people that come to work for us that continued sense of purpose, mission, because it matters to keep the lights on, keep the water flowing. And two

Aaron Crow (9:23.583) It does. Yeah.

Burns (9:28.052) it we've been doing this for so long in the military and it's a zero growth military, like we would get the like the tools that were issued to my OT team are the same tools that were issued to the IT team. So everything we had to figure out, we had to build ourselves and there was no budget, no way to do it. It was just what what I always say like the hardest steel is forged in the hottest dumpster fires.

Burns (9:57.069) We just had to be able to problem solve it. And then, like, more to your point, like my lead developer, he's 11 Bravo master infantryman who's been blowed up a couple times. Like, he might not work really well on a on a team of other guys that graduate from Stanford or wherever. He's all self-taught and but he he cranks out and stays up all night and works till his fingers almost bleed. So like

The Water Pilot and Driving the Cost Down

Burns (10:25.494) We're here, we're looking for them. People are hitting us up constantly. It's just a matter of our growth and what we can support. we're with all the news and stuff that's been going on, we are we've already like we're kicking off a pilot program. So we're reaching out to a couple of the local water water sites around, come a couple of our employees, and we're we're starting this pilot so that we can get our equipment up.

Burns (10:53.300) And start defending sites as quickly as possible. And everything we're doing is focused on driving the cost down because we know they don't have money. And I don't think I think all the solutions we've come up with kind of still give them an enterprise level or that does give them an enterprise level solution with a much lower cost. Because

Burns (11:18.662) you work you've seen all the vendors, everybody ever almost everybody has a slice of that vertical that they sit in and they're they're extremely good at it. They're extremely good at it and they're well defending and they're doing their vertical. But if a water treatment plant tries to procure all that stuff in that vertical, not to mention the sock analyst, they just it it they'll never be able to support that. So

I Hate AI: Automating to Lower the Noise Floor

Burns (11:46.317) Part of like part of the thing we're doing is resource pooling. It's it's it's yeah, we're gonna automate and I hate AI, I hate how everyone thinks AI is a solution. We're gonna automate to lower the noise floor. We have our own little secret things that we're trying to that we're trying out so that the noise floor is down and the the actual bad things come up so that an analyst gets there. But I think in the industry in cybersecurity as a whole, the

Burns (12:13.538) What they believe is AI is gonna make it so anybody can sit there at their terminal and do the job. And I don't believe that. I think AI is really good at finding like like offensively. It can try a million things really fast, find the one thing, and then it looks like magic. Right? It's not so good at just finding the million things that that you need to defend for. And then our opinion or our thesis is.

Burns (12:42.402) That when that thing comes out of the AI and it says, hey, I've enriched this, this is what I think it is, you better have the best dude there to solve the problem. Because there's still going to be somebody that has to understand the problem. And then on top of that, he's going to have to understand the customer. He's going to have to understand the site. So we're tying our teams to the locations that they service. and and they're they're gonna be.

Burns (13:9.812) intricately aware like we're starting our vertical into water treatment and it's going to be regionally aligned so we're in the south southeast so you know the guys that go out to the sites that do the site surveys and the assessment they're the ones that are gonna be conducting the analysis there isn't gonna be multiple and you have to there is no way to not do that and

No Juniors, No Seniors

Aaron Crow (13:28.777) Yeah. Yeah. Well, and and and you you hit something else I want to double tap on and make sure everybody heard is you know everybody thinks that AI is going to solve the problems. And and I agree with you. I think we're going to automate a lot of the entry level, lower level analysts, sock analysts, things like that. The problem with that, and that's a great thing. Cool. We're doing a lot of really low end menial type things. That's great.

Aaron Crow (13:57.632) The problem is, is like what how do we get seniors if we don't have juniors? I don't have like the whole point, like the way you become a senior analyst is by being the junior analyst and figuring out all the things not to do, the things to look for, the menial tasks, like all those things are how you learn. So if we're taking that opportunity away, how do we ever promote somebody to become a senior analyst if the AI is doing it and they don't have the opportunity to learn? Yeah.

Burns (14:1.720) Right.

Burns (14:13.100) Yeah. So

Hunter Killer Teams and the Apprentice Model

Burns (14:21.696) Yeah. So that's our hunter killer team methodology that I was talking about earlier is you've got that OJT and you've got the guy. It's it's much like being an electrician. You have an apprentice and and they're tied to you and you sign off whenever you think that they've met the requirements and now they're ready to be senior. And how we're gonna grow that is like we're already staffing HK zero zero one, right?

Aaron Crow (14:30.825) Yeah. A journeyman. Yeah.

Burns (14:45.532) that's gonna grow and right now it's gonna be four to five individuals that are senior that we know are senior. Like they're gonna be the the standard bearers going forward. Like everything's gonna be built off them. So they get four or five juniors, you know, they train them up, and then now you're at a team of ten.

Burns (15:7.958) And everyone's a senior level. Well, you break off some of those and you start another team that's either regionally aligned to water treatment or in the region and aligned to power distribution or any other critical infrastructure. And that becomes their subject matter expertise. And then it just continues to grow until you have a workforce of competent individuals. Like I I've been thinking about this a lot because, you know, sometimes we don't get the best analysts on the team in the army. We just don't. Like 'cause, you know.

Burns (15:38.123) 70% is a go in the army. So it's like, but we have JQRs, and if you enforce them, you you tie a trainer to that individual and you train them up to a standard. So I think I think that like I said, the answers are all here. man, you're gonna quiz me. I just know acronyms, man. yeah, jaw jaw joint qualification requirement possibly. It's like

Aaron Crow (15:51.847) Ex explain for the audience what is JQR?

Aaron Crow (15:59.583) It's job training, right?

Burns (16:6.166) What the army says to be a host analyst, you have to do these things. And then someone has to see you do them and then sign off on But it's only as good as if if you enforce it.

Aaron Crow (16:8.937) Right. Right.

Aaron Crow (16:13.097) Right. Well, and and to your right, but to your point, like the the water utility districts are having the same problem. Like they have the people they have, and they're not going to be able to go higher and recruit somebody from Duke Energy because Duke's paying more, they have more opportunity. So they have to deal with not saying that the people that are this is not an insult against anybody at a water utility district. It's just saying they have the experience that they have. They are the best that they can be because they're sitting in that seat.

Aaron Crow (16:42.069) They're not going to go hire a new team. They're not going to recruit new people. They've got to deal with the folks they have. And I say this all the time. Many times the guy at the seat, guy or gal at the seat at those water utility districts, they're also taking out the trash and they're mowing the yard and they're they're they're running the valve. Like they're doing all of the thing. They may be the chemist. Like they're just wearing all of those hats. There's no way they could be an expert in everything that they're doing. They're doing the best they can with what they have.

Burns (17:8.182) Right. And and they deserve to be defended. So I again it was like looking at the problem and saying, how do we get the best quality people down to these sites? So like part of it was what what does a site generate, you know? Like what what does an analyst require to conduct their their hunts? And then how do you get it out of the sites? So

Aaron Crow (17:12.319) Hundred percent.

Engineering an 800 Dollar Data Diode

Burns (17:36.503) I mean, we looked at the problem holistically. I mean, I've we started with a data diode because I looked at data diodes and I was like five to fourteen grand, they ain't gonna be able to afford that dog. Like five to fourteen grand? No, no, that's not gonna happen. So, you know, engineer our own, get it down to like eight hundred bucks. Now it's not a it's not for the customer to use the data diode, it's a data diode specifically for our telemetry to come out of the network. because

Aaron Crow (18:2.251) Sure.

Burns (18:6.132) that's what we're focused on. We're not we're not providing appliances to to increase their their ability to to conduct their day-to-day operations. We're trying to provide a solution that is the least intrus intrusive as possible and does not require any of their resources. So those are kind of our our mottos and like

Don't Tip the Box Over: Dave's Network and the XP Machine

Burns (18:33.108) Even when it comes down to like endpoints and like hosts and and those types of things, when we designed our our agents to get and I know agents have been co-opted, so I gotta find another term for that. For our tool to get telemetry off of hosts, it's all scoped with how do we do this and ensure it doesn't tip over? How how how do we do this? How do we where's the del where's the like

Aaron Crow (18:46.624) Right.

Burns (18:58.540) the point where we're getting enough stuff to answer these OT cybersecurity questions, but we're not burdening the resources on that box. Cause you know, you go out there's an Windows XP box that hasn't been updated since it was put in, or you sh you show up and there's a network and it's called Dave's network and you're like, who's Dave? And they're like, Dave quit. He made this. Yeah, 20 years. He bought this stuff at Walmart 20 years ago and it's been running. So it's it's that

Aaron Crow (19:12.425) Yep.

Aaron Crow (19:19.957) Twenty years ago.

Aaron Crow (19:24.725) Yeah. Yeah.

Burns (19:29.046) We and then because we're we're talking to a bunch of investors and stuff, it's like, well, how do you engineer out that delta of everything? Well, you design it so that the delta doesn't matter. That that that it learns and and where you in place stuff is all that matters. Like like you know.

Burns (19:48.919) You know to go to the core switch, you know to go to the distribution switches, you know what endpoints are important and and which ones you're just gonna be able to get network traffic off of. And then you learn, you design it around those things that are not gonna change. Because OT's not gonna change regardless of the money or or anything. Like it works, it ain't broke, they're not gonna fix it. So it's just about creating a solution that fits into that niche at scale.

Burns (20:18.762) And that our number one priority is to drive down that cost because if we can get it in as many places as possible, more places are defended. I mean

Not Everybody Can Afford Deloitte

Aaron Crow (20:28.363) Hundred percent. And and you know, it it it's it's so pertinent, right? You know, we we've got all levels, we've got folks, you know. I I used to be a consultant at Ernst and Young, you know, one of the larger big four consulting, three hundred thousand plus employees, you know, they're great. I love them. Deloitte, KPMG, all those big guys, right? not everybody has money to pay for a Deloitte. Not everybody has money. I mean, I work at Arcova now. Like, you know, we're not them, but still, it's not like we're cheap. Like again, it's like

Aaron Crow (20:56.489) We have to have these tiers of options and solutions for all of these things. And and and we have to have an answer, no matter what where the like we can't just not do anything, right? And that's where we're at in in in our in our country. We just saw all the water utility districts get hit, Minnesota, all the places. the answer is not nothing. And we've got to have some kind of of of capabilities that we can offer solutions because these these folks are are needing and they want to do things.

Aaron Crow (21:26.227) And the other piece to the the the financial side of the equation on a lot of these water utilities is they're ran by the city many times that they're in, and their their budget is up against, you know, a new school lunch program and a and a and a police cruiser. Like so they've got a hundred thousand dollars and they're having to s the the city council is voting on where to put that money and they don't necessarily understand the risk that they're at. They probably do now. but that's another part of the equation that we've been up against this whole time.

If You Mandate a Standard, Fund It

Burns (21:55.821) Yeah, so the other half of my my company is her name's Sam. she's the CEO and she gets into rooms and has friends and talks to people that I probably would never get into. So that like partnering with Sam was the greatest thing ever. So like she talks to policymakers in DC. She like talks and like brings me into chats with them. And my number one thing is like if you're gonna make a standard that's enforceable, you have to fund it.

Aaron Crow (22:12.554) Yeah.

Burns (22:25.760) And you have to be able to enforce it. Like those are the things. And it has to make sense because as soon as they start flooding the market with f with grants and stuff like that, you know, there's gonna be people there's gonna be snake oil salesmen out there that are trying to get that grant money and saying, I could solve your problems, and then they just take the grant, put it up and leave. And more to your point, they don't have the staff. Like, like I

Aaron Crow (22:41.759) Yeah. Yeah.

Burns (22:54.026) I would love to work for a company where every customer had excess money and all I was doing was setting up sensors and and a sweet dashboard and then dipped out and they had to figure out how to hunt on it. But they don't have people to hunt on it. And and we do. So like it's about getting their data to us in a single platform, lowering the noise floor and getting our analysts' eyes on it and helping.

Burns (23:23.862) Like everyone that we're working with is help. I get I've gotten two texts since we've been here of people that wanna just help. Like people are like I I still in, but I'll help. I'll I'll develop stuff, but just give me a job when I get out. And I'm like, Okay.

Aaron Crow (23:30.655) Well

Aaron Crow (23:33.674) Yeah. The the mission the mission is is important. I I agree with you there. And and and giving people that mission. And it's one of the reasons I'm so directed. That's why I run this podcast. It's why I wrote a book. It's why I do all of these things. Like I don't get I don't make money on this podcast. It costs me money. It costs me time. I'm doing this on my own time. I yeah. Yeah, that book. Thank you. But you know, that that mission is important and and and people want that mission. They want to

Burns (23:52.876) This book.

Aaron Crow (24:1.471) They want to s feel like they're making a difference. you know, that that sheepdog mentality, right?

Burns (24:4.940) Right. And and and it it sucks kind of when you learn about the problem. Because if you don't know about the problem, you don't think about it all the time. And I can tell yeah. I can tell you I have a lot of anxiety and I'm sure the military gave me a lot of it, but putting me on the OT mission didn't help. Like like but at the same time, it's how long are we gonna just look at the problem? Like

Aaron Crow (24:15.615) Hear no evil, see no evil.

Aaron Crow (24:25.213) Right.

Burns (24:33.836) Because even like I was at Black Hat recently and talking about panels and everything they're saying is the stuff that we've just talked about. There's a lack of visibility into these OT networks and the sites are underfunded. Like I might have walked up to a guy at at a high position in the federal government and gave him my card and said, I've already solved these problems, hit me up. And he just kind of looked at I don't know how much they want, like how how how they're

Burns (25:0.268) How much they're going to be able to solve those problems from within the government because there's so many levels that that have to be fed. And there's it's the same with a lot of the the companies, too. There's so many levels that have to be fed. They have to pay their marketing, they have to pay their their RD guys. And

Burns (25:23.340) We have to stay lean in order to be able to provide that service and not but also not sacrifice. And I think it's possible. I mean, takes a lot of hours. Takes a lot of hours.

A Tool Nobody Uses Is Worse Than No Tool

Aaron Crow (25:34.516) Hundred percent. Well, and and the other piece that that that I talked to a lot of folks on the vendor side, on on the solution side, on the in on the end user side as well. But that that's you're hitting a piece there. So we talked about a product, we need to have solutions, you know, all of this is people process and technology, right? I need to have technology that can get fine things that can

Aaron Crow (25:59.442) stop bad things from happening that can alert me when bad things are happening. I need to be left of boom and I also need to be right of boom. I need to be able to recover if something bad happens. But I also need somebody watching the wall. And and and all those a lot of times a vendor will come in and and again not to beat up on a vendor. I used to be a vendor selling a product you know I can sell you my product you know the analogy I give a lot of the time is you know I can buy tools and and I can have the best tools in my garage all day long.

Aaron Crow (26:27.391) I can buy a gun, I can buy anything, but if I don't use it, it doesn't do anything. It just sits there, right? Somebody has to pick it up and wield it, right? So it's no different than cyber tools in these OT spaces. We're already talking about, you know, we spent spent a lot of time on water today and and and because it's needed, but the getting them a tool is not it's not going to solve their problem. Like getting a tool in front of them and then you install it and then you walk away. If nobody's running that tool, then you just it's probably worse that they have a tool.

Aaron Crow (26:56.233) Because now s there's still nobody managing it, right? So they have this false sense of security because they have a tool that's not doing anything for.

Burns (26:58.766) Right.

Why Investors Hate This Model

Burns (27:3.638) Yeah, and trust me, like we we talk to people like finance people, we talk to VCs, we talk to all these people. They hate our model because it's it is the way it is and it's not gonna change. Like the they're like like we've had talks with people and they're like, Hey, you should be able to sit anybody down and and they should be able to use your tool.

Burns (27:28.950) And we say, no, that's not gonna work. It isn't working now. And I don't think it'll ever work. And then they're like, well, how do you how do you get the talent? I'm like, we've got the talent. And the talent wants to do the job. They just want to be paid well. So it's balancing the the the finding the talent and resourcing the talent appropriately. And then they're like, How do you how do you know that the talent's not gonna leave?

Burns (27:54.507) And we're like novel approach, we're gonna treat them good, and it's gonna be a good place to work. Like like it's like like if the CEO and the CTO are the lowest paid people at the at the business and we're doing the job, I'm cool with it. Like we're and we're both cool with it. Like we want to get this out there and

Aaron Crow (28:12.043) Sorry. Yeah.

Burns (28:19.062) When things go boom, you want the smartest guy behind the keyboard, not the person that is the entry level with the new tool. That's just my opinion. That's who I want. I want to hire people to defend the critical infrastructure.

Aaron Crow (28:29.737) Right. No, I agree.

The Cellular Modem and Defendable Terrain

Burns (28:36.268) That I will feel safe that the critical infrastructure is being defended. Like that's it. I mean, and it's simple stuff too. Like if we do a site survey and we walk around and we say, I've noticed so much stuff on site surveys where I'm like, what's this? And they're like, that's a cellular modem. And I'm like, Why? so they can do updates. And I'm like, that's a bad thing. Like, it's simple stuff like that.

Aaron Crow (28:56.981) I'd rather you not do updates.

Burns (28:58.752) Yeah, but until you get a guy on the ground who's got that cyber mentality and that like that that ability to think like the enemy and look at the terrain as if it is defendable terrain and what's the key terrain and where's the avenues of approach and those type of things, until you look at it from that point of view, you don't see it. They just see a availability and they're like, Hell yeah, I got availability. The the vendor's happy. So we we

Aaron Crow (29:22.559) Yeah. Yeah.

Burns (29:27.680) We are definitely gonna have teams walk sites. Like that is gonna happen. We're gonna have the site manager, whatever who the line manager is, whoever's running the line, the engineer, like all of that. When they're on that site, they're their best butt. They're talking to them, they're figuring everything out. And a lot of times when we leave a site, when I've left sites, I know more about that site as a whole than everyone else there. We find stuff that the manager didn't even know about.

Burns (29:56.397) You know, I understand how their water processing is being used and that it needs to have power from the local municipality as well. And that if if that's not, you know, protected, it can go down. I've been on sites where if they attack the AC unit, then production and some stuff that's really important to be produced for the for the government can't be used and or can't be made. And it's like, who's defending the AC unit?

Air Gaps: How Many Have You Actually Seen?

Burns (30:26.274) They're like, that's not that's that's on a that's on a different network. It's like, well, we gotta get on that network and we gotta make sure that's defended. So it's like a defense in depth works too. I get it. I also am a firm believer that just protecting at the boundary is not a solution for OT. Cause I don't know how many air gaps you've seen. I I haven't s seen. Yeah.

Aaron Crow (30:33.728) Mm-hmm.

Aaron Crow (30:48.457) Well, other than nuclear power plants and very critical DOD type sites, not many.

Burns (30:53.910) Yeah, not many. I've been to a lot where they told me it was air gapped until I started like, Well, why is that router there? Yeah.

Aaron Crow (30:58.271) Right.

Aaron Crow (31:1.875) Yeah. Well, we have to have remote access 'cause they have to get in there and I have to connect the vendor so they can they can tune the the thing. Well then you're not air gapped.

Burns (31:10.144) Yeah, and I've and and COVID COVID destroyed any air gaps that were just air gaps because nobody had set up connectivity yet. Because everybody wanted to work remote and work from home. So I I don't have the eyes that you have in the industry. I can just tell you from what I've seen in in the industry that I've seen is there was people well now I gotta I gotta monitor this HMI from home. It's like, dude, I don't think you should be doing that.

Aaron Crow (31:14.057) Right. Yeah.

Aaron Crow (31:38.612) That's right. I'm gonna update the ladder logic from from my house. No. You know, and and that that's that's the other piece, right? Is is as we walk into these sites and you talked about it, right? And and we we have to have an understanding of their business, right? We have to understand their process. we have to understand that in the end to make sure that we understand where the where the risks are, right? We're we're not just assessing the firewall rules, you know, we're not just looking at, you know.

Burns (31:43.319) Yeah.

Aaron Crow (32:8.329) the patches that that are on or not on the Windows machine in the corner. I have to understand where the risks are. You talked about the H V A C system. You I I walk into a DOD type site that where they like blow up things and and destroy, you know, get rid of things, and and and not play like the we're talking a furnace and explosions, places that humans can't be. So how do you monitor those environments? Well they have cameras. Okay. So I started asking questions. Well,

Changing the Flight: What On-Site Value Really Is

Aaron Crow (32:36.039) Is the camera part of your system? No, that's just that's just a camera. That's not part of OT. Well, what happens if that camera goes down? Well, we have to stop the process. See the problem here? And the other side of this coin is like I go to so many sites and I've been to so many. And and I actually had a guy, my one of my champions, I guess, at this site. We were going to five sites and they hired us to do these assessments. And and we went to the first site and they had scheduled five days to be at this site. It's not that big of a site.

Burns (32:43.714) Part of it too. Yeah. Yeah.

Aaron Crow (33:6.505) I didn't say anything. We we show up day one. We walk the site morning of day two. I'm like, all right, I've changed my flight. I'm leaving this afternoon. He's like, What? I'm like, I've I've seen it all. I've walked it. I know the process. We've got the asset. I've got sensors placed out in all the spaces. You're gonna send me the sensors back. Like, I've got everything that I need. If you really want me to sit here for the next three days, I can. And he's like, Well, I just have to I need to understand like.

Aaron Crow (33:33.096) It's kind of expensive for you to be here for a few hours and then go away. And I'm like, look. And I and I pulled up and showed him that. And this was like site two that we did this at. I I pulled up from site one and I said, Okay, we left here. Here's what all I know about your site and all your assets and the devices that are talking, where they're talking. I'm like, you're not me being on site is not the value that I bring. Me being there and knowing what to look for while I'm there, that I don't need to be there for five days. That's the value that I bring. And that's not me tooting my horn. It's just,

Aaron Crow (34:1.248) I've been to so many sites, I know what to look for, right? So that's the value that we bring. And the more of these that we do, and and what what we said a minute ago is being able to bring those those junior folks with me so they can see what I'm looking at and why I'm looking at it. Have, look at that. Let's look at this cabinet, have them show us around. That's the value that we need to continue doing in this OT space that makes us different than the IT. Those hard hats, you know, it's not just the clothes that we wear and the way that we look and dress and the tattoos we have. It's also the

Aaron Crow (34:30.633) The things that we're experienced with, right?

The Data Historian Under the Tablecloth

Burns (34:32.812) Yeah, I mean I I went to a site one time and there was a table with a cloth over over it and I saw a cable coming out from underneath of it and I was like, what's under here? And they're like, I don't know, and I pull it up and it was just their data historian. Just their data historian. Just the historian. And I was like, Okay, we need to we need to do a capture on this.

Aaron Crow (34:49.739) you know, just a historian. Yeah.

Burns (34:56.054) But it like what you're saying, like you know, you knew where to put the sensors in and then let soak and then pull back. Like that was exactly how we did operations. And I think that one of the the new things that has to change is we can't do that. There has to be some kind of sensing solution that's scalable. And

Burns (35:19.436) distributable across so that that access to that telemetry is is pervit. It like it it lasts longer than just that that that OT assessment. Like and then you know you look at the the people that are out there and what they're charging for these things. And again it's like okay so it's gonna cost like eighty ninety thousand dollars just to outfit for the proper distribution of like sensing solutions. And I'm like, I don't I don't think that an OT environment one

Burns (35:49.865) makes as much noise as as an IT environment. And I don't think that the sensors need to be quite as robust. I mean they need to be like tough, but I don't think they need to have all the whiz bang stuff. So it's about engineering the it down so that you know that like this right here is a box, but it

Burns (36:12.726) It's got everything it needs for your environment and your bandwidth, and it's gonna ride your wire out. It's gonna hop out of our data diode. And then once it gets to IT, I don't care. Let's let's bog it down. They're paying for an ISP or whatever. So like, like we're we're getting out there. The the cool thing that we've kind of come across though is like, okay, well then what do you do with PCAP? You know?

Aaron Crow (36:24.555) Correct.

Weaponizing Sneaker Net

Burns (36:34.508) PCAP, you're not gonna get that out and then you're not gonna remote in. So we designed a system of just leveraging sneaker net. And like we've got an IT landing site where our analysts can conduct investigations in their IT environment.

Aaron Crow (36:49.823) Mm-hmm.

Burns (36:50.370) And you know, the sensors just have a hot swappable drive that can pop out. You throw a new one in and starts collecting PCAP and then you or and it and it, you know, flushes the PCAP that it's been stored while you're doing that swap onto the drive. And then you got a guy just carry it up and st people are like, Well, who's gonna move it? I'm like, the people at the site, they want their stuff defended. Like they're not it's it's literally push a button, pull a drive, put it they're like these are smart guys, these are engineers, like they know it. There's

Aaron Crow (37:11.808) Yeah.

Burns (37:20.024) There's usually an the IT guy that is gonna be able to go, they want this drive, it must be important. Let me pull it out, put it in to there and so they can conduct their analysis. So we've we've weaponized sneaker net. It's

Aaron Crow (37:34.336) Well, dude, we used to do this in IT. We we rotated tapes. We had operators that would plug a tape into a backup. You on Monday morning we had a round or an operator job task. You go swap the damn DLT tape. This is not new information. We've been doing this for decades. We can use the same example in in in an OT space. It doesn't have to be complex. It doesn't have to be sexy. It doesn't have to have AI or ML, you know, LLMs or any of this type of stuff to make it.

Burns (37:38.071) Yeah.

Aaron Crow (38:3.935) valuable, right? We can do the basics and I talk about this all the time.

Burns (38:8.024) Keep it simple, stupid is what we do. And I'm not the smartest guy, but I usually can find a a solution and like it's great, my team's great because I've got a dev that will he'll work I'll I'll come up with an eighty percent solution in twenty minutes and then he'll work the twenty percent for two weeks.

Aaron Crow (38:27.839) That's right.

Burns (38:29.880) So like that's that's kind of our dynamic. Like I'm like, yeah, we could do this, this, this, and this. And I'll I'll crank it out. I'll code it up. I'll put it in there. And he's like, Well, you know, it doesn't really meet this framework that we're working with. So I gotta restructure it. And I'm like, good, you do that. I'm not doing that.

Aaron Crow (38:42.666) Right.

Aaron Crow (38:45.853) I just gave you the MVP. You make it real.

Burns (38:47.646) Yeah. Yeah. So I mean, and it's almost serendipitous that we got to this point because we are ready to go now, as like it's always been important, but now people realize how important it is. So we're trying to push to the next level and get this stuff out there. Especially with my teams all like getting out of the military right now and they're all transitioning and and they're just hungry. They're ready to work. They're ready.

DEF CON, the FBI Advisory, and the Air Gap Myth

Aaron Crow (39:12.511) Yeah. Yeah. That's awesome. Well, I mean, it's it's it's pertinent. I mean, we we see I just spoke at DEF CON in Vegas last week, and I spoke at DEF CON in Singapore earlier this year, and you know we're having these conversations, people are coming up, more and more folks have heard of OT and not just heard of OT, we're seeing it in the news all the time. Like literally, we talked about the water utility district from the stage.

Aaron Crow (39:39.816) at DEF CON because it was that week that the FBI, you know, released the the the the public information about about all those water utilities that were hit. So it it's no longer, you know, 10 years ago, 20 years ago, I would hear, well, I've got a firewall. Nobody's gonna hit me. You know, I'll just air gap my system. My system's air gap, you know, all that bullshit. and and now more and more folks are realizing even if you are air gapped, which most are not, as we know, as we've already discussed, that's only one attack factor.

Aaron Crow (40:8.831) That doesn't stop you. I mean, look at Stuxnet. Like that got into an air gap system. That's not going to stop you from being able to get hit. If I take if I take an operator, right? Yeah.

That Wasn't the A Team

Burns (40:16.844) Yeah, especially especially with frontier models. Like especially with the speed cause like you look at who allegedly hit these water treatment plants. They didn't as I mean, correct me if I'm wrong. I read a couple of them. It didn't look like they were throwing zero days at them. They were just exploiting things that were known vulnerabilities. So is it really the A the A team who pulled off this operation? not

Burns (40:44.980) military guy but Aaron Burns guy, I don't think it's the A team that pulled off this this operation. When I look at APTs that would be that have the ability to get into these environments by any means necessary. I don't think we've seen it yet. I think this is this was just a an crap we're getting blown up. Let's do something to inconvenience them. What do we got? I found this thing. Let's do it and they did it.

Burns (41:15.062) Like the low and slow guys, they're probably like they might still be out there, you know? That's what keeps me up at night. The guys who have strategically placed themselves in a position to create an impact at their time and choosing, in coordination with other global endeavors, say.

Aaron Crow (41:34.870) Well, and and unfortunately, as we know, there's so many low-hanging fruit things out there. You don't need a zero day. Like we don't have sophisticated protections on a lot of our things. And it it we're not we're not sharing state secrets here. it it's it's it's widely known that we are vulnerable in critical infrastructure across water utility, power utility, oil and gas, I mean transportation, you name it, right? Any of these things, we we don't even the ones that are more advanced.

Aaron Crow (42:3.709) A chain's only as strong as its weakest link. So we start shutting down water. We hit a we we hit one substation in the right spot. Like it's not that hard to do these things. And that's there that's in my exper in my I believe that's what they can show us in a very bad thing. And there's all there's all sorts of things going on in the world. Iran and and and Gaza and none of this is supposed to even talk about any of those things. But we have people that are not happy with us. Like so not to mention just

Burns (42:20.237) Yeah.

Aaron Crow (42:33.439) Bored teenagers that happen to find something on Shodan and don't know what they're attacking, right? So it doesn't even have to be a nation state actor, right?

Burns (42:36.588) yeah. Yeah. Right. Right. Yeah, it's about plugging those holes for sure. I I am also I don't want to just plug the holes. I want to find the the slow and sneaky guys. So when we do this, we are we've built this in a way that, you know, we'll be able to not only just

Burns (43:5.996) find that low-hanging fruit or that random connection that shouldn't be happening, but we're also gonna be able to find the connection that's happening that doesn't look right, that doesn't match what's been going on. And then we get the in the the right guy to look at that packet or the right guy to look at the the the binary that went over the wire and he can say, no, this is this is a little this is a little hanky here what's going on here. And and also

Burns (43:33.837) Just knowing that there's security in place is a huge deterrent for for nation state actors. Like they don't want to get caught. Like, like people that are doing ransomware and stuff like that, like yeah, they might not care as much. and God, if we get hit with a ransomware and some of these critical infrastructure, besides like the pipeline, which was just IT that got crushed.

Burns (43:59.265) It's it's not gonna be a good day once they start going into those. But

Left of Bang, Right of Bang, and Recovery

Aaron Crow (44:3.231) Well, and that that that was my point with the whole right of bang thing. Like we have to like we need to be monitoring and detecting and trying to keep people out, but we also need to focus on recovery and assuming that, okay, we're we're protecting for left of bang, we're we're monitoring for those things, we're looking, we're trying to keep bad actors out. We also have to have a plan for let's assume that some bad actor gets in and how do we recover? And and it doesn't even again, it doesn't even have to be nation state. It can be

Aaron Crow (44:29.109) faulty equipment, it can be power failure, it can be water damage, anything. Like we have to be able to recover and get that site back up for whatever reason. And that's the piece I think we're probably good in some areas. In other areas we're probably overly confident and and and probably couldn't recover.

Burns (44:43.490) Yeah. Well, they're overly confident until someone questions it because there's not anybody around to to question their hypothesis of like, yeah, we've got backup stored over here. Well, then you you're there for the first time and you're taking everything in, and you're like, Well, if that goes down too, what do you do then? And they're we don't really have an answer for that. So part of our side assessments as we go to these places is to do that report of

Aaron Crow (45:1.343) Right. Yep.

Burns (45:9.846) Here's what we here's what we learned. Here's some vulnerabilities, some some rooms for improvement, some some just TTPs that you can use to to fortify yourself. Like and and those side assessments are just part of the the process because we're identifying the weaknesses. So we share those with the customer so that they know how to harden those weaknesses. So it's it's

Aaron Crow (45:31.136) Yep.

Burns (45:32.547) you know, find, mitigate, and then track whether or not it's been mitigated. Now we're not gonna perform the mitigations and I don't think we should. We're not gonna track the mitigations and again, I don't think we should. But if they want us to do a reassessment after they've performed those mitigations, we definitely will. Again, do no evil. Do not change anything. Like even if we're like even if we're seeing an attack happen, it's gonna be more about getting

Burns (46:0.109) the information to the right guy on the ground as quickly as possible with information of like how to fix the problem or what what what mitigation steps to take. We're not the local defenders. Even if there's no cyber guy there, we're not the local defenders. There's gonna be a site engineer or an IT guy. So that was another thing.

Two Different Run Books: Land the Plane First

Aaron Crow (46:17.705) Well, it that's that's the piece, you know. You just look at run books. If you if you just looked at OT and IT and you looked at those two things, and I and I scream this every time we're having this conversation, because people are like, Should we have a dedicated OT sock or an IT OT sock? And I'm like, it doesn't matter, but you have to have two different run books. Because when I respond to something in an OT world, I'm not kicking it off the network. And and the analogy I always give is is a stupid one, but it helps them paint a picture. I'm like, you're 30,000 feet up in the air.

Aaron Crow (46:46.461) Somebody's attacking the control, you know, the the the the system that's flying the plane. Do you want to reboot the system while you're in the air? Or do you want to just land the plane? Let's land the plane first. And then if we need to do other things, we can do that. But that's OT. Like you can absolutely kill somebody by shutting the wrong thing off because then they can't control the process. And then things things break, you're damaging equipment, you can hurt people. It it's a different reaction. So my reaction to my response.

Aaron Crow (47:16.425) In an OT sock is usually to pick up the phone and call the local guy and say, Hey, can you go close the valve so they can't do anything anymore? Go manual.

Burns (47:19.276) Yeah, a hundred percent. Yeah. Yeah. And someone has to know what going manual looks like for them. And again, that's where we build those those that connective tissue and that relationship on site. Trust me. The the people that want to support this financially do not like that model at all. But we've we're hitting a we're hitting a a a wall of

Burns (47:49.261) There is no other way to do it. So we just have to figure out how to do it better and how to do it correctly and at scale. Because I mean, if the big players could do it, I think they would. If they thought the juice was worth the squeeze, I think they would. And so we're trying to control the vertical so we can drive down costs and then get more out of that squeeze. And and do the good work, if you would.

Aaron Crow (48:15.743) Yep. I love it. So what what do you see come over the rise and as far as like what what's exciting? What do you see that that is making you excited about what what's coming and maybe the the thing that's that's a little terrifying?

Transportation, One Second After, and Three Days of Food

Burns (48:30.040) I mean terrifying for me is transportation. you know, you take out railways and then like I always think like Warfighter, War War Games. You ever read the book One Second After? Okay. I always tell people not to read it. But that if you have anxiety, don't read that book either. But but the the th the when you think about transportation and railways and stuff like that, and if that was hit in a surgical way, then

Aaron Crow (48:42.345) Yep. Yes.

Aaron Crow (48:51.103) Yeah.

Burns (48:59.554) Then everything would have to shift to the road. And now you there's only a certain number of trucks. And it's like they have to make calls. Do we move bombs, bullets, and soldiers, or do we move bread? And most people have like three days of food at their house, depending on like how prepared they are. And then what happens after you run out of food? Babies start crying and it's a bad day. So that's my like my biggest fear.

Aaron Crow (49:21.737) Yep. Yep.

Burns (49:27.896) For me the the the things I'm most excited about is, you know, what me and my I mean, not to toot my own horn, but it's what me and my team are getting done and and really what we're what I think we're gonna be able to accomplish in the next few months to a year and and grow and prove. Like I wanna we wanna prove that this is a possible because I don't I don't know how else it's not

Burns (49:54.851) po like how else we continue on if it's not possible. and dude, as much as I hate AI, I use it every day, all day. And

Evil Prevails When Good Men Do Nothing

Aaron Crow (50:5.693) I know. Me too. You know, and and it it tells me that that that saying going off what you just said, like it's one of my favorite sayings. I say it all the time, say it to my kids, is evil prevails when good men do nothing. Right. And and and and the big guys are not focusing this because there's not enough money in it. The margins aren't there for They can't find the economics to make it work. But somebody has to step in that void and defend these areas. And that that we we have to find a solution. So I appreciate you guys stepping up, you guys standing in that void and and and that

Aaron Crow (50:34.953) Because all these things matter. Like, yeah, we've got critical infrastructure. We got power utility. We got nuclear power plants. We're we're focusing time on those things. we're we're looking at airports, we're looking at some of those big things. But again, take out water. Look at Katrina when we had no running water and what happens. You're a third world country real fucking quick. you know, all of these other there's sixteen, seventeen critical infrastructures across our country. Every one of them matter, and they're critical for a reason.

Aaron Crow (51:1.865) Right. So we have to find solutions for all of them. And all of them don't have, you know, large power utility money. that doesn't mean they don't matter, and that doesn't mean they can't be, you know, a a cog in the wheel of of bringing down our our way of life if the wrong things happen in in the wrong sequence of of events. Yeah. Of course. Yeah.

Burns (51:21.560) It's where they're gonna aim is the easiest target. So we gotta make everything hard to hit. And and I'm not saying that everybody isn't gonna push into those big boy markets eventually. Like but because I another thing that I really truly believe is a comprehensive like view of critical infrastructure needs to be accomplished because when you start seeing stuff in Wyoming.

Aaron Crow (51:31.349) Sure, absolutely.

Burns (51:45.367) And then, you know, the internet makes everything instantaneously at accessible. And if you don't have sensors all over to be ready to alert to those same signatures across the spectrum of different critical infrastructure, would like how are we gonna defend against it? Because it's gonna you would do a coordinated attack if you were gonna attack critical infrastructure. I I I would, if I was.

Aaron Crow (52:10.079) Right. Yep.

Burns (52:14.626) But I don't do that. I wanna do this.

Aaron Crow (52:14.751) Yep. Well, I mean, I I I think I think that's that's the the the goal of of a bad actor would be that, right? And and it un unfortunately, as we know, it's not it wouldn't be all that difficult. and again, you know, I I watch the the the listeners and and readers of of my book and the podcast and they come from all around the world. so so folks are listening to this, that that are not, you know, necessarily friendly to us. So

Aaron Crow (52:43.227) Obviously we don't share anything on here that's secret or things anything that you don't already know. but still like that that's something how I I've done a hundred and nineteen of these episodes. I've been doing this since twenty ten, you know, actively in this space. And I'm having the same conversations I've been having for sixteen, seventeen years. and I'm seeing is it better? Sometimes, sometimes it's not. and and

Burns (53:6.008) Yeah.

Aaron Crow (53:13.225) I think it's actually improving the messaging, the the the not me or I've got a firewall conversation, I still hear the air gapped crap or whatever. But you know, it it that doesn't mean I quit. I continue having the conversations. I don't get frustrated having the conversations. I'm talking to IT where they're focused on why don't you have, you know, encrypted protocols and like, okay, nerd, go in the corner. I'm a nerd too. That's not a doctor derogatory thing. I'm just saying.

Burns (53:37.611) Yeah.

Aaron Crow (53:41.118) If you don't understand that, go away and actually do some research. And that's not my biggest problem. Like passwords and locking my workstation and putting a firewall in, that's not going to help me. It's not going to solve the problem. It's not going to stop. It's not going to lower the risk enough that we can walk away and chal and solve it. Even if my protocols were secure. Okay, now what? That's not going to help me. It's not going to stop the attack vector. It stops one, but there's an infinite number of them out there. I've still got Windows XP. We'll just replace it. Like, come on, dude.

Aaron Crow (54:9.439) Like this is not what we're talking about here.

Burns (54:12.236) Yeah man maybe I'll be on like two hundred and seventeen and we'll have a completely different conversation.

Aaron Crow (54:17.237) There you go. Let's do it. And and let's see. It's August nineteenth today. Let's see. And in August 19th of 2027, let's hope you and I are having a different conversation where we've made a lot of progress and all that, man. All right. What's a call to action? How do people get a hold of you guys? Find out more. in in and hire you, all the things. Give us our give us a call to action.

Burns (54:21.645) Yeah.

Burns (54:27.448) Absolutely. Yeah. I'm sure.

Call to Action: EVR:RDY and the Pilot Program

Burns (54:38.040) So everready.com, E V R R D Y dot com is our website. You can reach out to us there. we're also on LinkedIn. No Instagram yet. no cool pictures yet. But yeah, if you're interested in if you're if you have a a site you want to do the pilot program, that's up on the site, you can apply to that. we're like I said, southeast right now, but you know, if we get

Burns (55:4.972) We can move that. We could go anywhere. I mean, it's the internet, like I said. So there's that. And then anybody that wants to hit me up, hit me up on LinkedIn. I love talking this stuff and problem solving, and we're here to help.

Aaron Crow (55:19.133) Awesome. Well, we'll have all the details in the show notes, folks. Definitely reach out to Aaron. Check out Ever Ready. doing good things. you know, there's there's plenty of need out there. They have resources, knowledge, and experience and capabilities to help solve. you know, do something, take action, reach out, have conversations. brother, I appreciate your time today. thanks. I know we had to reschedule this a few times and so I

Burns (55:43.797) All good.

Aaron Crow (55:44.841) I appreciate your time and and digging in. I love having these conversations and hopefully it helps somebody and we we we continue to s to fight this fight and solve these problems.

Burns (55:54.799) Sounds good. But

Aaron Crow (55:55.946) Uberly.

Transcript lightly edited for readability.